Problem
The signing-key abstraction currently exposes sign() and raw SPKI bytes, but public-key metadata is still ad hoc. KeyInfo writers and future signing APIs need a structured way to inspect the public key corresponding to the private signing key.
Current code analysis
src/xmldsig/sign.rs defines SigningKey::sign() and SigningKey::public_key_spki_der().
- RSA, ECDSA P-256, and ECDSA P-384 signing keys implement the trait.
X509CertificateKeyInfoWriter uses raw SPKI DER only to reject certificate/key mismatches.
- There is no structured public-key info return value for callers or future KeyInfo writers.
Solution
- Add structured public-key metadata to the signing-key abstraction.
- Preserve object safety for
SignContext and KeyInfoWriter.
- Return enough metadata to distinguish RSA and ECDSA keys and expose SPKI DER without reparsing private keys.
- Keep existing signing behavior unchanged for RSA-SHA256/SHA384/SHA512 and ECDSA P-256/P-384.
- Add tests for public-key info on RSA, P-256, and P-384, unsupported algorithm errors, and certificate/key mismatch behavior after the API change.
Acceptance Criteria
SigningKey exposes signing plus structured public-key information.
- RSA/P-256/P-384 concrete signing keys implement the full trait.
X509CertificateKeyInfoWriter uses the structured public-key info path, not an ad-hoc raw method.
- Existing sign/verify round-trips continue to pass.
cargo fmt -- --check, cargo check --all-features, cargo clippy --all-targets --all-features -- -D warnings, cargo nextest run --all-features, and cargo test --doc --all-features pass.
Problem
The signing-key abstraction currently exposes
sign()and raw SPKI bytes, but public-key metadata is still ad hoc. KeyInfo writers and future signing APIs need a structured way to inspect the public key corresponding to the private signing key.Current code analysis
src/xmldsig/sign.rsdefinesSigningKey::sign()andSigningKey::public_key_spki_der().X509CertificateKeyInfoWriteruses raw SPKI DER only to reject certificate/key mismatches.Solution
SignContextandKeyInfoWriter.Acceptance Criteria
SigningKeyexposes signing plus structured public-key information.X509CertificateKeyInfoWriteruses the structured public-key info path, not an ad-hoc raw method.cargo fmt -- --check,cargo check --all-features,cargo clippy --all-targets --all-features -- -D warnings,cargo nextest run --all-features, andcargo test --doc --all-featurespass.