// calogTrust.h -- where a TLS client finds its trust anchors.
//
// One implementation, shared by every calog library that verifies a server certificate: the http
// client and the tcp transport's client-side TLS both call calogTrustLoad. It lived inside
// calogHttp.c until 2026-09-11, when the tcp transport needed it too; a second copy of "which
// bundle does this operating system keep its roots in" is the last thing that should exist twice.

#ifndef CALOG_TRUST_H
#define CALOG_TRUST_H

#include <stdbool.h>

#include <openssl/ssl.h>

// Load the host's trust anchors into ctx. OpenSSL's own defaults resolve nothing on their own, so
// this consults the operating system directly (the Windows system stores, the macOS keychain, or
// the distro CA-bundle files). Overrides are honoured ahead of the native store, highest priority
// first: CALOG_CA_BUNDLE (authoritative and EXCLUSIVE, so it can pin to a private CA and fails
// closed if it will not load), then the OpenSSL-standard SSL_CERT_FILE / SSL_CERT_DIR.
//
// Returns true only if a trust source actually loaded -- not merely because an override variable is
// set -- so a caller can fail with a clear "no trust store" error rather than a misleading
// per-certificate verification failure.
bool calogTrustLoad(SSL_CTX *ctx);

#endif