mirror of
https://github.com/storytold/craft-libs.git
synced 2026-11-14 22:42:46 +00:00
Dylan M. Taylorandjonathanwxh-cell
1c5c8a4e14
* Add craft-pkcs7: DER, X.509, CMS SignedData, PKCS #12, RFC 3161 and revocation from PdfCraft Moved from PdfCraft's crates/sign at 1d7a9f9f: der, x509, cms, pkcs12, timestamp, revocation, keys, rsa_pad and ec512, with their unit tests, the integration tests that need no PDF, and the test keys. x509 no longer returns PdfCraft's worded sentences: signing_problem gives a SigningProblem and build_chain_noted a Refused (reason and the two certificates). The checks behind them are unchanged. Error is SignError without its PDF variants. * craft-pkcs7: write the certificate serial verbatim in SignerInfo and ESSCertIDv2 A serial with its high bit set and no leading zero was written with one added, so the signer identifier and the signing-certificate attribute named a different number than the certificate has. Ported from storytold/pdfcraft#6868. The test uses a certificate that really has such a serial and also checks that the signer's certificate is found. * craft-pkcs7: note why RIPEMD-160 is supported --------- Co-authored-by: jonathanwxh-cell <jonathanwxh@gmail.com>
54 lines
2.3 KiB
TOML
54 lines
2.3 KiB
TOML
[package]
|
|
name = "craft-pkcs7"
|
|
description = "The formats of digital signatures: ASN.1 DER, X.509 certificates and chains, CMS SignedData (PKCS #7), PKCS #12 identity files, RFC 3161 timestamps, and CRL / OCSP revocation evidence, read, verified and written."
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
rust-version.workspace = true
|
|
repository.workspace = true
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
# Every dependency here is MIT OR Apache-2.0 (RustCrypto, base64, chrono, thiserror), except
|
|
# ed25519-dalek (BSD-3-Clause) and aws-lc-rs (ISC AND (Apache-2.0 OR ISC)), all on the allowlist.
|
|
[dependencies]
|
|
thiserror = { workspace = true }
|
|
zeroize = "1"
|
|
# ASN.1 UTCTime/GeneralizedTime conversion goes through chrono (no hand-rolled calendar code).
|
|
chrono = { workspace = true }
|
|
base64 = "0.23"
|
|
sha1 = "0.11"
|
|
sha2 = "0.11"
|
|
sha3 = "0.12.0"
|
|
ripemd = "0.2.0"
|
|
p256 = { version = "0.14", default-features = false, features = ["ecdsa", "std"] }
|
|
p384 = { version = "0.14", default-features = false, features = ["ecdsa", "std"] }
|
|
# Verification only: P-521 and the Brainpool curves German qualified-signature cards use.
|
|
p521 = { version = "0.14", default-features = false, features = ["ecdsa", "std"] }
|
|
bp256 = { version = "0.14", default-features = false, features = ["arithmetic", "ecdsa", "std"] }
|
|
bp384 = { version = "0.14", default-features = false, features = ["arithmetic", "ecdsa", "std"] }
|
|
ecdsa = { version = "0.17", default-features = false, features = ["algorithm", "der"] }
|
|
ed25519-dalek = "3.0.0"
|
|
# Verification only on native targets (RSA private-key operations use aws-lc-rs).
|
|
crypto-bigint = { version = "0.7.11", default-features = false, features = ["alloc"] }
|
|
rsa = { version = "=0.10.0-rc.18", default-features = false, features = ["std", "hazmat"] }
|
|
pbkdf2 = { version = "0.13", default-features = false, features = ["hmac"] }
|
|
hmac = "0.13"
|
|
aes = "0.9"
|
|
cbc = { version = "0.2", features = ["alloc", "block-padding"] }
|
|
des = "0.9"
|
|
rc2 = "0.9"
|
|
|
|
[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
|
|
aws-lc-rs = { version = "1.18", default-features = false, features = ["aws-lc-sys", "prebuilt-nasm"] }
|
|
getrandom = "0.4"
|
|
|
|
[target.'cfg(target_arch = "wasm32")'.dependencies]
|
|
# crypto-bigint asks for randomness; in the browser it comes from Web Crypto.
|
|
getrandom = { version = "0.4", features = ["wasm_js"] }
|
|
|
|
[[test]]
|
|
name = "it"
|
|
path = "tests/it/main.rs"
|