Module path 

Certification paths: which sequences of certificates lead from a certificate to an anchor the caller trusts, and what that costs.

One signature can have several valid paths, and a report shows them, because a cross-certified provider is recognized under one scheme by one path and under another by another. That is not the same as enumerating every path: a certificate set somebody else controls can hold a combinatorial number of them, and a browser asked for all of them stops answering. So the search is bounded in every direction it can grow, and when a bound is reached the answer says so. Silence about truncation would be a worse answer than the truncation.

Where the bound is on how many paths are returned, which paths are kept is not the order they were found in. A second path to the same anchor naming the same policies tells a reader nothing the first did not; a path to another anchor, or one naming other policies, is the whole reason several paths are shown at all. So a path that differs in either is kept ahead of a repeat of one already held.

An anchor is an input, never a discovery (RFC 5280 6.1): a self-signed certificate that happens to sit in the same pool is a certificate like any other, and a path that ends at one the caller did not name ends nowhere.

Structs

Anchor

What the caller trusts, as the trust context named it.

Bounds

How far the search may go before it stops and says so.

Context

Everything the search asks of the caller: what is trusted, when, how far to look, what is being asked about, and who answers the questions this crate does not.

Interval

The interval the path is built for, in seconds from the epoch.

Outcome

What the search found, and what it did not get to.

Path

One certification path: the certificates from the target up, the anchor they lead to, and what the authorities along it agreed the target was issued under.

Policy

What the caller was asking about, before any certificate was read.

WorkingKey

The key a certificate’s signature is checked with, and the parameters that are in force for it.

Enums

BuildError

A path operation that could not finish, preserving the originating cause.

Truncation

Which bound stopped the search, where one did.

Verified

What a verifier says about one signature.

Traits

Verify

Who checks a signature.

Watch

Whether the search has run out of time.

Functions

build

Builds the paths from one certificate to the anchors the caller trusts.

Type Aliases

BuildResult

Result of path processing with the injected callbacks’ original error types.