Function kid_from_public_key_der

crates/openshell-bootstrap/src/jwt.rs:60–63

Stable `kid` derived from the SHA-256 of the public-key DER. First 16 bytes hex-encoded — collision-resistant for the small N of signing keys a single deployment ever has, while staying short enough to keep JWT headers compact.

(public_key_der: &[u8])

/// signing keys a single deployment ever has, while staying short enough
/// to keep JWT headers compact.
fn kid_from_public_key_der(public_key_der: &[u8]) -> String {
    let digest = Sha256::digest(public_key_der);
    hex_encode_prefix(&digest, 16)
}

fn hex_encode_prefix(bytes: &[u8], n: usize) -> String {
    use std::fmt::Write as _;