validation: document BC handling

Signed-off-by: William Woodruff <[email protected]>
pyca · Nov 26, 2023 · e26feb8 · e26feb8
1 parent c6d502e
commit e26feb8
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/src/rust/cryptography-x509-validation/src/policy/mod.rs b/src/rust/cryptography-x509-validation/src/policy/mod.rs
@@ -464,6 +464,9 @@ impl<'a, B: CryptoOps> Policy<'a, B> {
         // to test here. It's also conceptually an extension policy, but
         // requires a bit of extra external state (`current_depth`) that isn't
         // presently convenient to push into that layer.
+        //
+        // NOTE: BasicConstraints is required via `ca_extension_policies`,
+        // so we always take this branch.
         if let Some(bc) = extensions.get_extension(&BASIC_CONSTRAINTS_OID) {
             let bc: BasicConstraints = bc.value()?;