letsencrypt / pebble
9%
master: 8%

LAST BUILD BRANCH: main
DEFAULT BRANCH: master
Repo Added
Files 18
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH main
branch: SELECT
CHANGE BRANCH
x

coverage: 9.477% (+0.2%) from 9.243%
Relevant lines Covered
4664 RELEVANT LINES 442 COVERED LINES
1.71 HITS PER LINE
Source Files on master

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
36477763631 main Normalize the serial in NewCertID so ARI replaces lookups match (#556) When a certificate's serial starts with a byte >= 0x80, ACME clients put an extra `00` in front of it in the ARI certID. That's correct, since RFC 9773 asks for the DER intege... push web-flow github
9.48
36292524459 crl-serving-and-tests Serve a CRL when configured, and test it in CI Add the crlListenAddress, crlBaseURL, crlMaxDelay and crlValidity config fields and their PEBBLE_CRL_* environment overrides. When both the listen address and base URL are set, Pebble serves its CRL ... Pull #562 Preston12321 github
14.25
36292428832 crl-handler wfe: Add a CRL handler and record when revocations reach the CRL Add CRLHandler, which serves a freshly signed CRL at the CA's CRL URL, and set CRLVisibleAt on revoked certificates so that revocations appear on the CRL after a random delay. The ... Pull #561 Preston12321 github
13.2
36292344234 crl-signing ca: Add support for building and signing a CRL Add an optional CRLConfig to the CA. When it's set, issued certificates include a CRL Distribution Point, and GetCRL returns a CRL signed by the leaf-issuing intermediate with every revoked certifica... Pull #560 Preston12321 github
12.73
36292204789 reason-code-allowlist Only accept revocation reasons 0, 1, 3, 4, 5 and 9 Replace the check for reasons 7 and >10 with an allowlist. This also rejects cACompromise (2), which applies only to CA certificates; certificateHold (6), which the Baseline Requirements forbid; ... Pull #558 Preston12321 github
11.54
36283887341 revocation-race-fix Fix race condition in db.MemoryStore.RevokeCertificate() Pull #557 Preston12321 github
11.46
35880095069 certid-normalize-serial Normalize the serial in NewCertID so ARI replaces lookups match ARI certIDs carry the serial as DER INTEGER value bytes, which include a leading 0x00 when the top bit is set. Issued certificates are indexed by the hex of big.Int.Bytes(), which ha... Pull #556 shyney7 github
9.48
35784676080 main Use RFC 7093 SHA-512 truncated SKIs (#551) Always generate Subject Key Identifiers according to RFC 7093 Section 2 method 3: the leftmost 160 bits of the SHA-512 hash of the `subjectPublicKey` BIT STRING. This removes Pebble's use of SHA-1, so i... push web-flow github
9.24
35781538068 pzduniak/fips-safe-ski Use crypto/ecdh to parse the RFC 7093 example key elliptic.Unmarshal is deprecated since Go 1.21 and fails staticcheck SA1019. Co-authored-by: Cursor <cursoragent@cursor.com> Pull #551 pzduniak github
9.24
35759968840 main Fix deadlock from recursive RLock in Order() (#555) orderForDisplay takes a lock because many of its other callers don't take a lock themselves, but it leads to a recursive lock in this case. The only reason that Order() takes a lock at all is in... push web-flow github
9.24
See All Builds (1503)