platform layer: address types, stdlib tls client wrapper, mbedtls tls server

tests/fixtures/README.md

@@ -0,0 +1,34 @@
+# Test fixtures
+
+`self_signed_cert.pem` and `self_signed_key.pem` are a **test fixture**. The
+private key is **intentionally committed** to this public repository. It is not
+a secret and it must never protect anything real.
+
+Properties:
+
+- EC P-256 (`prime256v1`), SHA-256 signature
+- Subject `CN=localhost`
+- SAN `DNS:localhost`, `IP:127.0.0.1`
+- Validity 36500 days from generation
+
+The loopback TLS test in `src/platform/tls_server.zig` uses this pair. Nothing
+in the shipped binary reads it.
+
+Regenerate with:
+
+```sh
+openssl ecparam -name prime256v1 -genkey -noout -out self_signed_key.pem
+openssl req -new -x509 -key self_signed_key.pem -out self_signed_cert.pem \
+    -days 36500 -sha256 -subj "/CN=localhost" \
+    -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"
+```
+
+`mismatched_key.pem` is a second EC P-256 key with no certificate. It parses,
+but it does not belong to `self_signed_cert.pem`, so `ServerContext.init` must
+reject the pair with `error.KeyMismatch`. It is not a secret either.
+
+Regenerate with:
+
+```sh
+openssl ecparam -name prime256v1 -genkey -noout -out mismatched_key.pem
+```

tests/fixtures/fixtures.zig

@@ -0,0 +1,9 @@
+//! Test fixtures embedded as a separate module so `@embedFile` paths stay
+//! inside this directory (a module root may not embed files above itself).
+//! See tests/fixtures/README.md — the private key is not a secret.
+
+pub const cert_pem: [:0]const u8 = @embedFile("self_signed_cert.pem");
+pub const key_pem: [:0]const u8 = @embedFile("self_signed_key.pem");
+
+/// A well-formed private key that does not belong to `cert_pem`.
+pub const mismatched_key_pem: [:0]const u8 = @embedFile("mismatched_key.pem");

tests/fixtures/mismatched_key.pem

@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIHD4PI2utb6T0UJSzHJsS0OBYpxv9Yl1UQ9zkr++7oVWoAoGCCqGSM49
+AwEHoUQDQgAE2tUQSqRzgr7lCvTiin1mhRe4lzQPv9/U62lKm4MAtTQA6TvlqS8M
+n7c5kNuoR57s9hV+D64+pJqYMzNocaN5Yw==
+-----END EC PRIVATE KEY-----

tests/fixtures/self_signed_cert.pem

@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBmzCCAUGgAwIBAgIUST2RAi7t5xJCdgasH59MhX+teKgwCgYIKoZIzj0EAwIw
+FDESMBAGA1UEAwwJbG9jYWxob3N0MCAXDTI2MDczMTIxMzA0MVoYDzIxMjYwNzA3
+MjEzMDQxWjAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwWTATBgcqhkjOPQIBBggqhkjO
+PQMBBwNCAATZ5CFaK693mW+3/GdkLUo0fSjtAy2wUr0WttWLbzYVv3R3k0RmKMOt
+GTkYeN+H8gp281HW3sRcgGCJNNayzmU0o28wbTAdBgNVHQ4EFgQUb2BIm4JeUXZN
+WJu1ioHlwZijo9QwHwYDVR0jBBgwFoAUb2BIm4JeUXZNWJu1ioHlwZijo9QwDwYD
+VR0TAQH/BAUwAwEB/zAaBgNVHREEEzARgglsb2NhbGhvc3SHBH8AAAEwCgYIKoZI
+zj0EAwIDSAAwRQIhAOOhKN8H3xayyKA/2e42d6bdMI7PYLyT4ihymzA9zrFfAiAO
+0oHljOrRBIVz2PPxZ4YCOwM140tFesV50EtK3VnGZA==
+-----END CERTIFICATE-----

tests/fixtures/self_signed_key.pem

@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEILVQieUq8yy8RIuZoDGKWTNiPdq8cOBi9k33Zo1WunVYoAoGCCqGSM49
+AwEHoUQDQgAE2eQhWiuvd5lvt/xnZC1KNH0o7QMtsFK9FrbVi282Fb90d5NEZijD
+rRk5GHjfh/IKdvNR1t7EXIBgiTTWss5lNA==
+-----END EC PRIVATE KEY-----