platform layer: address types, stdlib tls client wrapper, mbedtls tls server

2026-07-31 23:59:39 +02:00
parent 1fa82668ec
commit 506ab8e038
10 changed files with 1723 additions and 0 deletions
@@ -0,0 +1,34 @@
+# Test fixtures
+
+`self_signed_cert.pem` and `self_signed_key.pem` are a **test fixture**. The
+private key is **intentionally committed** to this public repository. It is not
+a secret and it must never protect anything real.
+
+Properties:
+
+- EC P-256 (`prime256v1`), SHA-256 signature
+- Subject `CN=localhost`
+- SAN `DNS:localhost`, `IP:127.0.0.1`
+- Validity 36500 days from generation
+
+The loopback TLS test in `src/platform/tls_server.zig` uses this pair. Nothing
+in the shipped binary reads it.
+
+Regenerate with:
+
+```sh
+openssl ecparam -name prime256v1 -genkey -noout -out self_signed_key.pem
+openssl req -new -x509 -key self_signed_key.pem -out self_signed_cert.pem \
+    -days 36500 -sha256 -subj "/CN=localhost" \
+    -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"
+```
+
+`mismatched_key.pem` is a second EC P-256 key with no certificate. It parses,
+but it does not belong to `self_signed_cert.pem`, so `ServerContext.init` must
+reject the pair with `error.KeyMismatch`. It is not a secret either.
+
+Regenerate with:
+
+```sh
+openssl ecparam -name prime256v1 -genkey -noout -out mismatched_key.pem
+```