Enum CaKeyProtection 

pub enum CaKeyProtection {
    None,
    Passphrase(Zeroizing<String>),
}

At-rest protection for the daemon CA private key.

CaKeyProtection::None is the secure floor: a plaintext PKCS#8 PEM written 0600. CaKeyProtection::Passphrase additionally encrypts the key with XChaCha20-Poly1305 under an scrypt-derived key, so the on-disk bytes are useless without the passphrase (a stolen ca.key file does not yield the CA). An OS-keystore-backed variant is a documented future seam.

Variants

None

Plaintext PKCS#8 PEM at 0600 (backwards-compatible default / floor).

Passphrase(Zeroizing<String>)

scrypt + XChaCha20-Poly1305 encryption under an operator passphrase.

Implementations

impl CaKeyProtection

pub fn passphrase(passphrase: impl Into<String>) -> Self

Build a passphrase protection without the caller naming zeroize. An empty passphrase yields CaKeyProtection::None (the 0600 floor), so a daemon can source the passphrase from an env var / file and pass it through unconditionally.

pub fn from_env() -> Self

Source CA-key protection from the environment (the daemon’s opt-in passphrase; threat A4). ZEROCLAW_CA_PASSPHRASE takes precedence; otherwise ZEROCLAW_CA_PASSPHRASE_FILE is read. Unset yields CaKeyProtection::None (the 0600 floor). Every CA generation + read path uses this so the on-disk form always matches.

Trait Implementations

impl Clone for CaKeyProtection

fn clone(&self) -> CaKeyProtection

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.