20260418 优化去掉冗余存储repo object，mix quick最快170s

src/data_model/signed_object.rs

@@ -4,17 +4,27 @@ use crate::data_model::oid::{
     OID_CMS_ATTR_MESSAGE_DIGEST, OID_CMS_ATTR_MESSAGE_DIGEST_RAW, OID_CMS_ATTR_SIGNING_TIME,
     OID_CMS_ATTR_SIGNING_TIME_RAW, OID_CT_ASPA, OID_CT_ASPA_RAW, OID_CT_ROUTE_ORIGIN_AUTHZ,
     OID_CT_ROUTE_ORIGIN_AUTHZ_RAW, OID_CT_RPKI_MANIFEST, OID_CT_RPKI_MANIFEST_RAW,
-    OID_RSA_ENCRYPTION, OID_RSA_ENCRYPTION_RAW, OID_SHA256, OID_SHA256_RAW,
+    OID_KEY_USAGE_RAW, OID_RSA_ENCRYPTION, OID_RSA_ENCRYPTION_RAW, OID_SHA256, OID_SHA256_RAW,
     OID_SHA256_WITH_RSA_ENCRYPTION, OID_SHA256_WITH_RSA_ENCRYPTION_RAW, OID_SIGNED_DATA,
     OID_SIGNED_DATA_RAW, OID_SUBJECT_INFO_ACCESS,
 };
 use crate::data_model::rc::{ResourceCertificate, SubjectInfoAccess};
 use asn1_rs::{Any, Class, FromBer, Header, Tag};
 use ring::digest;
-use x509_parser::prelude::FromDer;
+use x509_parser::extensions::ParsedExtension;
+use x509_parser::prelude::{FromDer, X509Certificate};
 use x509_parser::public_key::PublicKey;
 use x509_parser::x509::SubjectPublicKeyInfo;
 
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum EeKeyUsageSummary {
+    DigitalSignatureOnly,
+    Missing,
+    NotCritical,
+    InvalidBits,
+    ParseError(String),
+}
+
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct ResourceEeCertificate {
     pub raw_der: Vec<u8>,
@@ -22,6 +32,9 @@ pub struct ResourceEeCertificate {
     pub spki_der: Vec<u8>,
     pub rsa_public_modulus: Vec<u8>,
     pub rsa_public_exponent: Vec<u8>,
+    pub tbs_certificate_der: Vec<u8>,
+    pub signature_bytes: Vec<u8>,
+    pub key_usage_summary: EeKeyUsageSummary,
     pub sia_signed_object_uris: Vec<String>,
     pub resource_cert: ResourceCertificate,
 }
@@ -726,6 +739,15 @@ fn parse_signer_infos_set_cursor(
 }
 
 fn validate_ee_certificate(der: &[u8]) -> Result<ResourceEeCertificate, SignedObjectValidateError> {
+    let (rem, cert) = X509Certificate::from_der(der)
+        .map_err(|e| SignedObjectValidateError::EeCertificateParse(e.to_string()))?;
+    if !rem.is_empty() {
+        return Err(SignedObjectValidateError::EeCertificateParse(format!(
+            "trailing bytes after EE certificate DER: {}",
+            rem.len()
+        )));
+    }
+
     let rc = match ResourceCertificate::from_der(der) {
         Ok(v) => v,
         Err(e) => {
@@ -800,11 +822,49 @@ fn validate_ee_certificate(der: &[u8]) -> Result<ResourceEeCertificate, SignedOb
         spki_der,
         rsa_public_modulus,
         rsa_public_exponent,
+        tbs_certificate_der: cert.tbs_certificate.as_ref().to_vec(),
+        signature_bytes: cert.signature_value.data.to_vec(),
+        key_usage_summary: summarize_ee_key_usage(&cert),
         sia_signed_object_uris: signed_object_uris,
         resource_cert: rc,
     })
 }
 
+fn summarize_ee_key_usage(cert: &X509Certificate<'_>) -> EeKeyUsageSummary {
+    for ext in cert.extensions() {
+        if ext.oid.as_bytes() == OID_KEY_USAGE_RAW {
+            match ext.parsed_extension() {
+                ParsedExtension::KeyUsage(ku) => {
+                    if !ext.critical {
+                        return EeKeyUsageSummary::NotCritical;
+                    }
+                    let ok = ku.digital_signature()
+                        && !ku.key_cert_sign()
+                        && !ku.crl_sign()
+                        && !ku.non_repudiation()
+                        && !ku.key_encipherment()
+                        && !ku.data_encipherment()
+                        && !ku.key_agreement()
+                        && !ku.encipher_only()
+                        && !ku.decipher_only();
+                    return if ok {
+                        EeKeyUsageSummary::DigitalSignatureOnly
+                    } else {
+                        EeKeyUsageSummary::InvalidBits
+                    };
+                }
+                other => {
+                    return EeKeyUsageSummary::ParseError(format!(
+                        "unexpected parsed keyUsage extension: {other:?}"
+                    ));
+                }
+            }
+        }
+    }
+
+    EeKeyUsageSummary::Missing
+}
+
 fn parse_signer_info_cursor(
     mut seq: CmsReader<'_>,
 ) -> Result<SignerInfoParsed, SignedObjectParseError> {