Trait KeyResolver 

pub trait KeyResolver {
    // Required method
    fn resolve<'a>(
        &'a self,
        key_info: Option<&KeyInfo>,
        algorithm: SignatureAlgorithm,
    ) -> Result<Option<Box<dyn VerifyingKey + 'a>>, DsigError>;

    // Provided methods
    fn resolve_with_policy<'a>(
        &'a self,
        key_info: Option<&KeyInfo>,
        algorithm: SignatureAlgorithm,
        _policy: &VerificationPolicy,
    ) -> Result<Option<Box<dyn VerifyingKey + 'a>>, DsigError> { ... }
    fn resolve_with_policy_and_provider<'a>(
        &'a self,
        key_info: Option<&KeyInfo>,
        algorithm: SignatureAlgorithm,
        policy: &VerificationPolicy,
        _provider: &dyn CryptoProvider,
    ) -> Result<Option<Box<dyn VerifyingKey + 'a>>, DsigError> { ... }
    fn consumes_document_key_info(&self) -> bool { ... }
}

Key resolver hook used by VerifyContext when no pre-set key is provided.

This trait intentionally has no Send + Sync supertraits; callers that need cross-thread sharing can wrap resolvers/keys in their own thread-safe types.

Required Methods

fn resolve<'a>( &'a self, key_info: Option<&KeyInfo>, algorithm: SignatureAlgorithm, ) -> Result<Option<Box<dyn VerifyingKey + 'a>>, DsigError>

Resolve a verification key from parsed <KeyInfo> sources.

Return Ok(None) when no suitable key could be resolved from available key material (for example, missing <KeyInfo> candidates). VerifyContext maps Ok(None) to DsigStatus::Invalid(FailureReason::KeyNotFound); reserve Err(...) for resolver failures.

Provided Methods

fn resolve_with_policy<'a>( &'a self, key_info: Option<&KeyInfo>, algorithm: SignatureAlgorithm, _policy: &VerificationPolicy, ) -> Result<Option<Box<dyn VerifyingKey + 'a>>, DsigError>

Resolve under the operation’s immutable policy snapshot.

Implementations that make trust or key-source decisions must override this method. Resolver implementations that inspect multiple candidates must enforce crate::policy::ResourcePolicy::max_key_candidates across that internal search. The verification pipeline separately requires capacity for the single candidate returned by any resolver. The default preserves source-only custom resolvers whose behavior is independent of other policy fields.

fn resolve_with_policy_and_provider<'a>( &'a self, key_info: Option<&KeyInfo>, algorithm: SignatureAlgorithm, policy: &VerificationPolicy, _provider: &dyn CryptoProvider, ) -> Result<Option<Box<dyn VerifyingKey + 'a>>, DsigError>

Resolve under both the operation policy and cryptographic provider.

Resolvers that evaluate cryptographic key metadata, such as X509Digest, must override this hook. The default keeps existing policy-aware custom resolvers source-compatible.

fn consumes_document_key_info(&self) -> bool

Return true when this resolver consumes document <KeyInfo> material.

The verification pipeline uses this to decide whether malformed <KeyInfo> should raise DsigError::ParseKeyInfo before resolver execution. Resolvers that ignore document key material can keep the default false to avoid fail-closed parsing on advisory <KeyInfo>.

Dyn Compatibility

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors

impl KeyResolver for DefaultKeyResolver