feat: integrate credential generators and X.509 identities

[domenkozar]

Credential generators from #417 merged into a feature branch after its parent PR had landed, leaving x509_identity and the other additional types unavailable on main. Integrate those generators with the current resolver and native SDKs, using Rust certificate and PKCS#12 libraries for X.509 operations.

• Add passphrase, BIP-39 mnemonic, WireGuard, JWK, age, and self-signed P-256 X.509 generation.
• Resolve from conversions, JSON/INI selections, and typed password credentials through the shared dependency graph. Support PEM/DER keys and certificates, certificate chains, and password-protected PKCS#12 archives while preserving scoped output, file ownership, and credential refresh deadlines.
• Replace vendored OpenSSL with rcgen, x509-parser, and p12-keystore. Certificate crypto uses the existing AWS-LC backend. Import RSA, P-256, P-384, P-521, and Ed25519 keys; consume every certificate bag and reject unrelated, duplicate, or ambiguous chains. Export AES-256-CBC/PBKDF2-HMAC-SHA-256 archives with a SHA-256 MAC and 100,000 iterations.
• Use published p12-keystore 0.4.0, which includes the upstream bag-preservation fix. Passwords currently support the Unicode Basic Multilingual Plane. Reject supplementary characters with a value-free credential error until RustCrypto/formats#2477 ships.
• Remove OpenSSL-specific Windows Haskell build setup and serialize provider paths in the credential-deadline test so Windows backslashes cannot break its TOML manifest. Mark new surfaces as 0.22+, retain 0.21+ labels for released OpenPGP/SSH generation, and update the schema, changelog, and release instructions.

RELEASE.md records the registry packaging and SDK CI checks to run before publishing 0.22, plus the supplementary-Unicode follow-up. There is no Git dependency in the final manifest or lockfile.

Validation on the pinned Rust 1.92 toolchain:

CI passed on the final PR head: Rust tests on Ubuntu, macOS, and Windows; feature and package checks; documentation; the language SDK suite and Swift SDK; and Haskell builds on Linux and Windows.

• cargo test --workspace --exclude secretspec-php-native --offline: passed, including 1,813 core tests (four ignored), derive compile-fail snapshots, IPC conformance, integration tests, native bindings, and doctests. The PHP extension is excluded as in native CI.
• cargo check -p secretspec --no-default-features --offline: passed.
• Repository prek run -a hooks: passed, including full-workspace Clippy with PHP headers and rustfmt.
• Documentation build and link check: 99 pages, zero diagnostics, zero broken links.
• cargo package -p secretspec --allow-dirty --no-verify --offline: passed. Full package verification resolves the new archive API, then fails on the existing MAX_JSON_INTEGER references because the published secretspec-ipc 0.21.1 predates current main. Publish the matching IPC crate first and rerun verification as documented in RELEASE.md.
• Final registry dependency checks: interoperability tests passed with p12-keystore 0.4.0 and the supported ChaCha20 0.10.2 patch. The registry crate checksum matches the index, and its sources match the tested upstream fix.
• OpenSSL-generated import fixtures cover every supported key type, legacy 3DES, and BMP passwords. Independent OpenSSL CLI verification of Rust exports confirms encryption/MAC settings, matching keys, SAN/EKU constraints, owner-only files, wrong-password rejection, and persistent stored identities.
• After synchronizing with main, the credential-deadline test and configuration schema/warning tests passed. The Windows fixture now escapes provider paths through TOML serialization.
• Active Linux and Windows MSVC dependency graphs contain no OpenSSL.

Fixes #481. Implements the X.509 backend transition tracked in #484; supplementary-Unicode support remains an upstream release follow-up.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	secretspec	0e9dd84	Commit Preview URL Branch Preview URL	Oct 10 2026, 09:36 AM