Skip to content

feat: complete SigningKey public key abstraction #84

Description

@polaz

Problem

The signing-key abstraction currently exposes sign() and raw SPKI bytes, but public-key metadata is still ad hoc. KeyInfo writers and future signing APIs need a structured way to inspect the public key corresponding to the private signing key.

Current code analysis

  • src/xmldsig/sign.rs defines SigningKey::sign() and SigningKey::public_key_spki_der().
  • RSA, ECDSA P-256, and ECDSA P-384 signing keys implement the trait.
  • X509CertificateKeyInfoWriter uses raw SPKI DER only to reject certificate/key mismatches.
  • There is no structured public-key info return value for callers or future KeyInfo writers.

Solution

  • Add structured public-key metadata to the signing-key abstraction.
  • Preserve object safety for SignContext and KeyInfoWriter.
  • Return enough metadata to distinguish RSA and ECDSA keys and expose SPKI DER without reparsing private keys.
  • Keep existing signing behavior unchanged for RSA-SHA256/SHA384/SHA512 and ECDSA P-256/P-384.
  • Add tests for public-key info on RSA, P-256, and P-384, unsupported algorithm errors, and certificate/key mismatch behavior after the API change.

Acceptance Criteria

  • SigningKey exposes signing plus structured public-key information.
  • RSA/P-256/P-384 concrete signing keys implement the full trait.
  • X509CertificateKeyInfoWriter uses the structured public-key info path, not an ad-hoc raw method.
  • Existing sign/verify round-trips continue to pass.
  • cargo fmt -- --check, cargo check --all-features, cargo clippy --all-targets --all-features -- -D warnings, cargo nextest run --all-features, and cargo test --doc --all-features pass.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions