These guides describe the current source tree. Versioned rustdoc on
docs.rs describes the published crate, which may lag
main; use the matching release tag when reproducing a deployed API. In
particular the policy-bound XmlSecurity facade is an unreleased API after 0.2.0.
No 1.0 release, full C compatibility or independent security certification is
implied by this documentation.
| Goal | Guide |
|---|---|
| Sign, authorize signed targets, encrypt and decrypt in Rust | Policy-bound Rust API |
| Run high-level and low-level examples | Executable examples |
| Select a deployment profile and compose restrictions | Profiles, deployment runbook |
| Load explicit policy configuration | Configuration, schema v1 |
| Replace a libxmlsec1 workflow | Migration guide, native CLI |
| Choose a provider and understand unsupported operations | Provider capability table, features |
- XMLDSig and authenticated reference queries
- XML Encryption and replacement
- Key inventory, certificates and caller UTC facts
- OPC Relationship transforms
- Compatibility and unsupported-case ledger
- XSLT conformance and performance
- Security invariants, historical regressions and CVE inventory
- Benchmarks and measurement boundaries
- Normative sources and standards audit
- Required CI, coverage and dependency gates
- Unreleased and published changes
Run cargo run -p xml-sec-tools -- documentation.
It rejects missing core/config public rustdoc and broken intra-doc links, compiles
doctests, executes both API levels and their rejection paths, and tests the
exact policy sample through the real configuration loader/compiler. It needs
Rust, cargo-nextest and the native FIPS build toolchain for
all-feature rustdoc, but no network oracle or token.
cargo run -p xml-sec-tools -- documentation docs runs only the core/config rustdoc gate.
Public core rustdoc covers exported library items, not the unpublished private
XPath/parser implementation kernels. Alloc-only (no std) and native-provider
qualification remain separate gates; a documentation pass does
not replace interoperability, fuzzing or an audit.