confium_pki/lib.rs
1//! X.509 cert + scoped delegation + CMS + XMLDSig for Confium.
2//!
3//! Four tightly-coupled PKI concerns:
4//!
5//! - **X.509 cert + CSR types** with hierarchical path validation
6//! - **Scoped delegation templates** (parent cert delegates bounded authority
7//! to child cert — e.g., OIML Manufacturer Model Cert → Instance Cert)
8//! - **CMS (PKCS#7) SignedData envelope** verifiable by OpenSSL, Thunderbird,
9//! Adobe
10//! - **XMLDSig + Exclusive C14N** for CNML-style XML documents
11//!
12//! Confium-produced signatures verify under standard tools (xmlsec1, openssl,
13//! browser-native XMLDSig). Feature flags let consumers opt in to specific
14//! envelope formats:
15//!
16//! - `parsing` (default): X.509 cert + CSR parsing
17//! - `delegation` (default): scoped delegation templates
18//! - `cms`: CMS DER encoding (`der` crate)
19//! - `xmldsig`: XMLDSig + canonicalization
20//!
21//! See `TODO.roadmap/32-cert-delegation-cms-xmldsig.md` for the full spec.
22//!
23//! # Example
24//!
25//! ```
26//! use confium_pki::result::VerificationResult;
27//!
28//! // Aggregate two verification results: if either is invalid, the
29//! // combined result is invalid; per-check failures propagate.
30//! let r1 = VerificationResult { valid: true, checks: vec![] };
31//! let r2 = VerificationResult {
32//! valid: false,
33//! checks: vec![confium_pki::PathFailure::Expired],
34//! };
35//! let combined = VerificationResult::aggregate(&[r1, r2]);
36//! assert!(!combined.valid);
37//! assert_eq!(combined.checks.len(), 1);
38//! ```
39
40#![forbid(unsafe_code)]
41#![allow(missing_docs)] // TODO: document before 1.0
42#![allow(ambiguous_glob_reexports)]
43
44pub mod cert;
45pub mod csr;
46pub mod path;
47pub mod result;
48
49#[cfg(feature = "delegation")]
50pub mod delegation;
51
52#[cfg(feature = "cms")]
53pub mod cms;
54
55#[cfg(feature = "xmldsig")]
56pub mod xmldsig;
57
58pub use cert::*;
59pub use path::*;
60pub use result::*;
61
62#[cfg(feature = "delegation")]
63pub use delegation::*;
64
65#[cfg(feature = "cms")]
66pub use cms::*;
67
68#[cfg(feature = "xmldsig")]
69pub use xmldsig::*;
70
71// Product-surface expansions (optional adapters, off by default).
72#[cfg(feature = "pkcs11-server")]
73/// PKCS#11 server (drop-in HSM replacement).
74pub use confium_pkcs11_server as pkcs11_server;
75
76#[cfg(feature = "openssl-provider")]
77/// OpenSSL 3.0 provider.
78pub use confium_openssl_provider as openssl_provider;
79
80#[cfg(feature = "jce-provider")]
81/// Java Cryptography Extension provider.
82pub use confium_jce_provider as jce_provider;
83
84#[cfg(feature = "tls-signer")]
85/// TLS 1.3 signature callback.
86pub use confium_tls_signer as tls_signer;
87
88#[cfg(feature = "composite")]
89/// Composite signatures (PQ migration).
90pub use confium_composite as composite;
91
92#[cfg(feature = "attributes")]
93/// Attribute-based signing predicates.
94pub use confium_attributes as attributes;