chore: checkpoint before Python removal

vendor/webpki-roots/.cargo-checksum.json

@@ -0,0 +1 @@
+{"files":{".cargo_vcs_info.json":"be49d84084cb6346d05c2635e127ab480a89ae001f1c2dfcd7be23bffab2250d","Cargo.lock":"45ea361527dd2d21b0d434257ab28c55eb89361f41fa004e3327fe4f448b7098","Cargo.toml":"4cdfbd70b7f7a64e9385f5b704b70bb072a828c79b1a9caa7e96b2ab1063b0ea","Cargo.toml.orig":"17fb36fb25023fa31eadba69c4e6a2a1cb0b375a69bf0f41471a5ac7f7624785","LICENSE":"e271993808fec50ab29350b39539cdec611a9103f827e0aa26d61da70e2d33f8","README.md":"3f785bbd28b6628dadc4203a9368b729453aaa65df454e54a0c2f8a7a42395f5","src/lib.rs":"b141d9e67f2b8dc5276d7959eb53d46827db5c9b2e760875f324b7ad180b0471","tests/codegen.rs":"06afca3127ffc684836406544e44ccfbb7cd0ae7ae15102c42bc62d076765ecd","tests/data/tubitak/inter.der":"bf32da954571659aaf715c13ee703e3643dfcbaeee2d82110ca68eb57cb67ce0","tests/data/tubitak/root.der":"46edc3689046d53a453fb3104ab80dcaec658b2660ea1629dd7e867990648716","tests/data/tubitak/subj.der":"8f0d491077ddc360e7416620af2cf4a8a4010e5b6f5a6d0f557f4f2499a38029","tests/verify.rs":"ef69aafbd92ba96b74325569025b44b04b021d526217ef69e7c3d46d83414632"},"package":"22cfaf3c063993ff62e73cb4311efde4db1efb31ab78a3e5c457939ad5cc0bed"}

vendor/webpki-roots/.cargo_vcs_info.json

@@ -0,0 +1,6 @@
+{
+  "git": {
+    "sha1": "c97def9fb9fcf4c6f687a6f11c376c021b4811a1"
+  },
+  "path_in_vcs": "webpki-roots"
+}

