From 309621ac4519ef767adec6bcaaae674f4b257cac Mon Sep 17 00:00:00 2001
From: MattJackson <1085847+MattJackson@users.noreply.github.com>
Date: Thu, 4 Jun 2026 16:04:06 -0700
Subject: [PATCH] =?UTF-8?q?KeydbSource::host=5Fcerts()=20=E2=80=94=20the?=
 =?UTF-8?q?=20keydb's=20second=20data=20type,=20for=20DriveCredentials?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/keydb.rs | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/src/keydb.rs b/src/keydb.rs
index e480d07..2c90647 100644
--- a/src/keydb.rs
+++ b/src/keydb.rs
@@ -15,7 +15,7 @@
 
 use std::path::PathBuf;
 
-use libfreemkv::aacs::KeyDb;
+use libfreemkv::aacs::{HostCert, KeyDb};
 use libfreemkv::{DiscInputs, Key, KeySource, Result};
 
 /// A [`KeySource`] backed by a local `keydb.cfg` file.
@@ -29,6 +29,17 @@ impl KeydbSource {
         Self { path: path.into() }
     }
 
+    /// The host certificate(s) in this keydb — the second kind of data the one
+    /// keydb file holds (alongside decryption keys). The app passes these to the
+    /// live-drive scan as `DriveCredentials` for the AACS handshake. Empty if
+    /// the keydb is missing/unreadable or carries no host cert.
+    pub fn host_certs(&self) -> Vec<HostCert> {
+        match KeyDb::load(&self.path) {
+            Ok(db) => db.host_certs,
+            Err(_) => Vec::new(),
+        }
+    }
+
     /// Build the ordered candidate list from a parsed keydb. Pure (no I/O), so
     /// it is unit-testable without a file on disk.
     fn candidates_from(db: &KeyDb, inputs: &DiscInputs) -> Vec<Key> {