tests: fix update_valid_ee_certs.rs script, update vendored test data
#111
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The syntax for this unstable cargo feature changed out from under us, producing syntax errors with recent nightly tooling. This commit updates the syntax to match the documented[0] example script. [0]: https://github.com/rust-lang/cargo/blob/master/src/doc/src/reference/unstable.md#script
This is an in-place update and avoids a separate older version of Rustls.
* Runs `update_valid_ee_certs.rs`, committing the two updated `.crt` files that result. * Updates the `verification_time()` to the current time to avoid not before errors.
complexspaces
approved these changes
Jul 13, 2024
The old end entity cert was also P-256 ECDSA, but it was issued ee -> R3 (retired) -> ISRG Root X1 (cross-signed by DST Root X3). This branch has ee -> E6 -> ISRG Root X2 (cross-signed by ISRG Root X1). All of the above is a long way of saying, yes 😆 Notably LE plans to switch between using E6 and E5 per-issuance for ECDSA subjects, so that's why it would be nice to have our tooling update the intermediate in addition to the leaf; we can expect to need to refresh the intermediate ~50% of the time we refresh the end entity cert going forward. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The syntax for the Cargo script unstable cargo feature changed out from under us, producing syntax errors running
update_valid_ee_certs.rswith recent nightly tooling. This branch updates the syntax to match the documented example script. Along the way I also updated thereqwestversion used by the script to the latest. Notably this synchronizes onrustlsversions and saves some build time.With the tooling fixed we can update the stale vendored end-entity cert. test data & static verification timestamp. The LE issuance chain has changed and so the intermediate & root also need updating. It would be nice if the tooling supported this too, but for now I've done it manually using the
.derprovided in Let's Encrypt docs.