crypto/default/trust_store.cc

// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//    https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

#include "crypto/default/trust_store.h"

#include <memory>
#include <string>
#include <vector>

#include "absl/log/log.h"
#include "absl/status/status.h"
#include "absl/status/status_macros.h"
#include "absl/status/statusor.h"
#include "absl/strings/str_cat.h"
#include "absl/strings/string_view.h"
#include "crypto/default/pem.h"
#include "google/protobuf/timestamp.pb.h"
#include "openssl/pki/verify.h"
#include "proto/signature_info.pb.h"

namespace credentio {

absl::StatusOr<std::unique_ptr<bssl::VerifyTrustStore>> LoadTrustStore(
    absl::string_view trust_anchor_pem) {
  // Construct a trust store from certs in the PEM file.
  //
  // 1) Parse the PEM file contents to a set of DER certs.
  ABSL_ASSIGN_OR_RETURN(std::vector<std::string> certs,
                        LoadCertsFromPem(trust_anchor_pem));
  if (certs.empty()) {
    return absl::InvalidArgumentError("No certs found in PEM file");
  }

  // 2) Construct the trust store from the DER certs.
  std::vector<std::string_view> der_certs_views(certs.begin(), certs.end());
  std::string diagnostics;
  std::unique_ptr<bssl::VerifyTrustStore> roots =
      bssl::VerifyTrustStore::FromDER(der_certs_views, &diagnostics);
  if (roots == nullptr) {
    return absl::InternalError(
        absl::StrCat("Failed to construct the trust store: ", diagnostics));
  }
  return roots;
}

}  // namespace credentio