vta_backup/lib.rs
1//! Backup/restore subsystem for the VTA, extracted from `vta-service`.
2//!
3//! - [`backup_bundle_store`] — the sealed backup-bundle store (bundle records +
4//! on-disk blobs for the two-phase export/import trust tasks).
5//! - [`backup_bundle_sweeper`] — TTL sweep of expired backup bundles.
6//! - [`ops`] — the encrypted full-state export/import operations (Argon2id +
7//! AES-256-GCM), the compatibility check, and the two-phase descriptor flow.
8//!
9//! The operations take narrow dependencies (keyspace handles, config, a
10//! [`vta_keyspaces::Keyspaces`] bundle) rather than a `&AppState`. The two
11//! `vta-service`-specific glue points stay in `vta-service`:
12//!
13//! - `DescriptorDeps` / `apply_import` are borrowed from `AppState` there via
14//! free constructors (`operations::descriptor_deps_from_app_state`).
15//! - TEE KMS re-encryption during import is injected through the
16//! [`BootstrapReEncryptor`] trait, whose only implementation wraps
17//! `vta-service`'s `tee::kms_bootstrap::re_encrypt_bootstrap_secrets`.
18
19pub mod backup_bundle_store;
20pub mod backup_bundle_sweeper;
21pub mod ops;
22
23#[cfg(test)]
24mod test_support;
25
26/// Test-only keyspaces: the sweeper tests open isolated keyspaces so a run
27/// can't clobber the shared `backup_bundles`.
28#[cfg(test)]
29pub(crate) const BACKUP_BUNDLES_TEST: &str = "backup_bundles_test";
30#[cfg(test)]
31pub(crate) const BACKUP_BUNDLES_SWEEPER_TEST: &str = "backup_bundles_sweeper_test";
32
33/// Injection seam for the TEE KMS re-encryption step of an import.
34///
35/// During a Mode-B (`TeeMode::Required`) import, the restored seed + JWT key
36/// must be re-encrypted to the enclave's KMS-derived storage key before the
37/// crash-safety sentinel is cleared. That call (`re_encrypt_bootstrap_secrets`)
38/// lives in `vta-service`'s `tee` module, which cannot move here — so the
39/// import op takes a `&dyn BootstrapReEncryptor` and `vta-service` supplies the
40/// one implementation.
41#[cfg(feature = "tee")]
42#[async_trait::async_trait]
43pub trait BootstrapReEncryptor: Sync {
44 async fn re_encrypt(
45 &self,
46 kms: &vta_config::TeeKmsConfig,
47 store: &vti_common::store::Store,
48 seed: &[u8],
49 jwt: &[u8; 32],
50 ) -> Result<(), vti_common::error::AppError>;
51}