Shared storage infrastructure and provider capability routing for certificate management

score/crypto/docs/architecture/api_description.rst

@@ -40,8 +40,8 @@ The API uses a two-phase resource identification model:
 
    struct CryptoResourceId {
        uint64_t id;                   // daemon-assigned, unique per session
-       ResourceType type;             // kProvider, kKeySlot, kCertSlot, kVerificationTrustStore,
-                                      // kKey, kCertificate, kCrl, kSecureObject, kDataObject
+       ResourceType type;             // kProvider, kKeySlot, kCertSlot, kCertificateTrustStore,
+                                      // kKey, kCertificate, kSecureObject, kDataObject
        ResourcePersistence persistence; // kPersistent or kEphemeral
        uint16_t primary_provider;     // owning device/provider index (0 = unbound)
    };

score/crypto/docs/architecture/design_decisions.rst

@@ -336,7 +336,7 @@ Scope
 ^^^^^
 
 Applies to ``kPersistent`` resources only: ``kKeySlot``, ``kCertificate``,
-``kCertSlot``, ``kVerificationTrustStore``. Ephemeral (``kKey``) IDs remain session-scoped
+``kCertSlot``, ``kCertificateTrustStore``. Ephemeral (``kKey``) IDs remain session-scoped
 (valid only within the ``IKeyManagementContext`` session that produced them).
 
 IPC Schema

score/crypto/docs/architecture/dynamic_architecture.rst

@@ -19,7 +19,7 @@ API Dynamic Architecture
 
 
 .. code-block:: rst
-   
+
    .. comp_arc_dyn:: Dynamic View
       :id: comp_arc_dyn__crypto__dynamic_view
       :security: YES
@@ -208,7 +208,7 @@ Certificate Verification
 
    // Resolve certificate and verification trust store
    auto cert = ctx->ResolveResource("DeviceCert", ResourceType::kCertSlot).value();
-   auto anchor = ctx->ResolveResource("RootCA", ResourceType::kVerificationTrustStore).value();
+   auto anchor = ctx->ResolveResource("RootCA", ResourceType::kCertificateTrustStore).value();
 
    // Verify using builder-style context
    CertificateVerificationContextConfig verify_cfg;

score/crypto/docs/architecture/key_management_class_diagram.puml

@@ -184,7 +184,7 @@ package "Slot Management" <<Rectangle>> #F0F8FF {
 }
 
 ' ====================================================================
-' SLOT DEPLOYMENT  (slot/deployment/)
+' SLOT DEPLOYMENT  (slot/ façades → daemon/common/storage/ implementations)
 ' ====================================================================
 package "Slot Deployment" <<Rectangle>> #E8F0FE {
 
@@ -225,12 +225,13 @@ package "Slot Deployment" <<Rectangle>> #E8F0FE {
         + Load(path : string) : Expected<SlotDeploymentInfo, DaemonErrorCode>
         .. parses [metadata] / [key] key=value sections ..
         .. blank lines and # comments ignored ..
+        .. delegates to file_io::ReadFile (score::filesystem) ..
     }
 
     class KvDeploymentWriter {
         + Write(path : string, info : SlotDeploymentInfo) : Expected<monostate, DaemonErrorCode>
         .. writes [metadata] then [key] sections ..
-        .. opens with ios::trunc ..
+        .. delegates to file_io::WriteFile (atomic write via score::filesystem) ..
     }
 }
 

score/crypto/docs/architecture/key_management_details.rst

@@ -619,22 +619,23 @@ implements ``IDeploymentLoader`` / ``IDeploymentWriter``:
 
