letsencrypt / letsencrypt/boulder
Consider integrating additional linting frameworks
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 5.8k
- Forks
- 649
- Avg merge
- 3d 23h
- Merged PRs (30d)
- 24
Description
An incident from earlier this year drives home the fact that no certificate linting library is perfect, and that simply counting on one library to enforce all requirements still provides plenty of avenues for accidental failure.
We should consider integrating additional linting libraries, such as https://github.com/amazon-archives/certlint and/or https://github.com/kroeckx/x509lint, into our issuance pipeline. As these two are C programs, they probably shouldn't be in Boulder's go-based pre- and post-issuance linting, but might be able to be integrated into our post-post-issuance cert-checker.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the post-post-issuance cert-checker entry point and how the issuance pipeline invokes it. Review certlint and x509lint to determine their integration requirements and assess whether both can be run there. Done would mean a decided integration approach with defined validation and operational behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, go
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100