From 4d32faec72461d43893b1dfb9afa7eb0f6fe29f8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=A1bor=20Z=20Sink=C3=B3?= Date: Tue, 3 Nov 2026 23:12:17 +0100 Subject: [PATCH 1/2] evidence(time): RFC 3161 time stamps of the signed records v0.2.1, v0.2.0 and v0.1.5 (DigiCert, 2026-11-03) Every certificate of the chain that signed these records ends on 2026-12-31 and the present verifier judges validity at the moment of checking, so from 2027-01-01 it refuses them. Evidence that a record existed before the chain ended has to be made before it ends; a token obtained in 2027 only shows a date after the end. Three tokens from the DigiCert public time-stamp authority over the SHA-256 of the three signed records, each answering its own request (nonce), the digest equal to the record read from git at its release commit. Stamp times 2026-11-03 22:07:48, 22:09:44 and 22:09:45 UTC. Kept: the 70-byte requests, the replies, the TSA chains the replies carry, the self-signed DigiCert Trusted Root G4 as the trust anchor (taken from the operating system store and equal to the SHA-256, SHA-1 and serial DigiCert publishes), a manifest, and verify.sh which re-checks all of it offline, the token at the time stamp and not at "now", and with --selftest shows that a record changed by one byte and a wrong anchor are refused. verify.sh itself was shown to fail on a damaged token, a changed manifest, a replaced anchor and missing commits. What it proves and what it does not is in the README: existence no later than the stamp, nothing about who signed or whether the release is genuine. Only digests were sent. No terms of use for the public endpoint were found; that and the other limits are written down. Data only: no code, no change to the records, the verifier or the release branches. --- [signing-metadata] key = cic-my-sign-key signature = vault:v1:MEQCIEGVAQvbflcRoVWqTgEiYLxyydPT/eLCNt8ZGdh0F9YwAiB0l+DJ729D8qMY8PNvzRQCCPSCRj0EUprD+kbJ1ELqSg== hash-algorithm = sha256 digest = tes803bYhBOgd/AfIUp13mZJU2O1LITc24L/NOpeet4= [certificate] -----BEGIN CERTIFICATE----- MIICBjCCAaygAwIBAgIUSnRMR6RPnEbg296XWPOqq/u5PCwwCgYIKoZIzj0EAwIw QzELMAkGA1UEBhMCSFUxGTAXBgNVBAoMEENlbnRyYWxJbmZyYUNvcmUxGTAXBgNV BAMMEENJQyBEZXZlbG9wZXIgQ0EwHhcNMjYwMzIwMTMyMjU5WhcNMjYxMjMxMTMy MjU5WjBFMQswCQYDVQQGEwJIVTEZMBcGA1UECgwQQ2VudHJhbEluZnJhQ29yZTEb MBkGA1UEAwwSR2Fib3IgWm9sdGFuIFNpbmtvMFkwEwYHKoZIzj0CAQYIKoZIzj0D AQcDQgAEIG2CVmTfmLB9pLLclj7YmP2eedAjklpy4LGrU2ijoiy6Xqpuybv7OgJe i+ez31s65NEV8+X/ByeX1cstR988z6N8MHowCQYDVR0TBAIwADAdBgNVHQ4EFgQU yZN6AIX/TNnIJ9GwAa/NRN3ujHAwHwYDVR0jBBgwFoAUXn6CHYzPUqU4JVP8g+OS WeDYjhcwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEF BQcDBDAKBggqhkjOPQQDAgNIADBFAiEA+bFzXRoJ4PCQbhAAtpkcMjt0vNj5rEW0 lOMBGDNyaWkCIB1vmM7PcZzv/c9bIrxF5kqv6QXomouhByUfeNUTbpKW -----END CERTIFICATE----- --- evidence/time/digicert-2026-11-03/README.md | 41 ++++++ .../time/digicert-2026-11-03/manifest.json | 103 +++++++++++++++ .../trust-anchor/DigiCert_Trusted_Root_G4.pem | 32 +++++ .../digicert-2026-11-03/v0.1.5/request.tsq | Bin 0 -> 69 bytes .../digicert-2026-11-03/v0.1.5/response.tsr | Bin 0 -> 6006 bytes .../digicert-2026-11-03/v0.1.5/tsa-chain.pem | 119 ++++++++++++++++++ .../digicert-2026-11-03/v0.2.0/request.tsq | Bin 0 -> 70 bytes .../digicert-2026-11-03/v0.2.0/response.tsr | Bin 0 -> 6007 bytes .../digicert-2026-11-03/v0.2.0/tsa-chain.pem | 119 ++++++++++++++++++ .../digicert-2026-11-03/v0.2.1/request.tsq | Bin 0 -> 70 bytes .../digicert-2026-11-03/v0.2.1/response.tsr | Bin 0 -> 6007 bytes .../digicert-2026-11-03/v0.2.1/tsa-chain.pem | 119 ++++++++++++++++++ evidence/time/digicert-2026-11-03/verify.sh | 47 +++++++ 13 files changed, 580 insertions(+) create mode 100644 evidence/time/digicert-2026-11-03/README.md create mode 100644 evidence/time/digicert-2026-11-03/manifest.json create mode 100644 evidence/time/digicert-2026-11-03/trust-anchor/DigiCert_Trusted_Root_G4.pem create mode 100644 evidence/time/digicert-2026-11-03/v0.1.5/request.tsq create mode 100644 evidence/time/digicert-2026-11-03/v0.1.5/response.tsr create mode 100644 evidence/time/digicert-2026-11-03/v0.1.5/tsa-chain.pem create mode 100644 evidence/time/digicert-2026-11-03/v0.2.0/request.tsq create mode 100644 evidence/time/digicert-2026-11-03/v0.2.0/response.tsr create mode 100644 evidence/time/digicert-2026-11-03/v0.2.0/tsa-chain.pem create mode 100644 evidence/time/digicert-2026-11-03/v0.2.1/request.tsq create mode 100644 evidence/time/digicert-2026-11-03/v0.2.1/response.tsr create mode 100644 evidence/time/digicert-2026-11-03/v0.2.1/tsa-chain.pem create mode 100755 evidence/time/digicert-2026-11-03/verify.sh diff --git a/evidence/time/digicert-2026-11-03/README.md b/evidence/time/digicert-2026-11-03/README.md new file mode 100644 index 0000000..c2c9b13 --- /dev/null +++ b/evidence/time/digicert-2026-11-03/README.md @@ -0,0 +1,41 @@ +# Time evidence for three signed cic-primitives release records (2026-11-03) + +RFC 3161 time-stamp tokens from the DigiCert public time-stamp authority over the SHA-256 of the three signed release records `v0.2.1`, `v0.2.0` and `v0.1.5`, obtained on 2026-11-03. + +**Why now.** Every certificate of the signing chain of these records (Developer CA, Source CA, the developer's certificate; the root a few hours later) ends on 2026-12-31 around 13:22 UTC, and the present verifier judges validity at the moment of checking, so from 2027-01-01 it refuses these records. Evidence that a record existed *before* the chain ended has to be made *before* it ends; a token obtained in 2027 would only show a date after the end. See `docs/P5-TRUST-MODEL-PLAN.md` of cic-primitive-forms (section 4). + +| Release | Record SHA-256 | Time stamp (UTC) | +|---|---|---| +| v0.2.1 | `e5d8268aede0d24f02e60a151099a2fdc7615172ed3105b0a05b6b5d19addf63` | 2026-11-03 22:07:48 | +| v0.2.0 | `955fab2d6d9638c773f29fbe97a3279f9f10b9539c4e3e79957df0acef9a57a6` | 2026-11-03 22:09:44 | +| v0.1.5 | `284e44bfcf62d79f782d6cae359c4c99ef2f5297f6f71dcea52a95d28b8c4456` | 2026-11-03 22:09:45 | + +## Check it + +From a clone of cic-primitives that has the full history (the records are read from git at their release commits): + +``` +bash evidence/time/digicert-2026-11-03/verify.sh --selftest +``` + +It checks the trust anchor against the figures in `manifest.json`, the record against its digest, the token against the request and against the record file, and the token **at the time stamp** (not "now"). With `--selftest` it also shows that a record changed by one byte and a wrong anchor are refused. It needs `openssl`, `git` and `python3`, and no network. Exit status 0 only if every check holds. + +## What is here + +* `manifest.json`: for each release the record (commit, path, SHA-256), the request (SHA-256, nonce), the response (SHA-256, status, serial, policy, time, nonce), and the trust anchor with the sources it was checked against. +* `/request.tsq`, `response.tsr`, `tsa-chain.pem`: the request that was sent (70 bytes: algorithm, digest, nonce, "send the TSA certificate"), the reply, and the three certificates the reply carries. +* `trust-anchor/DigiCert_Trusted_Root_G4.pem`: the **self-signed** DigiCert Trusted Root G4, SHA-256 `55:2F:7B:DC:F1:A7:AF:9E:6C:E6:72:01:7F:4F:12:AB:F7:72:40:C7:8E:76:1A:C2:03:D1:D9:D2:0A:C8:99:88`, valid to 2038-01-15. It was taken from the operating system store (an independent source) and its SHA-256, SHA-1 and serial equal those DigiCert publishes. The reply also carries a *cross-signed* copy of this root (valid to 2031); that one is not used as the anchor. + +## What it proves, and what it does not + +It proves that each digest existed **no later than** the stated time, according to the DigiCert time-stamp authority, and that the token is bound to the request that was sent (nonce) and to the exact bytes of the record. + +It does **not** prove who signed the record, that the signature was valid on that day, that the signer was allowed to sign, that the countersignature authorizes