Remove orphaned native logging that nothing reached:
- The /sdcard/Download zip dump (NativeCertGen.dump and the dumpLogs
JNI, dump_logs_inner, dump.rs, pub mod dump), superseded by the
diag.sh export.
- The verbose-marker helpers (sysfs.rs, pub mod sysfs); the manual
.verbose toggle still works via mod.rs::init's inline check.
Drop the now-unused direct deps zip and libc and the orphaned jstring
import. cargo ndk build is warning-clean.
DuckDetector flagged two issues:
1. Oversized challenge accepted, 256-byte attestation challenge should
return INVALID_INPUT_LENGTH (-21) like real KeyMint. Added early check
in handleGenerateKey before any path decision.
2. Issuer/subject chain mismatch, rcgen's HashMap loses DN attribute
ordering and converts PrintableString to UTF8String, producing
different DER bytes. Replaced rcgen with manual DER assembly that
injects raw keybox issuer_dn_der bytes directly.
Verified on device: TX_ID 315 rejects 256-byte challenge, TX_ID 501
generates valid 4-cert chain with correct issuer linkage.
Cargo.toml with 16 dependencies per build spec, error types with
From impls for all upstream error types, CertGenParams mapping the
full JNI config contract, EC/RSA key generation via ring and rsa crates.
Compiles clean for aarch64-linux-android via cargo-ndk.
Enginex0