Skip to content

Commit 1daa902

Browse files
LukasaLukasa
authored
Merge branch 'main' into fix-cmssignerinfo-unsignedattrs-tag
2 parents 6a0e3d4 + 449dbbe commit 1daa902

128 files changed

Lines changed: 5783 additions & 896 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/main.yml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
name: Main
22

3+
permissions:
4+
contents: read
5+
36
on:
47
push:
58
branches: [main]
@@ -11,9 +14,9 @@ jobs:
1114
name: Unit tests
1215
uses: apple/swift-nio/.github/workflows/unit_tests.yml@main
1316
with:
14-
linux_5_10_arguments_override: "--explicit-target-dependency-import-check error"
15-
linux_6_0_arguments_override: "-Xswiftc -warnings-as-errors --explicit-target-dependency-import-check error -Xswiftc -require-explicit-sendable"
1617
linux_6_1_arguments_override: "-Xswiftc -warnings-as-errors --explicit-target-dependency-import-check error -Xswiftc -require-explicit-sendable"
18+
linux_6_2_arguments_override: "-Xswiftc -warnings-as-errors --explicit-target-dependency-import-check error -Xswiftc -require-explicit-sendable"
19+
linux_6_3_arguments_override: "-Xswiftc -warnings-as-errors --explicit-target-dependency-import-check error -Xswiftc -require-explicit-sendable"
1720
linux_nightly_next_arguments_override: "--explicit-target-dependency-import-check error -Xswiftc -require-explicit-sendable"
1821
linux_nightly_main_arguments_override: "--explicit-target-dependency-import-check error -Xswiftc -require-explicit-sendable"
1922

@@ -37,3 +40,10 @@ jobs:
3740
with:
3841
runner_pool: nightly
3942
build_scheme: swift-certificates
43+
swift_6_1_build_arguments_override: "-Xswiftc -Xfrontend -Xswiftc -require-explicit-sendable"
44+
swift_6_2_build_arguments_override: "-Xswiftc -Xfrontend -Xswiftc -require-explicit-sendable"
45+
swift_6_3_build_arguments_override: "-Xswiftc -Xfrontend -Xswiftc -require-explicit-sendable"
46+
47+
release-builds:
48+
name: Release builds
49+
uses: apple/swift-nio/.github/workflows/release_builds.yml@main

‎.github/workflows/pull_request.yml‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,26 @@
11
name: PR
22

3+
permissions:
4+
contents: read
5+
36
on:
47
pull_request:
58
types: [opened, reopened, synchronize]
69

710
jobs:
811
soundness:
912
name: Soundness
10-
uses: swiftlang/github-workflows/.github/workflows/soundness.yml@main
13+
uses: swiftlang/github-workflows/.github/workflows/soundness.yml@0.0.7
1114
with:
1215
license_header_check_project_name: "SwiftCertificates"
1316

1417
unit-tests:
1518
name: Unit tests
1619
uses: apple/swift-nio/.github/workflows/unit_tests.yml@main
1720
with:
18-
linux_5_10_arguments_override: "--explicit-target-dependency-import-check error"
19-
linux_6_0_arguments_override: "-Xswiftc -warnings-as-errors --explicit-target-dependency-import-check error -Xswiftc -require-explicit-sendable"
2021
linux_6_1_arguments_override: "-Xswiftc -warnings-as-errors --explicit-target-dependency-import-check error -Xswiftc -require-explicit-sendable"
22+
linux_6_2_arguments_override: "-Xswiftc -warnings-as-errors --explicit-target-dependency-import-check error -Xswiftc -require-explicit-sendable"
23+
linux_6_3_arguments_override: "-Xswiftc -warnings-as-errors --explicit-target-dependency-import-check error -Xswiftc -require-explicit-sendable"
2124
linux_nightly_next_arguments_override: "--explicit-target-dependency-import-check error -Xswiftc -require-explicit-sendable"
2225
linux_nightly_main_arguments_override: "--explicit-target-dependency-import-check error -Xswiftc -require-explicit-sendable"
2326

@@ -54,3 +57,10 @@ jobs:
5457
with:
5558
runner_pool: general
5659
build_scheme: swift-certificates
60+
swift_6_1_build_arguments_override: "-Xswiftc -Xfrontend -Xswiftc -require-explicit-sendable"
61+
swift_6_2_build_arguments_override: "-Xswiftc -Xfrontend -Xswiftc -require-explicit-sendable"
62+
swift_6_3_build_arguments_override: "-Xswiftc -Xfrontend -Xswiftc -require-explicit-sendable"
63+
64+
release-builds:
65+
name: Release builds
66+
uses: apple/swift-nio/.github/workflows/release_builds.yml@main

