pub struct SignedResponse<'r, 'a> { /* private fields */ }Expand description
Original response authenticated by its actual signer. This proves neither signer authorization for a target issuer nor freshness or request binding.
Implementations§
Source§impl<'r, 'a> SignedResponse<'r, 'a>
impl<'r, 'a> SignedResponse<'r, 'a>
Sourcepub fn response(self) -> &'r BasicResponse<'a>
pub fn response(self) -> &'r BasicResponse<'a>
Original signed response, retaining every assertion and extension.
Sourcepub fn signer(self) -> &'r Certificate<'a>
pub fn signer(self) -> &'r Certificate<'a>
Actual certificate whose subject/key matched ResponderID.
Sourcepub fn key(self) -> WorkingKey<'a>
pub fn key(self) -> WorkingKey<'a>
Effective key bound to that certificate’s original SPKI.
Source§impl<'r, 'a> SignedResponse<'r, 'a>
impl<'r, 'a> SignedResponse<'r, 'a>
Sourcepub fn find<D: Digest>(
self,
target: &Certificate<'_>,
issuer: &Certificate<'_>,
digest: &D,
execution: &Memory,
) -> CallbackResult<Lookup<'r, 'a>, D::Error>
pub fn find<D: Digest>( self, target: &Certificate<'_>, issuer: &Certificate<'_>, digest: &D, execution: &Memory, ) -> CallbackResult<Lookup<'r, 'a>, D::Error>
Locate the target’s assertion using actual target/issuer bytes and the selected provider. RFC6960 §3.2(1) requires binding to the requested certificate. The caller binds these inputs to its actual request and checks nonce/intended recipient separately; identity alone is insufficient. https://www.rfc-editor.org/rfc/rfc6960#section-3.2
Source§impl<'r, 'a> SignedResponse<'r, 'a>
impl<'r, 'a> SignedResponse<'r, 'a>
Sourcepub fn bind_issuer(
self,
issuer: &'r Certificate<'a>,
issuing_key: WorkingKey<'a>,
execution: &Memory,
) -> Result<AuthorityBinding<'r, 'a>>
pub fn bind_issuer( self, issuer: &'r Certificate<'a>, issuing_key: WorkingKey<'a>, execution: &Memory, ) -> Result<AuthorityBinding<'r, 'a>>
Bind issuer-signed response to the actual authenticated target issuing key, including inherited parameters. Caller supplies issuer trust and current validity from its target path; a matching DN alone is inadequate. RFC6960 §4.2.2.2: https://www.rfc-editor.org/rfc/rfc6960#section-4.2.2.2
Sourcepub fn bind_delegate(
self,
facts: DelegateFacts<'a>,
execution: &Memory,
) -> Result<AuthorityBinding<'r, 'a>>where
'a: 'r,
pub fn bind_delegate(
self,
facts: DelegateFacts<'a>,
execution: &Memory,
) -> Result<AuthorityBinding<'r, 'a>>where
'a: 'r,
Attach completed direct local delegation to this exact actual signer. An unresolved revocation fact remains unresolved in the returned source.
Sourcepub fn trust_for_issuer(
self,
issuer: &'r Certificate<'a>,
) -> ScopedResponse<'r, 'a>
pub fn trust_for_issuer( self, issuer: &'r Certificate<'a>, ) -> ScopedResponse<'r, 'a>
Explicit caller assertion of locally configured responder trust for this target issuer, the separate RFC6960 §4.2.2.2 branch. Never call this merely because a certificate was included or carried an OCSP EKU. No traversal, allocation, trust discovery or policy selection occurs in this operation.