From 5753f541494aded5d28f6d4ad4320122a4d30d93 Mon Sep 17 00:00:00 2001 From: Brandon Thomas Date: Fri, 9 Oct 2026 19:24:26 -0400 Subject: [PATCH] Fix Windows build: the certificate store's key matches cover #386's new key types #386 added P-521, brainpool and Ed25519 public keys. The Windows-only certificate-store code matched PublicKey exhaustively, so the Windows build failed (E0004) while Linux CI passed. Store keys stay RSA, P-256 and P-384: other keys are skipped when listing identities and refused (Unsupported) when signing. Co-Authored-By: Claude Opus 5.5 --- crates/sign/src/windows.rs | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/crates/sign/src/windows.rs b/crates/sign/src/windows.rs index fa3c5378..2bd70d1c 100644 --- a/crates/sign/src/windows.rs +++ b/crates/sign/src/windows.rs @@ -31,6 +31,8 @@ impl ExternalKey for WindowsKey { PublicKey::P384(_) => p384::ecdsa::Signature::from_slice(&raw) .map(|s| s.to_der().as_bytes().to_vec()) .map_err(|e| SignError::Crypto(format!("CNG returned an invalid P-384 signature: {e}"))), + // `identities` lists only RSA, P-256 and P-384 store keys; anything else can't sign here. + _ => Err(SignError::Unsupported("signing with this key type through the Windows certificate store".into())), } } } @@ -67,6 +69,8 @@ pub fn identities() -> Result, SignError> { PublicKey::Rsa { .. } => key.algorithm_group().is_ok_and(|a| a == AlgorithmGroup::Rsa), PublicKey::P256(_) => key.algorithm_group().is_ok_and(|a| a == AlgorithmGroup::Ecdsa) && key.bits().is_ok_and(|bits| bits == 256), PublicKey::P384(_) => key.algorithm_group().is_ok_and(|a| a == AlgorithmGroup::Ecdsa) && key.bits().is_ok_and(|bits| bits == 384), + // Other keys verify signatures but can't sign through CNG here. + _ => false, }; if !supported { continue;