Add nc testcase for a present-but-empty excludedSubtrees - #660
Open
avalyset wants to merge 2 commits into
Open
Conversation
cpu
approved these changes
Sep 2, 2026
Collaborator
|
Noting that basically no validators reject this at the moment: https://github.com/C2SP/x509-limbo/actions/runs/33657818364?pr=660#summary-100340670046 Given that, I think perhaps we should give it the |
Member
None that are released 😆 rustls/webpki#535
I think that's reasonable. |
This was referenced Sep 2, 2026
woodruffw
requested changes
Sep 2, 2026
woodruffw
left a comment
woodruffw
left a comment
Collaborator
There was a problem hiding this comment.
Just blocking until above is addressed.
Collaborator
|
@avalyset Please rebase, thanks. |
Contributor
Author
|
Agreed. I've added |
Mirrors permitted-empty-sequence-excluded-nonempty from C2SP#658: a non-empty permittedSubtrees alongside an excludedSubtrees that is present but empty. Both shapes are rejected by RFC 5280 4.2.1.10, but only the first had a vector behind it. limbo.json carries only the new entry; the existing testcases are untouched. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
No validator currently rejects a present-but-empty excludedSubtrees, so the testcase gets the same treatment as the other RFC 5280 corners that are widely ignored in practice. limbo.json carries only the added features field; the certificates are left as generated, since a full recompile rewrites unrelated keys and serials without changing any testcase.
avalyset
force-pushed
the
nc/excluded-empty-sequence
branch
from
September 2, 2026 18:13
34e527a to
5f1888c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
rfc5280::nc::permitted-nonempty-excluded-empty-sequence, the mirror ofpermitted-empty-sequence-excluded-nonemptyfrom #658: a non-emptypermittedSubtreesalongside anexcludedSubtreesthat is present but empty. Both shapes are rejected by the same section of RFC 5280, but only the first had a testcase, so the second branch of the check has had no vector behind it. Split out from pyca/cryptography#15560, where @alex preferred these tests live in limbo rather than as Rust unit tests; pyca/cryptography 50.0.1 accepts the chain today.