[Baskerville42]

Summary

• accept encrypted PKCS#12 certificate safe contents and private-key bags
• support allow-listed SHA-1/3DES PBE and PBES2/PBKDF2 with AES-CBC
• bound KDF iterations and reject unsupported parameters fail-closed
• add production-shaped end-to-end profile signing coverage
• update patched test/documentation dependencies required by the audit gate

Verification

• npm ci --ignore-scripts --no-audit --no-fund
• npm run verify
• npm audit --audit-level=high
• npm audit signatures

[codecov]

Codecov Report

❌ Patch coverage is 93.33333% with 5 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/certificates/signing-material.ts	93.33%	0 Missing and 5 partials ⚠️

📢 Thoughts on this report? Let us know!