[package]
name = "geiserx_ts_keys"
version.workspace = true
description = "tailscale cryptographic key types"
categories = ["cryptography"]
keywords = ["tailscale", "keys"]

repository.workspace = true
edition.workspace = true
license.workspace = true
rust-version.workspace = true


[lib]
name = "ts_keys"
[dependencies]
thiserror.workspace = true
zerocopy.workspace = true
serde = { workspace = true, optional = true }
# zeroize (matching the workspace-tree pin in ts_control_noise) wipes secret byte buffers on
# drop. `alloc` (not `std`, this crate is `no_std`) is required for the `Zeroize`/`ZeroizeOnDrop`
# impls on `alloc::vec::Vec`, which is what `Zeroizing<Vec<u8>>` relies on for the persisted ACME
# account key. `Zeroizing<Vec<u8>>` serializes transparently via its inner `Vec`, so the on-wire
# JSON shape of `PersistState`/`NodeState` is unchanged. `derive` provides the
# `#[derive(Zeroize, ZeroizeOnDrop)]` proc-macros used on the private-key newtypes so their secret
# 32-byte buffer is wiped on drop (the `[u8; 32]` field zeroizes in place — no heap, no realloc).
zeroize = { version = "1.8", default-features = false, features = ["alloc", "derive"] }
x25519-dalek.workspace = true
crypto_box.workspace = true
# ed25519-dalek (v2, already in the workspace tree via ts_tka) provides the RFC 8032
# seed->public derivation for the Tailnet-Lock (TKA) key. Default features off keeps the
# crate no_std-clean; we only need from_bytes / verifying_key / to_bytes.
ed25519-dalek = { version = "2", default-features = false }
# getrandom 0.4 is already pulled transitively (via x25519-dalek 3.0.0-pre.6). We use it as a
# direct dep to source 32 uniformly-random bytes for the Ed25519 seed WITHOUT any bit clamping
# (x25519's StaticSecret clamps, which would reduce seed entropy and be wrong for Ed25519).
getrandom = "0.4"

[dev-dependencies]
serde_json.workspace = true
# Project Wycheproof X25519 adversarial vectors (dev-only KAT). See VENDOR.md.
wycheproof.workspace = true

[features]
# The `serde` feature must also turn on zeroize's `serde` so `Zeroizing<Vec<u8>>` serializes
# transparently via its inner `Vec` — keeping the persisted JSON shape byte-identical.
serde = ["dep:serde", "zeroize/serde"]

[lints]
workspace = true
