add a PKCS 12 builder to pkcs12 crate

pkcs12/Cargo.toml

@@ -22,21 +22,63 @@ x509-cert = { version = "0.3.0-rc.4", default-features = false }
 const-oid = { version = "0.10", features = ["db"], default-features = false }
 cms = { version = "=0.3.0-pre.2", default-features = false }
 
-# optional dependencies
+# optional dependencies (kdf)
 digest = { version = "0.11", features = ["alloc"], optional = true }
 zeroize = { version = "1.8.1", optional = true, default-features = false }
 
+# optional dependencies (builder)
+pkcs5 = { version = "0.8.0-rc.13", optional = true }
+pkcs8 = { version = "0.11.0-rc.11", features = ["encryption"], optional = true }
+crypto-common = { version = "0.2.0", optional = true }
+hmac = { version = "0.13.0-rc.5", optional = true }
+sha2 = { version = "0.11.0-rc.5", optional = true }
+log = { version = "0.4.29", optional = true }
+rand = { version = "0.10.0", optional = true }
+rand_core = { version = "0.10.0", optional = true }
+subtle = { version = "2.6.1", optional = true }
+
+# optional dependencies (legacy)
+sha1 = { version = "0.11.0", optional = true }
+cbc = { version = "0.2.0", optional = true }
+des = { version = "0.9.0", optional = true }
+rc2 = { version = "0.9.0", optional = true }
+
 [dev-dependencies]
 hex-literal = "1"
-pkcs8 = { version = "0.11.0-rc.10", features = ["pkcs5"] }
+pkcs8 = { version = "0.11.0-rc.11", features = ["pkcs5"] }
 pkcs5 = { version = "0.8.0-rc.13", features = ["pbes2", "3des"] }
 sha2 = "0.11"
 whirlpool = "0.11"
+openssl = { version = "0.10.75", features = ["vendored"] }
+subtle-encoding = "0.5.1"
+tempfile = "3.26.0"
 
 [features]
 default = ["pem"]
 kdf = ["dep:digest", "zeroize/alloc"]
 pem = ["der/pem", "x509-cert/pem"]
+builder = [
+    "kdf",
+    "dep:pkcs5",
+    "dep:pkcs8",
+    "dep:crypto-common",
+    "dep:hmac",
+    "dep:sha2",
+    "dep:log",
+    "dep:rand",
+    "dep:rand_core",
+    "dep:subtle",
+    "zeroize/alloc",
+]
+legacy = [
+    "builder",
+    "dep:sha1",
+    "dep:des",
+    "dep:rc2",
+    "dep:cbc",
+    "pkcs5/sha1-insecure",
+    "pkcs5/3des",
+]
 
 [package.metadata.docs.rs]
 all-features = true

pkcs12/README.md

@@ -12,6 +12,40 @@ Personal Information Exchange Syntax v1.1 ([RFC7292]).
 
 [Documentation][docs-link]
 
+## Builder (`builder` feature)
+
+The `builder` feature provides `Pkcs12Builder` for creating a `Pfx` containing one private key
+and one certificate, plus optional additional certificates (e.g. CA/intermediate chain
+certificates), all protected with password-based encryption (PBES2 / PBKDF2 by default) and a
+password-based MAC.
+
+### Features
+
+- PBES2 encryption with configurable PBKDF2 PRF and AES-CBC cipher
+- Configurable MAC algorithm and iteration count
+- Optional additional certificates (CA/intermediate chain)
+- `localKeyID` and `friendlyName` attribute helpers
+- Parsing and decryption of existing PKCS #12 files via `parse_pkcs12`
+- Per-bag attribute preservation (key ID, friendly name, and arbitrary attributes)
+- Legacy PKCS #12 PBE support (SHA-1/3DES-CBC, SHA-1/RC2-CBC) with the `legacy` feature
+
+### Quick start
+
+```toml
+[dependencies]
+pkcs12 = { version = "0.2", features = ["builder"] }
+```
+
+### `legacy` feature
+
+Enable the `legacy` feature to support legacy PKCS #12 PBE algorithms (SHA-1/3DES-CBC,
+SHA-1/RC2-CBC) and HMAC-SHA-1 MAC. 
+
+```toml
+[dependencies]
+pkcs12 = { version = "0.2", features = ["legacy"] }
+```
+
 ## Minimum Supported Rust Version (MSRV) Policy
 
 MSRV increases are not considered breaking changes and can happen in patch releases.