OneCRL support
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 45
- Forks
- 12
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 13
Description
OneCRL primarily covers a security critical revocation of intermediates certificates, especially the compromised ones. Mozilla uses Kinto for distribution.
The OneCRL bundle as of today
| Size | |
|---|---|
| Records | 1,880 |
| Uncompressed (JSON) | 794.2 KiB |
| Compressed (Brotli) | 107.7 KiB |
* We can use the compression for transfer
Mozilla seems to be soft-deleting the revocation instead of deleting them using the Kinto mechanisms but if the size would become a concern we could always handle this on upki size by deleting the disabled records.
Analysis spanning the updates since 2024 (835 days)
Delta updates
Mozilla provides delta updates using Kinto.
| # | Date (UTC) | Records | Size (KiB) |
|---|---|---|---|
| 1 | 2024-03-05 20:58 | 1 | 0.49 |
| 2 | 2024-03-11 20:06 | 5 | 1.90 |
| 3 | 2024-06-06 19:55 | 13 | 5.03 |
| 4 | 2024-09-25 16:01 | 21 | 8.12 |
| 5 | 2024-09-25 21:39 | 1 | 0.36 |
| 6 | 2024-09-26 20:09 | 7 | 2.81 |
| 7 | 2025-01-08 21:37 | 14 | 5.38 |
| 8 | 2025-05-21 00:15 | 15 | 5.76 |
| 9 | 2025-07-14 21:29 | 16 | 6.65 |
| 10 | 2025-08-11 20:06 | 1 | 0.40 |
| 11 | 2025-08-22 03:52 | 4 | 1.66 |
| 12 | 2025-08-25 21:14 | 11 | 4.34 |
| 13 | 2025-09-11 18:45 | 11 | 4.72 |
| 14 | 2025-09-26 22:15 | 10 | 3.76 |
| 15 | 2025-10-03 17:23 | 1 | 0.39 |
| 16 | 2025-12-10 17:13 | 16 | 6.93 |
| 17 | 2026-03-10 20:51 | 44 | 19.07 |
| 18 | 2026-03-26 19:45 | 6 | 2.32 |
| 19 | 2026-05-08 15:49 | 28 | 10.42 |
| 20 | 2026-06-11 22:15 | 37 | 15.01 |
| 21 | 2026-06-18 23:00 | 16 | 6.36 |
| total | 278 | 111.89 |
Statistics
Total of 21 delta updates
| Metric | Record count | Size (KiB) |
|---|---|---|
| Mean | 13.24 | 5.33 |
| Median | 11 | 4.72 |
| Min | 1 | 0.36 |
| Max | 44 | 19.07 |
| Stdev | 11.58 | 4.81 |
The estimate is 9 updates a year with the total size of 0.05 MB.
Final thoughts
I think this could be a great addition to upki, increasing security marginally, while the cost of initial download of the bundle is pretty small and the subsequent delta updates straight up negligible as they are really small and few(for now at least). Unless there are no objections for integrating this I will:
- Implement the fetching/updating mechanism similar to CRLite.
- Implement the checking mechanism.
- Propose API for integrating this functionality(separate call/config option..?).
- Implement the API
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files or tests are named. Start by reviewing the existing CRLite fetching, updating, and checking mechanisms, then consider the proposed API shape for OneCRL integration. Done means implementing fetching and updates, certificate checking, and an integration API.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100