Struct TpmInstance 

pub struct TpmInstance {
    pub config: TpmConfig,
}

One open TPM-backed keystore connection.

Carries the parsed TpmConfig as a public field so callers (and tests) can inspect the resolved configuration after open. With the tpm feature enabled it additionally owns a (future) tss-esapi context; for now the field is a placeholder so the struct shape is stable across the skeleton and the wired-up revision.

Fields

config: TpmConfig

Resolved configuration parsed from Options at open time.

Implementations

impl TpmInstance

pub fn from_config(config: TpmConfig) -> Self

Construct an instance directly from a parsed config. Useful for tests and for callers that already have a typed config rather than the string-keyed options map.

Trait Implementations

impl Send for TpmInstance

impl StoreInstance for TpmInstance

fn put_secret( &mut self, _module: &str, _app: &str, _key_id: &str, _key: *mut c_void, ) -> Result<()>

Insert a secret key into the private compartment, indexed by key_id.

fn get_secret( &self, _module: &str, _app: &str, _key_id: &str, ) -> Result<*mut c_void>

Fetch a secret key from the private compartment by key_id. Returns crate::error::Error::ValueNotFound if absent.

fn put_public( &mut self, _module: &str, _app: &str, _identity: &str, _key: *mut c_void, _sig: &[u8], ) -> Result<()>

Insert a public key into the public compartment, indexed by identity, with a detached signature over the identity.

fn get_public( &self, _module: &str, _app: &str, _identity: &str, ) -> Result<(*mut c_void, Vec<u8>)>

Fetch a public key from the public compartment by identity. Returns the key handle and the stored signature bytes.

fn enumerate( &self, _module: &str, _app: &str, _compartment: Compartment, ) -> Result<Vec<(*mut c_void, String)>>

Enumerate entries in one compartment of one (module, app) scope. Each entry is the opaque key handle paired with its index string (key_id for private, canonical identity for public).

fn sign( &self, _module: &str, _app: &str, _key_id: &str, _algorithm: &str, _message: &[u8], ) -> Result<Vec<u8>, Error>

Sign message with the remote key named by key_id, using the provider-specific algorithm name (e.g. "ECDSA_SHA_256" on AWS KMS, "EC_SIGN_P256_SHA256" on Cloud KMS, "ES256" on Key Vault). Input is the raw message — providers that sign digests hash it themselves or the backend does. This is the remote-sign half of the sign-with-handle contract: backends that hold keys out-of-process (cloud KMS, PKCS#11, TPM) implement it; local backends keep the default.

impl Sync for TpmInstance