* support X.509 certificate PSS signing no CSR, CRL, etc * handle PSS.(MAX_LENGTH, DIGEST_LENGTH), review feedback * name the kwarg * test improvements * skip if sha3 isn't supported
This matter models how x.509 represents these things, and will make it easier to make Extensions an iterator in the future
* certificate: add a `get_extension` helper Signed-off-by: William Woodruff <william@trailofbits.com> * certificate: OID by ref Signed-off-by: William Woodruff <william@trailofbits.com> * certificate: syntax Signed-off-by: William Woodruff <william@trailofbits.com> * x509, src: `check_duplicate_extensions` Signed-off-by: William Woodruff <william@trailofbits.com> * src: simplify Signed-off-by: William Woodruff <william@trailofbits.com> * src: everyone loves newtypes Signed-off-by: William Woodruff <william@trailofbits.com> * rust: refactor-o-rama Signed-off-by: William Woodruff <william@trailofbits.com> * src: look upon my works Signed-off-by: William Woodruff <william@trailofbits.com> * src: continue blasting the code Signed-off-by: William Woodruff <william@trailofbits.com> * src/rust: actually commit my changes Signed-off-by: William Woodruff <william@trailofbits.com> * src: clippage Signed-off-by: William Woodruff <william@trailofbits.com> * relocate Signed-off-by: William Woodruff <william@trailofbits.com> * src: dedupe Signed-off-by: William Woodruff <william@trailofbits.com> * src: cleanup Signed-off-by: William Woodruff <william@trailofbits.com> * clippage Signed-off-by: William Woodruff <william@trailofbits.com> * src: dedupe Signed-off-by: William Woodruff <william@trailofbits.com> * common: cleanup Signed-off-by: William Woodruff <william@trailofbits.com> * src: unused impls Signed-off-by: William Woodruff <william@trailofbits.com> * more deletion Signed-off-by: William Woodruff <william@trailofbits.com> * clippage Signed-off-by: William Woodruff <william@trailofbits.com> * extensions: add a `get_extension` test Signed-off-by: William Woodruff <william@trailofbits.com> * extensions: unused derives Signed-off-by: William Woodruff <william@trailofbits.com> * tests/x509: dup ext check for tbs_precertificate_bytes Signed-off-by: William Woodruff <william@trailofbits.com> * certificate: remove `extensions()` Signed-off-by: William Woodruff <william@trailofbits.com> * extensions: docs Signed-off-by: William Woodruff <william@trailofbits.com> * extensions: newtype Signed-off-by: William Woodruff <william@trailofbits.com> * rust: better error types, dedupe Signed-off-by: William Woodruff <william@trailofbits.com> extensions: unwrap -> expect Signed-off-by: William Woodruff <william@trailofbits.com> * Revert "rust: better error types, dedupe" This reverts commit 212b75ff2f69a3b3cfc9d6a55949f23877f8f618. --------- Signed-off-by: William Woodruff <william@trailofbits.com>
this allows easier verification of cert signatures, but more specifically allows PSS signature verification
Bumps [asn1](https://github.com/alex/rust-asn1) from 0.15.1 to 0.15.2. - [Commits](https://github.com/alex/rust-asn1/compare/0.15.1...0.15.2) --- updated-dependencies: - dependency-name: asn1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* invalid visible string support this allows utf8 in visiblestring, which is not valid DER. we raise a warning when this happens, but allow it since belgian eIDs, among others, have encoding errors. Belgium fixed this by 2021 (and possibly earlier), but their eID certificates have 10 year validity. * review comments * clippy
Also fix a test that had an incorrect parameters for an OID. The test had deliberately been constructed to be invalid, but in a _different_ respect.
I had hoped the parameters would just be Null (no Option<>), but a review of the RFC (3447, 4055) indicates that both should be allowed, though the WebPKI enforces greater constraints.