apple · rafaelcepeda · Jul 14, 2025 · Jul 14, 2025 · Jul 14, 2025 · Jul 14, 2025
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -37,3 +37,5 @@ jobs:
     with:
       runner_pool: nightly
       build_scheme: swift-certificates
+      xcode_16_2_build_arguments_override: "-Xswiftc -Xfrontend -Xswiftc -require-explicit-sendable"
+      xcode_16_3_build_arguments_override: "-Xswiftc -Xfrontend -Xswiftc -require-explicit-sendable"
diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
@@ -54,3 +54,5 @@ jobs:
     with:
       runner_pool: general
       build_scheme: swift-certificates
+      xcode_16_2_build_arguments_override: "-Xswiftc -Xfrontend -Xswiftc -require-explicit-sendable"
+      xcode_16_3_build_arguments_override: "-Xswiftc -Xfrontend -Xswiftc -require-explicit-sendable"
diff --git a/Sources/X509/CSR/CSRAttribute.swift b/Sources/X509/CSR/CSRAttribute.swift
@@ -122,7 +122,7 @@ extension CertificateSigningRequest.Attribute: DERImplicitlyTaggable {
 
 extension ASN1ObjectIdentifier {
     /// Object Identifiers that identify attributes applied to CSRs.
-    public enum CSRAttributes {
+    public enum CSRAttributes: Sendable {
         /// A request to apply specific certificate extensions.
         public static let extensionRequest: ASN1ObjectIdentifier = [1, 2, 840, 113549, 1, 9, 14]
     }

diff --git a/Sources/X509/CryptographicMessageSyntax/CMSOperations.swift b/Sources/X509/CryptographicMessageSyntax/CMSOperations.swift
@@ -20,7 +20,7 @@ import SwiftASN1
 import Crypto
 
 @available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, macCatalyst 13, visionOS 1.0, *)
-public enum CMS {
+public enum CMS: Sendable {
     @_spi(CMS)
     @inlinable
     public static func sign<Bytes: DataProtocol>(
@@ -447,7 +447,7 @@ public enum CMS {
     @_spi(CMS)
     public typealias SignatureVerificationResult = Result<Valid, VerificationError>
 
-    public struct Valid: Hashable {
+    public struct Valid: Hashable, Sendable {
         public var signer: Certificate
 
         @inlinable

diff --git a/Sources/X509/Digests.swift b/Sources/X509/Digests.swift
@@ -47,6 +47,9 @@ enum Digest {
     }
 }
 
+@available(*, unavailable)
+extension Digest: Sendable {}
+
 @available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, macCatalyst 13, visionOS 1.0, *)
 extension Digest: Sequence {
     @usableFromInline

diff --git a/Sources/X509/DistinguishedNameBuilder/CommonName.swift b/Sources/X509/DistinguishedNameBuilder/CommonName.swift
@@ -17,7 +17,7 @@ import SwiftASN1
 /// Set the Common Name (CN) of a ``DistinguishedName``.
 ///
 /// This type is used in ``DistinguishedNameBuilder`` contexts.
-public struct CommonName: RelativeDistinguishedNameConvertible {
+public struct CommonName: RelativeDistinguishedNameConvertible, Sendable {
     /// The value of the common name
     public var name: String
 

diff --git a/Sources/X509/DistinguishedNameBuilder/CountryName.swift b/Sources/X509/DistinguishedNameBuilder/CountryName.swift
@@ -17,7 +17,7 @@ import SwiftASN1
 /// Set the Country Name (C) of a ``DistinguishedName``.
 ///
 /// This type is used in ``DistinguishedNameBuilder`` contexts.
-public struct CountryName: RelativeDistinguishedNameConvertible {
+public struct CountryName: RelativeDistinguishedNameConvertible, Sendable {
     /// The value of the country name field.
     public var name: String
 

diff --git a/Sources/X509/DistinguishedNameBuilder/DNBuilder.swift b/Sources/X509/DistinguishedNameBuilder/DNBuilder.swift
@@ -30,7 +30,7 @@
 /// Users can extend this syntax for their own extensions by conforming their semantic type to ``RelativeDistinguishedNameConvertible``.
 /// This is the only requirement for adding new extensions to this builder syntax.
 @resultBuilder
-public struct DistinguishedNameBuilder {
+public struct DistinguishedNameBuilder: Sendable {
     @inlinable
     public static func buildExpression<Extension: RelativeDistinguishedNameConvertible>(
         _ expression: Extension

