aleleba/pdfcraft
1
0
Fork 0
mirror of https://github.com/storytold/pdfcraft.git synced 2026-10-31 05:28:09 -06:00
Code Issues Packages Projects Releases Wiki Activity

Fix non-exhaustive match in Windows signing path (#646)

Browse Source 
* Fix non-exhaustive match in Windows signing path

The PublicKey enum gained P521, BrainpoolP256, BrainpoolP384, BrainpoolP512, and Ed25519 variants, but the Windows-specific match statements in windows.rs were not updated, causing a compile error on Windows builds.

Add wildcard arms that return a clean error for unsupported key types.

* Windows store: a key type it can't sign with is Unsupported, not a crypto failure

---------

Co-authored-by: Brandon Thomas <echelon@gmail.com>
This commit is contained in:
Dammy196
2026-10-09 20:55:40 -04:00
committed by GitHub
co-authored by Brandon Thomas
parent c110c579a2
commit a016f88a90
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/sign/src/windows.rs
+3
View File
@@ -31,6 +31,8 @@ impl ExternalKey for WindowsKey {
PublicKey::P384(_) => p384::ecdsa::Signature::from_slice(&raw)
.map(|s| s.to_der().as_bytes().to_vec())
.map_err(|e| SignError::Crypto(format!("CNG returned an invalid P-384 signature: {e}"))),
// `identities` lists only RSA, P-256 and P-384 store keys; anything else can't sign here.
_ => Err(SignError::Unsupported("signing with this key type through the Windows certificate store".into())),
}
}
}
@@ -67,6 +69,7 @@ pub fn identities() -> Result<Vec<DigitalId>, SignError> {
PublicKey::Rsa { .. } => key.algorithm_group().is_ok_and(|a| a == AlgorithmGroup::Rsa),
PublicKey::P256(_) => key.algorithm_group().is_ok_and(|a| a == AlgorithmGroup::Ecdsa) && key.bits().is_ok_and(|bits| bits == 256),
PublicKey::P384(_) => key.algorithm_group().is_ok_and(|a| a == AlgorithmGroup::Ecdsa) && key.bits().is_ok_and(|bits| bits == 384),
_ => false,
};
if !supported {
continue;