vendor/webpki-roots/Cargo.lock

@@ -0,0 +1,717 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "asn1-rs"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56624a96882bb8c26d61312ae18cb45868e5a9992ea73c58e45c3101e56a1e60"
+dependencies = [
+ "asn1-rs-derive",
+ "asn1-rs-impl",
+ "displaydoc",
+ "nom",
+ "num-traits",
+ "rusticata-macros",
+ "thiserror",
+ "time",
+]
+
+[[package]]
+name = "asn1-rs-derive"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3109e49b1e4909e9db6515a30c633684d68cdeaa252f215214cb4fa1a5bfee2c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "asn1-rs-impl"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+
+[[package]]
+name = "aws-lc-rs"
+version = "1.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a88aab2464f1f25453baa7a07c84c5b7684e274054ba06817f382357f77a288"
+dependencies = [
+ "aws-lc-sys",
+ "untrusted 0.7.1",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-lc-sys"
+version = "0.35.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b45afffdee1e7c9126814751f88dddc747f41d91da16c9551a0f1e8a11e788a1"
+dependencies = [
+ "cc",
+ "cmake",
+ "dunce",
+ "fs_extra",
+]
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "cc"
+version = "1.2.51"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a0aeaff4ff1a90589618835a598e545176939b97874f7abc7851caa0618f203"
+dependencies = [
+ "find-msvc-tools",
+ "jobserver",
+ "libc",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "cmake"
+version = "0.1.57"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75443c44cd6b379beb8c5b45d85d0773baf31cce901fe7bb252f4eff3008ef7d"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "data-encoding"
+version = "2.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a2330da5de22e8a3cb63252ce2abb30116bf5265e89c0e01bc17015ce30a476"
+
+[[package]]
+name = "der-parser"
+version = "10.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07da5016415d5a3c4dd39b11ed26f915f52fc4e0dc197d87908bc916e51bc1a6"
+dependencies = [
+ "asn1-rs",
+ "displaydoc",
+ "nom",
+ "num-bigint",
+ "num-traits",
+ "rusticata-macros",
+]
+
+[[package]]
+name = "deranged"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ececcb659e7ba858fb4f10388c250a7252eb0a27373f1a72b8748afdd248e587"
+dependencies = [
+ "powerfmt",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "645cbb3a84e60b7531617d5ae4e57f7e27308f6445f5abf653209ea76dec8dff"
+
+[[package]]
+name = "fs_extra"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
+
+[[package]]
+name = "getrandom"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+ "wasip2",
+]
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "itoa"
+version = "1.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2"
+
+[[package]]
+name = "jobserver"
+version = "0.1.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9afb3de4395d6b3e67a780b6de64b51c978ecf11cb9a462c66be7d4ca9039d33"
+dependencies = [
+ "getrandom 0.3.4",
+ "libc",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+
+[[package]]
+name = "libc"
+version = "0.2.179"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c5a2d376baa530d1238d133232d15e239abad80d05838b4b59354e5268af431f"
+
+[[package]]
+name = "log"
+version = "0.4.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
+
+[[package]]
+name = "memchr"
+version = "2.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f52b00d39961fc5b2736ea853c9cc86238e165017a493d1d5c8eac6bdc4cc273"
+
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
+[[package]]
+name = "num-integer"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "oid-registry"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12f40cff3dde1b6087cc5d5f5d4d65712f34016a03ed60e9c08dcc392736b5b7"
+dependencies = [
+ "asn1-rs",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+
+[[package]]
+name = "pem"
+version = "3.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d30c53c26bc5b31a98cd02d20f25a7c8567146caf63ed593a9d87b2775291be"
+dependencies = [
+ "base64",