diff --git a/Sources/X509/DistinguishedNameBuilder/DomainComponent.swift b/Sources/X509/DistinguishedNameBuilder/DomainComponent.swift
@@ -17,7 +17,7 @@ import SwiftASN1
 /// Set the Domain Component (DC) of a ``DistinguishedName``.
 ///
 /// This type is used in ``DistinguishedNameBuilder`` contexts.
-public struct DomainComponent: RelativeDistinguishedNameConvertible {
+public struct DomainComponent: RelativeDistinguishedNameConvertible, Sendable {
     /// The value of the organizational unit name field.
     public var name: String
 

diff --git a/Sources/X509/DistinguishedNameBuilder/EmailAddress.swift b/Sources/X509/DistinguishedNameBuilder/EmailAddress.swift
@@ -17,7 +17,7 @@ import SwiftASN1
 /// Set the Domain Component (E) of a ``DistinguishedName``.
 ///
 /// This type is used in ``DistinguishedNameBuilder`` contexts.
-public struct EmailAddress: RelativeDistinguishedNameConvertible {
+public struct EmailAddress: RelativeDistinguishedNameConvertible, Sendable {
     /// The value of the email name field.
     public var name: String
 

diff --git a/Sources/X509/DistinguishedNameBuilder/LocalityName.swift b/Sources/X509/DistinguishedNameBuilder/LocalityName.swift
@@ -17,7 +17,7 @@ import SwiftASN1
 /// Set the Locality Name (L) of a ``DistinguishedName``.
 ///
 /// This type is used in ``DistinguishedNameBuilder`` contexts.
-public struct LocalityName: RelativeDistinguishedNameConvertible {
+public struct LocalityName: RelativeDistinguishedNameConvertible, Sendable {
     /// The value of the locality name field.
     public var name: String
 

diff --git a/Sources/X509/DistinguishedNameBuilder/OrganizationName.swift b/Sources/X509/DistinguishedNameBuilder/OrganizationName.swift
@@ -17,7 +17,7 @@ import SwiftASN1
 /// Set the Organization Name (O) of a ``DistinguishedName``.
 ///
 /// This type is used in ``DistinguishedNameBuilder`` contexts.
-public struct OrganizationName: RelativeDistinguishedNameConvertible {
+public struct OrganizationName: RelativeDistinguishedNameConvertible, Sendable {
     /// The value of the organization name field.
     public var name: String
 

diff --git a/Sources/X509/DistinguishedNameBuilder/OrganizationalUnitName.swift b/Sources/X509/DistinguishedNameBuilder/OrganizationalUnitName.swift
@@ -17,7 +17,7 @@ import SwiftASN1
 /// Set the Organizational Unit Name (OU) of a ``DistinguishedName``.
 ///
 /// This type is used in ``DistinguishedNameBuilder`` contexts.
-public struct OrganizationalUnitName: RelativeDistinguishedNameConvertible {
+public struct OrganizationalUnitName: RelativeDistinguishedNameConvertible, Sendable {
     /// The value of the organizational unit name field.
     public var name: String
 

diff --git a/Sources/X509/DistinguishedNameBuilder/StateOrProvinceName.swift b/Sources/X509/DistinguishedNameBuilder/StateOrProvinceName.swift
@@ -17,7 +17,7 @@ import SwiftASN1
 /// Set the State or Province Name (ST) of a ``DistinguishedName``.
 ///
 /// This type is used in ``DistinguishedNameBuilder`` contexts.
-public struct StateOrProvinceName: RelativeDistinguishedNameConvertible {
+public struct StateOrProvinceName: RelativeDistinguishedNameConvertible, Sendable {
     /// The value of the state or province name field.
     public var name: String
 

diff --git a/Sources/X509/DistinguishedNameBuilder/StreetAddress.swift b/Sources/X509/DistinguishedNameBuilder/StreetAddress.swift
@@ -17,7 +17,7 @@ import SwiftASN1
 /// Set the Street Address (STREET) of a ``DistinguishedName``.
 ///
 /// This type is used in ``DistinguishedNameBuilder`` contexts.
-public struct StreetAddress: RelativeDistinguishedNameConvertible {
+public struct StreetAddress: RelativeDistinguishedNameConvertible, Sendable {
     /// The value of the street address field.
     public var name: String
 

diff --git a/Sources/X509/Extension Types/AuthorityInformationAccess.swift b/Sources/X509/Extension Types/AuthorityInformationAccess.swift
@@ -255,7 +255,7 @@ extension AuthorityInformationAccess: CertificateExtensionConvertible {
 //         accessMethod          OBJECT IDENTIFIER,
 //         accessLocation        GeneralName  }
 @usableFromInline
-struct AuthorityInfoAccessSyntax: DERImplicitlyTaggable {
+struct AuthorityInfoAccessSyntax: DERImplicitlyTaggable, Sendable {
     @inlinable
     static var defaultIdentifier: ASN1Identifier {
         .sequence
@@ -285,7 +285,7 @@ struct AuthorityInfoAccessSyntax: DERImplicitlyTaggable {
 }
 
