[PATCH proxmox 01/20] pbs-api-types: define encryption key type and schema

Christian Ebner
2026-04-01T07:55:54Z

Will be used to store and uniquly identify encryption keys in the
config. Contains the KeyInfo extended by the unique key identifier.

Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
---
pbs-api-types/src/key_derivation.rs | 34 ++++++++++++++++++++++++++---
pbs-api-types/src/lib.rs | 2 +-
2 files changed, 32 insertions(+), 4 deletions(-)

diff --git a/pbs-api-types/src/key_derivation.rs b/pbs-api-types/src/key_derivation.rs
index 57ae353a..2a986c21 100644
--- a/pbs-api-types/src/key_derivation.rs
+++ b/pbs-api-types/src/key_derivation.rs
@@ -3,12 +3,13 @@ use serde::{Deserialize, Serialize};
#[cfg(feature = "enum-fallback")]
use proxmox_fixed_string::FixedString;

-use proxmox_schema::api;
+use proxmox_schema::api_types::SAFE_ID_FORMAT;
+use proxmox_schema::{api, Schema, StringSchema, Updater};

use crate::CERT_FINGERPRINT_SHA256_SCHEMA;

#[api(default: "scrypt")]
-#[derive(Clone, Copy, Debug, Deserialize, Serialize)]
+#[derive(Clone, Copy, Debug, Deserialize, Serialize, PartialEq)]
#[serde(rename_all = "lowercase")]
/// Key derivation function for password protected encryption keys.
pub enum Kdf {
@@ -41,7 +42,7 @@ impl Default for Kdf {
},
},
)]
-#[derive(Deserialize, Serialize)]
+#[derive(Clone, Default, Deserialize, Serialize, Updater, PartialEq)]
/// Encryption Key Information
pub struct KeyInfo {
/// Path to key (if stored in a file)
@@ -59,3 +60,30 @@ pub struct KeyInfo {
#[serde(skip_serializing_if = "Option::is_none")]
pub hint: Option<String>,
}
+
+/// ID to uniquely identify an encryption key.
+pub const ENCRYPTION_KEY_ID_SCHEMA: Schema =
+ StringSchema::new("ID to uniquely identify encryption key")
+ .format(&SAFE_ID_FORMAT)
+ .min_length(3)
+ .max_length(32)
+ .schema();
+
+#[api(
+ properties: {
+ id: {
+ schema: ENCRYPTION_KEY_ID_SCHEMA,
+ },
+ info: {
+ type: KeyInfo,
+ },
+ },
+)]
+#[derive(Clone, Default, Deserialize, Serialize, Updater, PartialEq)]
+/// Encryption Key Information
+pub struct EncryptionKey {
+ #[updater(skip)]
+ pub id: String,
+ #[serde(flatten)]
+ pub info: KeyInfo,
+}
diff --git a/pbs-api-types/src/lib.rs b/pbs-api-types/src/lib.rs
index 54547291..ddd5840e 100644
--- a/pbs-api-types/src/lib.rs
+++ b/pbs-api-types/src/lib.rs
@@ -104,7 +104,7 @@ mod jobs;
pub use jobs::*;

mod key_derivation;
-pub use key_derivation::{Kdf, KeyInfo};
+pub use key_derivation::{EncryptionKey, Kdf, KeyInfo, ENCRYPTION_KEY_ID_SCHEMA};

mod maintenance;
pub use maintenance::*;
--
2.47.3