+ "serde_core",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9695f8df41bb4f3d222c95a67532365f569318332d03d5f3f67f37b20e6ebdf0"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.42"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a338cc41d27e6cc6dce6cefc13a0729dfbb81c262b1f519331575dd80ef3067f"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "rcgen"
+version = "0.14.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ec0a99f2de91c3cddc84b37e7db80e4d96b743e05607f647eb236fc0455907f"
+dependencies = [
+ "pem",
+ "ring",
+ "rustls-pki-types",
+ "time",
+ "x509-parser",
+ "yasna",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.16",
+ "libc",
+ "untrusted 0.9.0",
+ "windows-sys",
+]
+
+[[package]]
+name = "rusticata-macros"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "faf0c4a6ece9950b9abdb62b1cfcf2a68b3b67a10ba445b3bb85be2a293d0632"
+dependencies = [
+ "nom",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "533f54bc6a7d4f647e46ad909549eda97bf5afc1585190ef692b4286b198bd8f"
+dependencies = [
+ "aws-lc-rs",
+ "log",
+ "once_cell",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "21e6f2ab2928ca4291b86736a8bd920a277a399bba1589409d72154ff87c1282"
+dependencies = [
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ffdfa2f5286e2247234e03f680868ac2815974dc39e00ea15adc445d0aafe52"
+dependencies = [
+ "aws-lc-rs",
+ "ring",
+ "rustls-pki-types",
+ "untrusted 0.9.0",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "2.0.113"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "678faa00651c9eb72dd2020cbdf275d92eccb2400d568e419efdd64838145cb4"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f63587ca0f12b72a0600bcba1d40081f830876000bb46dd2337a3051618f4fc8"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ff15c8ecd7de3849db632e14d18d2571fa09dfc5ed93479bc4485c7a517c913"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "time"
+version = "0.3.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e7d9e3bb61134e77bde20dd4825b97c010155709965fedf0f49bb138e52a9d"
+dependencies = [
+ "deranged",
+ "itoa",
+ "num-conv",
+ "powerfmt",
+ "serde",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40868e7c1d2f0b8d73e4a8c7f0ff63af4f6d19be117e90bd73eb1d62cf831c6b"
+
+[[package]]
+name = "time-macros"
+version = "0.2.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30cfb0125f12d9c277f35663a0a33f8c30190f4e4574868a330595412d34ebf3"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "tokio"
+version = "1.49.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72a2903cd7736441aac9df9d7688bd0ce48edccaadf181c3b90be801e81d3d86"
+dependencies = [
+ "pin-project-lite",
+ "tokio-macros",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af407857209536a95c8e56f8231ef2c2e2aff839b22e07a1ffcbc617e9db9fa5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5"
+
+[[package]]
+name = "untrusted"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasip2"
+version = "1.0.1+wasi-0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0562428422c63773dad2c345a1882263bbf4d65cf3f42e90921f787ef5ad58e7"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "1.0.6"
+dependencies = [
+ "aws-lc-rs",
+ "hex",
+ "percent-encoding",
+ "rcgen",
+ "rustls",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "tokio",
+ "x509-parser",
+ "yasna",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "wit-bindgen"
+version = "0.46.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f17a85883d4e6d00e8a97c586de764dabcc06133f7f1d55dce5cdc070ad7fe59"
+
+[[package]]
+name = "x509-parser"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb3e137310115a65136898d2079f003ce33331a6c4b0d51f1531d1be082b6425"
+dependencies = [
+ "asn1-rs",
+ "data-encoding",
+ "der-parser",
+ "lazy_static",
+ "nom",
+ "oid-registry",
+ "ring",
+ "rusticata-macros",
+ "thiserror",
+ "time",
+]
+
+[[package]]
+name = "yasna"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e17bb3549cc1321ae1296b9cdc2698e2b6cb1992adfa19a8c72e5b7a738f44cd"
+dependencies = [
+ "time",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"