anything, that the release is genuine, or that the records were *signed* at that time rather than only existing. It does not replace a trust anchor for the release chain, a revocation rule or a policy (`docs/P5-TRUST-MODEL-PLAN.md`, conditions C1 to C6); it supplies the one piece that could not be made late: independent evidence of existence before the end of the chain. + +## Limits to keep in view + +* The trust in the time rests on DigiCert and on the self-signed root above; the trust anchor was checked against the operating system store and against the publisher's page, not against a third independent party. +* No terms of use for the public endpoint were found (the documentation describes it for code signing and states neither permission nor restriction for other use). Only digests were sent. Another authority needs a new decision. +* The requests were made over plain HTTP (port 443 did not answer from that machine); the replies are signed, so this does not weaken the check. +* OpenSSL `ts -verify` was used; the tokens and the anchor are kept so any other RFC 3161 verifier can be applied later. +* A second, independent copy of this directory is required by the decision; where it lives is recorded outside this directory. diff --git a/evidence/time/digicert-2026-11-03/manifest.json b/evidence/time/digicert-2026-11-03/manifest.json new file mode 100644 index 0000000..a05459f --- /dev/null +++ b/evidence/time/digicert-2026-11-03/manifest.json @@ -0,0 +1,103 @@ +{ + "format": 1, + "what": "RFC 3161 time-stamp tokens over the SHA-256 of three signed cic-primitives release records, obtained from the DigiCert public time-stamp authority on 2026-11-03, before the certificate chain of those records ends on 2026-12-31. A token shows that the digest existed no later than the time it states; it shows nothing about who signed the record or whether the release is genuine.", + "authority": { + "name": "DigiCert public RFC 3161 time-stamp authority", + "endpoint": "http://timestamp.digicert.com", + "transport_note": "plain HTTP (port 443 did not answer from the machine that made the requests); the reply is signed, its integrity does not rest on the transport", + "terms_note": "No terms of use for the public endpoint were found: neither the search nor DigiCert's documentation pages state who may use it or restrict its use; they describe it for code signing. Only a SHA-256 digest, an algorithm identifier, a random nonce and a request for the TSA certificate were sent." + }, + "trust_anchor": { + "file": "trust-anchor/DigiCert_Trusted_Root_G4.pem", + "subject": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Trusted Root G4 (self-signed)", + "sha256": "55:2F:7B:DC:F1:A7:AF:9E:6C:E6:72:01:7F:4F:12:AB:F7:72:40:C7:8E:76:1A:C2:03:D1:D9:D2:0A:C8:99:88", + "sha1": "DD:FB:16:CD:49:31:C9:73:A2:03:7D:3F:C8:3A:4D:7D:77:5D:05:E4", + "serial": "059B1B579E8E2132E23907BDA777755C", + "not_after": "Jan 15 12:00:00 2038 GMT", + "verified_against": [ + { + "source": "operating system store, Ubuntu package ca-certificates 20260816ubuntu0.24.04.1, /usr/share/ca-certificates/mozilla/DigiCert_Trusted_Root_G4.crt", + "kind": "independent of the reply" + }, + { + "source": "https://knowledge.digicert.com/general-information/digicert-trusted-root-authority-certificates, entry DigiCert Trusted Root G4 (self-signed), read on 2026-11-03", + "kind": "the publisher's own figures: SHA-256, SHA-1 and serial all equal" + } + ], + "note": "The reply carries a cross-signed DigiCert Trusted Root G4 (issuer DigiCert Assured ID Root CA, valid to 2031-11-09) with the same public key. It is NOT used as the anchor; the self-signed root (valid to 2038-01-15) is." + }, + "stamps": [ + { + "release": "v0.2.1", + "record": { + "git_commit": "5e8c3219b52399e3e764b0b0bb27de710f5445a4", + "path": "release/cic-primitives-v0.2.1.yaml", + "sha256": "e5d8268aede0d24f02e60a151099a2fdc7615172ed3105b0a05b6b5d19addf63", + "bytes": 79011 + }, + "request": { + "file": "v0.2.1/request.tsq", + "sha256": "22a80e66f9b942f5d71a1acb401a9036927425a9ec8e2b0ed6160b28d6bd29d9", + "nonce": "0xEEA25FE7D7899723" + }, + "response": { + "file": "v0.2.1/response.tsr", + "sha256": "d3f4df0465578294b1a58157919462a0d8ec33fd7411b93417e1f7c24d2b5f65", + "status": "Granted", + "serial": "0x675CA92462CD68E87963124F1967FD43", + "policy_oid": "2.16.840.1.114412.7.1", + "stamp_time_utc": "Nov 3 22:07:48 2026 GMT", + "nonce": "0xEEA25FE7D7899723" + }, + "tsa_chain_file": "v0.2.1/tsa-chain.pem" + }, + { + "release": "v0.2.0", + "record": { + "git_commit": "960ee0f048d969a85ad20819bc0f2366ad91fa40", + "path": "release/cic-primitives-v0.2.0.yaml", + "sha256": "955fab2d6d9638c773f29fbe97a3279f9f10b9539c4e3e79957df0acef9a57a6", + "bytes": 64905 + }, + "request": { + "file": "v0.2.0/request.tsq", + "sha256": "1c2b433880a73cc92e9f3511c1066ccf37c872eb1f1c2d817cceb49a293c0a16", + "nonce": "0xF53BC5599CE05F53" + }, + "response": { + "file": "v0.2.0/response.tsr", + "sha256": "4d43ca701ced71f57d3ef78c881553ead52560b0fd75e67131c5e4fc7a1a456e", + "status": "Granted", + "serial": "0x2CD213F94B1638FBFF68D10520DE73E2", + "policy_oid": "2.16.840.1.114412.7.1", + "stamp_time_utc": "Nov 3 22:09:44 2026 GMT", + "nonce": "0xF53BC5599CE05F53" + }, + "tsa_chain_file": "v0.2.0/tsa-chain.pem" + }, + { + "release": "v0.1.5", + "record": { + "git_commit": "d59f7d6b5d22751a932b2bc0a522cf8acec1806b", + "path": "release/cic-primitives-v0.1.5.yaml", + "sha256": "284e44bfcf62d79f782d6cae359c4c99ef2f5297f6f71dcea52a95d28b8c4456", + "bytes": 55002 + }, + "request": { + "file": "v0.1.5/request.tsq", + "sha256": "d403b78ad4f66e53748777753121f33079545c23157a9f4571c66091eeca5fae", + "nonce": "0x2CDA40EE6D7CFA7A" + }, + "response": { + "file": "v0.1.5/response.tsr", + "sha256": "c91b2ad33077fef2806ec11e4ce363d49f102f3426fe7e77f6bd7cf48262ec6e", + "status": "Granted", + "serial": "0x03F23860CF26B3B2F8645FA478CFAAFC", + "policy_oid": "2.16.840.1.114412.7.1", + "stamp_time_utc": "Nov 3 22:09:45 2026 GMT", + "nonce": "0x2CDA40EE6D7CFA7A" + }, + "tsa_chain_file": "v0.1.5/tsa-chain.pem" + } + ] +} diff --git a/evidence/time/digicert-2026-11-03/trust-anchor/DigiCert_Trusted_Root_G4.pem b/evidence/time/digicert-2026-11-03/trust-anchor/DigiCert_Trusted_Root_G4.pem new file mode 100644 index 0000000..4214227 --- /dev/null +++ b/evidence/time/digicert-2026-11-03/trust-anchor/DigiCert_Trusted_Root_G4.pem @@ -0,0 +1,32 @@ +-----BEGIN CERTIFICATE----- +MIIFkDCCA3igAwIBAgIQBZsbV56OITLiOQe9p3d1XDANBgkqhkiG9w0BAQwFADBi +MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +d3cuZGlnaWNlcnQuY29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3Qg +RzQwHhcNMTMwODAxMTIwMDAwWhcNMzgwMTE1MTIwMDAwWjBiMQswCQYDVQQGEwJV +UzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQu +Y29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3QgRzQwggIiMA0GCSqG +SIb3DQEBAQUAA4ICDwAwggIKAoICAQC/5pBzaN675F1KPDAiMGkz7MKnJS7JIT3y +ithZwuEppz1Yq3aaza57G4QNxDAf8xukOBbrVsaXbR2rsnnyyhHS5F/WBTxSD1If +xp4VpX6+n6lXFllVcq9ok3DCsrp1mWpzMpTREEQQLt+C8weE5nQ7bXHiLQwb7iDV +ySAdYyktzuxeTsiT+CFhmzTrBcZe7FsavOvJz82sNEBfsXpm7nfISKhmV1efVFiO +DCu3T6cw2Vbuyntd463JT17lNecxy9qTXtyOj4DatpGYQJB5w3jHtrHEtWoYOAMQ +jdjUN6QuBX2I9YI+EJFwq1WCQTLX2wRzKm6RAXwhTNS8rhsDdV14Ztk6MUSaM0C/ +CNdaSaTC5qmgZ92kJ7yhTzm1EVgX9yRcRo9k98FpiHaYdj1ZXUJ2h4mXaXpI8OCi +EhtmmnTK3kse5w5jrubU75KSOp493ADkRSWJtppEGSt+wJS00mFt6zPZxd9LBADM +fRyVw4/3IbKyEbe7f/LVjHAsQWCqsWMYRJUadmJ+9oCw++hkpjPRiQfhvbfmQ6QY +uKZ3AeEPlAwhHbJUKSWJbOUOUlFHdL4mrLZBdd56rF+NP8m800ERElvlEFDrMcXK +chYiCd98THU/Y+whX8QgUWtvsauGi0/C1kVfnSD8oR7FwI+isX4KJpn15GkvmB0t +9dmpsh3lGwIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIB +hjAdBgNVHQ4EFgQU7NfjgtJxXWRM3y5nP+e6mK4cD08wDQYJKoZIhvcNAQEMBQAD +ggIBALth2X2pbL4XxJEbw6GiAI3jZGgPVs93rnD5/ZpKmbnJeFwMDF/k5hQpVgs2 +SV1EY+CtnJYYZhsjDT156W1r1lT40jzBQ0CuHVD1UvyQO7uYmWlrx8GnqGikJ9yd ++SeuMIW59mdNOj6PWTkiU0TryF0Dyu1Qen1iIQqAyHNm0aAFYF/opbSnr6j3bTWc +fFqK1qI4mfN4i/RN0iAL3gTujJtHgXINwBQy7zBZLq7gcfJW5GqXb5JQbZaNaHqa +sjYUegbyJLkJEVDXCLG4iXqEI2FCKeWjzaIgQdfRnGTZ6iahixTXTBmyUEFxPT9N +cCOGDErcgdLMMpSEDQgJlxxPwO5rIHQw0uA5NBCFIRUBCOhVMt5xSdkoF1BN5r5N +0XWs0Mr7QbhDparTwwVETyw2m+L64kW4I1NsBm9nVX9GtUw/bihaeSbSpKhil9Ie +4u1Ki7wb/UdKDd9nZn6yW0HQO+T0O/QEY+nvwlQAUaCKKsnOeMzV6ocEGLPOr0mI +r/OSmbaz5mEP0oUA51Aa5BuVnRmhuZyxm7EAHu/QD09CbMkKvO5D+jpxpchNJqU1 +/YldvIViHTLSoCtU7ZpXwdv6EM8Zt4tKG48BtieVU+i2iW1bvGjUI+iLUaJW+fCm +gKDWHrO8Dw9TdSmq6hN35N6MgSGtBxBHEa2HPQfRdbzP82Z+ +-----END CERTIFICATE----- diff --git a/evidence/time/digicert-2026-11-03/v0.1.5/request.tsq b/evidence/time/digicert-2026-11-03/v0.1.5/request.tsq new file mode 100644 index 0000000000000000000000000000000000000000..6bd7180b838d2ca76bbc3cb02e018e84836a97a4 GIT binary patch literal 69 zcmV-L0J{G$LjnN-FflL<1_@w>NC9O71OfpC00bZ?PDH=YV%MK|Eo`neoJ^VTFH)EG b_Z`lqDwWcUj6_xf2rSw_?rnVfdI16ds|Oh4 literal 0 HcmV?d00001 diff --git a/evidence/time/digicert-2026-11-03/v0.1.5/response.tsr b/evidence/time/digicert-2026-11-03/v0.1.5/response.tsr new file mode 100644 index 0000000000000000000000000000000000000000..ff2b5a50902c19d0c3987537de8bee9557c6fd58 GIT binary patch literal 6006 zcmciGc|4Tc{{ZmWi0s+7jBzP3JcAJ;CKR%TY(+G-u^VGavP{;pM3$IbV+kQemKIXT znk?DZkX_3aQN(Yio38Hn{(kqqe&5&Y`pbFFdCvLFJm+)X^LzjzHy(gOz#xFgjiaSM z6rmNd#suC2ArrYRDVIzkU?_?OV4|hBiO>SuLtzjw4G0JgrDga&lAaX|BjaJ7fI9>X z{(V%$SJypY0QIMvVDN+b8nqqg`!oHKt|jQ3x@qsFjZ#0Y3BJ5_D7pJ;jD{(M6}qfo z(;;@hY~Ai$u75}2CJ&1YAR~`L0kSeOfTA4Q5<(|Ar1s7&@Jj%h$gTtsY2N}wSTC6p zKLo-`XD}jb5TvO;T+b5!IgtlV4d8o}U42NyeY^?wcJLE&a1)%Hy)nVo%@gPD2sbju$N`G- zaAPfu3|byei53l4$Dn}y+)Og^fC7L9zWrHpGszyNd<;1mS+pWr(GtM^!%&U@iob^< z^COh+OYN*o4ab`r4&2Dz+tb6{&K^$IC{J!%c!&#V z+}M|;lO0tx=*R5tMCWd?*m;O`)GowdKHz3h>bwO_OEi5w0W8V}JaOj;tL|=eWr0@F zh;uY3w2855eJMy&_04Vo)fQl`#y!y^aB`>>JRui0NduxT;;@Gu!4 zc9!G#C60xd>7y}v!!BDv>q%kTkC^uRFU>gSvU4%5W%q8mnz$mOJz6p7IEk^>8)4eH zn;mFtPMfE|5vLae4ERA>7E|ms-L&%bw$z*H-R@T8;BI_M8hx_;!gUh`NfN5#O@mYz z#4Z}^&hScXFN?9A&+q|{Wu!?#?U2vB+AFD^mCtz<)nluHekFZ53`zGfqu9_*P+en9 z_qMs0$Y|Pv44GAJ+kJ$trs|!wx?TheW4VID=u0Fj<=2%n3&3LV%Ek9VJb%lr)vXdbj~rKSn_!PJJJR zwWW4@|1?l~Cvm=~@Cmuy3H&{ae$Odt_EM5p3X3NI=cw@t!OQ_uz=Ui>HjL2USp)AX z``<6%3c#rgz+t=qH$X>A>ln%irhM-VyARNxPcKU9fF(Naj$n3uoDxR3KUPi=DMAx8l&tTdrhjMdN;F$(cjy49L$KtmHxU z{g4FYo!_!L;xs2*{LLNp2oYVDqXT+Ghg(9Vcb4mZ6+q_1msckru#`J0IBr@V<&Xyn zI-F<s+D@nQ$3jc#wa#$GwI4-#`WJZ*9z zuWy>vsGNJW)lB#T zjxj}*m}O$mp?@LoE3dg&c$L2B)9poqZNsN5P7DdJp)a4ae@-4$dv`{`P26I1L`A~Y zr{S^t+-DZ?$!A>3tydU@3f-DW^QvDgUa&vAaP5;ZQL<8?bWftCOKXvm+Jz45ay|c; zH=q|~DFnR_UxD;P-Ca124M}k}TZ;*(&Bln))J5Zm9$sD36HA>VJ=;rWOMMMKtwL>@ zRTd+Hz21eDmNuI=fb#r7*;MBvW1?;+$CMBlktGYZ(u8~UXRNVoY#Og0Pu+B>JTg+> zhi}npvbRk@Bw7Q*EQPNx2cLM;d=az$D=4bZnVw#LtlD-xZ@#&q-6R`%Annqi#PqPH z3i?qDY}!24{KD%l9?A5IZMHs+oOX%P!!J_QR=!@QfLBfd@8);#n3{^sXtssZq}0?A zj7r)OyH9&6c;|msh7(|?Y&r^fj5|3&^$tbZg4D|l?5uu%em`w(l<>Dir%1^2hho(4p_z&q602JznbpIl{f9GAfKkC)q8yNf(<>OBUihYK2jyn;`PjP4H z-HByNsz^(@ENSvq-I*;O%`M}4tnf4cJtgmntgYMC)>3@RA_W8E`&JQ)4B4cVq5QX^ zL`%kD^m@XE;~PP(TQRQ+Z-%RHfvdDb8o*cUG z6Jx%Q(i(Kx9Hwv4{OH?dVl>8gG9=7DLbPa4i9O4Z?s#E$$D(lzv|gW-OiB+)fHX4D(6){_ehw96^aJImBCv|eRn zy|tkF82Us`wAlS6&P~%k+JeWIWE|t}OvGyrW10dZ6t;_+0$R;c^hsB)S}&Vs#7fT| zFvy*2TWJ5{tt?wMD@86ka^7GpymtGH(8Fu3Q7HZ%m~ude+1-stu5z>KfcxOfN&H~s+J%GP?M+eYSV50s6{zJXLL~XZv zOZ`*CZZ9i4-Ek>L)!9ckN(5L8epU}0@h#s3MgK&e-;P`q@mv7hKlBc>a~A-KK<`-e z54@x1=?S@Srm0guu@FodPy!Ul@?^OPnVot5&a@ws{6F2|e!0OFBCxebh0WIssCmNB zTp^bi+};`aJcY|f!j>?dA^U@#EzPNT32owqm549B3w$ZOql=O>$c1J6Cu8VQxweJ}+`&ViGq9|6 zwTvybE^J1`u)xgx!@tg8R=A%%h4Dyqop8QVdC@&)|El>X&}Hbdd0ELk?+{$|SyyGH z5WeRss0$qEgI=gnMUY zW0SFt@zqF7U8WMHE-L7qOQp2 z-_h`M4s579^U>j8*(KR2z;LG zk9^Xcy=9WRST$Is#)%*Igv}6+xOq(?8TsGAdt2awSaIabC2RfW>+8a{B)LVJM(d?B zeASCB9qq+(YUfG=9NzggYZW+{nPr-o$1zG&8RP?lrtexWT20+)F|eLS&!XCfu3L}9 z#fJ=4CfrcFcA?(Csj{@8!kI?_${IV+b2wLu=2Fxu@hEG8XVGaQMy7ul=6%RL0URi- z+f!Y_5B0I~cNkPcX{5`l)zbA_YUkF?+$KAY<{qfdGEl5wGv{9W3N@+sPwDK2ll zTen5o!RO;AVW1b61d{9H*M!T;*s2}}FZafHN@8pZOR+o}$$Y-&gFc1a+nBST+VcrFC}c%ZJ2Dt1ZuTm$@+i$`fu#8rd3KFxC(@Xf6K&!5I;mj>+>OIv+|lfEH{ zTphe!COFN%V-}^>0hR|?ewalAKq+SJ0_!h5+6|WGV)osY#5N)ddFpC@zHr7zw`P|A z0PDhzG8CKK0GEGgllsnG6q^q3nDT$w^gS81HK?hmj`^mO=I=Tk1t>m|DLzHW?acJQ z>hzz}xB_g{Y2dKE07Z3L80BBkpH3Gj5ex=-l55q^o}N`WN6sPet5kCJuhp9EsYx%+ zij-Umx4zBy7_lD7hciLE&5iPNtKs8VVb=+eMph}jU)c_MxSqAPj34`@+6daL-+5^4 z3(~aX^U7K=5RiVg%(|zeOI?GcF1(n6&(bPSYs)amr-icn9nk2R4W6?o_)sg&kT<_9 zr@XWVZHg@D)>Y$0A9u!?+O79#n1ArNsPz)EJKw|UwWsoOpn%K zcr4mR00M1;-zzpJGpk{r-#|PovsgXt(s7{3)%T@`2y!LJ%UQ$)vAyqs3GzVDfYRWH z%E*+jXS&W7^VI8QdRKvOXPOmSADn!cgd#!%0V33&QnLdt{fmXMzb?}4DlL*jy8yl) zWjlH(is`3HBOvfc9}S9yT4mc+9RwtH4TdnH1OPsOQlfxyoEj_|f@*sY7#wpb&LwKi z+{ZO20@8m>1w$cV@Dr8Q9pe`y{L})SMEreR9?$1B=f=L)Yfmz(#y#XmjI2aKE;(l9; z^2qLDh)X;&?j}#yasJ)X$FJF1~%rU54 zl%ykyv%oTPT;gPVKF9i~PG7?-G@g-1!0XCNC3Y)YYOy(8gfIF=j&)40zV6|w{N(+FLci#%doGxC$3=k0<2^_B4e-RJ;hhI`0_5HM`xCXw zos~Ty^#>u-#kcfDK9u&>Zfb|IRo|2+T`rvDz@_+fLl7w0e7FLAU`(~^P7fekYkXt={am_#OX@M^?3_stU(?~LUJ(n`C26->E=cyCTdP<)M zhmf*N{kveK_-|i}hUT=#okmPuM_sN6rWVQ9hdxH1^|T*yF`BLb2_tpjqD37Sv%s&*T;*JU@+-yDA|j$UW3H$1-{OdFwz*yxm(_d4Moq+%`nY-0UQQ-R6*rbuX$ z%3>>$z1;Uar$6lN`H4tFjGv;X)r;6%Z*daANOfP22}kR_i>C{!r0)7ix$pmy#mh@$ y#@L?a+xAeWV@{WZh%UMuz#u^5tKuk!yyy~mRrvTRs1GNit*=5aM&V55!2bXUHc3GM literal 0 HcmV?d00001 diff --git a/evidence/time/digicert-2026-11-03/v0.1.5/tsa-chain.pem b/evidence/time/digicert-2026-11-03/v0.1.5/tsa-chain.pem new file mode 100644 index 0000000..b999d62 --- /dev/null +++ b/evidence/time/digicert-2026-11-03/v0.1.5/tsa-chain.pem @@ -0,0 +1,119 @@ +subject=C = US, O = "DigiCert, Inc.", CN = DigiCert SHA256 RSA4096 Timestamp Responder 2026 1 +issuer=C = US, O = "DigiCert, Inc.", CN = DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1 +-----BEGIN CERTIFICATE----- +MIIG7TCCBNWgAwIBAgIQCE/cM09+RU7bww+P+ZIYNTANBgkqhkiG9w0BAQsFADBp +MQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMT +OERpZ2lDZXJ0IFRydXN0ZWQgRzQgVGltZVN0YW1waW5nIFJTQTQwOTYgU0hBMjU2 +IDIwMjUgQ0ExMB4XDTI2MDgwNTAwMDAwMFoXDTM3MTEwNDIzNTk1OVowYzELMAkG +A1UEBhMCVVMxFzAVBgNVBAoTDkRpZ2lDZXJ0LCBJbmMuMTswOQYDVQQDEzJEaWdp +Q2VydCBTSEEyNTYgUlNBNDA5NiBUaW1lc3RhbXAgUmVzcG9uZGVyIDIwMjYgMTCC +AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALZ7pvLJ/s1K+NSbTGWz/TjG +MPh8CQ6RucZCLv5anHzWJjF/NWJrFIhy24fcpKXlgRiky4WAawDfU3YP0BMxt9l3 +Dm5oCG5Z69AqEN1kgHg2epx+l+lZBcmJCcN0ASURML5uFIS80sZsDwO3BSkUxDjL +JhBI+qiZP3aixAC/qEGLjsBNlLol9VZ7pfGEXiMlneJIC5/YKuizVzNFKZZEeoy/ +0B8Zm+nzKBgSWG52lCO1w+nCg6XpCtklTJXeIg283hw7TmmsZXR+SMbjbrEOvZ3f +P2VxIgeR28Y90ZStd3F9VuA5RVynb/whITPAo9b75Zr4Ta6Mj3URm26QZYMn/Fnb +uTegcoRcFEZ9FOqM5T6MTdtr/n74lIT/ug0eeOzmZ6QTFg33otX+bFRsIolvykE1 +jive4PuESaT8zzVeFWDAMDtozNgLctkGD1ZjkEyZtJrLl5ya0m5doH/ScpaZCZVl +6pNUOCybMc/kxC6EAmSJY24L0yYKD1Nkddsnb/ItVKi/2nXpQNMu1PT5prW83vV8 +d67WowuUs0HdY4H8AMLGvdL/WHEj3ZnqMqAQQP9u3Ai9t+5eQ02GDwy0ODjdzi0x +lp70W+ow63/0++YDEX1M0iwgUHwbrJvfpklkZQvw3+kv3vUPItdwroczk9icflf5 +5W1zOEKAcJVAIXpcMCU9AgMBAAGjggGVMIIBkTAMBgNVHRMBAf8EAjAAMB0GA1Ud +DgQWBBQUyWOKMC7USvtulPPm40B+9ezN4jAfBgNVHSMEGDAWgBTvb1NK6eQGfHrK +4pBW9i/USezLTjAOBgNVHQ8BAf8EBAMCB4AwFgYDVR0lAQH/BAwwCgYIKwYBBQUH +AwgwgZUGCCsGAQUFBwEBBIGIMIGFMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5k +aWdpY2VydC5jb20wXQYIKwYBBQUHMAKGUWh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0 +LmNvbS9EaWdpQ2VydFRydXN0ZWRHNFRpbWVTdGFtcGluZ1JTQTQwOTZTSEEyNTYy +MDI1Q0ExLmNydDBfBgNVHR8EWDBWMFSgUqBQhk5odHRwOi8vY3JsMy5kaWdpY2Vy +dC5jb20vRGlnaUNlcnRUcnVzdGVkRzRUaW1lU3RhbXBpbmdSU0E0MDk2U0hBMjU2 +MjAyNUNBMS5jcmwwIAYDVR0gBBkwFzAIBgZngQwBBAIwCwYJYIZIAYb9bAcBMA0G +CSqGSIb3DQEBCwUAA4ICAQCNxTphHp1SCt+ZrAmAfn0oQLFr0mLywSLaDXQIENoy +KqxrFbJblzCVP/pkXmwXOdrOpWygLzlT12os5ipDCy35RBCg2UMeApEtrfGhz45F +4Wt4WGdNdIbRWt3YTYJmpR+b7lr4d7Uwn+H600u4D7RnOGf8Wj4UNgAdZkfHhHv1 +mx9EVh71SJelcEN/oORSjXzdjfw1iZH9d8Nh/thn6hH23d+VsPAr6GAYyzSA02nX +D1nYLI7Ijmiv+xLCiYC41DSFYL3GhTiy0PxpawPtGRyaBVGzq+UiTfM8pD7KVyF5 +aQyWP4KhVGUUTnmm/RlYJoW3TiXA/+t0YcT2oRVBm3JETjajHug2AL+v5jhtKVnd +3D0rbHXEu27o+Q8p4sEWPMqKDB+qbceb6T/6WcwTwXmQ9lOCLLYcsQeSWmvKqzpA +ec9etE14jOQAzLKWdE3w/TCaKtLRaRT7LCkRYVnhA2D73FLje1O5b3HR5eHs0NzU +/+xX7NbEdcofy0W3Wdwd1XOqtlpg/JgwtKfZM5dqO94lbUveOiJBI+xZEbGRsMNb +XmMREUTgu+Oca7Y73MPWcslIx2VhkSKSXjDbD6rgg39H5Mh7QfieAIjWagkJNt68 +Yfim6cjEzVSiLSeZfdkr5dtFPTW6jATlWJdYeeDRGCyatf8R1hSjzSvdN8yWQPT9 +gw== +-----END CERTIFICATE----- + +subject=C = US, O = "DigiCert, Inc.", CN = DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1 +issuer=C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Trusted Root G4 +-----BEGIN CERTIFICATE----- +MIIGtDCCBJygAwIBAgIQDcesVwX/IZkuQEMiDDpJhjANBgkqhkiG9w0BAQsFADBi +MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +d3cuZGlnaWNlcnQuY29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3Qg +RzQwHhcNMjUwNTA3MDAwMDAwWhcNMzgwMTE0MjM1OTU5WjBpMQswCQYDVQQGEwJV +UzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRy +dXN0ZWQgRzQgVGltZVN0YW1waW5nIFJTQTQwOTYgU0hBMjU2IDIwMjUgQ0ExMIIC +IjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAtHgx0wqYQXK+PEbAHKx126NG +aHS0URedTa2NDZS1mZaDLFTtQ2oRjzUXMmxCqvkbsDpz4aH+qbxeLho8I6jY3xL1 +IusLopuW2qftJYJaDNs1+JH7Z+QdSKWM06qchUP+AbdJgMQB3h2DZ0Mal5kYp77j +YMVQXSZH++0trj6Ao+xh/AS7sQRuQL37QXbDhAktVJMQbzIBHYJBYgzWIjk8eDrY +hXDEpKk7RdoX0M980EpLtlrNyHw0Xm+nt5pnYJU3Gmq6bNMI1I7Gb5IBZK4ivbVC +iZv7PNBYqHEpNVWC2ZQ8BbfnFRQVESYOszFI2Wv82wnJRfN20VRS3hpLgIR4hjzL +0hpoYGk81coWJ+KdPvMvaB0WkE/2qHxJ0ucS638ZxqU14lDnki7CcoKCz6eum5A1 +9WZQHkqUJfdkDjHkccpL6uoG8pbF0LJAQQZxst7VvwDDjAmSFTUms+wV/FbWBqi7 +fTJnjq3hj0XbQcd8hjj/q8d6ylgxCZSKi17yVp2NL+cnT6Toy+rN+nM8M7LnLqCr +O2JP3oW//1sfuZDKiDEb1AQ8es9Xr/u6bDTnYCTKIsDq1BtmXUqEG1NqzJKS4kOm +xkYp2WyODi7vQTCBZtVFJfVZ3j7OgWmnhFr4yUozZtqgPrHRVHhGNKlYzyjlroPx +ul+bgIspzOwbtmsgY1MCAwEAAaOCAV0wggFZMBIGA1UdEwEB/wQIMAYBAf8CAQAw +HQYDVR0OBBYEFO9vU0rp5AZ8esrikFb2L9RJ7MtOMB8GA1UdIwQYMBaAFOzX44LS +cV1kTN8uZz/nupiuHA9PMA4GA1UdDwEB/wQEAwIBhjATBgNVHSUEDDAKBggrBgEF +BQcDCDB3BggrBgEFBQcBAQRrMGkwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRp +Z2ljZXJ0LmNvbTBBBggrBgEFBQcwAoY1aHR0cDovL2NhY2VydHMuZGlnaWNlcnQu +Y29tL0RpZ2lDZXJ0VHJ1c3RlZFJvb3RHNC5jcnQwQwYDVR0fBDwwOjA4oDagNIYy +aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZFJvb3RHNC5j +cmwwIAYDVR0gBBkwFzAIBgZngQwBBAIwCwYJYIZIAYb9bAcBMA0GCSqGSIb3DQEB +CwUAA4ICAQAXzvsWgBz+Bz0RdnEwvb4LyLU0pn/N0IfFiBowf0/Dm1wGc/Do7oVM +Y2mhXZXjDNJQa8j00DNqhCT3t+s8G0iP5kvN2n7Jd2E4/iEIUBO41P5F448rSYJ5 +9Ib61eoalhnd6ywFLerycvZTAz40y8S4F3/a+Z1jEMK/DMm/axFSgoR8n6c3nuZB +9BfBwAQYK9FHaoq2e26MHvVY9gCDA/JYsq7pGdogP8HRtrYfctSLANEBfHU16r3J +05qX3kId+ZOczgj5kjatVB+NdADVZKON/gnZruMvNYY2o1f4MXRJDMdTSlOLh0HC +n2cQLwQCqjFbqrXuvTPSegOOzr4EWj7PtspIHBldNE2K9i697cvaiIo2p61Ed2p8 +xMJb82Yosn0z4y25xUbI7GIN/TpVfHIqQ6Ku/qjTY6hc3hsXMrS+U0yy+GWqAXam +4ToWd2UQ1KYT70kZjE4YtL8Pbzg0c1ugMZyZZd/BdHLiRu7hAWE6bTEm4XYRkA6T +l4KSFLFk43esaUeqGkH/wyW4N7OigizwJWeukcyIPbAvjSabnf7+Pu0VrFgoiovR +Diyx3zEdmcif/sYQsfch28bZeUz2rtY/9TCA6TD8dC3JE3rYkrhLULy7Dc90G6e8 +BlqmyIjlgp2+VqsS9/wQD7yFylIz0scmbKvFoW2jNrbM1pD2T7m3XA== +-----END CERTIFICATE----- + +subject=C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Trusted Root G4 +issuer=C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Assured ID Root CA +-----BEGIN CERTIFICATE----- +MIIFjTCCBHWgAwIBAgIQDpsYjvnQLefv21DiCEAYWjANBgkqhkiG9w0BAQwFADBl +MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJv +b3QgQ0EwHhcNMjIwODAxMDAwMDAwWhcNMzExMTA5MjM1OTU5WjBiMQswCQYDVQQG +EwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNl +cnQuY29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3QgRzQwggIiMA0G +CSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC/5pBzaN675F1KPDAiMGkz7MKnJS7J +IT3yithZwuEppz1Yq3aaza57G4QNxDAf8xukOBbrVsaXbR2rsnnyyhHS5F/WBTxS +D1Ifxp4VpX6+n6lXFllVcq9ok3DCsrp1mWpzMpTREEQQLt+C8weE5nQ7bXHiLQwb +7iDVySAdYyktzuxeTsiT+CFhmzTrBcZe7FsavOvJz82sNEBfsXpm7nfISKhmV1ef +VFiODCu3T6cw2Vbuyntd463JT17lNecxy9qTXtyOj4DatpGYQJB5w3jHtrHEtWoY +OAMQjdjUN6QuBX2I9YI+EJFwq1WCQTLX2wRzKm6RAXwhTNS8rhsDdV14Ztk6MUSa +M0C/CNdaSaTC5qmgZ92kJ7yhTzm1EVgX9yRcRo9k98FpiHaYdj1ZXUJ2h4mXaXpI +8OCiEhtmmnTK3kse5w5jrubU75KSOp493ADkRSWJtppEGSt+wJS00mFt6zPZxd9L +BADMfRyVw4/3IbKyEbe7f/LVjHAsQWCqsWMYRJUadmJ+9oCw++hkpjPRiQfhvbfm +Q6QYuKZ3AeEPlAwhHbJUKSWJbOUOUlFHdL4mrLZBdd56rF+NP8m800ERElvlEFDr +McXKchYiCd98THU/Y+whX8QgUWtvsauGi0/C1kVfnSD8oR7FwI+isX4KJpn15Gkv +mB0t9dmpsh3lGwIDAQABo4IBOjCCATYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E +FgQU7NfjgtJxXWRM3y5nP+e6mK4cD08wHwYDVR0jBBgwFoAUReuir/SSy4IxLVGL +p6chnfNtyA8wDgYDVR0PAQH/BAQDAgGGMHkGCCsGAQUFBwEBBG0wazAkBggrBgEF +BQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEMGCCsGAQUFBzAChjdodHRw +Oi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURSb290Q0Eu +Y3J0MEUGA1UdHwQ+MDwwOqA4oDaGNGh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9E +aWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwEQYDVR0gBAowCDAGBgRVHSAAMA0G +CSqGSIb3DQEBDAUAA4IBAQBwoL9DXFXnOF+go3QbPbYW1/e/Vwe9mqyhhyzshV6p +Grsi+IcaaVQi7aSId229GhT0E0p6Ly23OO/0/4C5+KH38nLeJLxSA8hO0Cre+i1W +z/n096wwepqLsl7Uz9FDRJtDIeuWcqFItJnLnU+nBgMTdydE1Od/6Fmo8L8vC6bp +8jQ87PcDx4eo0kxAGTVGamlUsLihVo7spNU96LHc/RzY9HdaXFSMb++hUD38dglo +hJ9vytsgjTVgHAIDyyCwrFigDkBjxZgiwbJZ9VVrzyerbHbObyMt9H5xaiNrIv8S +uFQtJ37YOtnwtoeW/VvRXKwYw02fc7cBqZ9Xql4o4rmU +-----END CERTIFICATE----- + diff --git a/evidence/time/digicert-2026-11-03/v0.2.0/request.tsq b/evidence/time/digicert-2026-11-03/v0.2.0/request.tsq new file mode 100644 index 0000000000000000000000000000000000000000..c3364faf891a1ea378cb4d28d96f2244b61175e0 GIT binary patch literal 70 zcmV-M0J;A#L;?W;FflL<1_@w>NC9O71OfpC00bbFU#l%`mN>_A@}It!qbHxA5V=#F cPCj{+eekUBnpdU*2>|sw#aW!-UsC}A|JDl`l>h($ literal 0 HcmV?d00001 diff --git a/evidence/time/digicert-2026-11-03/v0.2.0/response.tsr b/evidence/time/digicert-2026-11-03/v0.2.0/response.tsr new file mode 100644 index 0000000000000000000000000000000000000000..58aadc51e5efd76f9f8bf95a70b0410df776bc24 GIT binary patch literal 6007 zcmciGc|26>{{V2a*s=`S_d%!_&R~RWlO?hhvJ=_&ZLA^25`~Z@BqM7`k*%_neW@%- z){#9+%e6!iznN~jy5IZz-TV4|U#~lV&2ygTJm+)fJfG)1=L29_d;ka-L;_%0oXIGU zN2^C~(tyapI4p}9;gAs+1VO?88Zt_&XmyYs1PTU`k^tdYGO8aVDd|8^oDb9s@Bo8A zzmJOk=1L9%kbgP}3QxUIif~Jl?(kX7X-v-(%E_U7q<>3CAuu)MQ`yH%qe3v9$N<9^ zO=jusJ;#1hINoQP6($adOCgbfgt#~$BPnSLrX<-o*=BOOP6uRRQx}mB%V=b`jUy@l-#0Y+b38Er|?S!NPD9Iq_p=1o;^ZG~@fQi^R#6YX! z-;&z25;h@b>k=*xABQOTrDD-0bu*)^46o?hbH0eY7MX zBL&x2M~kDR;Dm5daAhc=iD5{=kpLFVckm}5JUIv!3?n>g@F6gk@W^W} z6|Q#ezBscrn5AX+@SAiyuoX;6oAjvtl<2PMt>7U+G1#{u7`8`o# zE+musey~0UWbKGQt-B+IyUB9jak>fHumGu`TcPQTCZt`llr0#L06oy?&KOxg(C!L@ z)RG=!Y?ba2q*MP|oT2DirRR%0Tw?;fuqm; z7-eHk?DqL(pxA!m{7B)`k_Qv`M;85_Q^f2gB(JEAHwL&sjF$&$3>X3iI6d6iXr29Q zc)Lpc_ZM&l;KU2Sp=Xb`>v4b`yy5DqSSQ~3!z?1dCbj!aQ$eH^3O0y1DMZsXXp?QY20H=cV0_nM{n! z3%mNZK5>8d1$J!u8M9pXRcf9Rw~nku#jhsM8J-0ue%8l|)NodiC!4x-m&z&y_F7hH z2gJ>iJg-c{Xn*r2ojntAB24rEh$2Z^dY3sMWWd zr$@EcWSr}@Pf3lb)y_?zs%S(a-T5S5z)ce`%ZKJ)F`=(WdeCBKX+ux1^7hHhEti^; z<1ItpUFscn)=7NHmcSUS?o#_7g^Z~IwAGOPFKhZyr-2v3}No~E?^ErI}E6#=|kKft5uC^I76`SQU;ejD=_+2^_!MPKENGA;-kw2yT7t#GY@2UcjuMXWrdpF9dJ>@L(9m`X5#8jPQ z$=1FXPm@xekrp9h@Lt)O{yK_9-1St+7mf$AK2y27ck3-h+2#0)hbIqj@GVo_$x0h7 zdM|)Ar5;0VC2c#*a;X=@y(+mCrMwHO)d*_^;khCll-biWSc@8GtlG|62%g@4k0@6N z%UiMDfj+5#x+^toqy1VUDG>%Y=sd(hTv+r)>LETExd7SWD9_gXyC+pgS^9c|`_5?A zn7-%?mbCOJs?Bt;N5E^oUft!RBYC^T%U2V*D=(2>`00nY3%|N zBNM$K?L(ych|A6xWtZxjU%!DKo?SC6G9X&6XMo+&%1Q2ZH?z=mw!)g2BNua`?&soQ zje&*3%a_^O3sBQ%7m`Jry|LKdqVlXn)Q0_8?lUO@o3^ybS+8!*r6sb}w6?xVB{Z2= zCH{32NlP4MG80Ph;R@4^;SgEzlMr!-gnLuhRmadB!O_xtr5!=t#z@MPtJf@74YT9L z7KC*3-}NlL`067kQMn+BD?NEp7a!HMXU6j=u{#FIF$k3l>NUE*{n%AeuHr zUyO!!`CCix@=}~-s2ki>ow+Wofel=b{`z`}J&kQ*S%eg^wCep?AEF@H(^|)JdGt%R z4PA2+byt%My&g6)IH%~u?RoS%%d@9YR^k5B&R1(LxyNyD7=I>-fUFum|jPWT|@wJneWgdM%tB2ahY;T^2VCjp1@q~|g655(dHv$A)072Y$I86UlRt)Et; zViL)f(V4T`PFJzXJJvoDsP(ygNO1!QTLgA6h%Sbp;p95av-MACdNCYD^<<`noiTIR z>_)@V!<##Fu==QOJ&A!1LD$l@T(>-_n&(4_pLHMAngdwUc!FELKis0tVomtchgkSH zc6ORViPiL=Ths)%?EYJ~jsSc_(jW{RKixw6`1pDg-rzJ;;NR&|Mt`SEobZx{{DUqe z;U!IG|0V6;;PdayYMM{m(4N6%N0wV&Kq02)>)Fvr0td~ zX6*ILUA-^LB$X~y1lfP^?^G|gH!{jGFixNruGK99Mhri6U$U6F*QIMYhgv}PjNY&u zPq-d7T9b5BDKW4mprfXuwc43g8bTL8Ja{5slr$t}1FJxny4OympI=jzH-(;KsF9x+$DZoB!+DaP-n zpS+31DZeYR=}tlFpWfa%%weC2>BehvFVNbQ&kue~PL{nbKTa~MDiB+fslp~4`ZT3# zz}jtDVx(C4KFa%d4;BJVnq}B^5TTDyiehaXJ=lI{TPV>V zOFq?5JFlG2T36@~nu4WJ^Kw-h921Cjoukz|cN)_uSXP7f#RrvLh*#{Ye}$$$Y&J)C zb{W~$?ajl{H*f)z%>i|gsu%Bj;0uX{(2f+GEj}C&Rx_syUdU6jIi8yzysE9Xv&8-vm zA7BOUD?