nx_x509_trust_store.nx

nx_x509_trust_store.nx -- trust anchor store + subject-DN lookup. Phase 0b §I.4 piece 9 of the chain-walker arc. Provides the data structure + lookup helper for cert chain validation's trust-anchor input. Model: A trust store holds an array of TrustAnchor entries. Each entry pairs a subject DN (full DER-encoded Name SEQUENCE bytes, byte-equality matchable) with a parsed X509Cert struct + its backing DER buffer that the chain walker uses as the "root" cert. Lookup: given the LAST cert in a peer's presented chain (the one signed by a CA), find its issuer DN, then search the store for a TrustAnchor whose subject DN byte-equals that issuer DN. If found -> caller has its trust anchor. If not -> chain terminates outside the trust store (UNTRUSTED). Why subject-DN-keyed lookup: - RFC 5280 §6.1.1 says the trust anchor is identified by its issuer DN matching the next cert's subject DN. - Indexing by full DER bytes (vs. parsing into a canonical form first) keeps the primitive sovereign + simple. Real CAs emit byte-equal DN encodings in matched pairs. - For multi-megabyte CA bundles a hash-table or binary tree would be needed; current linear scan is adequate for the Mozilla NSS bundle (~150 roots) at qemu speed. Public API: struct TrustAnchor { buf: *u8, DER cert buffer cert: *X509Cert, already-parsed cert } trust_store_alloc(max_n) -> *TrustStore trust_store_add(store, buf, cert) -> verdict trust_store_lookup_by_subject(store, dn_buf, dn_off, dn_len) -> *TrustAnchor (or NULL if not found) trust_store_count(store) -> i64 Sealed verdict enum for the add path: