feat(http): add SPKI pinning extension (fix #3414)

[patlux]

Motivation

Implements the SPKI pinning request from #3414 on top of the native transport extension API in the preceding PR.

The JavaScript fetch API remains unchanged. Pin configuration is native Rust code and cannot be disabled by frontend request options.

Security behavior

• Normal WebPKI certificate-chain, validity, signature, and hostname validation runs first.
• The SHA-256 digest of the leaf certificate's DER SubjectPublicKeyInfo is then matched against exact-host pins.
• Multiple pins per host support safe server-key rotation.
• Every HTTPS host, including redirect targets, requires pins by default.
• The client is HTTPS-only by default, preventing downgrade redirects.
• allow_unpinned_hosts() and allow_http() are explicit native opt-ins.
• Dangerous certificate and hostname settings are rejected while the extension is installed.
• Failures are returned as structured extension errors through the unchanged plugin IPC API.

API

let pinning = tauri_plugin_http::SpkiPinning::new()
    .pin("api.example.com", "sha256/CURRENT_BASE64_SPKI_HASH")?
    .pin("api.example.com", "sha256/BACKUP_BASE64_SPKI_HASH")?;

tauri::Builder::default().plugin(
    tauri_plugin_http::Builder::new()
        .extension(pinning)
        .build(),
);

The implementation is behind the optional spki-pinning Cargo feature, so applications that do not use it do not receive its Rustls, X.509, and hashing dependencies.

Depends on #3538 and should be reviewed as a stacked change. The second commit contains the SPKI-specific delta; once #3538 merges, this PR automatically reduces to that commit.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​rcgen@​0.13.2
	cargo/​x509-parser@​0.18.1

View full report