confium-pki 0.5.3

X.509 cert, scoped delegation, CMS, and XMLDSig for Confium
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94

//! X.509 cert + scoped delegation + CMS + XMLDSig for Confium.
//!
//! Four tightly-coupled PKI concerns:
//!
//! - **X.509 cert + CSR types** with hierarchical path validation
//! - **Scoped delegation templates** (parent cert delegates bounded authority
//!   to child cert — e.g., OIML Manufacturer Model Cert → Instance Cert)
//! - **CMS (PKCS#7) SignedData envelope** verifiable by OpenSSL, Thunderbird,
//!   Adobe
//! - **XMLDSig + Exclusive C14N** for CNML-style XML documents
//!
//! Confium-produced signatures verify under standard tools (xmlsec1, openssl,
//! browser-native XMLDSig). Feature flags let consumers opt in to specific
//! envelope formats:
//!
//! - `parsing` (default): X.509 cert + CSR parsing
//! - `delegation` (default): scoped delegation templates
//! - `cms`: CMS DER encoding (`der` crate)
//! - `xmldsig`: XMLDSig + canonicalization
//!
//! See `TODO.roadmap/32-cert-delegation-cms-xmldsig.md` for the full spec.
//!
//! # Example
//!
//! ```
//! use confium_pki::result::VerificationResult;
//!
//! // Aggregate two verification results: if either is invalid, the
//! // combined result is invalid; per-check failures propagate.
//! let r1 = VerificationResult { valid: true, checks: vec![] };
//! let r2 = VerificationResult {
//!     valid: false,
//!     checks: vec![confium_pki::PathFailure::Expired],
//! };
//! let combined = VerificationResult::aggregate(&[r1, r2]);
//! assert!(!combined.valid);
//! assert_eq!(combined.checks.len(), 1);
//! ```

#![forbid(unsafe_code)]
#![allow(missing_docs)] // TODO: document before 1.0
#![allow(ambiguous_glob_reexports)]

pub mod cert;
pub mod csr;
pub mod path;
pub mod result;

#[cfg(feature = "delegation")]
pub mod delegation;

#[cfg(feature = "cms")]
pub mod cms;

#[cfg(feature = "xmldsig")]
pub mod xmldsig;

pub use cert::*;
pub use path::*;
pub use result::*;

#[cfg(feature = "delegation")]
pub use delegation::*;

#[cfg(feature = "cms")]
pub use cms::*;

#[cfg(feature = "xmldsig")]
pub use xmldsig::*;

// Product-surface expansions (optional adapters, off by default).
#[cfg(feature = "pkcs11-server")]
/// PKCS#11 server (drop-in HSM replacement).
pub use confium_pkcs11_server as pkcs11_server;

#[cfg(feature = "openssl-provider")]
/// OpenSSL 3.0 provider.
pub use confium_openssl_provider as openssl_provider;

#[cfg(feature = "jce-provider")]
/// Java Cryptography Extension provider.
pub use confium_jce_provider as jce_provider;

#[cfg(feature = "tls-signer")]
/// TLS 1.3 signature callback.
pub use confium_tls_signer as tls_signer;

#[cfg(feature = "composite")]
/// Composite signatures (PQ migration).
pub use confium_composite as composite;

#[cfg(feature = "attributes")]
/// Attribute-based signing predicates.
pub use confium_attributes as attributes;