 .. code-block:: text
 
-   slot/
-     deployment_loader.hpp/.cpp        ← façade (public API unchanged for all callers)
+   key_management/slot/
+     deployment_loader.hpp/.cpp        ← façade (delegates to common/storage/ impls)
      deployment_writer.hpp/.cpp        ← façade
-     deployment/
-       deployment_path_utils.hpp       ← IsDeploymentPathSafe() — shared guard
-       i_deployment_loader.hpp         ← pure-virtual interface
-       i_deployment_writer.hpp         ← pure-virtual interface
-       kv/
-         kv_deployment_loader.hpp/.cpp ← current implementation
-         kv_deployment_writer.hpp/.cpp
-       json/                           ← reserved (add JsonDeploymentLoader when needed)
-       flatbuffer/                     ← reserved
+
+   daemon/common/storage/              ← shared by key_management and cert_management
+     deployment_path_utils.hpp         ← IsDeploymentPathSafe() — shared guard
+     i_deployment_loader.hpp           ← pure-virtual interface
+     i_deployment_writer.hpp           ← pure-virtual interface
+     kv/
+       kv_deployment_loader.hpp/.cpp   ← current implementation
+       kv_deployment_writer.hpp/.cpp   ← writes atomically via file_io::WriteFile
+     json/                             ← reserved (add JsonDeploymentLoader when needed)
+     flatbuffer/                       ← reserved
 
 To add a new format: implement ``IDeploymentLoader`` / ``IDeploymentWriter`` under
-``slot/deployment/<format>/``, then add one ``if``-branch in each façade ``.cpp``
-and one dep in ``slot/deployment/BUILD``.  No other files change.
+``daemon/common/storage/<format>/``, then add one ``if``-branch in each façade ``.cpp``
+and one dep in ``daemon/common/storage/BUILD``.  No other files change.
 
 **Key=value format (``"kv"``) — file layout**
 

score/crypto/src/api/certificate/BUILD

@@ -0,0 +1,29 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+
+load("@rules_cc//cc:defs.bzl", "cc_library")
+
+cc_library(
+    name = "cert_types",
+    hdrs = [
+        "cert_types.hpp",
+        "i_ocsp_request_export.hpp",
+    ],
+    includes = ["."],
+    visibility = ["//visibility:public"],
+    deps = [
+        "//score/crypto/src/api/common:crypto_common",
+        "@score_baselibs//score/language/futurecpp",
+        "@score_baselibs//score/result",
+    ],
+)

score/crypto/src/api/future/certificate/cert_types.hpp → score/crypto/src/api/certificate/cert_types.hpp

@@ -11,8 +11,8 @@
  * SPDX-License-Identifier: Apache-2.0
  ********************************************************************************/
 
-#ifndef SCORE_CRYPTO_SRC_API_FUTURE_CERTIFICATE_CERT_TYPES_HPP
-#define SCORE_CRYPTO_SRC_API_FUTURE_CERTIFICATE_CERT_TYPES_HPP
+#ifndef SCORE_CRYPTO_SRC_API_CERTIFICATE_CERT_TYPES_HPP
+#define SCORE_CRYPTO_SRC_API_CERTIFICATE_CERT_TYPES_HPP
 
 #include "score/crypto/src/api/common/types.hpp"
 
@@ -39,6 +39,15 @@ enum class CertVerifyResult : uint8_t
     kUnknownError       ///< Unspecified verification failure
 };
 
+/// @brief Controls where certificate-chain verification may terminate.
+enum class ChainTerminationPolicy : uint8_t
+{
+    /// Require a complete path ending at a self-signed trust-store root.
+    kRootRequired,
+    /// Permit termination at the first certificate present in the trust store.
+    kTrustStoreTerminated
+};
+
 /// @brief Status of an OCSP response.
 enum class OcspStatus : uint8_t
 {
@@ -52,4 +61,4 @@ enum class OcspStatus : uint8_t
 
 }  // namespace score
 
-#endif  // SCORE_CRYPTO_SRC_API_FUTURE_CERTIFICATE_CERT_TYPES_HPP
+#endif  // SCORE_CRYPTO_SRC_API_CERTIFICATE_CERT_TYPES_HPP

score/crypto/src/api/future/certificate/i_ocsp_request_export.hpp → score/crypto/src/api/certificate/i_ocsp_request_export.hpp

@@ -11,8 +11,8 @@
  * SPDX-License-Identifier: Apache-2.0
  ********************************************************************************/
 
