Struct CertChain 

pub struct CertChain {
    pub intermediates: Vec<SignedCredential>,
    pub leaf: SignedCredential,
}

A presented certificate chain: zero or more intermediate CA certs plus the leaf (node) credential.

Fields

intermediates: Vec<SignedCredential>

Intermediate CA certs, ordered anchor-first: intermediates[0] is signed by a trusted root in the receiver’s bundle; each subsequent cert is signed by the previous one; the last signed the leaf. Empty ⇒ the leaf is signed directly by a trusted root (the P2/P3 one-level case, preserved for back-compat).

leaf: SignedCredential

The leaf (node) credential whose subject_pubkey the caller will use as the peer’s verifying key once the chain verifies.

Implementations

impl CertChain

pub fn new(leaf: SignedCredential, intermediates: Vec<SignedCredential>) -> Self

A chain with an explicit leaf and intermediates (anchor-first).

pub fn direct(leaf: SignedCredential) -> Self

A one-level chain: the leaf is signed directly by a trusted root.

pub fn depth(&self) -> usize

Chain depth in levels (intermediates + the leaf).

pub fn intermediates_header_value( &self, ) -> Result<Option<String>, CredentialError>

Encode the anchor-first intermediates as the CHAIN_HEADER value (v1=<base64(CBOR array of credential wire envelopes)>), or None when the chain is one-level (no intermediates ⇒ no chain header, so a hierarchical sender degrades to the exact P2/P3 wire when it happens to hold a root-signed leaf). The leaf is encoded separately via SignedCredential::to_header_value into the credential header.

Errors

CredentialError::Malformed on an internal serialisation fault.

pub fn intermediates_from_header_value( value: &str, ) -> Result<Vec<SignedCredential>, CredentialError>

Parse a CHAIN_HEADER value (v1=<base64(CBOR array)>) into the anchor-first intermediates list. Pair with a leaf parsed from the credential header to reconstruct a CertChain via Self::new.

Errors

CredentialError::Malformed on a missing prefix, bad base64, or a structurally invalid CBOR array / envelope.

pub fn verify( &self, bundle: &TrustBundle, now_unix: i64, max_depth: usize, ) -> Result<FederationCredential, ChainError>

Verify the whole chain against bundle at now_unix, rejecting chains deeper than max_depth. On success returns the verified leaf FederationCredential whose subject_pubkey is the peer’s key.

Identity-binding (does the leaf’s subject_agent_id match the wire peer_id?) and delegation-authority (may this intermediate vouch for this leaf’s namespace?) stay the caller’s responsibility — the same crypto/policy split as SignedCredential::verify_against.

Errors

• ChainError::ChainTooDeep when depth() > max_depth.
• ChainError::NameMismatch / ChainError::DomainMismatch on a broken name or domain link.
• ChainError::Link wrapping any credential-layer failure (anchor not in bundle, bad signature, expired, etc.).

Trait Implementations

impl Clone for CertChain

fn clone(&self) -> CertChain

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CertChain

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.