Documentation
¶
Overview ¶
Package revocation enforces durable revocation at certificate issuance time (GHSA-339v-266x-79xr). Issuance paths used to consult revocation state only at poll time; because the blocklist is keyed by certificate fingerprint, a blocked host could re-enroll (or regenerate a mobile bundle) and receive a fresh certificate with a new fingerprint that no longer matched the blocked one — silently undoing the block. Disabling an operator likewise left their hosts able to renew forever. Every signing path must call CheckIssuanceAllowed before minting a certificate.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( // ErrHostBlocked is returned when issuance is refused because the host has // been blocked. ErrHostBlocked = errors.New("host is blocked") // ErrOperatorDisabled is returned when issuance is refused because the // operator that owns the host's CA has been disabled. ErrOperatorDisabled = errors.New("owning operator is disabled") )
Functions ¶
func CheckIssuanceAllowed ¶
CheckIssuanceAllowed reports whether a certificate may be (re-)issued for host. It rejects issuance when the host has been blocked or when the operator that owns the host's CA has been disabled, so that blocking a host or offboarding an operator is durable across re-enroll, renewal, and mobile bundle regeneration.
CA retirement is deliberately not checked: CAStatusRetired is not set by any production path (rotation uses predecessor/successor links plus trust bundles), and a retired-CA guard would risk breaking renewals during a rotation grace window for no current benefit.
Types ¶
This section is empty.
Source Files