diff --git a/Cargo.lock b/Cargo.lock index ce48f547..dbbaddbd 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -180,12 +180,6 @@ dependencies = [ "fs_extra", ] -[[package]] -name = "base64" -version = "0.21.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567" - [[package]] name = "base64" version = "0.22.1" @@ -207,15 +201,6 @@ version = "2.11.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3" -[[package]] -name = "block-buffer" -version = "0.10.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71" -dependencies = [ - "generic-array", -] - [[package]] name = "bstr" version = "1.12.1" @@ -301,7 +286,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601" dependencies = [ "cfg-if", - "cpufeatures 0.3.0", + "cpufeatures", "rand_core 0.10.1", ] @@ -400,15 +385,14 @@ dependencies = [ [[package]] name = "clubcard-crlite" -version = "0.4.0" +version = "0.5.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "94db8308070798e004eba1d535f6fb78e3ba7170deb40ab767776d3025747707" +checksum = "a6c94d9aa9e9986a62176f935ea8e74cebea6570e433795c0e52d479e6ef4f15" dependencies = [ - "base64 0.21.7", + "base64", "bincode", "clubcard", "serde", - "sha2", ] [[package]] @@ -530,15 +514,6 @@ version = "0.8.7" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b" -[[package]] -name = "cpufeatures" -version = "0.2.17" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280" -dependencies = [ - "libc", -] - [[package]] name = "cpufeatures" version = "0.3.0" @@ -624,16 +599,6 @@ version = "0.2.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5" -[[package]] -name = "crypto-common" -version = "0.1.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a" -dependencies = [ - "generic-array", - "typenum", -] - [[package]] name = "csv" version = "1.4.0" @@ -684,16 +649,6 @@ dependencies = [ "powerfmt", ] -[[package]] -name = "digest" -version = "0.10.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292" -dependencies = [ - "block-buffer", - "crypto-common", -] - [[package]] name = "directories" version = "6.0.0" @@ -857,16 +812,6 @@ dependencies = [ "slab", ] -[[package]] -name = "generic-array" -version = "0.14.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a" -dependencies = [ - "typenum", - "version_check", -] - [[package]] name = "getrandom" version = "0.2.17" @@ -1067,7 +1012,7 @@ version = "0.1.20" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0" dependencies = [ - "base64 0.22.1", + "base64", "bytes", "futures-channel", "futures-util", @@ -1866,7 +1811,7 @@ version = "0.13.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2b11be62ac29861f5e3205a0941578e265c93fa566fd1c36cfdb20a16ae3efc5" dependencies = [ - "base64 0.22.1", + "base64", "bytes", "encoding_rs", "futures-core", @@ -1905,7 +1850,7 @@ name = "revoke-test" version = "0.1.0" dependencies = [ "aws-lc-rs", - "base64 0.22.1", + "base64", "codspeed-criterion-compat", "criterion", "eyre", @@ -2035,7 +1980,7 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-upki" -version = "1.0.0-beta.1" +version = "1.0.0-beta.2" dependencies = [ "rustls", "rustls-native-certs", @@ -2176,17 +2121,6 @@ dependencies = [ "serde_core", ] -[[package]] -name = "sha2" -version = "0.10.9" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283" -dependencies = [ - "cfg-if", - "cpufeatures 0.2.17", - "digest", -] - [[package]] name = "sharded-slab" version = "0.1.7" @@ -2668,12 +2602,6 @@ version = "0.2.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b" -[[package]] -name = "typenum" -version = "1.20.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20" - [[package]] name = "unicode-ident" version = "1.0.24" @@ -2706,9 +2634,9 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1" [[package]] name = "upki" -version = "1.0.0-beta.1" +version = "1.0.0-beta.2" dependencies = [ - "base64 0.22.1", + "base64", "cbindgen", "chrono", "clubcard-crlite", @@ -2727,7 +2655,7 @@ dependencies = [ [[package]] name = "upki-cli" -version = "1.0.0-beta.1" +version = "1.0.0-beta.2" dependencies = [ "clap", "eyre", @@ -2764,7 +2692,7 @@ dependencies = [ [[package]] name = "upki-openssl" -version = "1.0.0-beta.1" +version = "1.0.0-beta.2" dependencies = [ "cbindgen", "openssl-sys", @@ -2803,12 +2731,6 @@ version = "0.2.15" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426" -[[package]] -name = "version_check" -version = "0.9.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a" - [[package]] name = "vte" version = "0.14.1" diff --git a/Cargo.toml b/Cargo.toml index 1b43a224..acca634d 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -13,7 +13,7 @@ aws-lc-rs = "1.15.2" base64 = "0.22.1" chrono = { version = "0.4.42", features = ["alloc"], default-features = false } clap = { version = "4.5", features = ["derive"] } -clubcard-crlite = "0.4" +clubcard-crlite = { version = "0.5.1", default-features = false, features = ["bincode"] } criterion = "0.8" csv = "1.4" directories = "6" diff --git a/rustls-upki/Cargo.toml b/rustls-upki/Cargo.toml index 85981670..4ff07ba8 100644 --- a/rustls-upki/Cargo.toml +++ b/rustls-upki/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "rustls-upki" -version = "1.0.0-beta.1" +version = "1.0.0-beta.2" license.workspace = true edition.workspace = true description = "A rustls verifier with upki revocation integration" @@ -11,7 +11,7 @@ readme = "README.md" [dependencies] rustls = { workspace = true, features = ["std", "tls12"] } rustls-webpki.workspace = true -upki = { version = "=1.0.0-beta.1", path = "../upki" } +upki = { version = "=1.0.0-beta.2", path = "../upki" } [dev-dependencies] rustls = { workspace = true, features = ["aws-lc-rs"] } diff --git a/rustls-upki/src/lib.rs b/rustls-upki/src/lib.rs index dd84d0c8..dea8654e 100644 --- a/rustls-upki/src/lib.rs +++ b/rustls-upki/src/lib.rs @@ -117,16 +117,16 @@ impl ServerVerifier { return self.policy.cert_has_no_scts.as_result(); } - let input = RevocationCheckInput { - cert_serial: CertSerial( + let input = RevocationCheckInput::new( + CertSerial( verified_path .end_entity() .serial() .to_vec(), ), - issuer_spki_hash: IssuerSpkiHash(issuer_spki_hash), + IssuerSpkiHash(issuer_spki_hash), sct_timestamps, - }; + ); match Index::from_cache(&self.config).and_then(|mut index| index.check(&input)) { Ok(rs) => Ok(rs), diff --git a/upki-cli/Cargo.toml b/upki-cli/Cargo.toml index 280c87c9..8934e12a 100644 --- a/upki-cli/Cargo.toml +++ b/upki-cli/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "upki-cli" -version = "1.0.0-beta.1" +version = "1.0.0-beta.2" rust-version.workspace = true edition.workspace = true repository.workspace = true @@ -12,7 +12,7 @@ description = "Platform-independent browser-grade certificate infrastructure" clap.workspace = true eyre.workspace = true rustls-pki-types.workspace = true -upki = { version = "=1.0.0-beta.1", path = "../upki", features = ["fetch"] } +upki = { version = "=1.0.0-beta.2", path = "../upki", features = ["fetch"] } tokio.workspace = true toml.workspace = true tracing.workspace = true diff --git a/upki-cli/tests/integration.rs b/upki-cli/tests/integration.rs index 4257ea3e..520bd784 100644 --- a/upki-cli/tests/integration.rs +++ b/upki-cli/tests/integration.rs @@ -22,7 +22,7 @@ fn version() { success: true exit_code: 0 ----- stdout ----- - upki 1.0.0-beta.1 + upki 1.0.0-beta.2 ----- stderr ----- "); diff --git a/upki-openssl/Cargo.toml b/upki-openssl/Cargo.toml index 9f9422c0..8858fe26 100644 --- a/upki-openssl/Cargo.toml +++ b/upki-openssl/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "upki-openssl" -version = "1.0.0-beta.1" +version = "1.0.0-beta.2" license.workspace = true rust-version.workspace = true edition.workspace = true @@ -9,7 +9,7 @@ repository.workspace = true [dependencies] openssl-sys = { workspace = true } rustls-pki-types.workspace = true -upki = { version = "=1.0.0-beta.1", path = "../upki", features = ["capi"] } +upki = { version = "=1.0.0-beta.2", path = "../upki", features = ["capi"] } [dev-dependencies] cbindgen.workspace = true diff --git a/upki/Cargo.toml b/upki/Cargo.toml index b30eea9d..f4977385 100644 --- a/upki/Cargo.toml +++ b/upki/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "upki" -version = "1.0.0-beta.1" +version = "1.0.0-beta.2" rust-version.workspace = true edition.workspace = true repository.workspace = true diff --git a/upki/src/revocation/index.rs b/upki/src/revocation/index.rs index a7f7b739..8f747401 100644 --- a/upki/src/revocation/index.rs +++ b/upki/src/revocation/index.rs @@ -452,14 +452,14 @@ mod tests { } fn test_input() -> RevocationCheckInput { - RevocationCheckInput { - cert_serial: CertSerial(vec![1, 2, 3]), - issuer_spki_hash: IssuerSpkiHash([0xaa; 32]), - sct_timestamps: vec![CtTimestamp { + RevocationCheckInput::new( + CertSerial(vec![1, 2, 3]), + IssuerSpkiHash([0xaa; 32]), + vec![CtTimestamp { log_id: [0xbb; 32], timestamp: 1000, }], - } + ) } #[expect(clippy::type_complexity)] diff --git a/upki/src/revocation/mod.rs b/upki/src/revocation/mod.rs index 7dbc5597..411054ec 100644 --- a/upki/src/revocation/mod.rs +++ b/upki/src/revocation/mod.rs @@ -126,6 +126,7 @@ pub struct RevocationCheckInput { pub issuer_spki_hash: IssuerSpkiHash, /// CT log IDs and inclusion timestamps present in the end-entity certificate. pub sct_timestamps: Vec, + issuer_serial_hash: [u8; 32], } impl RevocationCheckInput { @@ -164,15 +165,38 @@ impl RevocationCheckInput { }); } - Ok(Self { - cert_serial: CertSerial(end_entity.serial().into()), + Ok(Self::new( + CertSerial(end_entity.serial().to_vec()), issuer_spki_hash, sct_timestamps, - }) + )) + } + + /// Construct a `RevocationCheckInput` from its constituent parts. + pub fn new( + cert_serial: CertSerial, + issuer_spki_hash: IssuerSpkiHash, + sct_timestamps: Vec, + ) -> Self { + let mut issuer_serial_context = sha256::Context::new(); + issuer_serial_context.update(&issuer_spki_hash.0); + issuer_serial_context.update(&cert_serial.0); + let issuer_serial_hash = issuer_serial_context.finish().0; + + Self { + cert_serial, + issuer_spki_hash, + sct_timestamps, + issuer_serial_hash, + } } fn key(&self) -> CRLiteKey<'_> { - CRLiteKey::new(&self.issuer_spki_hash, &self.cert_serial.0) + CRLiteKey::with_hash( + &self.issuer_spki_hash, + &self.cert_serial.0, + self.issuer_serial_hash, + ) } }