Script updating archive at 2025-12-04T02:08:42Z. [ci skip]

Author: ID Bot

archive.json

@@ -1,6 +1,6 @@
 {
   "magic": "E!vIA5L86J2I",
-  "timestamp": "2025-12-02T02:08:02.645789+00:00",
+  "timestamp": "2025-12-04T02:08:40.337962+00:00",
   "repo": "davidben/merkle-tree-certs",
   "labels": [
     {
@@ -2722,6 +2722,37 @@
           "updatedAt": "2025-11-20T07:23:50Z"
         }
       ]
+    },
+    {
+      "number": 164,
+      "id": "I_kwDOJIBkVc7bvLSe",
+      "title": "Single-pass TBSCertificateLogEntry construction",
+      "url": "https://github.com/davidben/merkle-tree-certs/issues/164",
+      "state": "OPEN",
+      "author": "davidben",
+      "authorAssociation": "OWNER",
+      "assignees": [],
+      "labels": [],
+      "body": "This didn't make the cut for the first experiment, but here's a very minor optimization we can do that might benefit some very constrained implementations.\n\nAlmost everyone just keeps their certificates as buffers in memory, but if your signature algorithm has a init/update/final API, and if you have a streaming X.509 parser you, in principle, today could avoid keeping the entire certificate around in memory. I think [BearSSL](https://bearssl.org/x509.html) might do this? (Not sure.)\n\nTBSCertificateLogEntry makes this impossible because the total SEQUENCE length prefix is not know until you've _at least_ gotten to the SubjectPublicKeyInfo, so you know how much shorter it is than the total TBSCertificate. Even if you did have the whole TBSCertificate available, you have to do some annoying math if you want to stream the data into your hash context, rather than making a new allocated copy.\n\nWe could fix both of these by saying `tbs_cert_entry_data` contains just the contents octets of the TBSCertificateLogEntry. That is, you omit the leading outermost tag and length. That allows you compute `entry_hash` in a single pass over the data:\n\n```\nh := hash.New()\nh.Update(tbs.version .. tbs.subject)\nh.Update({OCTET_STRING, hash.Size()}) // subjectPublicKeyInfoHash header\nh.Update(hash(tbs.subjectPublicKeyInfo))\nh.Update(tbs.issuerUniqueID .. tbs.extensions)\nentryHash := h.Final()\n```\n\nThe downside is that if you're implementing this with a bog-standard DER encoder, you have to add a tiny bit of extra code to parse back the tag and length prefix and skip a few bytes. But this is quite easy to do:\n\n```\nfunc SkipFirstHeader(b []byte) []byte {\n  // We can assume the tag is SEQUENCE and thus one byte. The\n  // length starts at the second byte.\n  l := b[1]\n  if l < 0x80 {\n    return b[2:]  // Single-byte length\n  }\n  return b[2+l&0x7f:]  // First byte tells you length of length\n}\n```",
+      "createdAt": "2025-12-02T16:20:24Z",
+      "updatedAt": "2025-12-03T16:38:07Z",
+      "closedAt": null,
+      "comments": [
+        {
+          "author": "bwesterb",
+          "authorAssociation": "COLLABORATOR",
+          "body": "Good idea, but let's hold this change until we need to make another breaking change to the verification code / CA API.",
+          "createdAt": "2025-12-03T11:06:48Z",
+          "updatedAt": "2025-12-03T11:07:30Z"
+        },
+        {
+          "author": "davidben",
+          "authorAssociation": "OWNER",
+          "body": "Oops, uploaded the PR before I saw your comment. Yeah, _definitely_ not proposing to change the current implementation target!",
+          "createdAt": "2025-12-03T16:38:07Z",
+          "updatedAt": "2025-12-03T16:38:07Z"
+        }
+      ]
     }
   ],
   "pulls": [
@@ -10149,6 +10180,46 @@
           ]
         }
       ]
+    },
+    {
+      "number": 165,
+      "id": "PR_kwDOJIBkVc6234x2",
+      "title": "Omit the outermost SEQUENCE header in TBSCertificateLogEntry",
+      "url": "https://github.com/davidben/merkle-tree-certs/pull/165",
+      "state": "OPEN",
+      "author": "davidben",
+      "authorAssociation": "OWNER",
+      "assignees": [],
+      "labels": [],
+      "body": "Fixes #164. See #164 for motivation.\r\n\r\nThoughts? Worth doing?",
+      "createdAt": "2025-12-03T16:36:11Z",
+      "updatedAt": "2025-12-03T16:43:59Z",
+      "baseRepository": "davidben/merkle-tree-certs",
+      "baseRefName": "main",
+      "baseRefOid": "2b31f3d41162227fa1fe389b3e970cc33bf27eb6",
+      "headRepository": "davidben/merkle-tree-certs",
+      "headRefName": "single-pass",
+      "headRefOid": "50f7031777be2ce0f73ed4ebcb2d0e5d15ac425d",
+      "closedAt": null,
+      "mergedAt": null,
+      "mergedBy": null,
+      "mergeCommit": null,
+      "comments": [],
+      "reviews": [
+        {
+          "id": "PRR_kwDOJIBkVc7Swu-j",
+          "commit": {
+            "abbreviatedOid": "50f7031"
+          },
+          "author": "bwesterb",
+          "authorAssociation": "COLLABORATOR",
+          "state": "APPROVED",
+          "body": "",
+          "createdAt": "2025-12-03T16:43:59Z",
+          "updatedAt": "2025-12-03T16:43:59Z",
+          "comments": []
+        }
+      ]
     }
   ]
 }