`allow_fetching=True` together with `moment`
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 115
- Forks
- 34
- PR merge metrics
- No merged PRs in 30d
Description
I was wondering, in the comment you write:
If certificate validation should be performed based on a date and time other than right now. A datetime.datetime object with a tzinfo value. If this parameter is specified, then the only way to check OCSP and CRL responses is to pass them via the crls and ocsps parameters. Can not be combined with allow_fetching=True.
Why is this? What is wrong with fetching CRLs etc. with some defined moment? This restriction doesn't allow the CRL verification of any digital signature that has a timestamp certificate in it, since when there's a timestamp certificate, the moment is defined by that certificate, and not by current time.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the validation entry point that accepts moment and allow_fetching=True, then review how crls and ocsps are used for fetched responses. Determine whether fetching can be reconciled with validation at a historical moment, and define completion around correctly validating timestamped certificates without requiring manually supplied responses.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cryptography, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100