# Copyright (c) Microsoft Corporation.
# Licensed under the MIT License.

[package]
name = "crypto"
edition.workspace = true
rust-version.workspace = true

[features]
# Enable test-only helper functions.
test_helpers = ["x509-cert?/builder"]

# If the chosen backend supports it, vendor it.
# If the chosen backend is natively available, this feature is a no-op.
# If the chosen backend is not natively available and can't be vendored, this will trigger a compile error.
vendored = ["openssl?/vendored"]

# Use the native crypto backend (OpenSSL on Linux).
# TODO: It'd be nice if the dependencies needed for the native backends didn't get built unconditionally,
# but Cargo doesn't provide a way to conditionally include dependencies for specific targets based on features.
native = []

# Use OpenSSL.
openssl = ["dep:openssl", "dep:openssl_kdf"]

# Use Symcrypt.
# Note that the symcrypt backend does not support vendoring, enabling both
# `symcrypt` and `vendored` will trigger a compile error.
symcrypt = [
    "dep:symcrypt",
    "symcrypt/sha1",
    # The Symcrypt backend uses RustCrypto crates for de/serialization only.
    "dep:cms",
    "dep:der",
    "dep:pkcs1",
    "dep:pkcs8",
    "dep:signature",
    "dep:x509-cert",
]

# Use RustCrypto crates.
# Note that some of these crates have known security issues.
# This backend should not be used in production scenarios.
rust = [
    "dep:cms",
    "dep:der",
    "dep:getrandom",
    "dep:pkcs1",
    "dep:pkcs8",
    "dep:rsa",
    "dep:sha1",
    "dep:sha2",
    "dep:x509-cert",
]

[dependencies]
openssl_kdf = { workspace = true, optional = true }
openssl = { workspace = true, optional = true }

symcrypt = { workspace = true, optional = true }

cms = { workspace = true, optional = true }
der = { workspace = true, optional = true }
getrandom = { workspace = true, optional = true, features = ["sys_rng"] }
pkcs1 = { workspace = true, optional = true }
pkcs8 = { workspace = true, optional = true, features = ["alloc"] }
rsa = { workspace = true, optional = true, features = ["encoding", "sha2"] }
sha1 = { workspace = true, optional = true, features = ["oid"] }
sha2 = { workspace = true, optional = true }
signature = { workspace = true, optional = true, features = ["alloc"] }
x509-cert = { workspace = true, optional = true }

anyhow.workspace = true
thiserror.workspace = true

[target.'cfg(windows)'.dependencies]
wchar.workspace = true
windows = { workspace = true, features = [
    "Win32_Foundation",
    "Win32_Security_Cryptography",
] }
windows-result.workspace = true
zerocopy.workspace = true

# Used by the native backend to parse/encode data when no native support is available.
[target.'cfg(target_os = "macos")'.dependencies]
cms.workspace = true
der.workspace = true
pkcs1.workspace = true
pkcs8 = { workspace = true, features = ["alloc"] }
signature = { workspace = true, features = ["alloc"] }
x509-cert.workspace = true

# Default to OpenSSL on Linux since there is no native backend available,
# except on musl targets where we use Symcrypt instead.
[target.'cfg(all(target_os = "linux", not(target_env = "musl")))'.dependencies]
openssl_kdf.workspace = true
openssl.workspace = true

[target.'cfg(all(target_os = "linux", target_env = "musl"))'.dependencies]
symcrypt = { workspace = true, features = ["sha1"] }
cms.workspace = true
der.workspace = true
pkcs1.workspace = true
pkcs8 = { workspace = true, features = ["alloc"] }
signature = { workspace = true, features = ["alloc"] }
x509-cert.workspace = true

[dev-dependencies]
hex.workspace = true
x509-cert = { workspace = true, features = ["builder"] }

[lints]
workspace = true
