code wiki / _hdl_build / nx_x509_trust_root_kat.nx

nx_x509_trust_root_kat.nx

buildroot/runtime/_hdl_build/nx_x509_trust_root_kat.nx

6660 B112 linesdepth 9pulls 28 transitivereach 0 importersview sourcekind tooltopic x509
docsdependenciesstructsconstsfunctions

about

nx_x509_trust_root_kat.nx -- the RSA-verify crypto gate the ECDSA fixture couldn't provide (HONESTY SYSTEM follow-up 2026-07-16). A self-signed ROOT's signature is over its own TBS with its own key, so it verifies under its OWN extracted public key -- a self-contained RSA KAT needing NO chain-splitting and NO external vector. We load the REAL Mozilla bundle (data/mozilla_certdata.txt), find real RSA-2048 (sig=256) and RSA-4096 (sig=512) roots, and prove: extract issuer key -> self-verify -> OK ; corrupt a byte -> FAIL. This directly exercises (with real crypto that CANNOT fake-green) all four flagged organs: nx_x509_pubkey_extract_rsa, nx_x509_verify_rsa_pkcs1_sha256, + the _4096 pair. license_tier: ORIGINAL expect_exit:0

dependencies 8 imports · 0 importers

nx_syscalls.nx nx_x509.nx nx_x509_trust_store.nx nx_trust_store_load_from_certdata. nx_x509_pubkey_rsa.nx nx_x509_verify_rsa_pkcs1_sha256.nx nx_x509_pubkey_rsa_4096.nx nx_x509_verify_rsa_pkcs1_sha256_40 nx_x509_trust_root_kat.nx

imports: nx_syscalls.nxnx_x509.nxnx_x509_trust_store.nxnx_trust_store_load_from_certdata.nxnx_x509_pubkey_rsa.nxnx_x509_verify_rsa_pkcs1_sha256.nxnx_x509_pubkey_rsa_4096.nxnx_x509_verify_rsa_pkcs1_sha256_4096.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main nx_trust_store_load_from_c sys_mmap sys_read_file sys_openat_rd sys_lseek sys_mmap ↻ sys_read sys_close nx_nss_certdata_parse sys_mmap ↻ _pat_class_cert _pat_value_octal _pat_end _find_newline _starts_with _parse_octal_line sys_mmap ↻ _is_space _decode_octal_escape _is_octal trust_store_alloc sys_mmap ↻ nx_x509_trust_store_load sys_mmap ↻ x509_parse sys_mmap ↻ asn1_cursor_init asn1_expect_tag sys_mmap ↻ asn1_read_tlv_header asn1_read_tag asn1_read_length asn1_read_length ↻ x509_read_tlv sys_mmap ↻ asn1_expect_tag ↻ x509_read_alg_id sys_mmap ↻ asn1_expect_tag ↻

structs

none

consts

21const ANCHOR_STRIDE: i64 = 16 // TrustAnchor = { buf:*u8, cert:*X509Cert } = two 8-byte pointers

functions

18func kw(s: *u8) -> i64 { var n:i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
called by 1: main calls 1: sys_write
19func kn(v: i64) -> i64 { let b:*u8=sys_mmap(24); var m:i64=v; if m<0{sys_write(1,"-" as *u8,1);m=0-m} let t:*u8=sys_mmap(24); var k:i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var j:i64=0; while j<k{b[j]=t[k-1-j];j=j+1} sys_write(1,b,k); return 0 }
called by 1: main calls 2: sys_mmapsys_write
23func main() -> i64
calls 10: nx_trust_store_load_from_certdatakwknsys_mmapnx_x509_pubkey_extract_rsanx_x509_verify_rsa_pkcs1_sha256+4