_l!4RHB~HYx9)MX>3_zA68gO+S)RLxq@%%INPpss65$0zmKyNAM|Ha(|}( zRj2=)#ucC^P6LM?0tl*;K?z?;{z0Z&FcWYp0TxU2FB!;M!{l7**lo zs-)b?CZyv^@qm^R8%oXD$>2dQ3?_Z2?nr`07B6Y2>BNaV}D(wJ5XE1h4%yO zKg)KM5G2hnrAC1Bk3Lc)j96tmP#y$?4-5uVBRK(ffKZ}x;5mA600~lBQsd#0PcMKI2WJ;U z9t8ve0yI!K0+(I1&cKtifT(GkU+l7TIDa3i$X#^mISns-3cb8@Z~+pEa8N9mgv#X_ zs@(vgwdHH&{GK0#;tP+IBpbUq?`^^!Dw6x>>w~%*nOGTSpjN z>BGE6-ac6%fsd`}rwe#)+dCOX)loe5kA7eS)M<#CCh^G>Kir098sMpyP}>`WWY*Ze(9Ub%~QYL9sRMd#{b;WtvEyP~d9VTc#L zA|s}j!L=6Uys4Qk<;iZWcl_U3$E?AGbSx)dh74sy^3I{cMIOYFxicIw8A_mesYuK0 zMkmbNh~P$MnUhl`8+I=84TK<%j4u_irCs#IrwMc1s8(Sf%nXS+>OG)|&hv)O| zQBsKSz8vrkHY literal 0 HcmV?d00001 diff --git a/evidence/time/digicert-2026-11-03/v0.2.0/tsa-chain.pem b/evidence/time/digicert-2026-11-03/v0.2.0/tsa-chain.pem new file mode 100644 index 0000000..b999d62 --- /dev/null +++ b/evidence/time/digicert-2026-11-03/v0.2.0/tsa-chain.pem @@ -0,0 +1,119 @@ +subject=C = US, O = "DigiCert, Inc.", CN = DigiCert SHA256 RSA4096 Timestamp Responder 2026 1 +issuer=C = US, O = "DigiCert, Inc.", CN = DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1 +-----BEGIN CERTIFICATE----- +MIIG7TCCBNWgAwIBAgIQCE/cM09+RU7bww+P+ZIYNTANBgkqhkiG9w0BAQsFADBp +MQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMT +OERpZ2lDZXJ0IFRydXN0ZWQgRzQgVGltZVN0YW1waW5nIFJTQTQwOTYgU0hBMjU2 +IDIwMjUgQ0ExMB4XDTI2MDgwNTAwMDAwMFoXDTM3MTEwNDIzNTk1OVowYzELMAkG +A1UEBhMCVVMxFzAVBgNVBAoTDkRpZ2lDZXJ0LCBJbmMuMTswOQYDVQQDEzJEaWdp +Q2VydCBTSEEyNTYgUlNBNDA5NiBUaW1lc3RhbXAgUmVzcG9uZGVyIDIwMjYgMTCC +AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALZ7pvLJ/s1K+NSbTGWz/TjG +MPh8CQ6RucZCLv5anHzWJjF/NWJrFIhy24fcpKXlgRiky4WAawDfU3YP0BMxt9l3 +Dm5oCG5Z69AqEN1kgHg2epx+l+lZBcmJCcN0ASURML5uFIS80sZsDwO3BSkUxDjL +JhBI+qiZP3aixAC/qEGLjsBNlLol9VZ7pfGEXiMlneJIC5/YKuizVzNFKZZEeoy/ +0B8Zm+nzKBgSWG52lCO1w+nCg6XpCtklTJXeIg283hw7TmmsZXR+SMbjbrEOvZ3f +P2VxIgeR28Y90ZStd3F9VuA5RVynb/whITPAo9b75Zr4Ta6Mj3URm26QZYMn/Fnb +uTegcoRcFEZ9FOqM5T6MTdtr/n74lIT/ug0eeOzmZ6QTFg33otX+bFRsIolvykE1 +jive4PuESaT8zzVeFWDAMDtozNgLctkGD1ZjkEyZtJrLl5ya0m5doH/ScpaZCZVl +6pNUOCybMc/kxC6EAmSJY24L0yYKD1Nkddsnb/ItVKi/2nXpQNMu1PT5prW83vV8 +d67WowuUs0HdY4H8AMLGvdL/WHEj3ZnqMqAQQP9u3Ai9t+5eQ02GDwy0ODjdzi0x +lp70W+ow63/0++YDEX1M0iwgUHwbrJvfpklkZQvw3+kv3vUPItdwroczk9icflf5 +5W1zOEKAcJVAIXpcMCU9AgMBAAGjggGVMIIBkTAMBgNVHRMBAf8EAjAAMB0GA1Ud +DgQWBBQUyWOKMC7USvtulPPm40B+9ezN4jAfBgNVHSMEGDAWgBTvb1NK6eQGfHrK +4pBW9i/USezLTjAOBgNVHQ8BAf8EBAMCB4AwFgYDVR0lAQH/BAwwCgYIKwYBBQUH +AwgwgZUGCCsGAQUFBwEBBIGIMIGFMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5k +aWdpY2VydC5jb20wXQYIKwYBBQUHMAKGUWh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0 +LmNvbS9EaWdpQ2VydFRydXN0ZWRHNFRpbWVTdGFtcGluZ1JTQTQwOTZTSEEyNTYy +MDI1Q0ExLmNydDBfBgNVHR8EWDBWMFSgUqBQhk5odHRwOi8vY3JsMy5kaWdpY2Vy +dC5jb20vRGlnaUNlcnRUcnVzdGVkRzRUaW1lU3RhbXBpbmdSU0E0MDk2U0hBMjU2 +MjAyNUNBMS5jcmwwIAYDVR0gBBkwFzAIBgZngQwBBAIwCwYJYIZIAYb9bAcBMA0G +CSqGSIb3DQEBCwUAA4ICAQCNxTphHp1SCt+ZrAmAfn0oQLFr0mLywSLaDXQIENoy +KqxrFbJblzCVP/pkXmwXOdrOpWygLzlT12os5ipDCy35RBCg2UMeApEtrfGhz45F +4Wt4WGdNdIbRWt3YTYJmpR+b7lr4d7Uwn+H600u4D7RnOGf8Wj4UNgAdZkfHhHv1 +mx9EVh71SJelcEN/oORSjXzdjfw1iZH9d8Nh/thn6hH23d+VsPAr6GAYyzSA02nX +D1nYLI7Ijmiv+xLCiYC41DSFYL3GhTiy0PxpawPtGRyaBVGzq+UiTfM8pD7KVyF5 +aQyWP4KhVGUUTnmm/RlYJoW3TiXA/+t0YcT2oRVBm3JETjajHug2AL+v5jhtKVnd +3D0rbHXEu27o+Q8p4sEWPMqKDB+qbceb6T/6WcwTwXmQ9lOCLLYcsQeSWmvKqzpA +ec9etE14jOQAzLKWdE3w/TCaKtLRaRT7LCkRYVnhA2D73FLje1O5b3HR5eHs0NzU +/+xX7NbEdcofy0W3Wdwd1XOqtlpg/JgwtKfZM5dqO94lbUveOiJBI+xZEbGRsMNb +XmMREUTgu+Oca7Y73MPWcslIx2VhkSKSXjDbD6rgg39H5Mh7QfieAIjWagkJNt68 +Yfim6cjEzVSiLSeZfdkr5dtFPTW6jATlWJdYeeDRGCyatf8R1hSjzSvdN8yWQPT9 +gw== +-----END CERTIFICATE----- + +subject=C = US, O = "DigiCert, Inc.", CN = DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1 +issuer=C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Trusted Root G4 +-----BEGIN CERTIFICATE----- +MIIGtDCCBJygAwIBAgIQDcesVwX/IZkuQEMiDDpJhjANBgkqhkiG9w0BAQsFADBi +MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +d3cuZGlnaWNlcnQuY29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3Qg +RzQwHhcNMjUwNTA3MDAwMDAwWhcNMzgwMTE0MjM1OTU5WjBpMQswCQYDVQQGEwJV +UzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRy +dXN0ZWQgRzQgVGltZVN0YW1waW5nIFJTQTQwOTYgU0hBMjU2IDIwMjUgQ0ExMIIC +IjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAtHgx0wqYQXK+PEbAHKx126NG +aHS0URedTa2NDZS1mZaDLFTtQ2oRjzUXMmxCqvkbsDpz4aH+qbxeLho8I6jY3xL1 +IusLopuW2qftJYJaDNs1+JH7Z+QdSKWM06qchUP+AbdJgMQB3h2DZ0Mal5kYp77j +YMVQXSZH++0trj6Ao+xh/AS7sQRuQL37QXbDhAktVJMQbzIBHYJBYgzWIjk8eDrY +hXDEpKk7RdoX0M980EpLtlrNyHw0Xm+nt5pnYJU3Gmq6bNMI1I7Gb5IBZK4ivbVC +iZv7PNBYqHEpNVWC2ZQ8BbfnFRQVESYOszFI2Wv82wnJRfN20VRS3hpLgIR4hjzL +0hpoYGk81coWJ+KdPvMvaB0WkE/2qHxJ0ucS638ZxqU14lDnki7CcoKCz6eum5A1 +9WZQHkqUJfdkDjHkccpL6uoG8pbF0LJAQQZxst7VvwDDjAmSFTUms+wV/FbWBqi7 +fTJnjq3hj0XbQcd8hjj/q8d6ylgxCZSKi17yVp2NL+cnT6Toy+rN+nM8M7LnLqCr +O2JP3oW//1sfuZDKiDEb1AQ8es9Xr/u6bDTnYCTKIsDq1BtmXUqEG1NqzJKS4kOm +xkYp2WyODi7vQTCBZtVFJfVZ3j7OgWmnhFr4yUozZtqgPrHRVHhGNKlYzyjlroPx +ul+bgIspzOwbtmsgY1MCAwEAAaOCAV0wggFZMBIGA1UdEwEB/wQIMAYBAf8CAQAw +HQYDVR0OBBYEFO9vU0rp5AZ8esrikFb2L9RJ7MtOMB8GA1UdIwQYMBaAFOzX44LS +cV1kTN8uZz/nupiuHA9PMA4GA1UdDwEB/wQEAwIBhjATBgNVHSUEDDAKBggrBgEF +BQcDCDB3BggrBgEFBQcBAQRrMGkwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRp +Z2ljZXJ0LmNvbTBBBggrBgEFBQcwAoY1aHR0cDovL2NhY2VydHMuZGlnaWNlcnQu +Y29tL0RpZ2lDZXJ0VHJ1c3RlZFJvb3RHNC5jcnQwQwYDVR0fBDwwOjA4oDagNIYy +aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZFJvb3RHNC5j +cmwwIAYDVR0gBBkwFzAIBgZngQwBBAIwCwYJYIZIAYb9bAcBMA0GCSqGSIb3DQEB +CwUAA4ICAQAXzvsWgBz+Bz0RdnEwvb4LyLU0pn/N0IfFiBowf0/Dm1wGc/Do7oVM +Y2mhXZXjDNJQa8j00DNqhCT3t+s8G0iP5kvN2n7Jd2E4/iEIUBO41P5F448rSYJ5 +9Ib61eoalhnd6ywFLerycvZTAz40y8S4F3/a+Z1jEMK/DMm/axFSgoR8n6c3nuZB +9BfBwAQYK9FHaoq2e26MHvVY9gCDA/JYsq7pGdogP8HRtrYfctSLANEBfHU16r3J +05qX3kId+ZOczgj5kjatVB+NdADVZKON/gnZruMvNYY2o1f4MXRJDMdTSlOLh0HC +n2cQLwQCqjFbqrXuvTPSegOOzr4EWj7PtspIHBldNE2K9i697cvaiIo2p61Ed2p8 +xMJb82Yosn0z4y25xUbI7GIN/TpVfHIqQ6Ku/qjTY6hc3hsXMrS+U0yy+GWqAXam +4ToWd2UQ1KYT70kZjE4YtL8Pbzg0c1ugMZyZZd/BdHLiRu7hAWE6bTEm4XYRkA6T +l4KSFLFk43esaUeqGkH/wyW4N7OigizwJWeukcyIPbAvjSabnf7+Pu0VrFgoiovR +Diyx3zEdmcif/sYQsfch28bZeUz2rtY/9TCA6TD8dC3JE3rYkrhLULy7Dc90G6e8 +BlqmyIjlgp2+VqsS9/wQD7yFylIz0scmbKvFoW2jNrbM1pD2T7m3XA== +-----END CERTIFICATE----- + +subject=C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Trusted Root G4 +issuer=C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Assured ID Root CA +-----BEGIN CERTIFICATE----- +MIIFjTCCBHWgAwIBAgIQDpsYjvnQLefv21DiCEAYWjANBgkqhkiG9w0BAQwFADBl +MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJv +b3QgQ0EwHhcNMjIwODAxMDAwMDAwWhcNMzExMTA5MjM1OTU5WjBiMQswCQYDVQQG +EwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNl +cnQuY29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3QgRzQwggIiMA0G +CSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC/5pBzaN675F1KPDAiMGkz7MKnJS7J +IT3yithZwuEppz1Yq3aaza57G4QNxDAf8xukOBbrVsaXbR2rsnnyyhHS5F/WBTxS +D1Ifxp4VpX6+n6lXFllVcq9ok3DCsrp1mWpzMpTREEQQLt+C8weE5nQ7bXHiLQwb +7iDVySAdYyktzuxeTsiT+CFhmzTrBcZe7FsavOvJz82sNEBfsXpm7nfISKhmV1ef +VFiODCu3T6cw2Vbuyntd463JT17lNecxy9qTXtyOj4DatpGYQJB5w3jHtrHEtWoY +OAMQjdjUN6QuBX2I9YI+EJFwq1WCQTLX2wRzKm6RAXwhTNS8rhsDdV14Ztk6MUSa +M0C/CNdaSaTC5qmgZ92kJ7yhTzm1EVgX9yRcRo9k98FpiHaYdj1ZXUJ2h4mXaXpI +8OCiEhtmmnTK3kse5w5jrubU75KSOp493ADkRSWJtppEGSt+wJS00mFt6zPZxd9L +BADMfRyVw4/3IbKyEbe7f/LVjHAsQWCqsWMYRJUadmJ+9oCw++hkpjPRiQfhvbfm +Q6QYuKZ3AeEPlAwhHbJUKSWJbOUOUlFHdL4mrLZBdd56rF+NP8m800ERElvlEFDr +McXKchYiCd98THU/Y+whX8QgUWtvsauGi0/C1kVfnSD8oR7FwI+isX4KJpn15Gkv +mB0t9dmpsh3lGwIDAQABo4IBOjCCATYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E +FgQU7NfjgtJxXWRM3y5nP+e6mK4cD08wHwYDVR0jBBgwFoAUReuir/SSy4IxLVGL +p6chnfNtyA8wDgYDVR0PAQH/BAQDAgGGMHkGCCsGAQUFBwEBBG0wazAkBggrBgEF +BQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEMGCCsGAQUFBzAChjdodHRw +Oi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURSb290Q0Eu +Y3J0MEUGA1UdHwQ+MDwwOqA4oDaGNGh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9E +aWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwEQYDVR0gBAowCDAGBgRVHSAAMA0G +CSqGSIb3DQEBDAUAA4IBAQBwoL9DXFXnOF+go3QbPbYW1/e/Vwe9mqyhhyzshV6p +Grsi+IcaaVQi7aSId229GhT0E0p6Ly23OO/0/4C5+KH38nLeJLxSA8hO0Cre+i1W +z/n096wwepqLsl7Uz9FDRJtDIeuWcqFItJnLnU+nBgMTdydE1Od/6Fmo8L8vC6bp +8jQ87PcDx4eo0kxAGTVGamlUsLihVo7spNU96LHc/RzY9HdaXFSMb++hUD38dglo +hJ9vytsgjTVgHAIDyyCwrFigDkBjxZgiwbJZ9VVrzyerbHbObyMt9H5xaiNrIv8S +uFQtJ37YOtnwtoeW/VvRXKwYw02fc7cBqZ9Xql4o4rmU +-----END CERTIFICATE----- + diff --git a/evidence/time/digicert-2026-11-03/v0.2.1/request.tsq b/evidence/time/digicert-2026-11-03/v0.2.1/request.tsq new file mode 100644 index 0000000000000000000000000000000000000000..41f5a7ebac22520c201f1f47aad1ee02c64be044 GIT binary patch literal 70 zcmV-M0J;A#L;?W;FflL<1_@w>NC9O71OfpC00bcA*d~hY;L=Y5<_Z-MnWFv2VNr7J cF$J)oTWehzt>0q;2>|Y*U+33}mm>iI|JD5&8~^|S literal 0 HcmV?d00001 diff --git a/evidence/time/digicert-2026-11-03/v0.2.1/response.tsr b/evidence/time/digicert-2026-11-03/v0.2.1/response.tsr new file mode 100644 index 0000000000000000000000000000000000000000..e72c5c207bc4fb3edd0ca31cc590df89381013c2 GIT binary patch literal 6007 zcmciGc|26>{{V2an8-3@-^Uas+Zkq%Y!gD+LUtni&KN`z6Qb-{vSmnAq{vp0Le|PI zyX@IoWGmZmrkk#NzxVgM_x1a}UU&YQ=RD7O&gaZ|KF@p32OzL{0}wEX0wAzC!>Esj ztB0@Af%buk1U56$AtNvdf`S8dFlwuCb&wqd3IhAzjx^T z8^;g+HV1S#9JZ9%;Szv^6bc1MN=N|GXc<#5HO0rAb2INEQw|adOtJt0wg?cQJw(zC zfWZt@Izy5=L8{t=b@1443G5hh1V6(B(U8J+LeT)!FvwXbj0t>JAH@c+kQ@7%=vAB? zoRsZwcoBq#yNwtM3n-F1AWSm59S8%Qk2l`V7NLel7&y7v>Eo^4Je}Mf5PJGpG;mA` zp|6gWz(^rT;bIWVSQNm^MkgT!$N(7N$H$b7PEwk5A7}|l%rVR{Q^4jQhH@M@_FE_t zze4$Wsog7+!|^7EgV3|{_VjSKwZoCakV2pU0vNgXCm=mJ2muTyJ!$ZMFoE>Q%P;0F zHE+K;wceesY4>bKZqH0ylVdDEH1(2zzd8Sg;Gl zsJ<_}oe5RZ??>g9wfjBJa=aft?F!Wg+nSR zg_!GQS_K)@zu!$&^v$WKsJV;19`iyg@u|Ry;l(>&LM;ypWR9!TWc3~W@YqOFRVY~{ zAgZRFk0X8d>k;+?#_qm}2g~YaYp>jy-QO>unKXi=s~X`xuI*H4hYwP3m~bzqug)A* zwDUsliyv%|??`;$=XJ^O{V`SZe2-0je#sZNdpD-i*0qYFVtp9X-Q(=89Nsh;d?HQ6 zg_<*;yu>^gHKh=xHR!S(w4NBc^OTPF!osveE)y%=T29ZltAQ&r(xU~7i4h)ozY(gD zyV-`ZWU+by9Cv)(M}zB!!3}NVG*e5{T2nI8I^8XZmpgIEsnkh!b2kiRMAA`hll5Yu zVB1I=cbYE2{cwF-pTWZ(OQHsMYX*E~mAb^bm%rteRgJ6!`W5xwrb&E^9kvPCq^NDE z?%XlBGsjL+ar!AF{8Gb8@O1`yhHV4dKUf!67FkaH^6hY_) zauueJ=4sg4(R?1A6(3oFBj0%zU6s7iml0(2ZOYAC=0vb(k`jM_IUpbphJYwQw+Wym zfB=dIXh{o=hY1AQfr0@FfQQ_ohq6MMnVW5{0b<>!Hrx}xPERNWtt`A52l&X{2chf$ zYcTUC5B*cKld!;mmhm{lRq<|(g;s5Vo;(0fo(&2C?+XT4$!!60n-72hNe><%1dnhJXQ4kEk22y?YIu ztK@%w0apM)z5oKs0k8p7FqlIKEr|5H)9l?r|G0aRQWr!K{YuuFH&bu_XlfyKaL}bA zO2san=a*h02k7ur3CwhZE+Y2hE-?_yx5t?Ti359dO8OsC#F@XrZ^>r-iRo zwZdeGr^ow#xvACWO`tTtUoyq{_=tep=@D5Z_TYjEV{!bWIx|ZfMn;wQ&n7Zl%8w7# z_2Qb<8||#)kqMT-ApHLOE0@(Kn=WG4Z&5__I#W|ijZ|5$=gl_NzcI)WJ)C-}UwCRz zRUY#+3OZ$+V(kCEgIy%8Y=^Oz`Su&(Vd>Y&O3PbUNZ^%{z{~gv9$jOh5#T$ zgnAwxcoK&{q{EP$lm1;g832X)CEdS>?%#P=dI8n7|0WjqT<+ux?n0lz+b13IrDxbO zwH`#%C6=WoUlB1_RCZ>J#jr`Zp1A*w>yfPYSoZe4DoZg=xr2B6Mh~nY=V@}%lLzt_ z1qi0JgP8UB4Tnh{^*d2r_cOwjw?P#e!S$dKo+}Q@oGGd7`Ohb;Ug=s0s%^)fcW*h#k{K~#!SVAtBVjc=W_(ZLS|U(f-B7uJHlv3dPhHV7R)<=UFXp@7}(a_Kw2PDmJ6&TBX+)bAQYFZKxwgxL3}3aprnD7+1E$`3VNZ$2eyKR{F{?l8D; z5`E9O?Z{Nol`l`vr3YUZdcD9^?t-w<-}TOdzvh*xqii26J!klV|kx0;-?W zG?k(AF28BN`YM7GxU5r`ZVvPQ{NZDmrj1j!MbZRqr>;xWa=WB+=%KZWc{wii*y+=6 z27;RXtYx$Otd*(QkIfmy&C`IR%aI5+d1$1kDCEMkJZ<#g> zwKcTOH7<;LgwVjOeCb=$*k!htFQDwg9cs?k$}hS{@va!JQe1&78J85zatt68Uv`w2 z^WnO$Q*?j=eK2#?&0T3JBPV#i-N<-L^({f_fdOAMo}$P0cJwxNf6;_ECS2;a(K-sR zLEET*O8@#*Y;BeUgE$m?A7ysG>|?cLX8HBZf`3rvJ@I0xpuvSUZi*w z#gp2UwcWr_yv9G+(C@FgTGXq!0tC+jn|RS?rhvYL%G0`4&*<9lT=`Wn)4ZmLDMIFR z!-4~An+))(uogYZ&PGAkf>+sYx24Ko_r|U2JgG1T2$azzw|suOMW40Y;JNp9Kww{9H*kYv&zOkBU*!g_oA;7D(98Y+k%bSYzh&?P~7Nkjck7mD!p;_gX{4%++w*C^gQdH5v$2r+(XA3p0y=U zeNvshB@#OrR2alY319bxPUDZed5w$Ga(zVfG$VLyghbyiSZX)jSm(D+N6%9>ST2}x zR?RoJy(vU1ohuHo|LE7Ge%Ic}D9gY&hE}*jCm-lH{Md5QV&Xxwj^z|)2Gu%n!*VDl zHh7>s{-#o#f8B+~^5Xh3XLcC~Lv&xabgmfXrHB=R0z1<7D3D*X zyQ+u_;$v~azF!ulk|wECL-o#7Be!HjIB36M>dK^(_)Q+s zmHvArJX2h|W|3+gASnR;%PdL&LNaR)Sbyo!Ua(Z>a~>`yv=UIFXRhbx^Jji_Yl8m= zSpK`pkZf`TT>ha=%DZQgY?9tJ<^QtjXEJK2kW*0^`$H$y-*i#{NInrsK82%qXZl}t z`p;=x0Y>sP2)C5dxRFCudXOgV_M;=; zMGf1&Ew2><0cqDuEW6t}lvUD|`R9{y+3KaKt(iLcFbI?1VU_Ng%O6bcey$Ox$(vn5 z%Pp)y8n52%)KucYoOE_FcvP8f7_*SuBmbdzXp6gV+0WG6Aj;!Ywyyl9FSTQ6mPgAV zA{t}G4TiKL9u*oB>6L6=-9)}DFg>0d02{dJLUPi>JH(gAS( zD%(**P;`GNH3Hnf_fewYUHtfk*hL2S1jOlY_oOs=feQ$y|as> zjsSuH2^uIul$e>n%*2;9BU=7ydbZil;p{`GB5(eQ*L3`dG3@;2-UUc1!a)gO3W!!^ zy_(g*hv~&MFAscn7VfG?YYg`@x?J~C8B~f;lzd){Q}PPz{1S=xYxXYMNtV>{N}20> z>8ova#nZl}!NFykHvgR!!;)LysjZ_STyjqBD&od5*;$jw_}5SeJwx6BwdEzR3Rw4{ zB&fUqaI3*Pi~Hlb5hKVqqcehKHHi?-v>3=b;fm~2q3ciBff-1Z*O!_3pbvS26N*o= z=^qcose#lfD<<8+P$$W`!y3w`M6c&>ga z_~{rSdTPE%FKa#L=N2V>u-fB|). Needs openssl, git, python3 (json only). No network. +set -u +HERE=$(cd "$(dirname "$0")" && pwd) +M="$HERE/manifest.json" +ANCHOR="$HERE/trust-anchor/DigiCert_Trusted_Root_G4.pem" +fail=0 +say() { printf '%s\n' "$*"; } +bad() { say "FAIL $*"; fail=1; } +ok() { say "ok $*"; } + +want256=$(python3 -c 'import json,sys;print(json.load(open(sys.argv[1]))["trust_anchor"]["sha256"])' "$M") +want1=$(python3 -c 'import json,sys;print(json.load(open(sys.argv[1]))["trust_anchor"]["sha1"])' "$M") +got256=$(openssl x509 -in "$ANCHOR" -noout -fingerprint -sha256 | cut -d= -f2) +got1=$(openssl x509 -in "$ANCHOR" -noout -fingerprint -sha1 | cut -d= -f2) +[ "$got256" = "$want256" ] && [ "$got1" = "$want1" ] && ok "trust anchor $got256" || bad "trust anchor differs from the manifest ($got256)" + +n=$(python3 -c 'import json,sys;print(len(json.load(open(sys.argv[1]))["stamps"]))' "$M") +tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT +for i in $(seq 0 $((n - 1))); do + f() { python3 -c 'import json,sys;d=json.load(open(sys.argv[1]))["stamps"][int(sys.argv[2])];o=d +for k in sys.argv[3].split("."): o=o[k] +print(o)' "$M" "$i" "$1"; } + rel=$(f release); commit=$(f record.git_commit); path=$(f record.path); rsha=$(f record.sha256) + tsr="$HERE/$(f response.file)"; tsq="$HERE/$(f request.file)"; stamp=$(f response.stamp_time_utc) + if ! git cat-file -e "$commit^{commit}" 2>/dev/null; then bad "$rel: the commit $commit is not in this clone (fetch the full history)"; continue; fi + git show "$commit:$path" > "$tmp/rec-$rel.yaml" 2>/dev/null + [ "$(sha256sum "$tmp/rec-$rel.yaml" | cut -d' ' -f1)" = "$rsha" ] && ok "$rel: the record at $commit has sha256 ${rsha:0:16}..." || { bad "$rel: the record at $commit is not the one in the manifest"; continue; } + at=$(date -u -d "$stamp" +%s) + openssl ts -verify -queryfile "$tsq" -in "$tsr" -CAfile "$ANCHOR" >/dev/null 2>&1 && ok "$rel: the token answers our request (digest and nonce) and chains to the anchor" || bad "$rel: the token does not answer the request / does not chain to the anchor" + openssl ts -verify -data "$tmp/rec-$rel.yaml" -in "$tsr" -CAfile "$ANCHOR" >/dev/null 2>&1 && ok "$rel: the token covers the record file" || bad "$rel: the token does not cover the record file" + openssl ts -verify -data "$tmp/rec-$rel.yaml" -in "$tsr" -CAfile "$ANCHOR" -attime "$at" >/dev/null 2>&1 && ok "$rel: valid at the time stamp ($stamp)" || bad "$rel: not valid at the time stamp" + if [ "${1:-}" = "--selftest" ]; then + cp "$tmp/rec-$rel.yaml" "$tmp/alt-$rel.yaml"; printf '#' >> "$tmp/alt-$rel.yaml" + if openssl ts -verify -data "$tmp/alt-$rel.yaml" -in "$tsr" -CAfile "$ANCHOR" >/dev/null 2>&1; then bad "$rel: SELFTEST a record changed by one byte was ACCEPTED"; else ok "$rel: selftest, a record changed by one byte is refused"; fi + if openssl ts -verify -data "$tmp/rec-$rel.yaml" -in "$tsr" -CAfile /usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G2.crt >/dev/null 2>&1; then bad "$rel: SELFTEST a wrong anchor was ACCEPTED"; else ok "$rel: selftest, a wrong anchor is refused"; fi + fi +done +[ "$fail" = 0 ] && say "ALL CHECKS HOLD" || say "AT LEAST ONE CHECK FAILED" +exit "$fail" From 8cfdc79ed6eb681b010dfc5c1f06951d26dae9ae Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=A1bor=20Z=20Sink=C3=B3?