‎.github/workflows/pull_request_label.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
name: PR label
22

3+
permissions:
4+
contents: read
5+
36
on:
47
pull_request:
58
types: [labeled, unlabeled, opened, reopened, synchronize]
@@ -11,7 +14,7 @@ jobs:
1114
timeout-minutes: 1
1215
steps:
1316
- name: Checkout repository
14-
uses: actions/checkout@v4
17+
uses: actions/checkout@v6
1518
with:
1619
persist-credentials: false
1720
- name: Check for Semantic Version label

‎Benchmarks/Benchmarks/CertificatesBenchmark/Benchmarks.swift‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
import Benchmark
1616
import Foundation
1717

18-
let benchmarks = {
18+
let benchmarks: @Sendable () -> Void = {
1919
Benchmark.defaultConfiguration = .init(
2020
metrics: [
2121
.mallocCountTotal

‎Benchmarks/Benchmarks/CertificatesBenchmark/VerifierBenchmark.swift‎

Lines changed: 58 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
//===----------------------------------------------------------------------===//
1414

1515
import Benchmark
16-
import X509
16+
@_spi(FixedExpiryValidationTime) import X509
1717
import Foundation
1818
import Crypto
1919
import SwiftASN1
@@ -50,10 +50,10 @@ func testTrivialChainBuilding() async -> Int {
5050
let roots = CertificateStore([TestCertificate.ca1])
5151

5252
var verifier = Verifier(rootCertificates: roots) {
53-
RFC5280Policy(validationTime: TestCertificate.referenceTime)
53+
RFC5280Policy(fixedExpiryValidationTime: TestCertificate.referenceTime)
5454
}
5555
let result = await verifier.validate(
56-
leafCertificate: TestCertificate.localhostLeaf,
56+
leaf: TestCertificate.localhostLeaf,
5757
intermediates: CertificateStore([TestCertificate.intermediate1])
5858
)
5959

@@ -67,9 +67,11 @@ func testTrivialChainBuilding() async -> Int {
6767
func testExtraRootsAreIgnored() async -> Int {
6868
let roots = CertificateStore([TestCertificate.ca1, TestCertificate.ca2])
6969

70-
var verifier = Verifier(rootCertificates: roots) { RFC5280Policy(validationTime: TestCertificate.referenceTime) }
70+
var verifier = Verifier(rootCertificates: roots) {
71+
RFC5280Policy(fixedExpiryValidationTime: TestCertificate.referenceTime)
72+
}
7173
let result = await verifier.validate(
72-
leafCertificate: TestCertificate.localhostLeaf,
74+
leaf: TestCertificate.localhostLeaf,
7375
intermediates: CertificateStore([TestCertificate.intermediate1])
7476
)
7577

@@ -83,9 +85,11 @@ func testExtraRootsAreIgnored() async -> Int {
8385
func testPuttingRootsInTheIntermediariesIsntAProblem() async -> Int {
8486
let roots = CertificateStore([TestCertificate.ca1, TestCertificate.ca2])
8587

86-
var verifier = Verifier(rootCertificates: roots) { RFC5280Policy(validationTime: TestCertificate.referenceTime) }
88+
var verifier = Verifier(rootCertificates: roots) {
89+
RFC5280Policy(fixedExpiryValidationTime: TestCertificate.referenceTime)
90+
}
8791
let result = await verifier.validate(
88-
leafCertificate: TestCertificate.localhostLeaf,
92+
leaf: TestCertificate.localhostLeaf,
8993
intermediates: CertificateStore([TestCertificate.intermediate1, TestCertificate.ca1, TestCertificate.ca2])
9094
)
9195

@@ -99,9 +103,11 @@ func testPuttingRootsInTheIntermediariesIsntAProblem() async -> Int {
99103
func testSupportsCrossSignedRootWithoutTrouble() async -> Int {
100104
let roots = CertificateStore([TestCertificate.ca2])
101105