 @usableFromInline
-struct AIAAccessDescription: DERImplicitlyTaggable {
+struct AIAAccessDescription: DERImplicitlyTaggable, Sendable {
     @inlinable
     static var defaultIdentifier: ASN1Identifier {
         .sequence
@@ -329,7 +329,7 @@ struct AIAAccessDescription: DERImplicitlyTaggable {
 
 extension ASN1ObjectIdentifier {
     @usableFromInline
-    enum AccessMethodIdentifiers {
+    enum AccessMethodIdentifiers: Sendable {
         @usableFromInline
         static let ocspServer: ASN1ObjectIdentifier = [1, 3, 6, 1, 5, 5, 7, 48, 1]
 

diff --git a/Sources/X509/Extension Types/AuthorityKeyIdentifier.swift b/Sources/X509/Extension Types/AuthorityKeyIdentifier.swift
@@ -133,7 +133,7 @@ extension AuthorityKeyIdentifier: CertificateExtensionConvertible {
 
 // MARK: ASN1 helpers
 @usableFromInline
-struct AuthorityKeyIdentifierValue: DERImplicitlyTaggable {
+struct AuthorityKeyIdentifierValue: DERImplicitlyTaggable, Sendable {
     @inlinable
     static var defaultIdentifier: ASN1Identifier {
         .sequence

diff --git a/Sources/X509/Extension Types/BasicConstraints.swift b/Sources/X509/Extension Types/BasicConstraints.swift
@@ -101,7 +101,7 @@ extension BasicConstraints: CertificateExtensionConvertible {
 
 // MARK: ASN1 helpers
 @usableFromInline
-struct BasicConstraintsValue: DERImplicitlyTaggable {
+struct BasicConstraintsValue: DERImplicitlyTaggable, Sendable {
     @inlinable
     static var defaultIdentifier: ASN1Identifier {
         .sequence

diff --git a/Sources/X509/Extension Types/ExtendedKeyUsage.swift b/Sources/X509/Extension Types/ExtendedKeyUsage.swift
@@ -374,7 +374,7 @@ extension ASN1ObjectIdentifier {
     /// An acceptable usage for a certificate as attested in an
     /// ``ExtendedKeyUsage``
     /// extension.
-    public enum ExtendedKeyUsage {
+    public enum ExtendedKeyUsage: Sendable {
         /// The public key may be used for any purpose.
         public static let any: ASN1ObjectIdentifier = [2, 5, 29, 37, 0]
 
@@ -402,7 +402,7 @@ extension ASN1ObjectIdentifier {
 }
 
 @usableFromInline
-struct ASN1ExtendedKeyUsage: DERImplicitlyTaggable {
+struct ASN1ExtendedKeyUsage: DERImplicitlyTaggable, Sendable {
     @inlinable
     static var defaultIdentifier: ASN1Identifier {
         .sequence

diff --git a/Sources/X509/Extension Types/ExtensionIdentifiers.swift b/Sources/X509/Extension Types/ExtensionIdentifiers.swift
@@ -16,7 +16,7 @@ import SwiftASN1
 
 extension ASN1ObjectIdentifier {
     /// OIDs that identify known X509 extensions.
-    public enum X509ExtensionID {
+    public enum X509ExtensionID: Sendable {
         /// Identifies the authority key identifier extension, corresponding to
         /// ``AuthorityKeyIdentifier``.
         public static let authorityKeyIdentifier: ASN1ObjectIdentifier = [2, 5, 29, 35]

diff --git a/Sources/X509/Extension Types/NameConstraints.swift b/Sources/X509/Extension Types/NameConstraints.swift
@@ -61,7 +61,7 @@ public struct NameConstraints {
             hasher.combine(contentsOf: self)
         }
 
-        public struct Index: Comparable {
+        public struct Index: Comparable, Sendable {
             @inlinable
             public static func < (lhs: Self, rhs: Self) -> Bool {
                 lhs.wrapped < rhs.wrapped
@@ -157,7 +157,7 @@ public struct NameConstraints {
             hasher.combine(contentsOf: self)
         }
 
-        public struct Index: Comparable {
+        public struct Index: Comparable, Sendable {
             @inlinable
             public static func < (lhs: Self, rhs: Self) -> Bool {
                 lhs.wrapped < rhs.wrapped
@@ -253,7 +253,7 @@ public struct NameConstraints {
             hasher.combine(contentsOf: self)
         }
 
-        public struct Index: Comparable {
+        public struct Index: Comparable, Sendable {
             @inlinable
             public static func < (lhs: Self, rhs: Self) -> Bool {
                 lhs.wrapped < rhs.wrapped
@@ -349,7 +349,7 @@ public struct NameConstraints {
             hasher.combine(contentsOf: self)
         }
 
-        public struct Index: Comparable {
+        public struct Index: Comparable, Sendable {
             @inlinable
             public static func < (lhs: Self, rhs: Self) -> Bool {
                 lhs.wrapped < rhs.wrapped
@@ -749,7 +749,7 @@ extension NameConstraints: CertificateExtensionConvertible {
 // MARK: ASN1 Helpers
 @usableFromInline
 @available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, macCatalyst 13, visionOS 1.0, *)
-struct NameConstraintsValue: DERImplicitlyTaggable {
+struct NameConstraintsValue: DERImplicitlyTaggable, Sendable {
     @inlinable
     static var defaultIdentifier: ASN1Identifier {
         .sequence
@@ -837,7 +837,7 @@ struct NameConstraintsValue: DERImplicitlyTaggable {
 // [GeneralSubtree] will force a heap allocation. Instead, we inline the definition of GeneralSubtree into
 // GeneralSubtrees, to avoid the extra allocation.
 @usableFromInline
-struct GeneralSubtrees: DERImplicitlyTaggable {
+struct GeneralSubtrees: DERImplicitlyTaggable, Sendable {
     @inlinable
     static var defaultIdentifier: ASN1Identifier {
         .sequence

diff --git a/Sources/X509/ExtensionsBuilder.swift b/Sources/X509/ExtensionsBuilder.swift
@@ -40,7 +40,7 @@
 /// Users are also able to mark specific extensions as critical by using the ``Critical`` helper type.
 @resultBuilder
 @available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, macCatalyst 13, visionOS 1.0, *)
-public struct ExtensionsBuilder {
+public struct ExtensionsBuilder: Sendable {
     @inlinable
     public static func buildExpression<Extension: CertificateExtensionConvertible>(
         _ expression: Extension
@@ -147,3 +147,6 @@ public struct Critical<BaseExtension: CertificateExtensionConvertible>: Certific
         return ext
     }
 }
+
+@available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, macCatalyst 13, visionOS 1.0, *)
+extension Critical: Sendable where BaseExtension: Sendable {}
diff --git a/Sources/X509/GeneralName.swift b/Sources/X509/GeneralName.swift
@@ -204,7 +204,7 @@ extension GeneralName.OtherName: CustomStringConvertible {
 }
 
 @usableFromInline
-struct GeneralNames: DERImplicitlyTaggable {
+struct GeneralNames: DERImplicitlyTaggable, Sendable {
     @inlinable
     static var defaultIdentifier: ASN1Identifier {
         .sequence

diff --git a/Sources/X509/Lock.swift b/Sources/X509/Lock.swift
@@ -44,7 +44,7 @@ typealias LockPrimitive = pthread_mutex_t
 #endif
 
 @usableFromInline
-enum LockOperations {}
+enum LockOperations: Sendable {}
 
 extension LockOperations {
     @inlinable
@@ -196,6 +196,9 @@ final class LockStorage<Value>: ManagedBuffer<Value, LockPrimitive> {
     }
 }
 
+@available(*, unavailable)
+extension LockStorage: Sendable {}
+
 /// A threading lock based on `libpthread` instead of `libdispatch`.
 ///
 /// - Note: ``CertificatesLock`` has reference semantics.

