Chrome Release Bot (LUCI) 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
..
basic-constraints-pathlen-0-self-issued 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
expired-intermediate 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
expired-root 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
expired-target 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
incorrect-trust-anchor 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
intermediate-and-target-wrong-signature 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
intermediate-basic-constraints-ca-false 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
intermediate-basic-constraints-not-critical 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
intermediate-eku-any-and-clientauth 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
intermediate-eku-clientauth 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
intermediate-eku-server-gated-crypto 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
intermediate-lacks-basic-constraints 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
intermediate-lacks-signing-key-usage 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
intermediate-signed-with-md5 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
intermediate-unknown-critical-extension 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
intermediate-unknown-non-critical-extension 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
intermediate-wrong-signature-no-authority-key-identifier 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
issuer-and-subject-not-byte-for-byte-equal 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
key-rollover 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
many-names 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
non-self-signed-root 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
pkits_errors 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
root-basic-constraints-ca-false 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
root-eku-clientauth 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
root-lacks-basic-constraints 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
target-and-intermediate 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
target-eku-clientauth 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
target-eku-none 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
target-has-512bit-rsa-key 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
target-has-keycertsign-but-not-ca 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
target-has-pathlen-but-not-ca 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
target-not-end-entity 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
target-serverauth-various-keyusages 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
target-signed-by-512bit-rsa 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
target-signed-using-ecdsa 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
target-signed-with-md5 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
target-unknown-critical-extension 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
target-wrong-signature 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
target-wrong-signature-no-authority-key-identifier 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
unknown-critical-policy-qualifier 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
unknown-non-critical-policy-qualifier 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
violates-basic-constraints-pathlen-0 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
violates-pathlen-1-from-root 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
README 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
generate-all.sh 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
rebase-errors.py 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten

README

This directory contains test data for verifying certificate chains.

Tests are grouped into directories that contain the keys, python to generate
chains, and test expectations. "DIR" is used as a generic placeholder below to
identify such a directory.

===============================
DIR/generate-chains.py
===============================

Python script that generates one or more ".pem" file containing a sequence of
CERTIFICATE blocks. In most cases it will generate a single chain called
"chain.pem".

===============================
DIR/keys/*.key
===============================

The keys used (as well as generated) by the .py file generate-chains.py. The
private keys shouldn't be needed to run the tests, however are useful when
re-generating the test data to have stable results (at least for signature
types which are deterministic, like RSASSA PKCS#1 which is used by most of the
certificates data).

===============================
DIR/*.pem
===============================

A sequence of CERTIFICATE blocks that was created by the generate-chains.py
script. (Although in a few cases there are manually created .pem files that
lack a generator script).

===============================
DIR/*.test
===============================

A sequence of key-value pairs that identify the inputs to certificate
verification, as well as the expected outputs. The format is essentially a
newline separated sequence of key/value pairs:

key: value\n

All keys must be specified by tests, although they can be in any order.
The possible keys are:

"chain" - The value is a file path (relative to the test file) to a .pem
containing the CERTIFICATE chain.

"last_cert_trust" - The value identifies the trustedness of the last
certificate in the chain (i.e. whether it is a trust anchor or not). This
maps to the CertificateTrustType enum. Possible values are:
"TRUSTED_ANCHOR"
"TRUSTED_ANCHOR_WITH_EXPIRATION"
"TRUSTED_ANCHOR_WITH_CONSTRAINTS"
"UNSPECIFIED"
"DISTRUSTED"

"utc_time" - A string encoding for the generalized time at which verification
should be done. Example "150302120000Z"

"key_purpose" - The expected EKU to use when verifying. Maps to
KeyPurpose enum. Possible values are:
"ANY_EKU"
"SERVER_AUTH"
"CLIENT_AUTH"

"errors" - This has special parsing rules: it is interpreted as the
final key in the file. All lines after "errors:\n" are read as being the
error string (this allows embedding newlines in it).

Additionally, it is possible to add python-style comments by starting a line
with "#".

===============================
pkits_errors/*.txt
===============================

These files contain the expected errors for PKITS tests
(third_party/nist-pkits). The file name correspond so the PKITS tests number.
They are baselined specifically for VerifyCertificateChain().

===============================
generate-all.sh
===============================

Runs all of the generate-chains.py scripts and cleans up the temp files
afterwards.