Expose TrustAnchor -> SubjectPublicKeyInfoDer operation

Author: ctz

src/lib.rs

@@ -89,6 +89,9 @@ pub use {
     },
 };
 
+#[cfg(feature = "alloc")]
+pub use trust_anchor::spki_for_anchor;
+
 #[cfg(feature = "alloc")]
 pub use crl::{OwnedCertRevocationList, OwnedRevokedCert};
 

src/trust_anchor.rs

@@ -1,4 +1,4 @@
-use pki_types::{CertificateDer, TrustAnchor};
+use pki_types::{CertificateDer, SubjectPublicKeyInfoDer, TrustAnchor};
 
 use crate::cert::{Cert, lenient_certificate_serial_number};
 use crate::der;
@@ -43,6 +43,12 @@ pub fn anchor_from_trusted_cert<'a>(
     }
 }
 
+/// Reconstitutes the given trust anchor's SubjectPublicKeyInfo.
+#[cfg(feature = "alloc")]
+pub fn spki_for_anchor(anchor: &TrustAnchor<'_>) -> SubjectPublicKeyInfoDer<'static> {
+    der::asn1_wrap(der::Tag::Sequence, &anchor.subject_public_key_info).into()
+}
+
 /// Parses a v1 certificate directly into a TrustAnchor.
 fn extract_trust_anchor_from_v1_cert_der(
     cert_der: untrusted::Input<'_>,

src/verify_cert.rs

@@ -26,6 +26,8 @@ use crate::crl::RevocationOptions;
 use crate::der::{self, FromDer};
 use crate::end_entity::EndEntityCert;
 use crate::error::Error;
+#[cfg(feature = "alloc")]
+use crate::trust_anchor;
 use crate::{public_values_eq, subject_name};
 
 // Use `'a` for lifetimes that we don't care about, `'p` for lifetimes that become a part of
@@ -220,10 +222,7 @@ impl<'p> VerifiedPath<'p> {
     pub fn issuer_spki(&self) -> SubjectPublicKeyInfoDer<'p> {
         match self.intermediate_certificates().next() {
             Some(issuer) => issuer.subject_public_key_info(),
-            None => SubjectPublicKeyInfoDer::from(der::asn1_wrap(
-                der::Tag::Sequence,
-                self.anchor.subject_public_key_info.as_ref(),
-            )),
+            None => trust_anchor::spki_for_anchor(self.anchor),
         }
     }
 }

tests/integration.rs

@@ -509,3 +509,13 @@ fn no_scts() {
         cert.sct_log_timestamps().collect::<Result<Vec<_>, _>>()
     );
 }
+
+#[cfg(feature = "alloc")]
+#[test]
+fn anchor_spki() {
+    let ca = CertificateDer::from(&include_bytes!("netflix/ca.der")[..]);
+    let anchor = anchor_from_trusted_cert(&ca).unwrap();
+    let spki = webpki::spki_for_anchor(&anchor);
+
+    assert_eq!(Some(&0x30), spki.first()); // starts with SEQUENCE
+}