Crate confium_pki 

X.509 cert + scoped delegation + CMS + XMLDSig for Confium.

Four tightly-coupled PKI concerns:

• X.509 cert + CSR types with hierarchical path validation
• Scoped delegation templates (parent cert delegates bounded authority to child cert — e.g., OIML Manufacturer Model Cert → Instance Cert)
• CMS (PKCS#7) SignedData envelope verifiable by OpenSSL, Thunderbird, Adobe
• XMLDSig + Exclusive C14N for CNML-style XML documents

Confium-produced signatures verify under standard tools (xmlsec1, openssl, browser-native XMLDSig). Feature flags let consumers opt in to specific envelope formats:

• parsing (default): X.509 cert + CSR parsing
• delegation (default): scoped delegation templates
• cms: CMS DER encoding (der crate)
• xmldsig: XMLDSig + canonicalization

See TODO.roadmap/32-cert-delegation-cms-xmldsig.md for the full spec.

Example

use confium_pki::result::VerificationResult;

// Aggregate two verification results: if either is invalid, the
// combined result is invalid; per-check failures propagate.
let r1 = VerificationResult { valid: true, checks: vec![] };
let r2 = VerificationResult {
    valid: false,
    checks: vec![confium_pki::PathFailure::Expired],
};
let combined = VerificationResult::aggregate(&[r1, r2]);
assert!(!combined.valid);
assert_eq!(combined.checks.len(), 1);

Re-exports

pub use confium_pkcs11_server as pkcs11_server;

pub use confium_openssl_provider as openssl_provider;

pub use confium_jce_provider as jce_provider;

pub use confium_tls_signer as tls_signer;

pub use confium_composite as composite;

pub use confium_attributes as attributes;

pub use cert::*;

pub use path::*;

pub use result::*;

pub use delegation::*;

pub use cms::*;

pub use xmldsig::*;

Modules

cert

X.509 v3 certificate wrapper types.

cms

CMS (PKCS#7 / RFC 5652) SignedData envelope construction and verification.

csr

PKCS#10 CSR module — placeholder structure maintained in cert.rs.

delegation

Scoped certificate delegation templates.

path

Hierarchical path validation with scope enforcement.

result

Unified verification result shared across Confium PKI crates.

xmldsig

XMLDSig and Exclusive C14N for XML document signing.