-#ifndef SCORE_CRYPTO_SRC_API_FUTURE_CERTIFICATE_I_OCSP_REQUEST_EXPORT_HPP
-#define SCORE_CRYPTO_SRC_API_FUTURE_CERTIFICATE_I_OCSP_REQUEST_EXPORT_HPP
+#ifndef SCORE_CRYPTO_SRC_API_CERTIFICATE_I_OCSP_REQUEST_EXPORT_HPP
+#define SCORE_CRYPTO_SRC_API_CERTIFICATE_I_OCSP_REQUEST_EXPORT_HPP
 
 #include "score/result/result.h"
 #include "score/span.hpp"
@@ -61,4 +61,4 @@ class IOcspRequestExport
 
 }  // namespace score
 
-#endif  // SCORE_CRYPTO_SRC_API_FUTURE_CERTIFICATE_I_OCSP_REQUEST_EXPORT_HPP
+#endif  // SCORE_CRYPTO_SRC_API_CERTIFICATE_I_OCSP_REQUEST_EXPORT_HPP

score/crypto/src/api/common/types.hpp

@@ -57,17 +57,15 @@ using AlgorithmId = FixedCapacityString<64>;
 /// kKeySlot and kCertSlot identify only persistent storage locations.
 enum class ResourceType : uint8_t
 {
-    kProvider,                ///< Crypto provider / device
-    kKeySlot,                 ///< Persistent key storage slot
-    kCertSlot,                ///< Persistent certificate storage slot
-    kVerificationTrustStore,  ///< Named group of trusted CA certificates used for certificate chain
-                              ///< verification.
-    kKey,                     ///< Key material (generated / loaded / derived / imported)
-    kCertificate,             ///< Parsed or stored certificate object
-    kCrl,                     ///< Certificate Revocation List — shares the same numeric id
-                              ///< as the issuer certificate resource (differentiated by type field)
-    kSecureObject,            ///< Secure storage entry
-    kDataObject               ///< Generic data blob
+    kProvider,               ///< Crypto provider / device
+    kKeySlot,                ///< Persistent key storage slot
+    kCertSlot,               ///< Persistent certificate storage slot
+    kCertificateTrustStore,  ///< Named group of trusted CA certificates used for certificate chain
+                             ///< verification.
+    kKey,                    ///< Key material (generated / loaded / derived / imported)
+    kCertificate,            ///< Parsed or stored certificate object.
+    kSecureObject,           ///< Secure storage entry
+    kDataObject              ///< Generic data blob
 };
 
 /// @brief Persistence classification of a crypto resource.
@@ -133,6 +131,18 @@ enum class KeySlotState : uint8_t
     kLocked     ///< Slot is in use and cannot be modified
 };
 
+/// @brief State of a certificate slot.
+///
+/// Certificate slots contain certificate/CRL storage and are not bound to a
+/// certificate-operation provider. Provider selection is made by the
+/// operation/context that parses or verifies the material.
+enum class CertificateSlotState : uint8_t
+{
+    kEmpty,     ///< Slot contains no certificate
+    kOccupied,  ///< Slot contains a certificate
+    kLocked     ///< Slot is in use and cannot be modified
+};
+
 /// @brief Validity status of a certificate.
 enum class CertificateStatus : uint8_t
 {
@@ -284,14 +294,15 @@ inline constexpr bool HasPermission(KeyOperationPermission granted, KeyOperation
     return (g & r) == r;
 }
 
-/// @brief Information about a certificate slot and its contents.
+/// @brief Lightweight information about certificate-slot storage.
 ///
 /// Returned by ICertificateManagementContext::GetCertificateSlotInfo().
+/// Certificate-specific details such as subject, issuer, algorithm, and
+/// validity are obtained by loading/parsing the certificate.
 struct CertificateSlotInfo
 {
-    bool occupied{false};           ///< Whether the slot contains a certificate
-    AlgorithmId algorithm{};        ///< Public key algorithm of the stored certificate (empty if unoccupied)
-    uint16_t primary_provider{0U};  ///< Provider/device that owns this slot
+    CertificateSlotState state{CertificateSlotState::kEmpty};
+    bool has_crl{false};  ///< Whether a CRL is currently associated with the slot
 };
 
 /// @brief Information about a key slot and its contents.