diff --git a/Sources/X509/OCSP/DirectoryString.swift b/Sources/X509/OCSP/DirectoryString.swift
@@ -27,7 +27,7 @@ import SwiftASN1
 /// Note that these upper bounds are measured in _characters_, not bytes.
 ///
 @usableFromInline
-enum DirectoryString: DERParseable, DERSerializable, Hashable {
+enum DirectoryString: DERParseable, DERSerializable, Hashable, Sendable {
     case teletexString(ASN1TeletexString)
     case printableString(ASN1PrintableString)
     case universalString(ASN1UniversalString)

diff --git a/Sources/X509/OCSP/OCSPPolicy.swift b/Sources/X509/OCSP/OCSPPolicy.swift
@@ -184,7 +184,7 @@ public struct OCSPFailureMode: Hashable, Sendable {
 }
 
 @available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, macCatalyst 13, visionOS 1.0, *)
-public struct OCSPVerifierPolicy<Requester: OCSPRequester>: VerifierPolicy {
+public struct OCSPVerifierPolicy<Requester: OCSPRequester>: VerifierPolicy, Sendable {
     public let verifyingCriticalExtensions: [ASN1ObjectIdentifier] = []
 
     struct Storage: Sendable {

diff --git a/Sources/X509/PKCS8PrivateKey.swift b/Sources/X509/PKCS8PrivateKey.swift
@@ -47,7 +47,7 @@ import SwiftASN1
 // We disregard the attributes because we don't support them anyway.
 //
 @usableFromInline
-struct PKCS8PrivateKey: DERImplicitlyTaggable {
+struct PKCS8PrivateKey: DERImplicitlyTaggable, Sendable {
     @inlinable
     static var defaultIdentifier: ASN1Identifier {
         return .sequence

diff --git a/Sources/X509/RDNAttribute.swift b/Sources/X509/RDNAttribute.swift
@@ -317,7 +317,7 @@ extension RelativeDistinguishedName.Attribute {
 
 extension ASN1ObjectIdentifier {
     /// Common object identifiers used within ``RelativeDistinguishedName/Attribute``s.
-    public enum RDNAttributeType {
+    public enum RDNAttributeType: Sendable {
         /// The 'countryName' attribute type contains a two-letter
         /// ISO 3166 country code.
         public static let countryName: ASN1ObjectIdentifier = [2, 5, 4, 6]

diff --git a/Sources/X509/SEC1PrivateKey.swift b/Sources/X509/SEC1PrivateKey.swift
@@ -37,7 +37,7 @@ import SwiftASN1
 //   publicKey [1] EXPLICIT BIT STRING OPTIONAL
 // }
 @usableFromInline
-struct SEC1PrivateKey: DERImplicitlyTaggable, PEMRepresentable {
+struct SEC1PrivateKey: DERImplicitlyTaggable, PEMRepresentable, Sendable {
     @usableFromInline
     static let defaultPEMDiscriminator: String = "EC PRIVATE KEY"
 

diff --git a/Sources/X509/Verifier/AllOfPolicies.swift b/Sources/X509/Verifier/AllOfPolicies.swift
@@ -58,3 +58,6 @@ public struct AllOfPolicies<Policy: VerifierPolicy>: VerifierPolicy {
         await self.policy.chainMeetsPolicyRequirements(chain: chain)
     }
 }
+
+@available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, macCatalyst 13, visionOS 1.0, *)
+extension AllOfPolicies: Sendable where Policy: Sendable {}
diff --git a/Sources/X509/Verifier/AnyPolicy.swift b/Sources/X509/Verifier/AnyPolicy.swift
@@ -56,6 +56,9 @@ public struct AnyPolicy: VerifierPolicy {
     }
 }
 
+@available(*, unavailable)
+extension AnyPolicy: Sendable {}
+
 @available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, macCatalyst 13, visionOS 1.0, *)
 struct LegacyPolicySet: VerifierPolicy {
     let verifyingCriticalExtensions: [ASN1ObjectIdentifier]

diff --git a/Sources/X509/Verifier/CertificateStore.swift b/Sources/X509/Verifier/CertificateStore.swift
@@ -128,7 +128,7 @@ extension CertificateStore {
 @available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, macCatalyst 13, visionOS 1.0, *)
 extension CertificateStore {
     @usableFromInline
-    enum Resolved {
+    enum Resolved: Sendable {
         case custom(AnyCustomCertificateStore)
         case concrete(ConcreteResolved)
     }
@@ -158,7 +158,7 @@ extension CertificateStore.Resolved {
 @available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, macCatalyst 13, visionOS 1.0, *)
 extension CertificateStore {
     @usableFromInline
-    struct ConcreteResolved {
+    struct ConcreteResolved: Sendable {
 
         @usableFromInline
         var systemTrustRoots: [DistinguishedName: [Certificate]]