Module webizen_x509 

Bounded X.509 helpers for Webizen trust (swarm-2 Track C / D6).

Hard caps: no full root program, no CT, no OCSP, no MDM. Agents must never invent PEMs — only verify principal-enabled material.

Structs

PathVerifyResult

Result of a bounded path check against enabled PEM roots.

Enums

AgentTlsMode

Honesty: how agent TLS is configured.

Functions

agent_tls_mode

pem_to_ders

Split PEM into certificate DER blobs (CERTIFICATE blocks only).

root_cert_store_from_trust

Build a rustls RootCertStore from enabled PEM roots (for agent TLS).

spki_pin_matches

SPKI pin match: leaf SPKI fingerprint equals expected hex (case-insensitive).

spki_sha256_hex

SHA-256 fingerprint of SubjectPublicKeyInfo (SPKI) as lowercase hex.

verify_chain_against_enabled_roots

Verify leaf (and optional intermediates) against enabled PEM roots in the store.