shifathosn
/
pdfcraft
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix Windows build: the certificate store's key matches cover #386's new key types 

#386 added P-521, brainpool and Ed25519 public keys. The Windows-only
certificate-store code matched PublicKey exhaustively, so the Windows
build failed (E0004) while Linux CI passed. Store keys stay RSA, P-256
and P-384: other keys are skipped when listing identities and refused
(Unsupported) when signing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Brandon Thomas 2026-10-09 19:24:26 -04:00
parent dc4b3eee84
commit 5753f54149
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
crates/sign/src/windows.rs
View File

@ -31,6 +31,8 @@ impl ExternalKey for WindowsKey {
PublicKey::P384(_) => p384::ecdsa::Signature::from_slice(&raw)
.map(|s| s.to_der().as_bytes().to_vec())
.map_err(|e| SignError::Crypto(format!("CNG returned an invalid P-384 signature: {e}"))),
// `identities` lists only RSA, P-256 and P-384 store keys; anything else can't sign here.
_ => Err(SignError::Unsupported("signing with this key type through the Windows certificate store".into())),
}
}
}
@ -67,6 +69,8 @@ pub fn identities() -> Result<Vec<DigitalId>, SignError> {
PublicKey::Rsa { .. } => key.algorithm_group().is_ok_and(|a| a == AlgorithmGroup::Rsa),
PublicKey::P256(_) => key.algorithm_group().is_ok_and(|a| a == AlgorithmGroup::Ecdsa) && key.bits().is_ok_and(|bits| bits == 256),
PublicKey::P384(_) => key.algorithm_group().is_ok_and(|a| a == AlgorithmGroup::Ecdsa) && key.bits().is_ok_and(|bits| bits == 384),
// Other keys verify signatures but can't sign through CNG here.
_ => false,
};
if !supported {
continue;