test(xmldsig): auto-resolve donor KeyInfo vectors

[polaz]

Problem

P2-009a requires supported Aleksey and Merlin XMLDSig vectors to verify through DefaultKeyResolver without a preset PEM key. Embedded X.509 resolution is wired, but the donor suite still supplies preset keys and selector-only X509Data cannot search configured certificates, leaving the Aleksey X509Digest vector skipped.

Implementation

• Match selector-only X509Data against caller-provided trusted_certs by X509Digest, SubjectName, IssuerSerial, and SKI.
• Keep ordered KeyInfo resolution and signature-algorithm validation fail-closed.
• Add the Aleksey RSA X.509 chain vector and required anchor through a reproducible fixture import process.
• Verify supported embedded-certificate and embedded-chain donor vectors with DefaultKeyResolver, without VerifyContext::key or preset PEM helpers.
• Update donor pass/skip accounting so only genuinely unsupported DSA and weak-key vectors remain skipped.

Acceptance criteria

• The Aleksey X509Digest-only RSA-SHA512 vector resolves from configured certificates and verifies.
• Embedded RSA X509Data vectors verify without preset keys.
• The Aleksey embedded RSA chain verifies in TOFU mode and with chain validation against its configured root.
• Non-matching selectors and algorithm-incompatible certificates do not resolve.
• cargo check, clippy, all-feature build, nextest, and doctests pass.

Estimate

2d including resolver implementation, fixture import, donor integration tests, full validation, and review overhead.

[coderabbitai]

🔗 Related PRs

#41 - test(xmldsig): add donor full verification suite accounting [closed]
#53 - feat(xmldsig): parse X509Certificate with x509-parser [merged]
#63 - feat(xmldsig): verify x509 certificate chains [merged]
#66 - feat(xmldsig): add key resolver configuration [merged]
#68 - feat(xmldsig): resolve RSAKeyValue keys [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!