* verification: add test_verify_tz_aware
Signed-off-by: William Woodruff <william@trailofbits.com>
* py_to_datetime handles tzinfo, add test
Signed-off-by: William Woodruff <william@trailofbits.com>
* Update src/rust/src/x509/common.rs
Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>
* x509/common: coverage for the coverage god
Signed-off-by: William Woodruff <william@trailofbits.com>
---------
Signed-off-by: William Woodruff <william@trailofbits.com>
Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>
* Add support for SM4-GCM cipher
ref: #7503
ref: https://github.com/openssl/openssl/issues/13667
* Update SM4 GCM tests to use external test vector
* Cite SM4 test vectors sources in document
* Add tests for SM4ModeGCM finalize_with_tag
* Update CHANGELOG.rst
The existing cert doesn't expire until late 2038 but this simplifies
2038 checks for some downstream consumers. We shift the original
cert/key into a new pkcs12/ca directory so that we don't need to
regenerate all the PKCS12 vectors (which don't care about expiry anyway)
* raise an exception instead of returning an empty list
as davidben points out in #9926 we are calling a specific load
certificates function and an empty value doesn't necessarily mean empty
because PKCS7 contains multitudes. erroring is more correct.
* changelog
* Update CHANGELOG.rst
Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>
---------
Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>
* Apply refurb suggestion
[FURB138]: Consider using list comprehension
* Apply refurb suggestion
[FURB108]: Replace `x == y or x == z` with `x in (y, z)`
* src, tests: all max_chain_depth to validation API
Signed-off-by: William Woodruff <william@trailofbits.com>
* docs: document max_chain_depth
Signed-off-by: William Woodruff <william@trailofbits.com>
* verify: simplify type
Signed-off-by: William Woodruff <william@trailofbits.com>
* validation: document DEFAULT_MAX_CHAIN_DEPTH
Signed-off-by: William Woodruff <william@trailofbits.com>
---------
Signed-off-by: William Woodruff <william@trailofbits.com>
* Add top-level ServerVerifier.verify API
This is a breakout from #8873, with just the interface/types and
a `NotImplementedError` stub.
Signed-off-by: William Woodruff <william@trailofbits.com>
* verification: move Store into PolicyBuilder/ServerVerifier
Signed-off-by: William Woodruff <william@trailofbits.com>
* verification: docs
Signed-off-by: William Woodruff <william@trailofbits.com>
* lintage
Signed-off-by: William Woodruff <william@trailofbits.com>
* docs: document ServerVerifier.store
Signed-off-by: William Woodruff <william@trailofbits.com>
---------
Signed-off-by: William Woodruff <william@trailofbits.com>
