silk/support/certificate_pem

Profiles: aarch64-apple-darwin, aarch64-unknown-linux-gnu, aarch64-unknown-linux-gnu-no-libc, wasm32-unknown-unknown, x86_64-unknown-linux-gnu, x86_64-unknown-linux-gnu-no-libc.

Internal strict PEM framing and canonical base64 for owned certificate decoders.

Details

The scanner accepts only certificate blocks and ASCII space, tab, CR, and LF separators. It checks complete blocks and byte budgets before allocation. Certificate schema checks belong to the caller.

Import as Pem with import silk.support.certificate_pem { Pem }.

Public declarations: 2.

PemBlock

pub struct PemBlock

One independently owned decoded block and the input position after its END line.

Field bytes

pub bytes: Bytes

The exact decoded bytes, without a claim that they form a certificate.

Field nextOffset

pub nextOffset: usize

The input offset after the END line, including its newline when present.

Pem

pub struct Pem

Internal strict certificate PEM operations.

Associated function Pem.skipWhitespace

pub fn skipWhitespace<'life0>(input: &'life0 [u8], offset: usize) -> usize

Returns the first offset without a space, tab, CR, or LF byte.

Details

An offset at or beyond the input end returns the input length. This operation allocates nothing.

Associated function Pem.decodeNext

pub effect<'life0> fn decodeNext<'life0>(input: &'life0 [u8], offset: usize, limits: DecodeLimits, certificateIndex: usize, totalDerBytes: usize) -> silk/result.Result<silk/support/certificate_pem.PemBlock, silk/certificate.DecodeError> ! OutOfMemoryError ? &mut Allocator

Decodes one strict CERTIFICATE block into owned bytes, with exact byte and certificate limits.

Details

The caller supplies the BEGIN offset, block index, and previously decoded DER byte total. Failures use input offsets and expose no partial bytes. Allocation refusal uses OutOfMemoryError. Complete lexical validation precedes allocation. The caller validates the returned DER schema.

Gotchas

Other well-formed labels are unsupported. Headers, explanatory text, mismatched markers, and noncanonical base64 fail. This operation stops after one END line. The caller must check trailing input or decode further blocks.