yb_core/
lib.rs

1// SPDX-FileCopyrightText: 2025 - 2026 Frederic Ruget <fred@atlant.is> (GitHub: @douzebis)
2//
3// SPDX-License-Identifier: MIT
4
5//! Core library for `yb` — secure blob storage on a YubiKey.
6//!
7//! # Quick start
8//!
9//! ```no_run
10//! use yb_core::{store::Store, orchestrator, Context, ContextOptions, OutputOptions};
11//!
12//! let ctx = Context::new(ContextOptions { pin: Some("123456".into()), ..Default::default() }, Box::new(|| Ok(None)), Box::new(|_, _| Ok(None)), OutputOptions::default())?;
13//! let store = Store::from_device(&ctx.reader, ctx.piv.as_ref())?;
14//! for blob in orchestrator::list_blobs(&store) {
15//!     println!("{} ({} bytes)", blob.name, blob.plain_size);
16//! }
17//! let data = orchestrator::fetch_blob(
18//!     &store, ctx.piv.as_ref(), &ctx.reader, "my-secret", ctx.require_pin()?.as_deref(), false,
19//! )?;
20//! # Ok::<(), anyhow::Error>(())
21//! ```
22//!
23//! # Features
24//!
25//! | Feature | Purpose | Default |
26//! |---|---|---|
27//! | `chrono` | `BlobInfo::mtime_local()` convenience method | No |
28//! | `virtual-piv` | `VirtualPiv` in-memory backend for testing | No |
29//! | `integration-tests` | vsmartcard + piv-authenticator tests | No |
30//! | `hardware-tests` | Real YubiKey destructive tests | No |
31//!
32//! # Security note
33//!
34//! Private key material on the YubiKey is never extracted. ECDH key
35//! agreement is performed on-card via the PIV GENERAL AUTHENTICATE command.
36
37pub mod auxiliaries;
38pub mod crypto;
39
40pub mod context;
41pub mod errors;
42pub mod nvm;
43pub mod orchestrator;
44pub mod piv;
45pub mod policy;
46pub mod report;
47pub mod store;
48
49pub use context::{
50    parse_ec_public_key_from_cert_der, Context, ContextOptions, DevicePicker, KeySource,
51    OutputOptions, PrintedRepair, Repairs, SlotKeyCheck,
52};
53pub use nvm::{scan_nvm, NvmUsage};
54pub use orchestrator::{
55    chunks_needed, collect_blob_chain, fetch_blob, list_blobs, objects_needed, remove_blob,
56    remove_blobs, store_blob, BlobInfo, Compression, Encryption, StoreOptions,
57};
58pub use piv::hardware::HardwarePiv;
59pub use piv::{fixture_path, open_backend, DeviceInfo, FlashHandle, MgmtAlgo, PinRef, PivBackend};
60#[cfg(any(feature = "virtual-piv", feature = "test-utils"))]
61pub use piv::{Fault, VirtualPiv};
62pub use policy::SecretOp;
63/// Secrets (management key, PIN) are held in `Zeroizing` buffers.
64pub use zeroize::Zeroizing;
65
66#[cfg(any(test, feature = "test-utils"))]
67pub mod test_utils;
yb_core/lib.rs

yb_core/
lib.rs
