Struct Index 

pub struct Index<'source, N, D, G, P, O, W: Work, I> { /* private fields */ }

Accounted scoped index of every original occurrence. Keys borrow original DER, not copied/normalized certificate names or unqualified fingerprints. The same artifact in several containers keeps ALL locations, so later archive/actor checks cannot mistake a late or disallowed copy for coverage.

P is the format’s placement of an occurrence and O an entry of the format’s schema-open catalogue; the index stores and returns both unread. Only the holder of issuer I builds it from the format’s own pools, and it locates material only under coverage and evidence of the same issuer.

Implementations

impl<'source, N: Copy + Eq, D: Copy + Eq, G: Copy + Eq, P: Copy, O, W: Work, I> Index<'source, N, D, G, P, O, W, I>

pub fn new<Q: Query<Id = N, Document = D, Generation = G, Work = W>>( _issuer: I, signature: N, open: &'source [O], query: &Q, ) -> Result<Self, IndexError<N>>

An empty index for this signature in the query’s source generation.

open is the format’s schema-open material catalogue, retained only so that format checks find it beside the index. Requiring the issuer value keeps a caller of the format from building an index of its own.

pub fn insert<Q: Query<Id = N, Document = D, Generation = G, Work = W>>( &mut self, _issuer: I, artifact: ArtifactRef<'_, 'source>, occurrence: Occurrence<N, D, G, P>, query: &Q, ) -> Result<(), IndexError<N>>

Records one occurrence of an exact original artifact. For an OCSP value every certificate embedded in its basic response is recorded too, with the same location and placement. Hashing, probes and storage are admitted first; a refusal leaves the index for the caller to drop. The builder pays its own traversal of the format’s pools with Self::admit. Requiring the issuer value keeps a caller of the format, which may own the index, from adding material the document does not carry.

pub fn open(&self) -> &'source [O]

The format’s schema-open catalogue, as supplied.

pub fn signature(&self) -> N

Original selected signature of this index.

pub fn snapshot(&self) -> Snapshot<D, G>

Source generation of every occurrence.

pub fn certificate<'view, 'query, Q: Query<Id = N, Document = D, Generation = G>>( &'view self, value: &Certificate<'_>, query: &'query Q, ) -> Result<Occurrences<'view, 'query, 'source, N, D, G, P, O, W, Q, I>, IndexError<N>>

Finds all copies of this exact original certificate, including copies inside OCSP. A match is availability only, never authentication/trust.

pub fn crl<'view, 'query, Q: Query<Id = N, Document = D, Generation = G>>( &'view self, value: &CertificateList<'_>, query: &'query Q, ) -> Result<Occurrences<'view, 'query, 'source, N, D, G, P, O, W, Q, I>, IndexError<N>>

Finds all whole CRL copies. An authenticated delta still needs its authenticated/bound complete source; finding either alone proves no pair.

pub fn ocsp<'view, 'query, Q: Query<Id = N, Document = D, Generation = G>>( &'view self, value: &BasicResponse<'_>, query: &'query Q, ) -> Result<Occurrences<'view, 'query, 'source, N, D, G, P, O, W, Q, I>, IndexError<N>>

Finds the exact basic response in format-issued retained occurrences. Good-looking status or a successful wire code does not mint evidence.

pub fn artifact<'view, 'query, Q: Query<Id = N, Document = D, Generation = G>>( &'view self, artifact: ArtifactRef<'_, '_>, query: &'query Q, ) -> Result<Occurrences<'view, 'query, 'source, N, D, G, P, O, W, Q, I>, IndexError<N>>

Finds all copies of this exact artifact, in source catalogue order.

pub fn require_signature<Q: Query<Id = N, Document = D, Generation = G>>( &self, signature: N, query: &Q, ) -> Result<(), IndexError<N>>

Requires that this index was built for signature.

pub fn archived<Q: Query<Id = N, Document = D, Generation = G>, C: Work>( &self, artifact: ArtifactRef<'_, '_>, coverage: &Coverage<N, D, G, C, I>, evidence: &Verified<N, D, G, I>, query: &Q, ) -> Result<Archived<N, D, G, P>, ArchiveError<N>>

where N: HashWork,

Locates a whole original artifact in this exact checked archive input.

EN319132-1 §6.3(aa)/§5.5.2.2 requires the necessary material to have been incorporated before generating each archive timestamp. This uses the same selection the format used for actual timestamp input, so merely finding a late or self-carried copy cannot count as covered. All copies remain available; an early uncovered duplicate does not hide a covered one. This proves mathematical availability only. The caller must derive required artifacts from actual actor/path/status checks and must authenticate the TSA separately before claiming a baseline level. https://www.etsi.org/deliver/etsi_en/319100_319199/31913201/01.03.01_60/en_31913201v010301p.pdf

pub fn archived_path<'path, 'document, Q, C: Work>( &self, path: &'path CheckedPath<'document>, coverage: &Coverage<N, D, G, C, I>, evidence: &Verified<N, D, G, I>, query: &Q, ) -> Result<PathCertificates<'path, 'document, N, D, G, P>, ArchiveError<N>>

where N: HashWork, Q: Query<Id = N, Document = D, Generation = G>,

Derives certificate requirements from the actual common-validator path, including an existing anchor certificate, then checks each exact artifact against this archive’s mathematical input. Missing/late copies remain facts; resource/source failure returns no successful partial census.

EN319132-1 V1.3.1 §§5.4.2/5.5.2.2/6.3(aa) require the material of the actual actors before each archive. This certificate component does not assert that status, credential, countersigner or previous-TSA processing completed. The caller must supply their separately bound paths. https://www.etsi.org/deliver/etsi_en/319100_319199/31913201/01.03.01_60/en_31913201v010301p.pdf

pub fn admit<Q: Query<Id = N, Document = D, Generation = G>>( &self, query: &Q, ) -> Result<(), IndexError<N>>

Admits one traversal step over this index’s source generation.