Module cades 

CAdES attribute rules of ETSI EN 319 122-1 V1.3.1 §§5.2-5.5 that narrow the generic CMS and ESS schemas.

The generic readers accept what RFC 5652 and RFC 5035 accept; this module reports where a CAdES signature uses that freedom against the profile: an attribute in the wrong set, a single-valued attribute with another value count, a content-describing attribute inside a countersignature, ESS policies and an implied signature policy. Which attributes a level requires, and every verdict, stay with the caller.

Structs

Profile

One original ESS reading and its CAdES-specific profile findings. Keeping the reading lets a baseline layer bind the certificate without parsing the same signed attribute a second time in that operation.

Enums

Role

The SignerInfo being checked, since rules differ by where it sits.

Functions

findings_from_reading

Applies the same profile kernel to the SAME already parsed ESS reading. Source identity is checked before traversal; no ESS value is reparsed and no signature, certificate binding or application trust is established.

inspect_profile

Inspects the same profile while retaining nonterminal ESS selection/schema failures as located findings. A conflicting version has no selected binding; it cannot silently become the first assertion or an empty successful set. Source/resource refusal still returns an error without a successful prefix. This permits a format layer to inventory later timestamps and counters even when the original signer’s ESS fields are nonconforming.

profile

Runs the same profile kernel as profile_faults, retaining the already parsed ESS reading for subsequent baseline certificate binding. No result here supplies a baseline level, mathematical agreement or trust.

profile_faults

Reports every CAdES profile violation of one SignerInfo, in rule order, with original locations.