score/crypto/src/api/config/BUILD

@@ -29,3 +29,17 @@ cc_library(
         "//score/crypto/src/api/common:crypto_common",
     ],
 )
+
+cc_library(
+    name = "cert_context_configs",
+    hdrs = [
+        "certificate_context_config.hpp",
+        "certificate_verification_context_config.hpp",
+    ],
+    includes = ["."],
+    visibility = ["//visibility:public"],
+    deps = [
+        ":context_configs",
+        "//score/crypto/src/api/common:crypto_common",
+    ],
+)

score/crypto/src/api/future/config/certificate_context_config.hpp → score/crypto/src/api/config/certificate_context_config.hpp

@@ -11,8 +11,8 @@
  * SPDX-License-Identifier: Apache-2.0
  ********************************************************************************/
 
-#ifndef SCORE_CRYPTO_SRC_API_FUTURE_CONFIG_CERTIFICATE_CONTEXT_CONFIG_HPP
-#define SCORE_CRYPTO_SRC_API_FUTURE_CONFIG_CERTIFICATE_CONTEXT_CONFIG_HPP
+#ifndef SCORE_CRYPTO_SRC_API_CONFIG_CERTIFICATE_CONTEXT_CONFIG_HPP
+#define SCORE_CRYPTO_SRC_API_CONFIG_CERTIFICATE_CONTEXT_CONFIG_HPP
 
 #include "score/crypto/src/api/config/base_context_config.hpp"
 
@@ -67,4 +67,4 @@ struct CertificateContextConfig : public BaseContextConfig
 
 }  // namespace score
 
-#endif  // SCORE_CRYPTO_SRC_API_FUTURE_CONFIG_CERTIFICATE_CONTEXT_CONFIG_HPP
+#endif  // SCORE_CRYPTO_SRC_API_CONFIG_CERTIFICATE_CONTEXT_CONFIG_HPP

score/crypto/src/api/future/config/certificate_verification_context_config.hpp → score/crypto/src/api/config/certificate_verification_context_config.hpp

@@ -11,8 +11,8 @@
  * SPDX-License-Identifier: Apache-2.0
  ********************************************************************************/
 
-#ifndef SCORE_CRYPTO_SRC_API_FUTURE_CONFIG_CERTIFICATE_VERIFICATION_CONTEXT_CONFIG_HPP
-#define SCORE_CRYPTO_SRC_API_FUTURE_CONFIG_CERTIFICATE_VERIFICATION_CONTEXT_CONFIG_HPP
+#ifndef SCORE_CRYPTO_SRC_API_CONFIG_CERTIFICATE_VERIFICATION_CONTEXT_CONFIG_HPP
+#define SCORE_CRYPTO_SRC_API_CONFIG_CERTIFICATE_VERIFICATION_CONTEXT_CONFIG_HPP
 
 #include "score/crypto/src/api/common/types.hpp"
 #include "score/crypto/src/api/config/base_context_config.hpp"
@@ -86,4 +86,4 @@ struct CertificateVerificationContextConfig : public BaseContextConfig
 
 }  // namespace score
 
-#endif  // SCORE_CRYPTO_SRC_API_FUTURE_CONFIG_CERTIFICATE_VERIFICATION_CONTEXT_CONFIG_HPP
+#endif  // SCORE_CRYPTO_SRC_API_CONFIG_CERTIFICATE_VERIFICATION_CONTEXT_CONFIG_HPP

score/crypto/src/api/contexts/BUILD

@@ -48,6 +48,25 @@ cc_library(
     ],
 )
 
+cc_library(
+    name = "cert_contexts",
+    hdrs = [
+        "i_certificate_management_context.hpp",
+        "i_certificate_verification_context.hpp",
+    ],
+    includes = ["."],
+    visibility = ["//visibility:public"],
+    deps = [
+        ":context_bases",
+        "//score/crypto/src/api/certificate:cert_types",
+        "//score/crypto/src/api/common:crypto_common",
+        "//score/crypto/src/api/config:cert_context_configs",
+        "//score/crypto/src/api/objects:cert_objects",
+        "@score_baselibs//score/language/futurecpp",
+        "@score_baselibs//score/result",
+    ],
+)
+
 cc_library(
     name = "crypto_contexts_impl",
     srcs = [