= Date: Tue, 3 Nov 2026 23:20:01 +0100 Subject: [PATCH 2/2] evidence(time): verify.sh proves the stamps lie inside the CIC certificates, at the time of the token; the CIC chain is kept The review of the first commit found two gaps in verify.sh, both real: 1. It checked the validity of the TSA chain at the stamp, not that of the certificates that signed the records, which is what the whole evidence is for. It now keeps the four public CIC certificates (developer, Developer CA, Source CA, root; the Developer CA is carried by none of the records) and shows that the stamp lies inside the validity of EACH, twice: openssl verify -attime over both chains, and plain arithmetic on the dates. The developer, Source CA and root kept here are checked against the ones each record carries; the Developer CA is checked to be the issuer of the developer certificate, not assumed. Margin at the stamp: 57 to 58 days. 2. Two token checks ran at the current time, and the stamp time came from the editable manifest. The time is now read from the token, every token check runs at it, and the manifest value is only compared with it. Found while doing it: the root_certificate field of the v0.2.0 and v0.2.1 records is the printed text of openssl x509 -text with the PEM at its end, the v0.1.5 field is plain PEM. The same certificate, two spellings, so the comparison is by DER and not by text. The records are not changed for it. New negative controls, each refused: a stamp after the end of the CIC chain, before its beginning, when only SOME of the CIC certificates are still valid, a wrong issuer of the developer certificate. verify.sh itself was shown to fail on an edited manifest time, a swapped Developer CA, a swapped developer certificate, a changed manifest fingerprint and a damaged token. The .tsq, .tsr, the trust anchor and the records are byte-identical to the first commit. Still open and said so in the README: the second, independent copy. --- [signing-metadata] key = cic-my-sign-key signature = vault:v1:MEQCIGxR75C7r9w8o3dAS5UaeBsuPjX0bxM6jkJcCgwGlXGcAiBW2qpIFYuyEAcdw0jmMzfQA8CopW6nXW4eOR5m/T186w== hash-algorithm = sha256 digest = A0nuoEVjsw5n6pmyg4D82XEbOm5H6rah6dpZBtVCx9k= [certificate] -----BEGIN CERTIFICATE----- MIICBjCCAaygAwIBAgIUSnRMR6RPnEbg296XWPOqq/u5PCwwCgYIKoZIzj0EAwIw QzELMAkGA1UEBhMCSFUxGTAXBgNVBAoMEENlbnRyYWxJbmZyYUNvcmUxGTAXBgNV BAMMEENJQyBEZXZlbG9wZXIgQ0EwHhcNMjYwMzIwMTMyMjU5WhcNMjYxMjMxMTMy MjU5WjBFMQswCQYDVQQGEwJIVTEZMBcGA1UECgwQQ2VudHJhbEluZnJhQ29yZTEb MBkGA1UEAwwSR2Fib3IgWm9sdGFuIFNpbmtvMFkwEwYHKoZIzj0CAQYIKoZIzj0D AQcDQgAEIG2CVmTfmLB9pLLclj7YmP2eedAjklpy4LGrU2ijoiy6Xqpuybv7OgJe i+ez31s65NEV8+X/ByeX1cstR988z6N8MHowCQYDVR0TBAIwADAdBgNVHQ4EFgQU yZN6AIX/TNnIJ9GwAa/NRN3ujHAwHwYDVR0jBBgwFoAUXn6CHYzPUqU4JVP8g+OS WeDYjhcwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEF BQcDBDAKBggqhkjOPQQDAgNIADBFAiEA+bFzXRoJ4PCQbhAAtpkcMjt0vNj5rEW0 lOMBGDNyaWkCIB1vmM7PcZzv/c9bIrxF5kqv6QXomouhByUfeNUTbpKW -----END CERTIFICATE----- --- evidence/time/digicert-2026-11-03/README.md | 5 +- .../cic-chain/developer-ca.pem | 14 +++ .../cic-chain/developer.pem | 13 +++ .../digicert-2026-11-03/cic-chain/root.pem | 52 +++++++++ .../cic-chain/source-ca.pem | 14 +++ .../time/digicert-2026-11-03/manifest.json | 37 +++++- evidence/time/digicert-2026-11-03/verify.sh | 110 ++++++++++++++---- 7 files changed, 220 insertions(+), 25 deletions(-) create mode 100644 evidence/time/digicert-2026-11-03/cic-chain/developer-ca.pem create mode 100644 evidence/time/digicert-2026-11-03/cic-chain/developer.pem create mode 100644 evidence/time/digicert-2026-11-03/cic-chain/root.pem create mode 100644 evidence/time/digicert-2026-11-03/cic-chain/source-ca.pem diff --git a/evidence/time/digicert-2026-11-03/README.md b/evidence/time/digicert-2026-11-03/README.md index c2c9b13..c9479d2 100644 --- a/evidence/time/digicert-2026-11-03/README.md +++ b/evidence/time/digicert-2026-11-03/README.md @@ -18,12 +18,13 @@ From a clone of cic-primitives that has the full history (the records are read f bash evidence/time/digicert-2026-11-03/verify.sh --selftest ``` -It checks the trust anchor against the figures in `manifest.json`, the record against its digest, the token against the request and against the record file, and the token **at the time stamp** (not "now"). With `--selftest` it also shows that a record changed by one byte and a wrong anchor are refused. It needs `openssl`, `git` and `python3`, and no network. Exit status 0 only if every check holds. +It reads the time of each stamp **from the token** (the signed time; the manifest value is only compared with it) and runs **every** token check at that time, so a later end of the TSA chain, or the clock of the machine, changes nothing. It checks the trust anchor and the kept CIC certificates against the figures in `manifest.json`, the record against its digest, the token against the request and against the record file, and **that the stamp lies inside the validity of the developer certificate, the Developer CA, the Source CA and the root of the CIC chain**, twice (`openssl verify -attime` over both chains, and plain arithmetic on the dates), and that the kept CIC certificates are the ones the records carry. With `--selftest` it also shows that a record changed by one byte, a wrong anchor, a stamp after the end of the CIC chain, a stamp before it began, a stamp when only some of the CIC certificates are still valid, and a wrong issuer of the developer certificate are all refused. It needs `openssl`, `git` and `python3` with PyYAML, and no network. Exit status 0 only if every check holds. ## What is here * `manifest.json`: for each release the record (commit, path, SHA-256), the request (SHA-256, nonce), the response (SHA-256, status, serial, policy, time, nonce), and the trust anchor with the sources it was checked against. * `/request.tsq`, `response.tsr`, `tsa-chain.pem`: the request that was sent (70 bytes: algorithm, digest, nonce, "send the TSA certificate"), the reply, and the three certificates the reply carries. +* `cic-chain/`: the four public certificates of the CIC chain that signed the records: developer, Developer CA (**not carried by any record**), Source CA, root. With their validity they are what shows that the stamp was made while the chain was valid. * `trust-anchor/DigiCert_Trusted_Root_G4.pem`: the **self-signed** DigiCert Trusted Root G4, SHA-256 `55:2F:7B:DC:F1:A7:AF:9E:6C:E6:72:01:7F:4F:12:AB:F7:72:40:C7:8E:76:1A:C2:03:D1:D9:D2:0A:C8:99:88`, valid to 2038-01-15. It was taken from the operating system store (an independent source) and its SHA-256, SHA-1 and serial equal those DigiCert publishes. The reply also carries a *cross-signed* copy of this root (valid to 2031); that one is not used as the anchor. ## What it proves, and what it does not @@ -38,4 +39,4 @@ It does **not** prove who signed the record, that the signature was valid on tha * No terms of use for the public endpoint were found (the documentation describes it for code signing and states neither permission nor restriction for other use). Only digests were sent. Another authority needs a new decision. * The requests were made over plain HTTP (port 443 did not answer from that machine); the replies are signed, so this does not weaken the check. * OpenSSL `ts -verify` was used; the tokens and the anchor are kept so any other RFC 3161 verifier can be applied later. -* A second, independent copy of this directory is required by the decision; where it lives is recorded outside this directory. +* **A second, independent copy of this directory is required by the decision and does not exist yet.