nx_x509_trust_store_load.nx

nx_x509_trust_store_load.nx -- bulk-load a TrustStore from a length-prefixed bundle of DER certificates. Phase 0b §I.4 piece 10 of the chain-walker arc. The data- loader that turns "embedded CA root bytes" into "ready-to-use trust store". Format-agnostic about how the bundle was produced (Mozilla NSS certdata.txt parser, hand-curated DER blobs, etc.) -- as long as the input matches the layout below, the loader handles the rest. Bundle wire format: [2 bytes BE] cert_count N for each i in 0..N: [3 bytes BE] cert_len_i [cert_len_i bytes] cert_DER_i Total bundle bytes = 2 + sum_i (3 + cert_len_i). For each cert in the bundle: - x509_parse against the cert bytes (caller's bundle_buf at the appropriate offset) - trust_store_add(store, &cert_bytes, parsed_cert) - If parse fails, the loader returns BAD_CERT and the store is partially populated (caller can inspect trust_store_count to see how many succeeded before the failure). Why a custom wire format (vs. NSS certdata.txt): - Sovereign: parser is bits-up + small. - certdata.txt is a complex text format requiring tokenization and base64 decoding. Parsing it bits-up is a separate primitive (queued: nx_nss_certdata_parse.nx). The wire format here is what that parser would emit; or the user can hand-build it from raw DER blobs. Public API: nx_x509_trust_store_load(bundle_buf, bundle_len, store) -> verdict nx_x509_trust_store_load_verdict_is_valid(v) -> 0|1