Skip to content

Commit 7269efe

Browse files
author
ID Bot
committed
Script updating archive at 2026-06-25T04:16:36Z. [ci skip]
1 parent 09379fd commit 7269efe

1 file changed

Lines changed: 247 additions & 10 deletions

File tree

‎archive.json‎

Lines changed: 247 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"magic": "E!vIA5L86J2I",
3-
"timestamp": "2026-06-23T04:13:35.681177+00:00",
3+
"timestamp": "2026-06-25T04:16:34.415588+00:00",
44
"repo": "ietf-plants-wg/merkle-tree-certs",
55
"labels": [
66
{
@@ -3542,7 +3542,7 @@
35423542
"id": "I_kwDOJIBkVc8AAAABCaLv1A",
35433543
"title": "Log numbers follow-up work",
35443544
"url": "https://github.com/ietf-plants-wg/merkle-tree-certs/issues/232",
3545-
"state": "OPEN",
3545+
"state": "CLOSED",
35463546
"author": "davidben",
35473547
"authorAssociation": "COLLABORATOR",
35483548
"assignees": [
@@ -3551,8 +3551,8 @@
35513551
"labels": [],
35523552
"body": "Filing some follow-up work for myself after we merge https://github.com/ietf-plants-wg/merkle-tree-certs/pull/213. Filing this so I can reference this in TODOs\n\n- [x] Make the serial numbers fit in 64 bits again\n- [x] Fix up the slightly awkward sectioning\n- [ ] Some text discussing how you use multiple logs, like how CAs should only be appending to the latest and other considerations",
35533553
"createdAt": "2026-05-15T20:04:19Z",
3554-
"updatedAt": "2026-05-16T05:09:59Z",
3555-
"closedAt": null,
3554+
"updatedAt": "2026-06-24T21:11:11Z",
3555+
"closedAt": "2026-06-24T21:11:11Z",
35563556
"comments": []
35573557
},
35583558
{
@@ -3592,22 +3592,29 @@
35923592
"id": "I_kwDOJIBkVc8AAAABDO_lNQ",
35933593
"title": "Whither null_entry?",
35943594
"url": "https://github.com/ietf-plants-wg/merkle-tree-certs/issues/241",
3595-
"state": "OPEN",
3595+
"state": "CLOSED",
35963596
"author": "davidben",
35973597
"authorAssociation": "COLLABORATOR",
35983598
"assignees": [],
35993599
"labels": [],
36003600
"body": "After #213, null_entry is no longer needed for avoiding the zero serial. Should we still have it?\n\nBenefits:\n* Exercises the entry type extension point ahead of time\n* Maybe useful for liveness checks?\n* Maaaybe useful if someone wants to pad out the tree to some multiple of a power of 2 and avoid partial subtrees????\n\nDownsides:\n* Doesn't _really_ do anything. :-)\n* The spec text right now doesn't particularly motivate it so maybe we should fix that if we keep it",
36013601
"createdAt": "2026-05-24T15:13:53Z",
3602-
"updatedAt": "2026-05-25T11:50:20Z",
3603-
"closedAt": null,
3602+
"updatedAt": "2026-06-24T19:52:38Z",
3603+
"closedAt": "2026-06-24T19:52:38Z",
36043604
"comments": [
36053605
{
36063606
"author": "bwesterb",
36073607
"authorAssociation": "COLLABORATOR",
36083608
"body": "I like it for liveness checks.",
36093609
"createdAt": "2026-05-25T11:50:20Z",
36103610
"updatedAt": "2026-05-25T11:50:20Z"
3611+
},
3612+
{
3613+
"author": "davidben",
3614+
"authorAssociation": "COLLABORATOR",
3615+
"body": "Hehe, good enough reason for me. Closing.",
3616+
"createdAt": "2026-06-24T19:52:38Z",
3617+
"updatedAt": "2026-06-24T19:52:38Z"
36113618
}
36123619
]
36133620
},
@@ -3666,6 +3673,46 @@
36663673
"updatedAt": "2026-06-16T03:45:46Z",
36673674
"closedAt": null,
36683675
"comments": []
3676+
},
3677+
{
3678+
"number": 258,
3679+
"id": "I_kwDOJIBkVc8AAAABGg3B9Q",
3680+
"title": "Single-pass entry_hash procedure omits the RFC 9162 Merkle leaf prefix",
3681+
"url": "https://github.com/ietf-plants-wg/merkle-tree-certs/issues/258",
3682+
"state": "CLOSED",
3683+
"author": "Vaisman",
3684+
"authorAssociation": "NONE",
3685+
"assignees": [],
3686+
"labels": [],
3687+
