Struct Metadata 

pub struct Metadata {
    pub shamir_threshold: Option<u32>,
    pub lastmodified: String,
    pub mac: String,
    pub unencrypted_suffix: Option<String>,
    pub encrypted_suffix: Option<String>,
    pub unencrypted_regex: Option<String>,
    pub encrypted_regex: Option<String>,
    pub unencrypted_comment_regex: Option<String>,
    pub encrypted_comment_regex: Option<String>,
    pub mac_only_encrypted: bool,
    pub version: String,
    /* private fields */
}

The sops: metadata block.

Field order below is byte order in the file — see the module docs. Key arrays are private and derived; see Metadata::from_wrapped.

Fields

shamir_threshold: Option<u32>

Shamir threshold, when key groups are in use.

lastmodified: String

lastmodified, kept verbatim as it appeared in the file.

Not a parsed timestamp, and deliberately so: this string is the AAD of the mac field, so any normalisation we applied on the way through — Z becoming +00:00, a dropped fractional second — would silently make a valid file unreadable.

mac: String

The mac field, still in its ENC[…] form.

unencrypted_suffix: Option<String>

encrypted_suffix: Option<String>

unencrypted_regex: Option<String>

encrypted_regex: Option<String>

unencrypted_comment_regex: Option<String>

encrypted_comment_regex: Option<String>

mac_only_encrypted: bool

version: String

Implementations

impl Metadata

pub fn from_wrapped( keys: Vec<WrappedKey>, lastmodified: impl Into<String>, mac: impl Into<String>, ) -> Self

Build metadata from the keys that actually exist.

This is the only constructor. There is no Metadata { age: … } literal available to a caller and no setter for a recipient list, which is what makes “declared recipients disagree with the ciphertext” unrepresentable in an emitted file.

pub fn keys(&self) -> &[WrappedKey]

Every wrapped key, in file order.

pub fn keys_for(&self, provider: KeyProvider) -> Vec<&WrappedKey>

The wrapped keys for one provider, in file order — the projection the sops.<provider> array is emitted from.

pub fn age_keys(&self) -> Vec<AgeKey>

The sops.age array, derived.

pub fn providers(&self) -> Vec<KeyProvider>

Every provider present in this file, sorted for a stable report.

pub fn unimplemented_providers(&self) -> Vec<KeyProvider>

The providers this file needs that this build cannot unwrap.

Empty means every key in the file is one we could open given the right identity. Non-empty is a refusal to name, not a reason to guess.

pub fn rewrap(&mut self, keys: Vec<WrappedKey>) -> Result<(), WireError>

Replace the key set — a rekey or updatekeys.

Takes the whole set rather than offering add/remove, so the arrays stay a projection of one atomically-replaced truth. Refuses an empty set: a file with no wrapped keys can never be decrypted by anyone, and producing one is how a rekey bug becomes permanent data loss.

pub fn selector(&self) -> Result<EncryptionSelector, WireError>

Build the compiled selector for this file’s policy.

Falls back to sops’s default (_unencrypted) when nothing is configured, matching upstream’s defaulting of UnencryptedSuffix.

Trait Implementations

impl Clone for Metadata

fn clone(&self) -> Metadata

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Metadata

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for Metadata

impl PartialEq for Metadata

fn eq(&self, other: &Metadata) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for Metadata