Discussion: Roadmap and future

Open
  • Is something wrong?
#199 4 comments 1 reaction 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Feature
Clarity
Needs clarification
Activity status
Quiet
Tech stack
c, rust
Domain
cryptography, security

Research direction

Start by reading the current roadmap and open issues, then inspect the Policy/Outcome API and the rustls-webpki path-building boundary described here. Done would be a maintainer decision on the four requested areas and a clear roadmap or scope statement, rather than a standalone code change.

Written by the indexing model from the issue text.

Description

Hi,

I am reaching out to you as a member of the Red Hat Crypto team. We are evaluating upki as the foundation for system-wide certificate verification on fedora/rhel/centos, targeting parity with Mozilla Firefox's certificate validation behavior. We find the project direction very compelling and the roadmap items align well with what we need.

As part of this effort we are planning integrations with GnuTLS, OpenSSL, NSS, and potentially
other crypto libraries — so we expect to be working closely with the C FFI and OpenSSL callbackpaths in particular. We have already opened a discussion with the OpenSSL project on this topic https://github.com/openssl/openssl/discussions/31932. We wanted to open a discussion about a few areas we could not find on the current roadmap or in open issues, and ask where you are heading with them.

1. NotCoveredByRevocationData and the fresh-certificate grace period

Firefox exempts certificates issued within the last 10 days from revocation checks. upki returns
NotCoveredByRevocationData for certificates outside the filter window, which is in the same
ballpark but not the same policy. Is there a plan to expose a certificate-age threshold in the
Policy / Outcome API to match this behaviour?

2. CT policy: multiple SCTs from distinct log operators

We presume CT enforcement is on the roadmap, and as part of that — Firefox's CT policy requires
SCTs from a minimum number of independently operated logs, not just the presence of any SCT. The
The current Policy API only distinguishes "has at least one SCT" from "has none." Is a configurable
threshold and log list management something you intend to cover as part of that work?

3. OneCRL

Mozilla's OneCRL covers emergency revocation of intermediate CAs outside of the normal CRLite
flow. Is integrating something equivalent on your roadmap, or is this considered out of scope?

4. Alternate path building with a cached intermediate store

Currently path building is delegated to rustls-webpki, which builds a single path from the chain
provided by the caller. Retry against a cached intermediate store would be particularly valuable
during root transitions. Is this planned as part of the intermediate preloading work, or considered
out of scope?

Dominant language
Rust
Stars
181
Forks
14
Avg merge
14h 16m
Merged PRs (30d)
21

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from rustls/upki

All issues in rustls/upki

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.