Skip to content
Auditing for TLS certificates (Go code)
Go Shell Other
Branch: master
Clone or download

Latest commit

dependabot-preview Bump github.com/google/go-cmp from 0.4.0 to 0.4.1 (#694)
Bumps [github.com/google/go-cmp](https://github.com/google/go-cmp) from 0.4.0 to 0.4.1.
- [Release notes](https://github.com/google/go-cmp/releases)
- [Commits](google/go-cmp@v0.4.0...v0.4.1)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>
Latest commit 433e4dc May 29, 2020

Files

Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
asn1 Clean-up. (#593) Jul 31, 2019
client Support loading config from both text and binary protobufs (#618) Nov 26, 2019
ctpolicy LoglistV1 -> LoglistV2 transition for proxy (#590) Jul 31, 2019
ctutil Add a VerifySCT method taking a SignatureVerifier (#641) Jan 17, 2020
dnsclient Resolve some now obsolete todos (#628) Dec 3, 2019
fixchain Fix still flaking ratelimiter_test (#646) Feb 5, 2020
gossip Resolve some now obsolete todos (#628) Dec 3, 2019
ingestor/ranges Fix var / package collisions and extra parens (#565) Jul 17, 2019
jsonclient jsonclient: log client URI when logging errors (#617) Nov 20, 2019
logid Fix var / package collisions and extra parens (#565) Jul 17, 2019
loglist Update to golangci-lint 1.17.1 (#532) Jun 11, 2019
loglist2 Fix Sharding logic with using notbefore of a certificate. (#647) Feb 6, 2020
preload Fix var / package collisions and extra parens (#565) Jul 17, 2019
scanner Fix var / package collisions and extra parens (#565) Jul 17, 2019
schedule Move Every() from submission package to new schedule package Mar 27, 2019
scripts Resolve some now obsolete todos (#628) Dec 3, 2019
submission Adding debug logs (#683) Apr 28, 2020
testdata LoglistV1 -> LoglistV2 transition for proxy (#590) Jul 31, 2019
third_party/prometheus trillian: initial Prometheus consoles Jun 20, 2017
tls Wean CTFE off trillian "tcrypto" for Go "crypto" (#194) Mar 21, 2018
trillian Remove FixedBackendResolver (#696) May 28, 2020
watcher Refactor code to use schedule.Every() Mar 27, 2019
x509 x509: fix OS X compile error Jan 3, 2020
x509util Bug-fix (#559) Jul 3, 2019
.gitignore gossip: add goshawk for checking minimal gossip May 24, 2018
.golangci.yaml Set golangci-lint --exclude-use-default=false Nov 27, 2019
.travis.yml Check go.mod during Travis build Dec 20, 2019
AUTHORS client: make backoff to per-client not per-POST (#75) Oct 30, 2017
CHANGELOG.md Remove FixedBackendResolver (#696) May 28, 2020
CONTRIBUTING.md Pristine copy of CT Go code May 4, 2017
CONTRIBUTORS Adding Tatiana to contributors list. (#461) Feb 21, 2019
LICENSE Squashed 'vendor/github.com/coreos/etcd/' content from commit 44a017e… Sep 11, 2017
PULL_REQUEST_TEMPLATE.md Remove reference to feature implementation matrix Jul 18, 2019
README.md go module proof go:generate protoc (#535) Jun 12, 2019
cloudbuild.yaml Make cloudbuild.yaml only dry-run deployment to Kubernetes Jun 26, 2019
cloudbuild_master.yaml Make cloudbuild.yaml only dry-run deployment to Kubernetes Jun 26, 2019
cloudbuild_tag.yaml Add config for creating Docker images for tagged releases automatically Jun 25, 2018
codecov.yml Remove codecov exclusion for vendor directory (#542) Jun 19, 2019
go.mod Bump github.com/google/go-cmp from 0.4.0 to 0.4.1 (#694) May 29, 2020
go.sum Bump github.com/google/go-cmp from 0.4.0 to 0.4.1 (#694) May 29, 2020
serialization.go [Migrillian] Make admission control laxer (#320) Aug 10, 2018
serialization_test.go Fix var / package collisions and extra parens (#565) Jul 17, 2019
signatures.go Fix another bunch of warnings / nits in c-t-go. (#481) Mar 18, 2019
signatures_test.go ct: fix lint warnings in tests Jan 31, 2019
tools.go Use instaler for golangci-lint (#630) Dec 17, 2019
types.go Factor out conversion from AddChainResponse to SCT. (#626) Dec 2, 2019
types_test.go Factor out conversion from AddChainResponse to SCT. (#626) Dec 2, 2019

README.md

Certificate Transparency: Go Code

Build Status Go Report Card GoDoc

This repository holds Go code related to Certificate Transparency (CT). The repository requires Go version 1.9.

