feat(xmldsig): parse X509Certificate with x509-parser

[polaz]

Summary

• parse X509Certificate DER bytes with x509-parser during KeyInfo/X509Data parsing
• extract certificate metadata (subject DN, issuer DN, SKI) and SPKI key info (RSA/EC, plus unsupported algorithm OID marker)
• keep unsupported key algorithms as parsed metadata instead of failing the whole KeyInfo parse
• update and extend parse tests to use real fixture certificate DER and add invalid-DER regression

Verification

• cargo check --workspace
• cargo clippy --workspace --all-targets -- -D warnings
• cargo nextest run --workspace
• cargo test --doc --workspace
• cargo build --workspace

[coderabbitai]

Warning

Rate limit exceeded

@polaz has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 4 minutes and 40 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 4 minutes and 40 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 4bfd2a51-8ba7-410e-a45d-d6527521f017

📥 Commits

Reviewing files that changed from the base of the PR and between 89b6536 and bcac24f.

📒 Files selected for processing (1)

• src/xmldsig/parse.rs

📝 Walkthrough

Walkthrough

Adds strict DER parsing of <X509Certificate> elements: extracts subject and issuer DNs, optional SubjectKeyIdentifier, and parses the certificate public key into RSA, EC, or unsupported variants; stores results in a new parsed_certificates field on X509DataInfo.

Changes

Cohort / File(s)

Summary

X.509 Certificate Parsing src/xmldsig/parse.rs

Added parsed_certificates: Vec<ParsedX509Certificate> to X509DataInfo. Introduced ParsedX509Certificate and X509PublicKeyInfo (RSA/EC/Unsupported). Implemented parse_x509_certificate() to DER-parse certificates, extract subject/issuer DNs, optional SubjectKeyIdentifier extension, and parse public keys (RSA modulus/exponent with leading-zero trimming, EC curve OID and point bytes). Updated parse_x509_data_dispatch() to populate parsed certificates and added unit tests replacing dummy DER with a real RSA certificate and asserting invalid DER is rejected.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related issues

• P2-002: parse full X509Data sub-elements in KeyInfo #50: Related work to extend X509Data parsing and store parsed certificate metadata.

Possibly related PRs

• feat(xmldsig): add KeyInfo dispatch parsing #47: Adds initial KeyInfo/X509Data parsing infrastructure that this change extends with DER-level certificate parsing and structured metadata extraction.
• feat(xmldsig): parse full x509data sub-elements #51: Builds X509Data parsing foundations in parse.rs and X509DataInfo; this PR further parses certificate content into typed representations.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 40.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'feat(xmldsig): parse X509Certificate with x509-parser' directly and accurately describes the main change: adding X509Certificate parsing functionality using the x509-parser library during KeyInfo/X509Data parsing.
Description check	✅ Passed	The description is well-related to the changeset, detailing certificate metadata extraction, key algorithm detection, and test updates that align with the code changes in the raw summary.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/p2-003-x509-parser

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

This PR enhances XMLDSig <KeyInfo>/<X509Data> parsing by decoding <X509Certificate> DER bytes with x509-parser, extracting certificate metadata (DNs, SKI) and public key details while preserving metadata for unsupported key algorithms instead of failing the whole parse.

Changes:

• Add ParsedX509Certificate and X509PublicKeyInfo types and store parsed certificate metadata in X509DataInfo.
• Parse <X509Certificate> DER using x509-parser and extract subject/issuer DN, SKI, and SPKI key info (RSA/EC/Unsupported).
• Update tests to use a real PEM fixture certificate and add an invalid-DER regression test.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/xmldsig/parse.rs`:
- Around line 186-188: Add a clear doc comment documenting the parallel-array
invariant between the certificates and parsed_certificates fields: state that
both Vecs have equal length and that entries at the same index correspond to the
same certificate and its parsed representation. Put this comment near the struct
definition (above the struct or above both fields) referencing the field names
certificates and parsed_certificates and the ParsedX509Certificate type so
future maintainers know they must be updated together.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: a3ab81db-0d88-42cc-bf29-948df54746ae

📥 Commits

Reviewing files that changed from the base of the PR and between a591d4c and 89b6536.

📒 Files selected for processing (1)

• src/xmldsig/parse.rs

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.