Michael Stapelberg
96dc232fbd
x509roots/fallback/bundle: add bundle package to export root certs
...
Fixes golang/go#69898
Change-Id: Idbb1bbe48016a622414c84a56fe26f48bfe712c8
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/687155
Reviewed-by: Roland Shoemaker <roland@golang.org >
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com >
Auto-Submit: Roland Shoemaker <roland@golang.org >
Reviewed-by: Mateusz Poliwczak <mpoliwczak34@gmail.com >
2025-09-11 08:14:50 -07:00
Mateusz Poliwczak
c247dead11
x509roots/fallback: store bundle certs directly in DER
...
goos: linux
goarch: amd64
pkg: golang.org/x/crypto/x509roots/fallback
cpu: AMD Ryzen 5 4600G with Radeon Graphics
│ /tmp/before │ /tmp/after │
│ sec/op │ sec/op vs base │
InitTime-12 1.726m ± 0% 1.101m ± 1% -36.20% (p=0.000 n=30)
│ /tmp/before │ /tmp/after │
│ B/op │ B/op vs base │
InitTime-12 1178.2Ki ± 0% 779.8Ki ± 0% -33.81% (p=0.000 n=30)
│ /tmp/before │ /tmp/after │
│ allocs/op │ allocs/op vs base │
InitTime-12 11.35k ± 0% 10.64k ± 0% -6.32% (p=0.000 n=30)
Updates golang/go#73691
Change-Id: Ic33f2fdfc65001c41afeb3b6af8a383288d10de6
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/676217
Reviewed-by: Roland Shoemaker <roland@golang.org >
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com >
Reviewed-by: Mark Freeman <mark@golang.org >
2025-08-03 12:47:17 -07:00
Mateusz Poliwczak
4f9f0ca9fc
x509roots/fallback: add init time benchmark
...
goos: linux
goarch: amd64
pkg: golang.org/x/crypto/x509roots/fallback
cpu: AMD Ryzen 5 4600G with Radeon Graphics
│ /tmp/before │
│ sec/op │
InitTime-12 1.726m ± 0%
│ /tmp/before │
│ B/op │
InitTime-12 1.151Mi ± 0%
│ /tmp/before │
│ allocs/op │
InitTime-12 11.35k ± 0%
For golang/go#73691
Change-Id: Ic932bd7835e50dd5c6adbdf684644afa49bddebc
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/676216
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com >
Reviewed-by: Roland Shoemaker <roland@golang.org >
Reviewed-by: Sean Liao <sean@liao.dev >
Auto-Submit: Sean Liao <sean@liao.dev >
Reviewed-by: Michael Knyszek <mknyszek@google.com >
2025-05-31 02:59:11 -07:00
Mateusz Poliwczak
eac7cf0d78
x509roots/fallback: move parsing code to a non-generated file
...
For golang/go#73691
Change-Id: I3e2b09055c39286d863fe70ca3bd72a839e25d0a
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/676215
Reviewed-by: Michael Knyszek <mknyszek@google.com >
Reviewed-by: Roland Shoemaker <roland@golang.org >
Reviewed-by: Sean Liao <sean@liao.dev >
Auto-Submit: Sean Liao <sean@liao.dev >
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com >
2025-05-31 02:59:06 -07:00
Roland Shoemaker
376eb14006
x509roots: support constrained roots
...
Adds support for roots with the distrust-after bit set. The constraint
function construction is a little funky, but I couldn't think of an
obvious better way to do it.
Fixes golang/go#70777
Fixes golang/go#70623
Change-Id: I780f866416b626360eaee9368185768da7bc75ef
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/652996
Reviewed-by: David Chase <drchase@google.com >
Reviewed-by: Daniel McCarney <daniel@binaryparadox.net >
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com >
2025-03-13 16:44:06 -07:00
Dmitri Shuralyov
b0784b7bfb
x509roots/fallback: drop obsolete build constraint
...
Back when Go 1.20 and 1.19 were supported, the go1.20 build constraint
was there to establish 1.20 as the minimum for the package, because it
requires an API that was added only in Go 1.20 and there was no way to
make it work with 1.19's APIs.
By now only Go 1.24 and 1.23 are supported, and the minimum is set via
the go directive in go.mod.
For golang/go#57792 .
Change-Id: Ie4d37d34993374cdd380667930ee667af97eeccb
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/649716
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com >
Reviewed-by: Cherry Mui <cherryyz@google.com >
Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org >
Reviewed-by: Roland Shoemaker <roland@golang.org >
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com >
2025-02-21 09:26:01 -08:00
Dmitri Shuralyov
a9e447dde7
x509roots/fallback: add //go:build go1.20 to bundle.go
...
Package fallback has no API; its only purpose is to automatically call
x509.SetFallbackRoots with a set of fallback roots. That API was added
in Go 1.20, hence the go1.20 build constraint in fallback.go.
Add that constraint to bundle.go too, so that it fails to build rather
than quietly being a no-op in Go 1.19.
Also simplify Write(fmt.Sprintf()) into fmt.Fprintf while here.
Add a temporary workaround for go.dev/issue/52287.
It has no effect on the public API in this module.
For golang/go#57792 .
For golang/go#52287 .
Change-Id: I1fe13f7d54b07b0b031e8bae685cffd7a8160165
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/505578
Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org >
TryBot-Result: Gopher Robot <gobot@golang.org >
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com >
Reviewed-by: Roland Shoemaker <roland@golang.org >
Run-TryBot: Dmitri Shuralyov <dmitshur@golang.org >
2023-06-23 16:46:51 +00:00
Roland Shoemaker
d0b316056b
x509roots: add new module
...
Adds the nss parser, under x509roots/nss, and the fallback
module/package, with the initial generated bundle.
Fixes golang/go#57792
Change-Id: Iebb1052e49126fa5baba1236f4ebc8dd8a823179
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/462036
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com >
TryBot-Result: Gopher Robot <gobot@golang.org >
Run-TryBot: Roland Shoemaker <roland@golang.org >
Reviewed-by: Filippo Valsorda <filippo@golang.org >
Reviewed-by: Damien Neil <dneil@google.com >
Auto-Submit: Roland Shoemaker <roland@golang.org >
2023-06-09 17:23:14 +00:00
Michael Stapelberg
Mateusz Poliwczak
Roland Shoemaker
Dmitri Shuralyov