Repository Structure

The main parts of the repository are:

  • Encoding libraries:
    • asn1/ and x509/ are forks of the upstream Go encoding/asn1 and crypto/x509 libraries. We maintain separate forks of these packages because CT is intended to act as an observatory of certificates across the ecosystem; as such, we need to be able to process somewhat-malformed certificates that the stricter upstream code would (correctly) reject. Our x509 fork also includes code for working with the pre-certificates defined in RFC 6962.
    • tls holds a library for processing TLS-encoded data as described in RFC 5246.
    • x509util/ provides additional utilities for dealing with x509.Certificates.
  • CT client libraries:
    • The top-level ct package (in .) holds types and utilities for working with CT data structures defined in RFC 6962.
    • client/ and jsonclient/ hold libraries that allow access to CT Logs via HTTP entrypoints described in section 4 of RFC 6962.
    • dnsclient/ has a library that allows access to CT Logs over DNS.
    • scanner/ holds a library for scanning the entire contents of an existing CT Log.
  • CT Personality for Trillian:
    • trillian/ holds code that allows a Certificate Transparency Log to be run using a Trillian Log as its back-end -- see below.
  • Command line tools:
    • ./client/ctclient allows interaction with a CT Log.
    • ./ctutil/sctcheck allows SCTs (signed certificate timestamps) from a CT Log to be verified.
    • ./scanner/scanlog allows an existing CT Log to be scanned for certificates of interest; please be polite when running this tool against a Log.
    • ./x509util/certcheck allows display and verification of certificates
    • ./x509util/crlcheck allows display and verification of certificate revocation lists (CRLs).
  • Other libraries related to CT:
    • ctutil/ holds utility functions for validating and verifying CT data structures.
    • loglist/ has a library for reading JSON lists of CT Logs.

Trillian CT Personality

The trillian/ subdirectory holds code and scripts for running a CT Log based on the Trillian general transparency Log, and is documented separately.

Working on the Code

Developers who want to make changes to the codebase need some additional dependencies and tools, described in the following sections. The Travis configuration for the codebase is also useful reference for the required tools and scripts, as it may be more up-to-date than this document.

In order for the go generate command to work properly, the code must be checked out to the following location: $GOPATH/src/github.com/google/certificate-transparency-go

Running Codebase Checks

The scripts/presubmit.sh script runs various tools and tests over the codebase; please ensure this script passes before sending pull requests for review.

# Install golangci-lint
go get -u github.com/golangci/golangci-lint/cmd/golangci-lint
cd $GOPATH/src/github.com/golangci/golangci-lint/cmd/golangci-lint
go install -ldflags "-X 'main.version=$(git describe --tags)' -X 'main.commit=$(git rev-parse --short HEAD)' -X 'main.date=$(date)'"
cd -

# Run code generation, build, test and linters
./scripts/presubmit.sh

# Run build, test and linters but skip code generation
./scripts/presubmit.sh  --no-generate

# Or just run the linters alone:
golangci-lint run

Rebuilding Generated Code

Some of the CT Go code is autogenerated from other files:

  • Protocol buffer message definitions are converted to .pb.go implementations.
  • A mock implementation of the Trillian gRPC API (in trillian/mockclient) is created with GoMock.

Re-generating mock or protobuffer files is only needed if you're changing the original files; if you do, you'll need to install the prerequisites:

and run the following:

go generate -x ./...  # hunts for //go:generate comments and runs them

Updating Vendor Code

The codebase includes a couple of external projects under the vendor/ subdirectory, to ensure that builds use a fixed version (typically because the upstream repository does not guarantee back-compatibility between the tip master branch and the current stable release). See instructions in the Trillian repo for how to update vendored subtrees.

You can’t perform that action at this time.