https://gitlab.synchro.net/main/sbbs/-/commit/fb86d178737aa59467d0e158
Added Files:
src/xptls/test_rsa_pkcs1.pem test_xp_crypto.c test_xp_crypto_none.c xp_digest.h xp_digest_botan3.cpp xp_digest_none.c xp_digest_openssl.c xp_sign.h
Modified Files:
src/xptls/CMakeLists.txt xp_ca.h xp_ca_botan3.cpp xp_ca_none.c xp_ca_openssl.c
Log Message:
xptls: add provider-neutral signing and ACME primitives

Synchronet's DKIM implementation currently calls OpenSSL directly,
while the JavaScript ACME clients depend on Cryptlib for RSA/ECDSA
keys, JWS signatures, CSRs, certificate chains, and SHA-2. Those
callers need a common primitive layer before either dependency can be
removed without tying the replacement to another provider API.

Extend the opaque CA key handle with RSA and ECDSA generation,
standard in-memory key encodings, public-key components,
identity-bearing CSRs, certificate-chain PEM handling, and validity
accessors. Add message-level RSA, ECDSA, and Ed25519 signing plus
streaming SHA-256/384/512 implementations for OpenSSL, Botan 3, and
the disabled backend.

Keep the committed CA interfaces source-compatible and leave the
DKIM, SpiderMonkey, key-storage, and Cryptlib migration work for their
separate integration steps. Cover the shared behavior with
provider-independent tests, standard digest and RSA signature vectors,
legacy PKCS#1 import, and disabled-backend checks.

Co-Authored-By: Codex <noreply@openai.com>

---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net