Module material 

Exact incorporated validation material and its coverage by archive inputs.

The format layer builds an Index of every original certificate, CRL and OCSP value it carries, with its own placement of each occurrence, and a Coverage for each archive timestamp input. These modules then locate the material that actual actor paths and status results need. Availability is never authentication, freshness, placement acceptance or a level.

Modules

status

Original status artifacts derived from common authenticated evidence.

Structs

AnchorMaterial

Direct credential anchor’s distinct certificate-material obligation.

ArchivedCertificate

One checked-path certificate’s mathematical availability before an archive.

ArtifactKey

Exact identity of one original artifact: its kind and original DER. Two separately parsed copies of the same value have the same identity.

ArtifactUse

An original certificate/status value with ALL its actual actor purposes. Exact kind and original DER identify an artifact; two checked paths or separately parsed copies do not make the same certificate exclusive to one.

ArtifactUses

Complete X.509/CRL/OCSP artifact census for the same participant requirements. Credential-format-specific data remain separate. This does not assert CA status, allowed placement, freshness or baseline grade.

CarriedOrigin

Exact identity of a revocation choice carried in a timestamp token. These ordinals do not address the format’s own material pool.

Coverage

The original items one timestamp’s prepared input covers in their entirety.

IncorporatedArtifact

One actual validation input and an exact original incorporated copy, if any. An acquired/caller-supplied value alone is not an incorporated occurrence.

Incorporation

Complete X.509 input presence for whole-signature LT requirements. This preserves missing artifacts rather than accepting a caller-written subset. Placement, format-specific credentials, status usability, historical trust, chronology and archive coverage are SEPARATE obligations, not inferred here.

Index

Accounted scoped index of every original occurrence. Keys borrow original DER, not copied/normalized certificate names or unqualified fingerprints. The same artifact in several containers keeps ALL locations, so later archive/actor checks cannot mistake a late or disallowed copy for coverage.

Occurrence

One original occurrence, with an explicit source-pool discriminator and the format’s own placement of the value.

Occurrences

Source-catalogue-order traversal of every copy; current Work pays metadata access even when index storage belongs to an earlier execution. The first source/resource refusal is returned once and fuses the iterator.

ParticipantMaterial

Every participant’s reached X.509 artifacts under the SAME original archive. Source requirements and negative status facts remain available in inputs. This does not decide status usability, trust, exclusive material placement, credential-format-specific material, chronology or an attained baseline level.

PathCertificates

Complete certificate census for one actual checked path and archive input. It deliberately retains its path: ordinals cannot be relabelled as another actor after this check. Status artifacts and actor association are separate.

Targets

Status targets of one artifact, most recently recorded first.

Enums

ArchiveError

Original source/resource failure, separately from missing archive material.

Archived

Exact original artifact availability under one checked archive input.

ArtifactRef

One original parsed artifact to locate. This is a source reference, not a receipt of authentication, applicability, freshness or actor membership.

ArtifactSource

One actual location of an original certificate or status artifact. No path, authorization, freshness, reason coverage or attained level is asserted.

CoverageError

Source/current admission and foreign evidence are independent of absence.

IncorporationError

Incomplete scope and original source/resource errors are not missing values.

IndexError

Original source refusal is independent of index capacity/work refusal.

ParticipantArchiveError

Foreign archive evidence cannot satisfy another original obligation set.

PathCertificate

Exact position of a certificate in a supplied, actually checked path.

Functions

archived_participants

Match the complete participant closure to its one particular original archive, then reuse the exact artifact/coverage kernel for every reached authority and existing direct-anchor certificate. EN319132-1 §5.4.2/§5.4.3/§6.3(aa) distinguishes existing anchor certificate material from non-anchor status obligations. https://www.etsi.org/deliver/etsi_en/319100_319199/31913201/01.03.01_60/en_31913201v010301p.pdf

artifact_uses

Merge purposes by exact original artifact identity AFTER role propagation. EN319132-1 §§5.4.2(5)/5.4.3(4) concern exclusive certificate/status uses, which cannot be inferred from path identity or the first occurrence alone. https://www.etsi.org/deliver/etsi_en/319100_319199/31913201/01.03.01_60/en_31913201v010301p.pdf

incorporation

Locate every actual X.509 validation input, including independently retained anchors and reached CRL/delta/OCSP authentication paths, through the SAME exact-artifact index used for archive coverage and TSA placement. EN319132-1 §6.3(cc) permits missing validation data in AnyValidationData; §§5.4.2–5.4.6 and6.3(x) additionally constrain particular container roles. This necessary presence check does not replace those placement checks or assert that Unknown/stale/revoked input is Good. No parse/crypto is repeated. https://www.etsi.org/deliver/etsi_en/319100_319199/31913201/01.03.01_60/en_31913201v010301p.pdf

Type Aliases

ArtifactUsesResult

Original source/role association and resource failures remain terminal.