wimse — spiffe-id

**SPIFFE / WIMSE URI parsing library. Zero runtime deps, no_std-friendly.

This repo hosts the spiffe-id crate: a typed SpiffeId newtype that parses and validates SPIFFE-ID URIs (spiffe://<trust-domain>/<path>) and the WIMSE workload-identifier grammar (ns/<namespace>/sa/<service-account>[/<extra>...]).

Field	Value
Crate	spiffe-id
License	MIT
no_std	yes — core + alloc only, no I/O, no crypto (so aim-wasm can use it)

Usage

use spiffe_id::SpiffeId;

let id = SpiffeId::parse("spiffe://twn.network/ns/prod/sa/agent-orchestrator")?;
assert_eq!(id.trust_domain(), "twn.network");
assert_eq!(id.path(), "ns/prod/sa/agent-orchestrator");

// WIMSE workload view (None for non-WIMSE paths — not an error):
let wl = id.as_wimse_workload().unwrap();
assert_eq!(wl.namespace, "prod");
assert_eq!(wl.service_account, "agent-orchestrator");

// Round-trips back to the canonical URI:
assert_eq!(id.as_uri(), "spiffe://twn.network/ns/prod/sa/agent-orchestrator");
# Ok::<(), spiffe_id::ParseError>(())

Display / FromStr are implemented; enable the serde feature to (de)serialise as the URI string.

Features

• serde (off by default) — Serialize as the URI string, Deserialize via SpiffeId::parse.

What this crate does not do

ID-URI parsing only. SVID document parsing (X.509-SVID, JWT-SVID), trust-domain bundle management, the SPIFFE Workload API, and federation policy are all out of scope (other crates — see ROADMAP.md, and spiffe for the full stack). And — important — a valid SPIFFE ID is not authentication or authorization; the trust domain in an ID is whatever string was in the input, not a verified issuer. See the threat model.

Documentation

The API reference is the rustdoc (docs.rs/spiffe-id). Around it:

• FEATURES.md — what it does: the validation rules, the accessors, the error type, the serde feature, the properties.
• docs/THREAT-MODEL.md — what it defends against, what it doesn't, what's on you — for service operators, dependent-crate authors, and maintainers. Read before shipping.
• docs/INTEGRATION.md — taking the dependency, the parse-at-the-boundary pattern, wasm/embedded, where it fits in a SPIFFE pipeline, the supply-chain story.
• docs/IMPLEMENTATION.md — how it works inside: the parse pipeline, the canonical-form invariant, the no_std strategy, the test strategy.
• ROADMAP.md — what's done, what's next, and what's deliberately out of scope (and why).
• docs/README.md — the index of all of the above.

Project & security

• SECURITY.md — report a vulnerability privately (security@twn.systems or GitHub private vulnerability reporting); scope, supported versions, disclosure process, safe harbour.
• docs/playbooks/ — maintainer runbooks: the GHSA / vulnerability-response playbook and the maintainer-compromise playbook.
• CONTRIBUTING.md · CODE_OF_CONDUCT.md · GOVERNANCE.md · CHANGELOG.md.