pub struct ProtectedTransfer { /* private fields */ }Expand description
The confirmed protected state of a main process, as a new main process takes it over: the optional fingerprint key, the number of versions issued, and the confirmed header set of every cluster, clusters sorted by id and headers in their configured order. Pending proposals never travel.
There is no serde, no Clone, and Debug prints counts only. The values
stay behind their Arc handles until Self::encode_into writes them
into a caller-owned zeroing buffer; the key is copied into zeroing
storage. The one reader is Self::restore, which accepts nothing the
authoritative configuration metadata does not name.
Implementations§
Source§impl ProtectedTransfer
impl ProtectedTransfer
Sourcepub fn export<'m>(
journal: &ProtectedHeaderJournal,
key: Option<&FingerprintKey>,
metadata: impl Fn(&str) -> Option<&'m [HealthCheckHeader]>,
) -> Result<Self, TransferError>
pub fn export<'m>( journal: &ProtectedHeaderJournal, key: Option<&FingerprintKey>, metadata: impl Fn(&str) -> Option<&'m [HealthCheckHeader]>, ) -> Result<Self, TransferError>
The confirmed state of journal and key, or why it cannot be handed
over exactly: an unresolved proposal, a held value without a key, or a
set the configuration metadata of its cluster does not name.
Sourcepub fn restore<'m>(
self,
metadata: impl Fn(&str) -> Option<&'m [HealthCheckHeader]>,
) -> Result<(Option<FingerprintKey>, ProtectedHeaderJournal), TransferError>
pub fn restore<'m>( self, metadata: impl Fn(&str) -> Option<&'m [HealthCheckHeader]>, ) -> Result<(Option<FingerprintKey>, ProtectedHeaderJournal), TransferError>
Rebuild a fresh key and journal from the transfer, and keep a cluster’s
set only when metadata, the authoritative configuration, names it
exactly: same names and full HMAC fingerprints under the transferred
key, in the same order. An epoch alone is never acceptance.
Sourcepub fn encoded_len(&self) -> Result<usize, TransferError>
pub fn encoded_len(&self) -> Result<usize, TransferError>
The exact number of bytes Self::encode_into appends.
Sourcepub fn encode_into(
&self,
out: &mut Zeroizing<Vec<u8>>,
) -> Result<(), TransferError>
pub fn encode_into( &self, out: &mut Zeroizing<Vec<u8>>, ) -> Result<(), TransferError>
Append the encoding to out without ever growing it: the spare
capacity must hold Self::encoded_len bytes, so no unwiped block is
left behind by a reallocation.
Sourcepub fn decode(bytes: &[u8]) -> Result<Self, TransferError>
pub fn decode(bytes: &[u8]) -> Result<Self, TransferError>
Read an encoding back. Every count and length is bounded before it is used, text must be UTF-8, values must pass the per-value header rules, clusters must be strictly increasing, and nothing may follow.