refactor(crypto): support independent backends and backend-free CA import

Signed-off-by: Varsha Prasad Narsing <varshaprasad96@gmail.com>

Author: varshaprasad96

Cargo.lock

@@ -13,6 +13,8 @@ license = "Apache-2.0"
 repository = "https://github.com/NVIDIA/OpenShell"
 
 [workspace.dependencies]
+# Product backend selection. Consumer crates inherit this choice.
+openshell-crypto = { path = "crates/openshell-crypto", default-features = false, features = ["aws-lc"] }
 # Async runtime
 tokio = { version = "1.43", features = ["full"] }
 
@@ -40,7 +42,7 @@ h2 = "0.4"
 tokio-rustls = { version = "0.26", default-features = false, features = ["logging", "tls12"] }
 rustls = { version = "0.23", default-features = false, features = ["std", "logging", "tls12"] }
 rustls-pemfile = "2"
-rcgen = { version = "0.13", default-features = false, features = ["crypto", "pem", "x509-parser"] }
+rcgen = { version = "0.14.10", default-features = false, features = ["pem"] }
 webpki-roots = "1"
 rustls-native-certs = "0.8"
 

Cargo.toml

@@ -35,12 +35,21 @@ development shells provide static AWS-LC libraries.
 First-party crypto selection lives in `openshell-crypto`: backend-neutral
 primitive traits and protocol adapters preserve existing TLS, PKI, JWT, and
 credential-storage behavior. Application crates enable integration features on
-that crate instead of naming a backend. Process-default initialization preserves
-existing embedder providers; context capability reporting does not attest those
-globals or dependency-owned crypto. OpenSSL and strict FIPS operation are separate
-follow-up work. The crate README defines extension and coverage boundaries.
+that crate instead of naming a backend. The workspace selects the default AWS-LC
+feature centrally. Backend-owned signing keys support fallible export and import;
+rcgen only adapts certificate encoding. Explicit context selection controls
+first-party TLS configuration even after Rustls global initialization. Without
+explicit selection, builders preserve embedder defaults. Capability reporting
+does not attest globals or dependency-owned crypto. This boundary prepares a
+system-OpenSSL backend; its proof of concept, dynamic-link packaging, and strict
+FIPS operation are separate follow-up work. The crate README defines extension and coverage boundaries.
 Digest operations propagate backend failures through JWT and credential key-ID
 generation rather than requiring infallible provider operations.
+Persisted CA metadata is parsed by `openshell-crypto` using `x509-parser`
+without verification features. rcgen's parser feature remains disabled because
+it couples parsing to built-in CSR verification backends. Backend keys implement
+rcgen's signing trait directly; the proxy checks certificate/key matching through
+the selected TLS backend and retains the original CA bytes in certificate chains.
 
 SQLx uses AWS-LC with native certificate roots.
  The server enables

architecture/build.md

@@ -12,7 +12,7 @@ repository.workspace = true
 
 [dependencies]
 openshell-isolation-interface = { path = "../openshell-isolation-interface" }
-sha2 = { workspace = true }
+openshell-crypto = { workspace = true }
 
 [lints]
 workspace = true

crates/openshell-binary-identity/Cargo.toml

@@ -329,11 +329,11 @@ fn executable_path(pid: u32) -> Result<std::path::PathBuf, ResolveError> {
 
 #[cfg(target_os = "linux")]
 fn hash_executable(pid: u32, executable: &mut std::fs::File) -> Result<Sha256Digest, ResolveError> {
-    use sha2::{Digest as _, Sha256};
     use std::io::Read as _;
 
     let path = format!("/proc/{pid}/exe");
-    let mut digest = Sha256::new();
+    let crypto_error = |error| ResolveError::Failed(format!("hash executable: {error}"));
+    let mut digest = openshell_crypto::sha256_digest().map_err(crypto_error)?;
     let mut buffer = [0_u8; 8 * 1024];
     loop {
         let length = executable
@@ -342,9 +342,11 @@ fn hash_executable(pid: u32, executable: &mut std::fs::File) -> Result<Sha256Dig
         if length == 0 {
             break;
         }
-        digest.update(&buffer[..length]);
+        digest.update(&buffer[..length]).map_err(crypto_error)?;
     }
-    format!("{:x}", digest.finalize()).parse()
+    let bytes = digest.finish().map_err(crypto_error)?;
+    let hex: String = bytes.iter().map(|byte| format!("{byte:02x}")).collect();
+    hex.parse()
 }
 