"body": "While comparing the full entry_hash construction with the single-pass shortcut, I noticed that the latter appears to omit the RFC 9162 leaf prefix.\n\nThe full procedure in \"Verifying Certificate Signatures\" defines `entry_hash` as:\n\n> Let `entry_hash` be the hash of the entry, `MTH({entry}) = HASH(0x00 || entry)`, as defined in Section 2.1.1 of RFC9162.\n\nThe single-pass procedure described right after it, however, appears to start hashing the serialized `MerkleTreeCertEntry` directly:\n\n1. Initialize a hash instance.\n2. Write the big-endian, two-byte `tbs_cert_entry` value to the hash.\n3. Write the `TBSCertificate` contents octets to the hash, up to the `subjectPublicKeyInfo` field.\n\nThere is no step that writes the required `0x00` Merkle leaf prefix before the entry bytes. Without that prefix, the single-pass procedure computes `HASH(entry)` rather than `HASH(0x00 || entry)`, so it is not equivalent to `MTH({entry})`.\n\nSuggested fix: add an explicit first hashing step before writing the `MerkleTreeCertEntry` contents:\n\n> Write the octet `0x00` to the hash.",
3688+
"createdAt": "2026-06-24T05:51:54Z",
3689+
"updatedAt": "2026-06-24T15:42:39Z",
3690+
"closedAt": "2026-06-24T15:42:38Z",
3691+
"comments": [
3692+
{
3693+
"author": "davidben",
3694+
"authorAssociation": "COLLABORATOR",
3695+
"body": "Thanks! Already fixed in #243. (You can look at the editor's draft in GitHub. We haven't cut draft-05 yet, but it'll be in there.)",
3696+
"createdAt": "2026-06-24T15:42:39Z",
3697+
"updatedAt": "2026-06-24T15:42:39Z"
3698+
}
3699+
]
3700+
},
3701+
{
3702+
"number": 259,
3703+
"id": "I_kwDOJIBkVc8AAAABGmdO-w",
3704+
"title": "Whither relative OIDs in RDN attributes?",
3705+
"url": "https://github.com/ietf-plants-wg/merkle-tree-certs/issues/259",
3706+
"state": "OPEN",
3707+
"author": "davidben",
3708+
"authorAssociation": "COLLABORATOR",
3709+
"assignees": [],
3710+
"labels": [],
3711+
"body": "See this thread https://mailarchive.ietf.org/arch/msg/plants/sQSyFQkAXUGp-YxTJDzyD4S-vc8/\n\nMixed responses so far. Filing this just so we don't forget this is a decision we have to make.",
3712+
"createdAt": "2026-06-24T19:53:17Z",
3713+
"updatedAt": "2026-06-24T19:53:17Z",
3714+
"closedAt": null,
3715+
"comments": []
36693716
}
36703717
],
36713718
"pulls": [
@@ -18123,26 +18170,216 @@
1812318170
"id": "PR_kwDOJIBkVc7pZCri",
1812418171
"title": "Define a CA's current issuance log and rules around that",
1812518172
"url": "https://github.com/ietf-plants-wg/merkle-tree-certs/pull/255",
18126-
"state": "OPEN",
18173+
"state": "MERGED",
1812718174
"author": "davidben",
1812818175
"authorAssociation": "COLLABORATOR",
1812918176
"assignees": [],
1813018177
"labels": [],
1813118178
"body": "This clarifies that log numbers are not a free-for-all for CAs to just start issuing at any point. We care about monotonicity of sequence numbers for something like minSeriael to work, and we care that only one issuance log's landmarks are enough in normal operation.\r\n\r\nSee issue #232. This still isn't quite everything. I'd like to add some discussion on log failures, to clarify what this mechanism is actually for, and also discuss things that transparency-enforcing relying parties should do as a result. (Still working on that text, but this PR was ready in the meantime.)",
1813218179
"createdAt": "2026-06-22T22:09:54Z",
18133-
"updatedAt": "2026-06-22T22:09:54Z",
18180+
"updatedAt": "2026-06-24T16:04:43Z",
1813418181
"baseRepository": "ietf-plants-wg/merkle-tree-certs",
1813518182
"baseRefName": "main",
1813618183
"baseRefOid": "a6b3f491b81217735674c237d72bc41bee6cffae",
1813718184
"headRepository": "ietf-plants-wg/merkle-tree-certs",
1813818185
"headRefName": "current-log-number",
1813918186
"headRefOid": "28054b14b9dc4ab78c4b1b36556a3656cd390f8b",
