Module trust 

X.509 certificate-chain verification for PDF signatures, against caller-provided trust anchors.

crate::signature answers “are the bytes intact and signed by the key in the embedded certificate?”. This module answers the follow-up: “does that certificate chain to a root I trust?” — chain building (subject/issuer matching over the CMS certificates set), per-link signature verification (RSA PKCS#1 v1.5 and ECDSA P-256/P-384, SHA-1/256/384/512), validity-period checks, and anchoring at a caller-supplied root set (PEM or DER).

Deliberately out of scope: revocation (CRL/OCSP fetching needs a network), name constraints, policy mapping, and RSA-PSS.

Structs

TrustAnchor

A trusted root certificate.

Enums

ChainStatus

Verdict of a chain verification.

Functions

parse_trust_anchors

Parse trust anchors from PEM (-----BEGIN CERTIFICATE----- blocks) or, when no PEM markers are found, a single DER certificate.

verify_certificate_chain

Verify the certificate chain embedded in a CMS SignedData blob (a PDF signature’s /Contents) against anchors.