structured_pkix/lib.rs
1//! Certificates, read into a model that keeps what a decision needs.
2//!
3//! A certificate is read once and kept as it arrived: every field borrows the
4//! document, and the bytes a signature is computed over are handed back as the
5//! range they occupy rather than re-encoded from what was understood. A parser
6//! that re-encodes has decided that its own understanding is the document, and
7//! a signature checked over that says nothing about the file somebody was sent.
8//!
9//! Two kinds of fault are kept apart, because they lead to different answers.
10//!
11//! What cannot be represented honestly is refused: an unreadable encoding, a
12//! field the certificate's own version says is not there, two copies of one
13//! extension with no way to say which applies, or an algorithm named outside
14//! the signed bytes that differs from the one named inside them.
15//!
16//! What can be represented is reported rather than refused, even when it is
17//! wrong: a negative serial number, a validity interval that ends before it
18//! starts, a critical extension nobody here knows. Refusing those would leave
19//! the product unable to explain a document a person is holding, and
20//! explaining is the product.
21
22#![cfg_attr(not(feature = "std"), no_std)]
23
24extern crate alloc;
25
26#[cfg(test)]
27mod fixtures;
28
29pub mod access;
30pub mod algorithm;
31pub mod certificate;
32pub mod constraints;
33pub mod der;
34pub mod error;
35pub mod extension;
36pub mod general_name;
37pub mod identifier;
38pub mod key;
39pub mod name;
40pub mod oid;
41pub mod path;
42pub mod policy;
43pub mod qualified;
44pub mod temporal;
45pub mod time;
46pub mod usage;
47
48pub use algorithm::AlgorithmIdentifier;
49pub use certificate::{Certificate, TbsCertificate, Validity, Version};
50pub use error::{Error, ErrorCode, Result};
51pub use extension::{Extension, Extensions, Recognizer};
52pub use key::PublicKeyInfo;
53pub use name::{Attribute, Name, Ordered};
54pub use time::Time;