validation: add Rust-side certificate validation helpers

src/rust/cryptography-x509-validation/src/certificate.rs

@@ -0,0 +1,20 @@
+// This file is dual licensed under the terms of the Apache License, Version
+// 2.0, and the BSD License. See the LICENSE file in the root of this repository
+// for complete details.
+
+//! Validation-specific certificate functionality.
+
+use cryptography_x509::certificate::Certificate;
+
+use crate::ops::CryptoOps;
+
+pub(crate) fn cert_is_self_issued(cert: &Certificate<'_>) -> bool {
+    cert.issuer() == cert.subject()
+}
+
+pub(crate) fn cert_is_self_signed<B: CryptoOps>(cert: &Certificate<'_>, ops: &B) -> bool {
+    match ops.public_key(cert) {
+        Ok(pk) => cert_is_self_issued(cert) && ops.verify_signed_by(cert, pk).is_ok(),
+        Err(_) => false,
+    }
+}

src/rust/cryptography-x509-validation/src/lib.rs

@@ -5,6 +5,7 @@
 #![forbid(unsafe_code)]
 #![deny(rust_2018_idioms, clippy::undocumented_unsafe_blocks)]
 
+pub mod certificate;
 pub mod ops;
 pub mod policy;
 pub mod trust_store;