vendor/webpki-roots/Cargo.toml

@@ -0,0 +1,77 @@
+# THIS FILE IS AUTOMATICALLY GENERATED BY CARGO
+#
+# When uploading crates to the registry Cargo will automatically
+# "normalize" Cargo.toml files for maximal compatibility
+# with all versions of Cargo and also rewrite `path` dependencies
+# to registry (e.g., crates.io) dependencies.
+#
+# If you are reading this file be aware that the original Cargo.toml
+# will likely look very different (and much more reasonable).
+# See Cargo.toml.orig for the original contents.
+
+[package]
+edition = "2021"
+rust-version = "1.64"
+name = "webpki-roots"
+version = "1.0.6"
+build = false
+autolib = false
+autobins = false
+autoexamples = false
+autotests = false
+autobenches = false
+description = "Mozilla's CA root certificates for use with webpki"
+homepage = "https://github.com/rustls/webpki-roots"
+readme = "README.md"
+license = "CDLA-Permissive-2.0"
+repository = "https://github.com/rustls/webpki-roots"
+
+[lib]
+name = "webpki_roots"
+path = "src/lib.rs"
+
+[[test]]
+name = "codegen"
+path = "tests/codegen.rs"
+
+[[test]]
+name = "verify"
+path = "tests/verify.rs"
+
+[dependencies.pki-types]
+version = "1.8"
+default-features = false
+package = "rustls-pki-types"
+
+[dev-dependencies.aws-lc-rs]
+version = "1.15.2"
+
+[dev-dependencies.hex]
+version = "0.4.3"
+
+[dev-dependencies.percent-encoding]
+version = "2.3"
+
+[dev-dependencies.rcgen]
+version = "0.14.3"
+
+[dev-dependencies.rustls]
+version = "0.23"
+
+[dev-dependencies.tokio]
+version = "1"
+features = [
+    "macros",
+    "rt-multi-thread",
+]
+
+[dev-dependencies.webpki]
+version = "0.103"
+features = ["alloc"]
+package = "rustls-webpki"
+
+[dev-dependencies.x509-parser]
+version = "0.18"
+
+[dev-dependencies.yasna]
+version = "0.5.2"