 #[cfg(target_os = "linux")]

crates/openshell-binary-identity/src/lib.rs

@@ -10,7 +10,7 @@ repository.workspace = true
 rust-version.workspace = true
 
 [dependencies]
-openshell-crypto = { path = "../openshell-crypto" }
+openshell-crypto = { workspace = true }
 openshell-core = { path = "../openshell-core", default-features = false }
 bytes = { workspace = true }
 miette = { workspace = true }

crates/openshell-bootstrap/Cargo.toml

@@ -40,7 +40,7 @@ pub fn generate_jwt_key() -> Result<JwtKeyMaterial> {
     let keypair = openshell_crypto::pki::generate_jwt_keypair()
         .into_diagnostic()
         .wrap_err("failed to generate Ed25519 JWT signing key")?;
-    let signing_key_pem = keypair.serialize_pem();
+    let signing_key_pem = keypair.serialize_pem().into_diagnostic()?;
     let public_key_pem = keypair.public_key_pem();
     let kid = kid_from_public_key_der(&keypair.public_key_der())?;
     Ok(JwtKeyMaterial {

crates/openshell-bootstrap/src/jwt.rs

@@ -4,7 +4,7 @@
 use crate::jwt::{JwtKeyMaterial, generate_jwt_key};
 use miette::{IntoDiagnostic, Result, WrapErr};
 use rcgen::{
-    BasicConstraints, CertificateParams, DnType, Ia5String, IsCa, KeyUsagePurpose, SanType,
+    BasicConstraints, CertificateParams, DnType, IsCa, KeyUsagePurpose, SanType, string::Ia5String,
 };
 use std::net::IpAddr;
 
@@ -121,11 +121,11 @@ pub fn generate_pki(extra_sans: &[String]) -> Result<PkiBundle> {
 
     Ok(PkiBundle {
         ca_cert_pem: ca_cert.pem(),
-        ca_key_pem: ca_key.serialize_pem(),
+        ca_key_pem: ca_key.serialize_pem().into_diagnostic()?,
         server_cert_pem: server_cert.pem(),
-        server_key_pem: server_key.serialize_pem(),
+        server_key_pem: server_key.serialize_pem().into_diagnostic()?,
         client_cert_pem: client_cert.pem(),
-        client_key_pem: client_key.serialize_pem(),
+        client_key_pem: client_key.serialize_pem().into_diagnostic()?,
         jwt_signing_key_pem,
         jwt_public_key_pem,
         jwt_key_id,

crates/openshell-bootstrap/src/pki.rs

@@ -15,7 +15,7 @@ name = "openshell"
 path = "src/main.rs"
 
 [dependencies]
-openshell-crypto = { path = "../openshell-crypto", features = ["tls-hyper"] }
+openshell-crypto = { workspace = true, features = ["tls-hyper"] }
 openshell-bootstrap = { path = "../openshell-bootstrap" }
 openshell-core = { path = "../openshell-core", default-features = false }
 openshell-policy = { path = "../openshell-policy" }

crates/openshell-cli/Cargo.toml

@@ -215,7 +215,7 @@ pub fn build_rustls_config(materials: &TlsMaterials) -> Result<rustls::ClientCon
         .into_diagnostic()?;
     let key = load_private_key(&materials.key)?;
 
-    rustls::ClientConfig::builder()
+    openshell_crypto::tls::client_builder()
         .with_root_certificates(roots)
         .with_client_auth_cert(cert_chain, key)
         .into_diagnostic()
@@ -284,7 +284,7 @@ impl ServerCertVerifier for InsecureServerCertVerifier {
     }
 
     fn supported_verify_schemes(&self) -> Vec<rustls::SignatureScheme> {
-        openshell_crypto::tls::provider()
+        openshell_crypto::tls::configuration_provider()
             .signature_verification_algorithms
             .supported_schemes()
     }
@@ -324,7 +324,7 @@ impl tower::Service<hyper::Uri> for InsecureTlsConnector {
 }
 
 pub fn build_insecure_rustls_config() -> Result<rustls::ClientConfig> {
-    let config = rustls::ClientConfig::builder()
+    let config = openshell_crypto::tls::client_builder()
         .dangerous()
         .with_custom_certificate_verifier(std::sync::Arc::new(InsecureServerCertVerifier))
         .with_no_client_auth();