Milestone 6: root CA generated, snakeoil intermediate embedded, DER parser

Root CA + snakeoil intermediate generated entirely offline
(/home/rajames/CLionProjects/lithosananke-ca/, outside this repo,
private keys chmod 600) per this milestone's own requirement: Ed25519,
root self-signed 20-year validity, intermediate real-CA-signed
(CA:TRUE, pathlen:0), chain verified via openssl.

Snakeoil intermediate embedded as a capsule (capsules/pki/
snakeoil-intermediate.der) -- confirmed the font-capsule precedent
needed zero new infrastructure, any non-.4th file under capsules/
embeds verbatim already.

New x509_ed25519.c: a from-scratch, narrow DER walker (not general
ASN.1/X.509, per this milestone's design decision) extracting the raw
Ed25519 pubkey from a cert's SubjectPublicKeyInfo -- handles the
optional v3 version field, verifies the AlgorithmIdentifier OID is
Ed25519 rather than assuming, handles both DER length forms. Verified
against ground truth: the extracted key from the real embedded cert
matches openssl's own reported pubkey byte-for-byte; refusal path
checked against truncated/garbage/empty/wrong-algorithm (real RSA cert)
input. Compiles clean on all three architectures.

Still open: mkcapsule signing step, wiring ed25519_verify() into
capsule_birth.c's three validate call sites (landing warn-only first,
per decision -- a bug here could stop every capsule from birthing,
including Mama's own, on all three arches), and the BLOCK_MAP.md
signature-status column. Documented in FABRIC-3.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U14ET9CWAtbQMbYqomKgXd

This commit is contained in:

Robert Allan James

2026-08-26 20:55:05 -04:00

co-authored by

Claude Sonnet 5

parent a8692681a8

commit 431bcb1f34

5 changed files with 203 additions and 1 deletions

									
										capsules/BLOCK_MAP.md
									
		+1
		-1
	
												View File
												
				@@ -1,5 +1,5 @@

				# Capsule Block Manifest — Auto-generated

				<!-- Generated by mkcapsule --manifest  2026-08-27T00:36:05Z -->

				<!-- Generated by mkcapsule --manifest  2026-08-27T00:54:08Z -->

				<!-- DO NOT EDIT — re-run mkcapsule --manifest to refresh.  -->

				<!-- Hand-written justifications and immutability notes live  -->

				<!-- in MANIFEST.md alongside this auto-generated index.      -->

capsules/pki/snakeoil-intermediate.der

BIN

View File

Binary file not shown.