vendor/webpki-roots/LICENSE

@@ -0,0 +1,61 @@
+# Community Data License Agreement - Permissive - Version 2.0
+
+This is the Community Data License Agreement - Permissive, Version
+2.0 (the "agreement"). Data Provider(s) and Data Recipient(s) agree
+as follows:
+
+## 1. Provision of the Data
+
+1.1. A Data Recipient may use, modify, and share the Data made
+available by Data Provider(s) under this agreement if that Data
+Recipient follows the terms of this agreement.
+
+1.2. This agreement does not impose any restriction on a Data
+Recipient's use, modification, or sharing of any portions of the
+Data that are in the public domain or that may be used, modified,
+or shared under any other legal exception or limitation.
+
+## 2. Conditions for Sharing Data
+
+2.1. A Data Recipient may share Data, with or without modifications, so
+long as the Data Recipient makes available the text of this agreement
+with the shared Data.
+
+## 3. No Restrictions on Results
+
+3.1. This agreement does not impose any restriction or obligations
+with respect to the use, modification, or sharing of Results.
+
+## 4. No Warranty; Limitation of Liability
+
+4.1. All Data Recipients receive the Data subject to the following
+terms:
+
+THE DATA IS PROVIDED ON AN "AS IS" BASIS, WITHOUT REPRESENTATIONS,
+WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED
+INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
+NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
+
+NO DATA PROVIDER SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT,
+INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING
+WITHOUT LIMITATION LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF
+LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE DATA OR RESULTS,
+EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+## 5. Definitions
+
+5.1. "Data" means the material received by a Data Recipient under
+this agreement.
+
+5.2. "Data Provider" means any person who is the source of Data
+provided under this agreement and in reliance on a Data Recipient's
+agreement to its terms.
+
+5.3. "Data Recipient" means any person who receives Data directly
+or indirectly from a Data Provider and agrees to the terms of this
+agreement.
+
+5.4. "Results" means any outcome obtained by computational analysis
+of Data, including for example machine learning models and models'
+insights.

vendor/webpki-roots/README.md

@@ -0,0 +1,20 @@
+# webpki-roots
+This is a crate containing Mozilla's root certificates for use with
+the [webpki](https://github.com/rustls/webpki) or
+[rustls](https://github.com/rustls/rustls) crates.
+
+This crate is inspired by [certifi.io](https://certifi.io/en/latest/) and
+uses the data provided by the [Common CA Database (CCADB)](https://www.ccadb.org/).
+
+[![webpki-roots](https://github.com/rustls/webpki-roots/actions/workflows/build.yml/badge.svg?branch=main)](https://github.com/rustls/webpki-roots/actions/workflows/build.yml)
+[![Crate](https://img.shields.io/crates/v/webpki-roots.svg)](https://crates.io/crates/webpki-roots)
+
+# License
+The underlying data is used via the [CCADB Data Usage Terms](https://www.ccadb.org/rootstores/usage#ccadb-data-usage-terms) (see [`LICENSE`](LICENSE)).
+The data in this crate is a derived work of the CCADB data.
+
+# Regenerating sources
+Sources are generated in an integration test, in `tests/codegen.rs`. The test
+will fail if the sources are out of date relative to upstream, and update
+`src/lib.rs` if so. The code is generated in deterministic order so changes
+to the source should only result from upstream changes.

vendor/webpki-roots/target/package/tmp-registry/index/we/bp/webpki-roots

@@ -0,0 +1 @@
+{"name":"webpki-roots","vers":"1.0.6","deps":[{"name":"pki-types","req":"^1.8","features":[],"optional":false,"default_features":false,"target":null,"kind":"normal","registry":"https://github.com/rust-lang/crates.io-index","package":"rustls-pki-types","public":null,"artifact":null,"bindep_target":null,"lib":false},{"name":"aws-lc-rs","req":"^1.15.2","features":[],"optional":false,"default_features":true,"target":null,"kind":"dev","registry":"https://github.com/rust-lang/crates.io-index","package":null,"public":null,"artifact":null,"bindep_target":null,"lib":false},{"name":"hex","req":"^0.4.3","features":[],"optional":false,"default_features":true,"target":null,"kind":"dev","registry":"https://github.com/rust-lang/crates.io-index","package":null,"public":null,"artifact":null,"bindep_target":null,"lib":false},{"name":"percent-encoding","req":"^2.3","features":[],"optional":false,"default_features":true,"target":null,"kind":"dev","registry":"https://github.com/rust-lang/crates.io-index","package":null,"public":null,"artifact":null,"bindep_target":null,"lib":false},{"name":"rcgen","req":"^0.14.3","features":[],"optional":false,"default_features":true,"target":null,"kind":"dev","registry":"https://github.com/rust-lang/crates.io-index","package":null,"public":null,"artifact":null,"bindep_target":null,"lib":false},{"name":"rustls","req":"^0.23","features":[],"optional":false,"default_features":true,"target":null,"kind":"dev","registry":"https://github.com/rust-lang/crates.io-index","package":null,"public":null,"artifact":null,"bindep_target":null,"lib":false},{"name":"tokio","req":"^1","features":["macros","rt-multi-thread"],"optional":false,"default_features":true,"target":null,"kind":"dev","registry":"https://github.com/rust-lang/crates.io-index","package":null,"public":null,"artifact":null,"bindep_target":null,"lib":false},{"name":"webpki","req":"^0.103","features":["alloc"],"optional":false,"default_features":true,"target":null,"kind":"dev","registry":"https://github.com/rust-lang/crates.io-index","package":"rustls-webpki","public":null,"artifact":null,"bindep_target":null,"lib":false},{"name":"x509-parser","req":"^0.18","features":[],"optional":false,"default_features":true,"target":null,"kind":"dev","registry":"https://github.com/rust-lang/crates.io-index","package":null,"public":null,"artifact":null,"bindep_target":null,"lib":false},{"name":"yasna","req":"^0.5.2","features":[],"optional":false,"default_features":true,"target":null,"kind":"dev","registry":"https://github.com/rust-lang/crates.io-index","package":null,"public":null,"artifact":null,"bindep_target":null,"lib":false}],"features":{},"features2":null,"cksum":"ffb5a4605d5c62c1d4c58621b8852e6b36a8e75995ec2003b735ddb0bac7c1b5","yanked":null,"links":null,"rust_version":null,"v":2}