102-
var verifier = Verifier(rootCertificates: roots) { RFC5280Policy(validationTime: TestCertificate.referenceTime) }
106+
var verifier = Verifier(rootCertificates: roots) {
107+
RFC5280Policy(fixedExpiryValidationTime: TestCertificate.referenceTime)
108+
}
103109
let result = await verifier.validate(
104-
leafCertificate: TestCertificate.localhostLeaf,
110+
leaf: TestCertificate.localhostLeaf,
105111
intermediates: CertificateStore([TestCertificate.intermediate1, TestCertificate.ca1CrossSignedByCA2])
106112
)
107113

@@ -115,9 +121,11 @@ func testSupportsCrossSignedRootWithoutTrouble() async -> Int {
115121
func testBuildsTheShorterPathInTheCaseOfCrossSignedRoots() async -> Int {
116122
let roots = CertificateStore([TestCertificate.ca1, TestCertificate.ca2])
117123

118-
var verifier = Verifier(rootCertificates: roots) { RFC5280Policy(validationTime: TestCertificate.referenceTime) }
124+
var verifier = Verifier(rootCertificates: roots) {
125+
RFC5280Policy(fixedExpiryValidationTime: TestCertificate.referenceTime)
126+
}
119127
let result = await verifier.validate(
120-
leafCertificate: TestCertificate.localhostLeaf,
128+
leaf: TestCertificate.localhostLeaf,
121129
intermediates: CertificateStore([
122130
TestCertificate.intermediate1, TestCertificate.ca2CrossSignedByCA1, TestCertificate.ca1CrossSignedByCA2,
123131
])
@@ -133,9 +141,11 @@ func testBuildsTheShorterPathInTheCaseOfCrossSignedRoots() async -> Int {
133141
func testPrefersToUseIntermediatesWithSKIThatMatches() async -> Int {
134142
let roots = CertificateStore([TestCertificate.ca1])
135143

136-
var verifier = Verifier(rootCertificates: roots) { RFC5280Policy(validationTime: TestCertificate.referenceTime) }
144+
var verifier = Verifier(rootCertificates: roots) {
145+
RFC5280Policy(fixedExpiryValidationTime: TestCertificate.referenceTime)
146+
}
137147
let result = await verifier.validate(
138-
leafCertificate: TestCertificate.localhostLeaf,
148+
leaf: TestCertificate.localhostLeaf,
139149
intermediates: CertificateStore([TestCertificate.intermediate1, TestCertificate.intermediate1WithoutSKIAKI])
140150
)
141151

@@ -149,9 +159,11 @@ func testPrefersToUseIntermediatesWithSKIThatMatches() async -> Int {
149159
func testPrefersNoSKIToNonMatchingSKI() async -> Int {
150160
let roots = CertificateStore([TestCertificate.ca1])
151161

152-
var verifier = Verifier(rootCertificates: roots) { RFC5280Policy(validationTime: TestCertificate.referenceTime) }
162+
var verifier = Verifier(rootCertificates: roots) {
163+
RFC5280Policy(fixedExpiryValidationTime: TestCertificate.referenceTime)
164+
}
153165
let result = await verifier.validate(
154-
leafCertificate: TestCertificate.localhostLeaf,
166+
leaf: TestCertificate.localhostLeaf,
155167
intermediates: CertificateStore([
156168
TestCertificate.intermediate1WithIncorrectSKIAKI, TestCertificate.intermediate1WithoutSKIAKI,
157169
])
@@ -167,9 +179,11 @@ func testPrefersNoSKIToNonMatchingSKI() async -> Int {
167179
func testRejectsRootsThatDidNotSignTheCertBeforeThem() async -> Int {
168180
let roots = CertificateStore([TestCertificate.ca1WithAlternativePrivateKey, TestCertificate.ca2])
169181

170-
var verifier = Verifier(rootCertificates: roots) { RFC5280Policy(validationTime: TestCertificate.referenceTime) }
182+
var verifier = Verifier(rootCertificates: roots) {
183+
RFC5280Policy(fixedExpiryValidationTime: TestCertificate.referenceTime)
184+
}
171185
let result = await verifier.validate(
172-
leafCertificate: TestCertificate.localhostLeaf,
186+
leaf: TestCertificate.localhostLeaf,
173187
intermediates: CertificateStore([
174188
TestCertificate.ca1CrossSignedByCA2, TestCertificate.ca2CrossSignedByCA1, TestCertificate.intermediate1,
175189
])
@@ -186,10 +200,10 @@ func testPolicyFailuresCanFindLongerPaths() async -> Int {
186200

