pub enum KeyError {
Crypto(String),
Persistence(String),
StoreNotInstalled,
UnsupportedKeyringPlatform,
ServiceNotRegistered,
NoDeviceIdentity,
IdentityMismatch {
existing_pubkey_hex: String,
imported_pubkey_hex: String,
},
NoPendingIdentity {
request_public_key_hex: String,
},
InvalidSecretName {
name: String,
reason: String,
},
StaleKeyRotation,
MissingKeychainEntitlement,
}Variants§
Crypto(String)
Persistence(String)
StoreNotInstalled
UnsupportedKeyringPlatform
ServiceNotRegistered
NoDeviceIdentity
IdentityMismatch
NoPendingIdentity
InvalidSecretName
StaleKeyRotation
Adopting a rotated store key found, under the write lock, that the incoming keyring adds nothing to the live one — a concurrent op already adopted a keyring that covers it. Failing loud keeps the delayed apply from regressing the seal key or custody.
MissingKeychainEntitlement
The OS refused a Keychain data-protection-store operation with
errSecMissingEntitlement (OSStatus -34018). This is not “the binary
isn’t signed” — an ad-hoc or Development-signed binary with no
keychain-access-groups entitlement at all also gets -34018, and a
signed binary that does carry that entitlement with no provisioning
profile behind it is killed by the kernel at launch instead. The fix is
a team-prefixed keychain-access-groups entitlement backed by an
embedded provisioning profile — in Xcode, set DEVELOPMENT_TEAM so
automatic signing fetches and embeds one. A build with no team must
omit the entitlement entirely, which means it also has no access to
the data-protection keychain and will hit this error on first use.