Provide test cases as PKCS #7 alongside JSON

[fencepost-error]

Would it be possible to make the test cases in limbo.json available as binary PKCS #7 cert chains (where it's appropriate, i.e. where the test case is certs)? What I'm thinking of is taking an entry like "pathlen::ee-with-intermediate-pathlen-0" and writing the chain to "ee-with-intermediate-pathlen-0.p7c". This would make it possible to integrate into existing test frameworks without having to write custom harness code to feed it from the JSON file, and also makes it easier to debug problems because instead of the harness reporting "thing X passed when it should have failed" and then you have to figure it out from there, the test framework can provide its own diagnostics on where the failure occurred and what it was.

[woodruffw]

I think it would be pretty easy to modify limbo compile to emit PKCS7 blobs as an alternative to JSON, but I'm hesitant to include them in the main limbo.json itself -- that file is already pretty large and is semi-frozen in format to make breakage less likely.

Could you say more about your use case? I know a few major projects (Chrome, rustls, etc.) have successfully integrated x509-limbo without needing an upstream change to the JSON format, so I'm curious to hear more about the constraints on your side.

[fencepost-error]

I was thinking more taking limbo.json as input and spitting out the derived PKCS #7s, so there'd be no extra data being created except on the target system. So no need to change limbo.json, just a postprocessor to extract the test data.

The specific use case in this instance is a PKI library that has an existing test mechanism where you point it at a directory and it processes each file telling you what it thinks of it, but more generally it would allow any random third-party PKI-handling code to do a quick eval of at least some of the limbo test cases without having to create a custom test harness for it.

[woodruffw]

I was thinking more taking limbo.json as input and spitting out the derived PKCS #7s, so there'd be no extra data being created except on the target system. So no need to change limbo.json, just a postprocessor to extract the test data.

Makes sense! Yeah, I would be happy to take a PR that adds the functionality for that to the limbo CLI.

(Ideally we'd use nothing but the cryptography package for that -- I think cryptography.hazmat.primitives.serialization.pkcs7.serialize_certificates would do the trick.)

[fencepost-error]

I was hoping someone who knows Python could have a look at it, I'm not sure my having a go at it with awk and sed would get very far :-).