187201
var verifier = Verifier(rootCertificates: roots) {
188202
FailIfCertInChainPolicy(forbiddenCert: TestCertificate.ca1)
189-
RFC5280Policy(validationTime: TestCertificate.referenceTime)
203+
RFC5280Policy(fixedExpiryValidationTime: TestCertificate.referenceTime)
190204
}
191205
let result = await verifier.validate(
192-
leafCertificate: TestCertificate.localhostLeaf,
206+
leaf: TestCertificate.localhostLeaf,
193207
intermediates: CertificateStore([
194208
TestCertificate.intermediate1, TestCertificate.ca2CrossSignedByCA1, TestCertificate.ca1CrossSignedByCA2,
195209
])
@@ -205,9 +219,11 @@ func testPolicyFailuresCanFindLongerPaths() async -> Int {
205219
func testSelfSignedCertsAreTrustedWhenInTrustStore() async -> Int {
206220
let roots = CertificateStore([TestCertificate.ca1, TestCertificate.isolatedSelfSignedCert])
207221

208-
var verifier = Verifier(rootCertificates: roots) { RFC5280Policy(validationTime: TestCertificate.referenceTime) }
222+
var verifier = Verifier(rootCertificates: roots) {
223+
RFC5280Policy(fixedExpiryValidationTime: TestCertificate.referenceTime)
224+
}
209225
let result = await verifier.validate(
210-
leafCertificate: TestCertificate.isolatedSelfSignedCert,
226+
leaf: TestCertificate.isolatedSelfSignedCert,
211227
intermediates: CertificateStore([TestCertificate.intermediate1])
212228
)
213229

@@ -232,7 +248,7 @@ func testTrustRootsCanBeNonSelfSignedLeaves() async -> Int {
232248

233249
var verifier = Verifier(rootCertificates: roots) { IgnoreBasicConstraintsPolicy() }
234250
let result = await verifier.validate(
235-
leafCertificate: TestCertificate.localhostLeaf,
251+
leaf: TestCertificate.localhostLeaf,
236252
intermediates: CertificateStore([TestCertificate.intermediate1])
237253
)
238254

@@ -246,9 +262,11 @@ func testTrustRootsCanBeNonSelfSignedLeaves() async -> Int {
246262
func testTrustRootsCanBeNonSelfSignedIntermediates() async -> Int {
247263
let roots = CertificateStore([TestCertificate.intermediate1])
248264

249-
var verifier = Verifier(rootCertificates: roots) { RFC5280Policy(validationTime: TestCertificate.referenceTime) }
265+
var verifier = Verifier(rootCertificates: roots) {
266+
RFC5280Policy(fixedExpiryValidationTime: TestCertificate.referenceTime)
267+
}
250268
let result = await verifier.validate(
251-
leafCertificate: TestCertificate.localhostLeaf,
269+
leaf: TestCertificate.localhostLeaf,
252270
intermediates: CertificateStore([TestCertificate.intermediate1])
253271
)
254272

@@ -275,9 +293,11 @@ func testWePoliceCriticalExtensionsOnLeafCerts() async -> Int {
275293
TestCertificate.ca1, TestCertificate.isolatedSelfSignedCertWithWeirdCriticalExtension,
276294
])
277295

278-
var verifier = Verifier(rootCertificates: roots) { RFC5280Policy(validationTime: TestCertificate.referenceTime) }
296+
var verifier = Verifier(rootCertificates: roots) {
297+
RFC5280Policy(fixedExpiryValidationTime: TestCertificate.referenceTime)
298+
}
279299
let result = await verifier.validate(
280-
leafCertificate: TestCertificate.isolatedSelfSignedCertWithWeirdCriticalExtension,
300+
leaf: TestCertificate.isolatedSelfSignedCertWithWeirdCriticalExtension,
281301
intermediates: CertificateStore([TestCertificate.intermediate1])
282302
)
283303

@@ -291,9 +311,11 @@ func testWePoliceCriticalExtensionsOnLeafCerts() async -> Int {
291311
func testMissingIntermediateFailsToBuild() async -> Int {
292312
let roots = CertificateStore([TestCertificate.ca1])
293313

294-
var verifier = Verifier(rootCertificates: roots) { RFC5280Policy(validationTime: TestCertificate.referenceTime) }
314+
var verifier = Verifier(rootCertificates: roots) {
315+
RFC5280Policy(fixedExpiryValidationTime: TestCertificate.referenceTime)
316+
}
295317
let result = await verifier.validate(
296-
leafCertificate: TestCertificate.localhostLeaf,
318+
leaf: TestCertificate.localhostLeaf,
297319
intermediates: CertificateStore([])
298320
)
299321

