letsencrypt / letsencrypt/boulder
CRL ceremony: take previous CRL as input
Open
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 5.8k
- Forks
- 649
- Avg merge
- 3d 23h
- Merged PRs (30d)
- 24
Description
The CRL ceremony type should take a previously-published CRL as one of its inputs. It can then check:
- that the configured CRL number is greater than the previous number
- that the configured list of revoked certs isn't missing any that were present in the previous CRL, and that weren't already expired at the time of that previous CRL
- that the Issuer and Issuing Distribution Point (if present) is/are identical
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the CRL ceremony type and its input-validation entry point. Add the previously published CRL as an input, then verify the CRL number increases, retained unexpired revocations are not dropped, and the Issuer and Issuing Distribution Point remain identical.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100