vendor/webpki-roots/tests/codegen.rs

@@ -0,0 +1,172 @@
+use std::ascii::escape_default;
+use std::fmt::Write;
+use std::fs;
+
+use aws_lc_rs::digest;
+use pki_types::CertificateDer;
+use webpki::anchor_from_trusted_cert;
+use webpki_ccadb::fetch_ccadb_roots;
+use x509_parser::prelude::AttributeTypeAndValue;
+use x509_parser::x509::X509Name;
+
+#[tokio::test]
+async fn new_generated_code_is_fresh() {
+    let tls_roots_map = fetch_ccadb_roots().await;
+    let mut code = String::with_capacity(256 * 1_024);
+    code.push_str(HEADER);
+    code.push_str("pub const TLS_SERVER_ROOTS: &[TrustAnchor<'static>] = &[\n");
+    let (mut subject, mut spki, mut name_constraints) =
+        (String::new(), String::new(), String::new());
+
+    for root in tls_roots_map.values() {
+        // Verify the DER FP matches the metadata FP.
+        let der = root.der();
+        let calculated_fp = digest::digest(&digest::SHA256, &der);
+        let metadata_fp = hex::decode(&root.sha256_fingerprint).expect("malformed fingerprint");
+        assert_eq!(calculated_fp.as_ref(), metadata_fp.as_slice());
+
+        let ta_der = CertificateDer::from(der.as_ref());
+        let ta = anchor_from_trusted_cert(&ta_der).expect("malformed trust anchor der");
+        subject.clear();
+        for &b in ta.subject.as_ref() {
+            write!(&mut subject, "{}", escape_default(b)).unwrap();
+        }
+
+        spki.clear();
+        for &b in ta.subject_public_key_info.as_ref() {
+            write!(&mut spki, "{}", escape_default(b)).unwrap();
+        }
+
+        name_constraints.clear();
+        if let Some(nc) = &root.mozilla_applied_constraints() {
+            for &b in nc.iter() {
+                write!(&mut name_constraints, "{}", escape_default(b)).unwrap();
+            }
+        }
+
+        let (_, parsed_cert) =
+            x509_parser::parse_x509_certificate(&der).expect("malformed x509 der");
+        let issuer = name_to_string(parsed_cert.issuer());
+        let subject_str = name_to_string(parsed_cert.subject());
+        let label = root.common_name_or_certificate_name.clone();
+        let serial = root.serial().to_string();
+        let sha256_fp = root.sha256_fp();
+
+        // Write comment
+        code.push_str("  /*\n");
+        code.push_str(&format!("   * Issuer: {issuer}\n"));
+        code.push_str(&format!("   * Subject: {subject_str}\n"));
+        code.push_str(&format!("   * Label: {label:?}\n"));
+        code.push_str(&format!("   * Serial: {serial}\n"));
+        code.push_str(&format!("   * SHA256 Fingerprint: {sha256_fp}\n"));
+        for ln in root.pem().lines() {
+            code.push_str("   * ");
+            code.push_str(ln.trim());
+            code.push('\n');
+        }
+        code.push_str("   */\n");
+
+        // Write the code
+        code.push_str("  TrustAnchor {\n");
+        code.write_fmt(format_args!(
+            "    subject: Der::from_slice(b\"{subject}\"),\n"
+        ))
+        .unwrap();
+        code.write_fmt(format_args!(
+            "    subject_public_key_info: Der::from_slice(b\"{spki}\"),\n"
+        ))
+        .unwrap();
+        match name_constraints.is_empty() {
+            false => code
+                .write_fmt(format_args!(
+                    "    name_constraints: Some(Der::from_slice(b\"{name_constraints}\"))\n"
+                ))
+                .unwrap(),
+            true => code.push_str("    name_constraints: None\n"),
+        }
+        code.push_str("  },\n\n");
+    }
+    code.push_str("];\n");
+
+    // Check that the generated code matches the checked-in code
+    let old = fs::read_to_string("src/lib.rs").unwrap();
+    if old != code {
+        fs::write("src/lib.rs", code).unwrap();
+        panic!("generated code changed");
+    }
+}
+
+/// The built-in x509_parser::X509Name Display impl uses a different sort order than
+/// the one historically used by mkcert.org^[0]. We re-create that sort order here to
+/// avoid unnecessary churn in the generated code.
+///
+/// [0]: <https://github.com/Lukasa/mkcert/blob/6911a8f68681f4d6a795c1f6db7b063f75b03b5a/certs/convert_mozilla_certdata.go#L405-L428>
+fn name_to_string(name: &X509Name) -> String {
+    let mut ret = String::with_capacity(256);
+
+    if let Some(cn) = name
+        .iter_common_name()
+        .next()
+        .and_then(|cn| cn.as_str().ok())
+    {
+        write!(ret, "CN={cn}").unwrap();
+    }
+
+    let mut append_attrs = |attrs: Vec<&AttributeTypeAndValue>, label| {
+        let str_parts = attrs
+            .iter()
+            .filter_map(|attr| attr.as_str().ok())
+            .collect::<Vec<_>>()
+            .join("/");
+        if !str_parts.is_empty() {
+            if !ret.is_empty() {
+                ret.push(' ');
+            }
+            write!(ret, "{label}={str_parts}").unwrap();
+        }
+    };
+
+    append_attrs(name.iter_organization().collect(), "O");
+    append_attrs(name.iter_organizational_unit().collect(), "OU");
+
+    ret
+}
+
+const HEADER: &str = r#"//! A compiled-in copy of the root certificates trusted by Mozilla.
+//!
+//! To use this library with rustls 0.22:
+//!
+//! ```rust
+//! let root_store = rustls::RootCertStore {
+//!   roots: webpki_roots::TLS_SERVER_ROOTS.to_vec(),
+//! };
+//! ```
+//!
+//! This library is suitable for use in applications that can always be recompiled and instantly deployed.
+//! For applications that are deployed to end-users and cannot be recompiled, or which need certification
+//! before deployment, consider a library that uses the platform native certificate verifier such as
+//! [rustls-platform-verifier]. This has the additional benefit of supporting OS provided CA constraints
+//! and revocation data.
+//!
+//! [rustls-platform-verifier]: https://docs.rs/rustls-platform-verifier
+//
+// This library is automatically generated from the Mozilla
+// IncludedCACertificateReportPEMCSV report via ccadb.org. Don't edit it.
+//
+// The generation is done deterministically so you can verify it
+// yourself by inspecting and re-running the generation process.
+
+#![no_std]
+#![forbid(unsafe_code, unstable_features)]
+#![deny(
+    elided_lifetimes_in_paths,
+    trivial_casts,
+    trivial_numeric_casts,
+    unused_import_braces,
+    unused_extern_crates,
+    unused_qualifications
+)]
+
+use pki_types::{Der, TrustAnchor};
+
+"#;