18187+
"closedAt": "2026-06-24T16:04:40Z",
18188+
"mergedAt": "2026-06-24T16:04:40Z",
18189+
"mergedBy": "davidben",
18190+
"mergeCommit": {
18191+
"oid": "73917459ca861815701949fc994d2ebcd66ca50e"
18192+
},
18193+
"comments": [],
18194+
"reviews": [
18195+
{
18196+
"id": "PRR_kwDOJIBkVc8AAAABD5Hx5g",
18197+
"commit": {
18198+
"abbreviatedOid": "28054b1"
18199+
},
18200+
"author": "lukevalenta",
18201+
"authorAssociation": "COLLABORATOR",
18202+
"state": "APPROVED",
18203+
"body": "",
18204+
"createdAt": "2026-06-23T18:51:07Z",
18205+
"updatedAt": "2026-06-23T18:51:07Z",
18206+
"comments": []
18207+
}
18208+
]
18209+
},
18210+
{
18211+
"number": 256,
18212+
"id": "PR_kwDOJIBkVc7p3KLb",
18213+
"title": "Add a discussion of multiple logs in security considerations",
18214+
"url": "https://github.com/ietf-plants-wg/merkle-tree-certs/pull/256",
18215+
"state": "MERGED",
18216+
"author": "davidben",
18217+
"authorAssociation": "COLLABORATOR",
18218+
"assignees": [],
18219+
"labels": [],
18220+
"body": "Closes #232. This PR sits on top of #255.",
18221+
"createdAt": "2026-06-23T22:38:33Z",
18222+
"updatedAt": "2026-06-24T21:11:13Z",
18223+
"baseRepository": "ietf-plants-wg/merkle-tree-certs",
18224+
"baseRefName": "main",
18225+
"baseRefOid": "a6b3f491b81217735674c237d72bc41bee6cffae",
18226+
"headRepository": "ietf-plants-wg/merkle-tree-certs",
18227+
"headRefName": "log-number-security-considerations",
18228+
"headRefOid": "405b8bb97410467deb1124fc15ce9f659cd729f4",
18229+
"closedAt": "2026-06-24T21:11:10Z",
18230+
"mergedAt": "2026-06-24T21:11:10Z",
18231+
"mergedBy": "davidben",
18232+
"mergeCommit": {
18233+
"oid": "6795e4f7ead20f0adaccabfad793bd5258f4a610"
18234+
},
18235+
"comments": [],
18236+
"reviews": [
18237+
{
18238+
"id": "PRR_kwDOJIBkVc8AAAABD-sqvQ",
18239+
"commit": {
18240+
"abbreviatedOid": "bf582f8"
18241+
},
18242+
"author": "lukevalenta",
18243+
"authorAssociation": "COLLABORATOR",
18244+
"state": "APPROVED",
18245+
"body": "",
18246+
"createdAt": "2026-06-24T12:13:14Z",
18247+
"updatedAt": "2026-06-24T12:31:06Z",
18248+
"comments": [
18249+
{
18250+
"originalPosition": 52,
18251+
"body": "Feel free to reject to keep it more general, but this just makes it clear whose 'trustworthy or not' opinion ultimately matters.\n```suggestion\n* If relying parties consider the CA operator and the CA instance still trustworthy, repairing the incident without changing the CA requires less overhead.\n```",
18252+
"createdAt": "2026-06-24T12:21:42Z",
18253+
"updatedAt": "2026-06-24T12:31:07Z"
18254+
},
18255+
{
18256+
"originalPosition": 53,
18257+
"body": "```suggestion\n* If relying parties consider either the CA operator or the CA instance no longer trustworthy and in need of replacement, the CA may still be needed to serve older, unupdated relying parties.\n```",
18258+
"createdAt": "2026-06-24T12:23:07Z",
18259+
"updatedAt": "2026-06-24T12:31:07Z"
18260+
},
18261+
{
18262+
"originalPosition": 51,
18263+
"body": "minor nit: We're a bit inconsistent with having a period or not terminating list items. Probably can all be cleaned up in an editorial pass down the road.",
18264+
"createdAt": "2026-06-24T12:27:56Z",
18265+
"updatedAt": "2026-06-24T12:31:07Z"
18266+
}
18267+
]
18268+
},
18269+
{
18270+
"id": "PRR_kwDOJIBkVc8AAAABEA8T2Q",
18271+
"commit": {
18272+
"abbreviatedOid": "405b8bb"
18273+
},
18274+
"author": "davidben",
18275+
"authorAssociation": "COLLABORATOR",
18276+
"state": "COMMENTED",
18277+
"body": "",
18278+
"createdAt": "2026-06-24T17:15:24Z",
18279+
"updatedAt": "2026-06-24T17:15:51Z",
18280+
"comments": [
18281+
{
18282+
"originalPosition": 51,
18283+
