Enum ArtifactValue 

pub enum ArtifactValue {
    BackendKey {
        backend_name: String,
        key_id: KeyId,
        algorithm: KeyAlgorithm,
        public_key: Option<PublicKeyDer>,
        check_value: Option<KeyCheckValue>,
    },
    WrappedKey(WrappedKey),
    EncryptedData(EncryptedData),
    PublicKey(PublicKeyDer),
    Bytes(Vec<u8>),
    Secret(SecretBox<Vec<u8>>),
    Shares(ShareSet),
    Text(String),
    Certificate(CertificateDer),
}

Runtime representation of an artifact.

Variants

BackendKey

Cryptographic key managed by a backend (software, HSM, YubiKey). The private key never leaves the backend - only references are stored.

Fields

backend_name: String

Name of the backend that owns this key (e.g., “software”, “yubikey1”).

key_id: KeyId

Backend-specific key identifier (opaque, e.g., UUID or “slot_9c”).

algorithm: KeyAlgorithm

Algorithm for type checking and evidence.

public_key: Option<PublicKeyDer>

Public key (None for non-exportable HSM keys).

check_value: Option<KeyCheckValue>

Key check value, for a symmetric key.

What the key answers to where a keypair is answered for by its public half. A ceremony reaches it as ${artifact.kek.kcv | hex}, which is how a custodian compares it against what the token shows.

WrappedKey(WrappedKey)

Wrapped key, with the scheme it was wrapped under and the algorithms the wrap actually used. The container follows the scheme; the OpenSSL backend produces a CMS ContentInfo.

EncryptedData(EncryptedData)

Content encrypted for a recipient, in the container its scheme names.

Distinct from WrappedKey even though the bytes have the same shape. What differs is the claim: a wrapped key left a backend under protection, and encrypted content says nothing about custody. The type is what keeps a document from reaching a step that installs keys.

PublicKey(PublicKeyDer)

Exported public key.

Bytes(Vec<u8>)

Binary content from files or inline data (documents, crypto materials). Used for hashing, cryptographic operations, and verification.

Secret(SecretBox<Vec<u8>>)

Content a step opened, wiped when the artifact is dropped.

The same shape as Bytes and a different claim: these bytes came out of a container that existed to keep them unreadable. A step reads them the way it reads any bytes, and an output writes them like any other artifact; declaring the output is the author’s decision to put them on disk. Nothing displays them: the wrapper redacts its Debug output and hands the bytes out only through expose_secret.

Shares(ShareSet)

The shares of a split secret, wiped when the artifact is dropped.

One artifact for the whole set, so the transcript and the all-subsets check see one thing, and a step names one share as a property: ${artifact.shares.share_2} is the share evaluated at 2. A share is read only through reads:, never rendered by an expression, since the copy an expression makes is unwiped JSON and a prompt text is a transcript fact. The set is not written to the run directory at all; shares go onto paper, through a step that shows one at a time. A set of one is how a share typed back at a recovery arrives.

Text(String)

Display text for physical item references (USB drives, tamper bags, etc.). Used in messages and prompts when referencing physical objects.

Certificate(CertificateDer)

X.509 certificate. Stored as DER; displayed and serialized as PEM.

Implementations

impl ArtifactValue

pub fn serialize( &self, format: Option<&str>, ) -> Result<SerializedArtifact, String>

Serialize artifact to bytes with metadata.

Returns a SerializedArtifact containing both the serialized bytes and metadata (MIME type, file extension) appropriate for the format.

Applies sensible defaults if format is None, then validates strictly.

Supported formats by artifact type:

• WrappedKey: “der” (default), “pem”
• PublicKey: “pem” (default), “der”, “base64”
• RsaKeypair: “pem” (default), “der” (private key in PKCS#8)
• Other artifacts: text representation (format ignored)

MIME type references:

• application/pkcs7-mime: CMS/PKCS#7 (RFC 5273)
• application/pkcs8: PKCS#8 private keys (RFC 5958)
• application/x-pem-file: PEM-encoded files
• application/x-x509-ca-cert: X.509 certificates (Netscape)
• text/plain: Text artifacts

Returns an error if an unsupported format is specified.

Trait Implementations

impl Debug for ArtifactValue

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for ArtifactValue

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.