vendor/webpki-roots/tests/verify.rs

@@ -0,0 +1,202 @@
+use core::time::Duration;
+use std::convert::TryFrom;
+
+use pki_types::{CertificateDer, ServerName, SignatureVerificationAlgorithm, UnixTime};
+use rcgen::{
+    BasicConstraints, CertificateParams, CertifiedIssuer, DnType, IsCa, Issuer, KeyPair,
+    KeyUsagePurpose,
+};
+use webpki::{anchor_from_trusted_cert, EndEntityCert, Error, KeyUsage};
+use x509_parser::extensions::{GeneralName, NameConstraints as X509ParserNameConstraints};
+use x509_parser::prelude::FromDer;
+
+use webpki_roots::TLS_SERVER_ROOTS;
+
+#[test]
+fn name_constraints() {
+    for name_constraints in TLS_SERVER_ROOTS
+        .iter()
+        .filter_map(|ta| ta.name_constraints.as_ref())
+    {
+        let time = UnixTime::since_unix_epoch(Duration::from_secs(0x40000000)); // Time matching rcgen default.
+        let test_case = ConstraintTest::new(name_constraints.as_ref());
+        let trust_anchors = &[anchor_from_trusted_cert(&test_case.trust_anchor).unwrap()];
+
+        // Each permitted EE should verify without error.
+        for permitted_ee in test_case.permitted_certs {
+            webpki::EndEntityCert::try_from(&permitted_ee)
+                .unwrap()
+                .verify_for_usage(
+                    ALL_ALGORITHMS,
+                    trust_anchors,
+                    &[],
+                    time,
+                    KeyUsage::server_auth(),
+                    None,
+                    None,
+                )
+                .unwrap();
+        }
+
+        // Each forbidden EE should fail to verify with the expected name constraint error.
+        for forbidden_ee in test_case.forbidden_certs {
+            let ee = EndEntityCert::try_from(&forbidden_ee).unwrap();
+            let result = ee.verify_for_usage(
+                ALL_ALGORITHMS,
+                trust_anchors,
+                &[],
+                time,
+                KeyUsage::server_auth(),
+                None,
+                None,
+            );
+            assert!(matches!(result, Err(Error::NameConstraintViolation)));
+        }
+    }
+}
+
+struct ConstraintTest {
+    trust_anchor: CertificateDer<'static>,
+    permitted_certs: Vec<CertificateDer<'static>>,
+    forbidden_certs: Vec<CertificateDer<'static>>,
+}
+
+impl ConstraintTest {
+    fn new(webpki_name_constraints: &[u8]) -> Self {
+        let name_constraints = rcgen_name_constraints(webpki_name_constraints);
+
+        // Create a trust anchor CA certificate that has the name constraints we want to test.
+        let trust_anchor = {
+            let mut params = CertificateParams::new([]).unwrap();
+            params
+                .distinguished_name
+                .push(DnType::CommonName, "Name Constraint Test CA");
+            params.is_ca = IsCa::Ca(BasicConstraints::Unconstrained);
+            params.key_usages = vec![
+                KeyUsagePurpose::KeyCertSign,
+                KeyUsagePurpose::DigitalSignature,
+            ];
+            params.name_constraints = Some(name_constraints.clone());
+
+            let key = KeyPair::generate().unwrap();
+            CertifiedIssuer::self_signed(params, key).unwrap()
+        };
+
+        let certs_for_subtrees = |suffix| {
+            name_constraints
+                .permitted_subtrees
+                .iter()
+                .filter_map(|subtree| match subtree {
+                    rcgen::GeneralSubtree::DnsName(dns_name) => Some(rcgen_ee_for_name(
+                        format!("valid{dns_name}{suffix}"),
+                        &trust_anchor,
+                    )),
+                    _ => None,
+                })
+                .collect()
+        };
+
+        Self {
+            // For each permitted subtree in the name constraints, issue an end entity certificate
+            // that contains a DNS name matching the permitted subtree base.
+            permitted_certs: certs_for_subtrees(""),
+            // For each permitted subtree in the name constraints, issue an end entity certificate