"body": "I've usually done it based on whether it's a list of clauses (no period) or a list of sentences (period), but maybe that's not right?",
18284+
"createdAt": "2026-06-24T17:15:24Z",
18285+
"updatedAt": "2026-06-24T17:15:51Z"
18286+
}
18287+
]
18288+
},
18289+
{
18290+
"id": "PRR_kwDOJIBkVc8AAAABEBfewQ",
18291+
"commit": {
18292+
"abbreviatedOid": "bf582f8"
18293+
},
18294+
"author": "lukevalenta",
18295+
"authorAssociation": "COLLABORATOR",
18296+
"state": "COMMENTED",
18297+
"body": "",
18298+
"createdAt": "2026-06-24T18:42:59Z",
18299+
"updatedAt": "2026-06-24T18:42:59Z",
18300+
"comments": [
18301+
{
18302+
"originalPosition": 51,
18303+
"body": "That works for me!",
18304+
"createdAt": "2026-06-24T18:42:59Z",
18305+
"updatedAt": "2026-06-24T18:42:59Z"
18306+
}
18307+
]
18308+
},
18309+
{
18310+
"id": "PRR_kwDOJIBkVc8AAAABECcQJA",
18311+
"commit": {
18312+
"abbreviatedOid": "405b8bb"
18313+
},
18314+
"author": "jdeblasio",
18315+
"authorAssociation": "NONE",
18316+
"state": "APPROVED",
18317+
"body": "",
18318+
"createdAt": "2026-06-24T21:02:52Z",
18319+
"updatedAt": "2026-06-24T21:02:52Z",
18320+
"comments": []
18321+
}
18322+
]
18323+
},
18324+
{
18325+
"number": 257,
18326+
"id": "PR_kwDOJIBkVc7p4f1E",
18327+
"title": "The \"enhancement\" link relation",
18328+
"url": "https://github.com/ietf-plants-wg/merkle-tree-certs/pull/257",
18329+
"state": "OPEN",
18330+
"author": "davidben",
18331+
"authorAssociation": "COLLABORATOR",
18332+
"assignees": [],
18333+
"labels": [],
18334+
"body": "Another ACME option. Fourth time's the charm? :-)",
18335+
"createdAt": "2026-06-24T00:00:14Z",
18336+
"updatedAt": "2026-06-24T12:41:07Z",
18337+
"baseRepository": "ietf-plants-wg/merkle-tree-certs",
18338+
"baseRefName": "main",
18339+
"baseRefOid": "a6b3f491b81217735674c237d72bc41bee6cffae",
18340+
"headRepository": "ietf-plants-wg/merkle-tree-certs",
18341+
"headRefName": "link-rel-enhancement",
18342+
"headRefOid": "23ea09584ae5f182b162d20825bbe625b709770e",
1814018343
"closedAt": null,
1814118344
"mergedAt": null,
1814218345
"mergedBy": null,
1814318346
"mergeCommit": null,
1814418347
"comments": [],
18145-
"reviews": []
18348+
"reviews": [
18349+
{
18350+
"id": "PRR_kwDOJIBkVc8AAAABD69PvA",
18351+
"commit": {
18352+
"abbreviatedOid": "ce59bee"
18353+
},
18354+
"author": "aarongable",
18355+
"authorAssociation": "CONTRIBUTOR",
18356+
"state": "APPROVED",
18357+
"body": "",
18358+
"createdAt": "2026-06-24T00:28:04Z",
18359+
"updatedAt": "2026-06-24T00:31:26Z",
18360+
"comments": [
18361+
{
18362+
"originalPosition": 10,
18363+
"body": "```suggestion\nThis is similar to the \"alternate\" link relation, except that it specifies the substitute is optional. In some applications, a client may fetch all alternates, so that it may forward one of the alternates to another party. For example, {{Section 7.4.2 of !RFC8555}} describes how an ACME server uses the \"alternate\" link relation to serve multiple certificate chains for an ACME order. An ACME client might then fetch all of them and configure them in a TLS server, which presents them to TLS clients. Different TLS clients need different chains, so the ACME client might reasonably treat any unavailable alternate as an error.\n```",
18364+
"createdAt": "2026-06-24T00:28:04Z",
18365+
"updatedAt": "2026-06-24T00:31:26Z"
18366+
}
18367+
]
18368+
},
18369+
{
18370+
"id": "PRR_kwDOJIBkVc8AAAABD-4XKg",
18371+
"commit": {
18372+
"abbreviatedOid": "23ea095"
18373+
},
18374+
"author": "lukevalenta",
18375+
"authorAssociation": "COLLABORATOR",
18376+
"state": "APPROVED",
18377+
"body": "",
18378+
"createdAt": "2026-06-24T12:41:06Z",
18379+
"updatedAt": "2026-06-24T12:41:06Z",
18380+
"comments": []
18381+
}
18382+
]
1814618383
}
1814718384
]
1814818385
}

0 commit comments

Comments
 (0)