Struct TlsConfigWitness 

pub struct TlsConfigWitness(/* private fields */);

Opaque, transient witness derived from the canonical configuration inputs.

Hosts derive this from policy, profile references and material under the same read as each view. It is not a policy cache or a mutable revision counter. Never expose the witness to guests or persist it.

Implementations

impl TlsConfigWitness

pub fn new(digest: [u8; 32]) -> Self

Construct a host-derived keyed content witness (not a guest value).

pub fn derive(inputs: &impl Serialize) -> Result<Self, PluginError>

Derive the witness for one locked canonical config view.

inputs is serialized straight into HMAC-SHA256 under a key drawn once per process, so no plaintext copy of it is buffered and a witness cannot serve as an offline oracle for the secret values it covers. Neither the key nor the digest is logged, serialized, or exposed to a guest.

Errors

Fails closed with PluginError::InvalidConfig when the process key cannot be drawn or inputs cannot be serialized.

Trait Implementations

impl Clone for TlsConfigWitness

fn clone(&self) -> TlsConfigWitness

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TlsConfigWitness

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for TlsConfigWitness

impl PartialEq for TlsConfigWitness

fn eq(&self, other: &TlsConfigWitness) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for TlsConfigWitness