[package]
name = "pdfcraft-sign"
description = "Digital signatures (ISO 32000-2 §12.8, PAdES): X.509, CMS, PKCS #12, signing and validation"
version.workspace = true
edition.workspace = true
license.workspace = true
rust-version.workspace = true
repository.workspace = true

[lints]
workspace = true

[dependencies]
pdfcraft-cos = { workspace = true }
pdfcraft-annot = { workspace = true }
pdfcraft-fonts = { workspace = true }
thiserror.workspace = true
base64 = "0.22"
sha1 = "0.11"
sha2 = "0.11"
p256 = { version = "0.14", default-features = false, features = ["ecdsa", "std"] }
p384 = { version = "0.14", default-features = false, features = ["ecdsa", "std"] }
# Verification only: P-521 and the Brainpool curves German qualified-signature cards use.
p521 = { version = "0.14", default-features = false, features = ["ecdsa", "std"] }
bp256 = { version = "0.14", default-features = false, features = ["arithmetic", "ecdsa", "std"] }
bp384 = { version = "0.14", default-features = false, features = ["arithmetic", "ecdsa", "std"] }
ecdsa = { version = "0.17", default-features = false, features = ["algorithm", "der"] }
# Verification only on native targets (RSA private-key operations use aws-lc-rs, ADR-0009).
crypto-bigint = { version = "0.7", default-features = false, features = ["alloc"] }
rsa = { version = "=0.10.0-rc.18", default-features = false, features = ["std", "hazmat"] }
pbkdf2 = { version = "0.13", default-features = false, features = ["hmac"] }
hmac = "0.13"
aes = "0.9"
cbc = { version = "0.2", features = ["alloc", "block-padding"] }
des = "0.9"
rc2 = "0.9"
sha3 = "0.12.0"
ripemd = "0.2.0"
ed25519-dalek = "3.0.0"

[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
aws-lc-rs = { version = "1.18", default-features = false, features = ["aws-lc-sys", "prebuilt-nasm"] }
getrandom = "0.4"

[target.'cfg(target_os = "windows")'.dependencies]
# Safe Windows certificate store and CNG signing wrappers (MIT OR Apache-2.0).
rustls-cng = { version = "0.7.1", default-features = false }

[target.'cfg(target_os = "macos")'.dependencies]
# Signing with Keychain identities (MIT OR Apache-2.0).
security-framework = "3.7"

[target.'cfg(target_arch = "wasm32")'.dependencies]
# crypto-bigint asks for randomness; in the browser it comes from Web Crypto.
getrandom = { version = "0.4", features = ["wasm_js"] }