+            // that contains a DNS name that will **not** match the permitted subtree base.
+            forbidden_certs: certs_for_subtrees(".invalid"),
+            trust_anchor: trust_anchor.der().to_owned(),
+        }
+    }
+}
+
+fn rcgen_ee_for_name(name: String, issuer: &Issuer<'_, KeyPair>) -> CertificateDer<'static> {
+    let mut ee = CertificateParams::new(vec![name.clone()]).unwrap();
+    ee.distinguished_name.push(DnType::CommonName, name);
+    ee.is_ca = IsCa::NoCa;
+    let key_pair = KeyPair::generate().unwrap();
+    ee.signed_by(&key_pair, issuer).unwrap().into()
+}
+
+/// Convert the webpki trust anchor DER encoding of name constraints to rcgen NameConstraints.
+fn rcgen_name_constraints(der: &[u8]) -> rcgen::NameConstraints {
+    // x509 parser expects the outer SEQUENCE that the webpki trust anchor representation elides
+    // so wrap the DER up.
+    let wrapped_der = yasna::construct_der(|writer| {
+        writer.write_sequence(|writer| {
+            writer.next().write_der(der);
+        })
+    });
+
+    // Constraints should parse with no trailing data.
+    let (trailing, constraints) = X509ParserNameConstraints::from_der(&wrapped_der).unwrap();
+    assert!(
+        trailing.is_empty(),
+        "unexpected trailing DER in name constraint"
+    );
+
+    // There should be at least one permitted subtree.
+    assert!(
+        constraints.permitted_subtrees.is_some(),
+        "empty permitted subtrees in constraints"
+    );
+
+    // We don't expect any excluded subtrees as this time.
+    assert!(constraints.excluded_subtrees.is_none());
+
+    // Collect all of the DNS names from the x509-parser representation, mapping to the rcgen
+    // representation usable in cert parameters. We don't expect to find any other types of general
+    // name and x509-parser doesn't parse the subtree minimum and maximum (which we would assert to
+    // be missing for proper encoding anyway).
+    let permitted_subtrees = match constraints.permitted_subtrees {
+        None => Vec::default(),
+        Some(subtrees) => subtrees
+            .iter()
+            .map(|subtree| match &subtree.base {
+                GeneralName::DNSName(base) => rcgen::GeneralSubtree::DnsName(base.to_string()),
+                name => panic!("unexpected subtree base general name type: {name}"),
+            })
+            .collect(),
+    };
+
+    rcgen::NameConstraints {
+        permitted_subtrees,
+        excluded_subtrees: Vec::default(),
+    }
+}
+
+#[test]
+fn tubitak_name_constraint_works() {
+    let root = CertificateDer::from(&include_bytes!("data/tubitak/root.der")[..]);
+    let inter = CertificateDer::from(&include_bytes!("data/tubitak/inter.der")[..]);
+    let subj = CertificateDer::from(&include_bytes!("data/tubitak/subj.der")[..]);
+
+    let roots = [anchor_from_trusted_cert(&root).unwrap().to_owned()];
+    let now = UnixTime::since_unix_epoch(Duration::from_secs(1493668479));
+    let cert = EndEntityCert::try_from(&subj).unwrap();
+    cert.verify_for_usage(
+        ALL_ALGORITHMS,
+        &roots,
+        &[inter, root],
+        now,
+        KeyUsage::server_auth(),
+        None,
+        None,
+    )
+    .unwrap();
+
+    let subject = ServerName::try_from("testssl.kamusm.gov.tr").unwrap();
+    cert.verify_is_valid_for_subject_name(&subject).unwrap();
+}
+
+static ALL_ALGORITHMS: &[&dyn SignatureVerificationAlgorithm] = &[
+    webpki::aws_lc_rs::ECDSA_P256_SHA256,
+    webpki::aws_lc_rs::ECDSA_P256_SHA384,
+    webpki::aws_lc_rs::ECDSA_P384_SHA256,
+    webpki::aws_lc_rs::ECDSA_P384_SHA384,
+    webpki::aws_lc_rs::RSA_PKCS1_2048_8192_SHA256,
+    webpki::aws_lc_rs::RSA_PKCS1_2048_8192_SHA384,
+    webpki::aws_lc_rs::RSA_PKCS1_2048_8192_SHA512,
+    webpki::aws_lc_rs::RSA_PKCS1_3072_8192_SHA384,
+    webpki::aws_lc_rs::RSA_PSS_2048_8192_SHA256_LEGACY_KEY,
+    webpki::aws_lc_rs::RSA_PSS_2048_8192_SHA384_LEGACY_KEY,
+    webpki::aws_lc_rs::RSA_PSS_2048_8192_SHA512_LEGACY_KEY,
+];