From a016f88a908716e965e9905da7632cb136234bb7 Mon Sep 17 00:00:00 2001 From: Dammy196 Date: Sat, 10 Oct 2026 02:55:40 +0200 Subject: [PATCH] Fix non-exhaustive match in Windows signing path (#646) * Fix non-exhaustive match in Windows signing path The PublicKey enum gained P521, BrainpoolP256, BrainpoolP384, BrainpoolP512, and Ed25519 variants, but the Windows-specific match statements in windows.rs were not updated, causing a compile error on Windows builds. Add wildcard arms that return a clean error for unsupported key types. * Windows store: a key type it can't sign with is Unsupported, not a crypto failure --------- Co-authored-by: Brandon Thomas --- crates/sign/src/windows.rs | 3 +++ 1 file changed, 3 insertions(+) diff --git a/crates/sign/src/windows.rs b/crates/sign/src/windows.rs index fa3c53784e..0e49823e69 100644 --- a/crates/sign/src/windows.rs +++ b/crates/sign/src/windows.rs @@ -31,6 +31,8 @@ impl ExternalKey for WindowsKey { PublicKey::P384(_) => p384::ecdsa::Signature::from_slice(&raw) .map(|s| s.to_der().as_bytes().to_vec()) .map_err(|e| SignError::Crypto(format!("CNG returned an invalid P-384 signature: {e}"))), + // `identities` lists only RSA, P-256 and P-384 store keys; anything else can't sign here. + _ => Err(SignError::Unsupported("signing with this key type through the Windows certificate store".into())), } } } @@ -67,6 +69,7 @@ pub fn identities() -> Result, SignError> { PublicKey::Rsa { .. } => key.algorithm_group().is_ok_and(|a| a == AlgorithmGroup::Rsa), PublicKey::P256(_) => key.algorithm_group().is_ok_and(|a| a == AlgorithmGroup::Ecdsa) && key.bits().is_ok_and(|bits| bits == 256), PublicKey::P384(_) => key.algorithm_group().is_ok_and(|a| a == AlgorithmGroup::Ecdsa) && key.bits().is_ok_and(|bits| bits == 384), + _ => false, }; if !supported { continue;