Documentation
¶
Index ¶
- Variables
- func Check(tbs *x509.Certificate, subjectPubKey crypto.PublicKey, ...) ([]byte, error)
- func CheckCRL(tbs *x509.RevocationList, realIssuer *x509.Certificate, ...) error
- func NewRegistry(skipLints []string) (lint.Registry, error)
- func NewRegistryWithConfig(skipLints []string, config Config) (lint.Registry, error)
- func ProcessResultSet(lintRes *zlint.ResultSet) error
- type Config
- type Linter
Constants ¶
This section is empty.
Variables ¶
var ErrLinting = fmt.Errorf("failed lint(s)")
Functions ¶
func Check ¶
func Check(tbs *x509.Certificate, subjectPubKey crypto.PublicKey, realIssuer *x509.Certificate, realSigner crypto.Signer, config Config, skipLints []string) ([]byte, error)
Check accomplishes the entire process of linting: it generates a throwaway signing key, uses that to create a linting cert, and runs a default set of lints (everything except for the ETSI and EV lints) against it. If the subjectPubKey and realSigner indicate that this is a self-signed cert, the cert will have its pubkey replaced to also be self-signed. This is the primary public interface of this package, but it can be inefficient; creating a new signer and a new lint registry are expensive operations which performance-sensitive clients may want to cache via linter.New().
func CheckCRL ¶
func CheckCRL(tbs *x509.RevocationList, realIssuer *x509.Certificate, realSigner crypto.Signer, skipLints []string) error
CheckCRL is like Check, but for CRLs.
func NewRegistry ¶
NewRegistry returns a zlint Registry with irrelevant (ETSI, EV) lints excluded. This registry also includes all custom lints defined in Boulder.
func NewRegistryWithConfig ¶ added in v0.20260729.0
NewRegistryWithConfig is like NewRegistry, but the returned registry also carries the contents of the given Config.
func ProcessResultSet ¶
Types ¶
type Config ¶ added in v0.20260729.0
type Config struct {
// contains filtered or unexported fields
}
Config is a validated, in-memory zlint lint configuration. The zero value is an empty configuration.
func LoadConfigFile ¶ added in v0.20260729.0
LoadConfigFile reads and validates a zlint TOML config file. An empty path yields an empty Config. It is an error for the file to set the shared configuration keys read by the CP/CPS profile lints: those are derived from certificates via WithIssuer and WithExisting instead.
func (Config) WithExisting ¶ added in v0.20260729.0
func (c Config) WithExisting(existing *x509.Certificate) (Config, error)
WithExisting returns a copy of the Config with a stanza holding the PEM of the pre-existing certificate which is being cross-signed. This is necessary for the CP/CPS Cross-Certified Subordinate CA Certificate lint. It is only used by the ceremony tool. A nil existing certificate, or one with no raw DER bytes, returns the Config unchanged.
func (Config) WithIssuer ¶ added in v0.20260729.0
func (c Config) WithIssuer(issuer *x509.Certificate) (Config, error)
WithIssuer returns a copy of the Config with a stanza holding the PEM of the issuer's certificate. This is necessary for the CP/CPS profile lints, which check that certain fields of the certificate being linted match the issuer. A nil issuer, or one with no raw DER bytes (i.e. a to-be-signed template rather than a real certificate, as in a self-signed root ceremony), returns the Config unchanged.
type Linter ¶
type Linter struct {
// contains filtered or unexported fields
}
Linter is capable of linting a to-be-signed (TBS) certificate. It does so by signing that certificate with a throwaway private key and a fake issuer whose public key matches the throwaway private key, and then running the resulting certificate through a registry of zlint lints.
func New ¶
New constructs a Linter. It uses the provided real certificate and signer (private key) to generate a matching fake keypair and issuer cert that will be used to sign the lint certificate. It uses the provided list of lint names to skip to filter the zlint global registry to only those lints which should be run.
func (*Linter) Check ¶
func (l *Linter) Check(tbs *x509.Certificate, subjectPubKey crypto.PublicKey, reg lint.Registry, config Config) ([]byte, error)
Check signs the given TBS certificate using the Linter's fake issuer cert and private key, then runs the resulting certificate through all lints in reg. If the subjectPubKey is identical to the public key of the real signer used to create this linter, then the throwaway cert will have its pubkey replaced with the linter's pubkey so that it appears self-signed. It returns an error if any lint fails. On success it also returns the DER bytes of the linting certificate.
Source Files
Directories