@@ -307,9 +329,11 @@ func testMissingIntermediateFailsToBuild() async -> Int {
307329
func testSelfSignedCertsAreRejectedWhenNotInTheTrustStore() async -> Int {
308330
let roots = CertificateStore([TestCertificate.ca1])
309331

310-
var verifier = Verifier(rootCertificates: roots) { RFC5280Policy(validationTime: TestCertificate.referenceTime) }
332+
var verifier = Verifier(rootCertificates: roots) {
333+
RFC5280Policy(fixedExpiryValidationTime: TestCertificate.referenceTime)
334+
}
311335
let result = await verifier.validate(
312-
leafCertificate: TestCertificate.isolatedSelfSignedCert,
336+
leaf: TestCertificate.isolatedSelfSignedCert,
313337
intermediates: CertificateStore([TestCertificate.intermediate1])
314338
)
315339

@@ -322,9 +346,11 @@ func testSelfSignedCertsAreRejectedWhenNotInTheTrustStore() async -> Int {
322346
func testMissingRootFailsToBuild() async -> Int {
323347
let roots = CertificateStore([])
324348

325-
var verifier = Verifier(rootCertificates: roots) { RFC5280Policy(validationTime: TestCertificate.referenceTime) }
349+
var verifier = Verifier(rootCertificates: roots) {
350+
RFC5280Policy(fixedExpiryValidationTime: TestCertificate.referenceTime)
351+
}
326352
let result = await verifier.validate(
327-
leafCertificate: TestCertificate.localhostLeaf,
353+
leaf: TestCertificate.localhostLeaf,
328354
intermediates: CertificateStore([TestCertificate.intermediate1])
329355
)
330356

‎Benchmarks/Package.swift‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// swift-tools-version:5.10
1+
// swift-tools-version:6.1
22
//===----------------------------------------------------------------------===//
33
//
44
// This source file is part of the SwiftCertificates open source project
@@ -22,15 +22,15 @@ let package = Package(
2222
],
2323
dependencies: [
2424
.package(path: "../"),
25-
.package(url: "https://github.com/ordo-one/package-benchmark.git", from: "1.11.1"),
26-
.package(url: "https://github.com/apple/swift-crypto.git", "2.5.0"..<"4.0.0"),
25+
.package(url: "https://github.com/ordo-one/benchmark.git", from: "1.11.1"),
26+
.package(url: "https://github.com/apple/swift-crypto.git", "3.12.3"..<"5.0.0"),
2727
.package(url: "https://github.com/apple/swift-asn1.git", from: "1.0.0"),
2828
],
2929
targets: [
3030
.executableTarget(
3131
name: "CertificatesBenchmark",
3232
dependencies: [
33-
.product(name: "Benchmark", package: "package-benchmark"),
33+
.product(name: "Benchmark", package: "benchmark"),
3434
.product(name: "X509", package: "swift-certificates"),
3535
.product(name: "SwiftASN1", package: "swift-asn1"),
3636
.product(name: "Crypto", package: "swift-crypto"),
@@ -40,7 +40,7 @@ let package = Package(
4040
.copy("ca-certificates/")
4141
],
4242
plugins: [
43-
.plugin(name: "BenchmarkPlugin", package: "package-benchmark")
43+
.plugin(name: "BenchmarkPlugin", package: "benchmark")
4444
]
4545
)
4646
]

‎Benchmarks/Thresholds/5.10/CertificatesBenchmark.Parse_WebPKI_Roots_from_DER.p90.json‎

Lines changed: 0 additions & 3 deletions
This file was deleted.

‎Benchmarks/Thresholds/5.10/CertificatesBenchmark.Parse_WebPKI_Roots_from_PEM_files.p90.json‎

Lines changed: 0 additions & 3 deletions
This file was deleted.

‎Benchmarks/Thresholds/5.10/CertificatesBenchmark.Parse_WebPKI_Roots_from_multi_PEM_file.p90.json‎

Lines changed: 0 additions & 3 deletions
This file was deleted.

‎Benchmarks/Thresholds/5.10/CertificatesBenchmark.Verifier.p90.json‎

Lines changed: 0 additions & 3 deletions
This file was deleted.

0 commit comments

Comments
 (0)