Keystore Core
The Signer trait, the KeyStore trait, KeyEntry, and SignatureAlgorithm — the always-compiled contract every backend implements
Every backend in Mudrit — bundled or your own — implements two small traits from mudrit_keystore:
Signer produces a signature, and KeyStore discovers
one. Both, plus KeyEntry and SignatureAlgorithm, are compiled
in regardless of which backend features are enabled — even mudrit-pdfsign with
default-features = false still has them.
The Signer trait
pub trait Signer: Send {
fn certificate(&self) -> &[u8];
fn chain(&self) -> &[Vec<u8>];
fn sign(&self, data: &[u8]) -> Result<Vec<u8>>;
fn algorithm(&self) -> SignatureAlgorithm { SignatureAlgorithm::RsaPkcs1Sha256 }
fn subject(&self) -> (String, String) { /* (CN, O) from certificate() */ }
}Prop
Type
Only certificate, chain, and sign are mandatory; algorithm and subject have default
implementations and are overridden only when a backend needs to. For token / store backends, sign
is where a PIN prompt may appear — the private key never leaves the device.
Send, but not Sync
Signer requires Send — a signer (including a Box<dyn Signer> returned by a KeyStore) can be
moved across threads; every bundled backend satisfies it. It intentionally does not require
Sync: a live PKCS#11 session is Send but not safely shareable by reference across threads, so
a single signer must stay on one thread at a time. Parallel paths (sign_batch, the async wrappers)
add an explicit + Sync bound at the use site instead of forcing it on every implementation.
The KeyStore trait
pub trait KeyStore {
fn aliases(&self) -> Result<Vec<KeyEntry>>;
fn signer(&self, alias: &str) -> Result<Box<dyn Signer>>;
}Prop
Type
KeyStore sits above Signer — Java-KeyStore-style discovery. PfxKeyStore exposes exactly
one entry (alias "0"); Pkcs11KeyStore and WinStoreKeyStore may expose several. See
Backends for each concrete KeyStore implementation.
KeyEntry
One discoverable key — enough to render a choice to the user.
Prop
Type
SignatureAlgorithm
The signature scheme a Signer produces — RSA PKCS#1 v1.5, RSA-PSS, or ECDSA, each over SHA-256,
SHA-384, or SHA-512. #[non_exhaustive]; Default is RsaPkcs1Sha256.
Prop
Type
Four methods drive how the CMS layer treats a variant:
Prop
Type
use mudrit_pdfsign::prelude::*;
let alg = SignatureAlgorithm::RsaPssSha384;
assert!(alg.is_pss() && !alg.is_ecdsa());
let digest = alg.digest(b"hello"); // SHA-384 of the bytesSee Algorithms for the CMS signatureAlgorithm mapping and the
per-backend support matrix.