Module x509 

X.509 bridge: scopes in certificate extensions (SIGNATIF §11, scope-encoding and the four-layer scope enforcement).

Layer 1 of the four-layer enforcement: the scope travels as a signed certificate extension. The extension carries the JCS bytes of the ScopeDimensions JSON encoding (deterministic, machine-checkable, extensible — unknown dimensions are carried in the extra map and ignored by verifiers that do not recognize them). Layer 2 is per-link enforcement in crate::graph, layer 3 the pipeline’s condition evaluation, and layer 4 the transparency log recording (see crate::revocation and the log-server’s certificate entries).

Constants

SCOPE_EXTENSION_OID

The private enterprise OID arc for SIGNATIF scope extensions: 2.25.4294967295-style UUID arc is unwieldy; schemes register their own arc under their IANA PEN. The default here uses the Confium PEN placeholder documented in the README.

Functions

authority_node_from_cert

Build a trust-graph node from a certificate: the key is the certificate’s subject public key, the scope comes from the scope extension, and the kind defaults as given (the caller knows roots from the anchor bundle).

decode_scope_extension

Decode a scope from its extension value bytes.

encode_scope_extension

Encode a scope into its deterministic extension value bytes: the JCS canonicalization of the scope’s JSON form.

scope_of

Extract the scope from a certificate’s SIGNATIF extension; the unconstrained scope when the extension is absent (extensibility: verifiers ignore unknown extensions, absent means unconstrained under this bridge’s convention).