Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x509-cert: builder updates #1001

Merged
merged 9 commits into from
Apr 18, 2023
Merged

x509-cert: builder updates #1001

merged 9 commits into from
Apr 18, 2023

Commits on Apr 18, 2023

  1. x509-cert: builder: implement std::error::Error for Error 

    Without this, x509-cert::builder::Error can not be used in the pattern
of Box<dyn Error>, which is pretty common.

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
    @lumag
    lumag committed Apr 18, 2023
    Configuration menu
    Copy the full SHA
    9d733ea View commit details
    Browse the repository at this point in the history

  2. x509-cert: builder: disable DigitalSignature usage on Root and SubCA … 

    …keys

Per RFC5280, DigitalSignature 'is asserted when the subject public key
is used for verifying digital signatures, other than signatures on
certificates (bit 5) and CRLs (bit 6)'.
Using CA keys to sign random data would definitely be a bad practice and
should be avoided. Thus remove the DigitalSignature keyUsage from these
certificates.

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
    @lumag
    lumag committed Apr 18, 2023
    Configuration menu
    Copy the full SHA
    fec22bc View commit details
    Browse the repository at this point in the history

  3. x509-cert: builder: use DynSignatureAlgorithmIdentifier for S 

    RSA PSS implements DynSignatureAlgorithmIdentifier only for the
SigningKey, not for the verifying key. To allow using CertificateBuilder
with RSA PSS keys require DynSignatureAlgorithmIdentifier implementation
on S rather than on S::VerifyingKey.

This also follows the following logic: verifying key can possibly verify
several kinds of signatures, while for the signing key we must know
exact signature kind and parameters.

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
    @lumag
    lumag committed Apr 18, 2023
    Configuration menu
    Copy the full SHA
    dd9374c View commit details
    Browse the repository at this point in the history

  4. x509-cert: builder: don't require mutability of the signer 

    Signer (unlike SignerMut) is not expected to be mutable. Don't require
mutability of the Signer argument.

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
    @lumag
    lumag committed Apr 18, 2023
    Configuration menu
    Copy the full SHA
    26b0c58 View commit details
    Browse the repository at this point in the history

  5. x509-cert: builder: make keyEncipherment usage optional 

    ECDSA keys can not be used for keyEncipherment. Make this keyUsage bit
optional.

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
    @lumag
    lumag committed Apr 18, 2023
    Configuration menu
    Copy the full SHA
    da6cd22 View commit details
    Browse the repository at this point in the history

  6. x509-cert: test-support/zlint: implement Eq in addition to PartialEq 

    Add Eq to the list of derived traits to make clippy happy.

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
    @lumag
    lumag committed Apr 18, 2023
    Configuration menu
    Copy the full SHA
    77536b3 View commit details
    Browse the repository at this point in the history

  7. x509-cert: don't require signature's 'derive' feature 

    There are no dependencies on the "derive" featue of the signature crate.
Drop it now.

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
    @lumag
    lumag committed Apr 18, 2023
    Configuration menu
    Copy the full SHA
    6d6160b View commit details
    Browse the repository at this point in the history

  8. x509-cert: builder: follow rules from RFC5280 to set certificate's ve… 

    …rsion

Follow the rules from RFC 5280 Section 4.1.2.1 to set the certificate's
version depending on the presence of the extensions and identifiers.

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
    @lumag
    lumag committed Apr 18, 2023
    Configuration menu
    Copy the full SHA
    0032002 View commit details
    Browse the repository at this point in the history

  9. x509-cert/tests/builder: remove extra to_der/from_der conversion 

    Remove unused conversion when building RDN fields.

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
    @lumag
    lumag committed Apr 18, 2023
    Configuration menu
    Copy the full SHA
    e560912 View commit details
    Browse the repository at this point in the history