** The GitHub repository is one copy; where the second lives is for the owner to name, and it is not recorded here until it exists. diff --git a/evidence/time/digicert-2026-11-03/cic-chain/developer-ca.pem b/evidence/time/digicert-2026-11-03/cic-chain/developer-ca.pem new file mode 100644 index 0000000..e16fc3f --- /dev/null +++ b/evidence/time/digicert-2026-11-03/cic-chain/developer-ca.pem @@ -0,0 +1,14 @@ +-----BEGIN CERTIFICATE----- +MIICMzCCAdmgAwIBAgIUStyiR+g40cCBauhK8nOUNLIj0iMwCgYIKoZIzj0EAwIw +PjELMAkGA1UEBhMCSFUxGTAXBgNVBAoMEENlbnRyYWxJbmZyYUNvcmUxFDASBgNV +BAMMC0NJQyBSb290IENBMB4XDTI2MDMyMDEzMjI0NloXDTI2MTIzMTEzMjI0Nlow +QzELMAkGA1UEBhMCSFUxGTAXBgNVBAoMEENlbnRyYWxJbmZyYUNvcmUxGTAXBgNV +BAMMEENJQyBEZXZlbG9wZXIgQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAR7 +529RefaN8Yc+qVHNcNbssh+y5JBlp8lBeRbaWdoP2J0ZzWeHKfehV4Oh04d0J+cd +HLhMA1Ikelhi9B0xJnMeo4GvMIGsMB0GA1UdDgQWBBRefoIdjM9SpTglU/yD45JZ +4NiOFzBnBgNVHSMEYDBegBSiQtbuMt81/vweajD7O4ogMMaKGqFCpEAwPjELMAkG +A1UEBhMCSFUxGTAXBgNVBAoMEENlbnRyYWxJbmZyYUNvcmUxFDASBgNVBAMMC0NJ +QyBSb290IENBggIQBDASBgNVHRMBAf8ECDAGAQH/AgEAMA4GA1UdDwEB/wQEAwIB +hjAKBggqhkjOPQQDAgNIADBFAiEAzG5v4TbZRsEjcHFPmcx3R8gIv35ckgBYLdg9 +62uygnQCIBpkfZz/HxqFgsi4VGbjWMfg4xSsWyKfyR//DrgD176X +-----END CERTIFICATE----- diff --git a/evidence/time/digicert-2026-11-03/cic-chain/developer.pem b/evidence/time/digicert-2026-11-03/cic-chain/developer.pem new file mode 100644 index 0000000..e9a0650 --- /dev/null +++ b/evidence/time/digicert-2026-11-03/cic-chain/developer.pem @@ -0,0 +1,13 @@ +-----BEGIN CERTIFICATE----- +MIICBjCCAaygAwIBAgIUSnRMR6RPnEbg296XWPOqq/u5PCwwCgYIKoZIzj0EAwIw +QzELMAkGA1UEBhMCSFUxGTAXBgNVBAoMEENlbnRyYWxJbmZyYUNvcmUxGTAXBgNV +BAMMEENJQyBEZXZlbG9wZXIgQ0EwHhcNMjYwMzIwMTMyMjU5WhcNMjYxMjMxMTMy +MjU5WjBFMQswCQYDVQQGEwJIVTEZMBcGA1UECgwQQ2VudHJhbEluZnJhQ29yZTEb +MBkGA1UEAwwSR2Fib3IgWm9sdGFuIFNpbmtvMFkwEwYHKoZIzj0CAQYIKoZIzj0D +AQcDQgAEIG2CVmTfmLB9pLLclj7YmP2eedAjklpy4LGrU2ijoiy6Xqpuybv7OgJe +i+ez31s65NEV8+X/ByeX1cstR988z6N8MHowCQYDVR0TBAIwADAdBgNVHQ4EFgQU +yZN6AIX/TNnIJ9GwAa/NRN3ujHAwHwYDVR0jBBgwFoAUXn6CHYzPUqU4JVP8g+OS +WeDYjhcwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEF +BQcDBDAKBggqhkjOPQQDAgNIADBFAiEA+bFzXRoJ4PCQbhAAtpkcMjt0vNj5rEW0 +lOMBGDNyaWkCIB1vmM7PcZzv/c9bIrxF5kqv6QXomouhByUfeNUTbpKW +-----END CERTIFICATE----- diff --git a/evidence/time/digicert-2026-11-03/cic-chain/root.pem b/evidence/time/digicert-2026-11-03/cic-chain/root.pem new file mode 100644 index 0000000..b5de3b1 --- /dev/null +++ b/evidence/time/digicert-2026-11-03/cic-chain/root.pem @@ -0,0 +1,52 @@ +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 4100 (0x1004) + Signature Algorithm: ecdsa-with-SHA256 + Issuer: C=HU, O=CentralInfraCore, CN=CIC Root CA + Validity + Not Before: Mar 19 12:59:30 2026 GMT + Not After : Dec 31 23:59:59 2026 GMT + Subject: C=HU, O=CentralInfraCore, CN=CIC Root CA + Subject Public Key Info: + Public Key Algorithm: id-ecPublicKey + Public-Key: (256 bit) + pub: + 04:cd:07:56:3a:e7:28:41:c4:99:76:3a:e8:5e:90: + 39:54:be:e7:7d:42:ab:65:49:05:f0:f8:84:63:5f: + 5f:05:22:56:d1:29:e0:ac:7d:67:e3:cf:ac:8f:9c: + e2:be:71:6f:a8:91:00:e4:6c:af:1f:f2:86:3f:6d: + 03:1d:36:c7:f4 + ASN1 OID: prime256v1 + NIST CURVE: P-256 + X509v3 extensions: + X509v3 Subject Key Identifier: + A2:42:D6:EE:32:DF:35:FE:FC:1E:6A:30:FB:3B:8A:20:30:C6:8A:1A + X509v3 Authority Key Identifier: + keyid:A2:42:D6:EE:32:DF:35:FE:FC:1E:6A:30:FB:3B:8A:20:30:C6:8A:1A + DirName:/C=HU/O=CentralInfraCore/CN=CIC Root CA + serial:10:04 + X509v3 Basic Constraints: critical + CA:TRUE, pathlen:3 + X509v3 Key Usage: critical + Digital Signature, Certificate Sign, CRL Sign + Signature Algorithm: ecdsa-with-SHA256 + Signature Value: + 30:45:02:20:51:b0:f6:e5:50:ac:3b:f8:2e:d1:af:7a:7a:b3: + 42:7b:5d:8e:1d:d0:7d:e0:5c:60:48:42:aa:6b:f0:24:8b:a0: + 02:21:00:d8:c6:94:12:db:f1:a8:b8:3b:45:46:b9:30:88:36: + 6c:f3:e2:56:76:02:35:f6:17:0b:b5:3a:7b:80:5d:16:24 +-----BEGIN CERTIFICATE----- +MIICHDCCAcKgAwIBAgICEAQwCgYIKoZIzj0EAwIwPjELMAkGA1UEBhMCSFUxGTAX +BgNVBAoMEENlbnRyYWxJbmZyYUNvcmUxFDASBgNVBAMMC0NJQyBSb290IENBMB4X +DTI2MDMxOTEyNTkzMFoXDTI2MTIzMTIzNTk1OVowPjELMAkGA1UEBhMCSFUxGTAX +BgNVBAoMEENlbnRyYWxJbmZyYUNvcmUxFDASBgNVBAMMC0NJQyBSb290IENBMFkw +EwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEzQdWOucoQcSZdjroXpA5VL7nfUKrZUkF +8PiEY19fBSJW0SngrH1n48+sj5zivnFvqJEA5GyvH/KGP20DHTbH9KOBrzCBrDAd +BgNVHQ4EFgQUokLW7jLfNf78Hmow+zuKIDDGihowZwYDVR0jBGAwXoAUokLW7jLf +Nf78Hmow+zuKIDDGihqhQqRAMD4xCzAJBgNVBAYTAkhVMRkwFwYDVQQKDBBDZW50 +cmFsSW5mcmFDb3JlMRQwEgYDVQQDDAtDSUMgUm9vdCBDQYICEAQwEgYDVR0TAQH/ +BAgwBgEB/wIBAzAOBgNVHQ8BAf8EBAMCAYYwCgYIKoZIzj0EAwIDSAAwRQIgUbD2 +5VCsO/gu0a96erNCe12OHdB94FxgSEKqa/Aki6ACIQDYxpQS2/GouDtFRrkwiDZs +8+JWdgI19hcLtTp7gF0WJA== +-----END CERTIFICATE----- diff --git a/evidence/time/digicert-2026-11-03/cic-chain/source-ca.pem b/evidence/time/digicert-2026-11-03/cic-chain/source-ca.pem new file mode 100644 index 0000000..27c0e91 --- /dev/null +++ b/evidence/time/digicert-2026-11-03/cic-chain/source-ca.pem @@ -0,0 +1,14 @@ +-----BEGIN CERTIFICATE----- +MIICMDCCAdagAwIBAgIUStyiR+g40cCBauhK8nOUNLIj0iIwCgYIKoZIzj0EAwIw +PjELMAkGA1UEBhMCSFUxGTAXBgNVBAoMEENlbnRyYWxJbmZyYUNvcmUxFDASBgNV +BAMMC0NJQyBSb290IENBMB4XDTI2MDMyMDEzMjIzOVoXDTI2MTIzMTEzMjIzOVow +QDELMAkGA1UEBhMCSFUxGTAXBgNVBAoMEENlbnRyYWxJbmZyYUNvcmUxFjAUBgNV +BAMMDUNJQyBTb3VyY2UgQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARuSq7+ +gRkRwiZYbZBp8aWzFyK36YMBQ58PwUTtoL6Gzu5QZS2tDGLWvFqDY/BRavqcOfel +I6y+P9WlhntH4oI6o4GvMIGsMB0GA1UdDgQWBBTXWkl+CqRrqaEpr/fUmVHc6B7I +OTBnBgNVHSMEYDBegBSiQtbuMt81/vweajD7O4ogMMaKGqFCpEAwPjELMAkGA1UE +BhMCSFUxGTAXBgNVBAoMEENlbnRyYWxJbmZyYUNvcmUxFDASBgNVBAMMC0NJQyBS +b290IENBggIQBDASBgNVHRMBAf8ECDAGAQH/AgEAMA4GA1UdDwEB/wQEAwIBhjAK +BggqhkjOPQQDAgNIADBFAiEA25x0lXd37TAiRROTXQtqXNoMiwl0wCZln3m/DMBR +YcQCID3gc64TnA9Y7QL96lY1nYhAl2NWeMjK8pFXXN2Dymuf +-----END CERTIFICATE----- diff --git a/evidence/time/digicert-2026-11-03/manifest.json b/evidence/time/digicert-2026-11-03/manifest.json index a05459f..e0472a5 100644 --- a/evidence/time/digicert-2026-11-03/manifest.json +++ b/evidence/time/digicert-2026-11-03/manifest.json @@ -99,5 +99,40 @@ }, "tsa_chain_file": "v0.1.5/tsa-chain.pem" } - ] + ], + "cic_chain": { + "developer": { + "file": "cic-chain/developer.pem", + "subject": "C = HU, O = CentralInfraCore, CN = Gabor Zoltan Sinko", + "sha256": "5E:F7:39:DC:91:CF:87:6D:3E:E9:29:DB:94:60:6A:60:A5:80:46:D7:C6:0C:25:EC:93:10:70:83:E9:28:93:03", + "not_before": "Mar 20 13:22:59 2026 GMT", + "not_after": "Dec 31 13:22:59 2026 GMT", + "source": "carried by each of the three records (release.createdBy.certificate); the three records carry the same certificate" + }, + "developer-ca": { + "file": "cic-chain/developer-ca.pem", + "subject": "C = HU, O = CentralInfraCore, CN = CIC Developer CA", + "sha256": "D3:59:D1:47:8F:E9:15:89:FA:02:B7:8A:EC:E3:98:37:DC:0D:60:27:24:B2:6E:0F:4E:4F:86:4B:40:76:F6:6A", + "not_before": "Mar 20 13:22:46 2026 GMT", + "not_after": "Dec 31 13:22:46 2026 GMT", + "source": "NOT carried by the records; a public certificate taken from the owner's local PKI directory (EEC/CICDeveloperCA/CICDeveloperCA2026.pem). That it is the issuer of the developer certificate is shown by openssl verify, not assumed" + }, + "source-ca": { + "file": "cic-chain/source-ca.pem", + "subject": "C = HU, O = CentralInfraCore, CN = CIC Source CA", + "sha256": "27:2B:B9:73:EA:68:4C:C0:00:D6:DF:3E:77:21:25:2C:3C:48:85:BF:93:4E:9A:57:C5:CF:D0:E1:BE:C8:BC:20", + "not_before": "Mar 20 13:22:39 2026 GMT", + "not_after": "Dec 31 13:22:39 2026 GMT", + "source": "carried by each of the three records (cic_countersign.authority.certificate); the same in all three" + }, + "root": { + "file": "cic-chain/root.pem", + "subject": "C = HU, O = CentralInfraCore, CN = CIC Root CA", + "sha256": "7A:87:3A:BB:99:D7:20:D9:77:96:B4:A9:82:30:C4:3A:31:99:3B:7E:67:E3:30:2B:B5:7F:AE:9C:4F:5F:D1:A3", + "not_before": "Mar 19 12:59:30 2026 GMT", + "not_after": "Dec 31 23:59:59 2026 GMT", + "source": "carried by each of the three records (cic_countersign.authority.root_certificate); the same in all three" + }, + "note": "The CIC certificates are public. They are kept because the Developer CA is in none of the records, and because a later check of 'was this signature made while the chain was valid' needs them with the time of the stamp. They are not a trust anchor for the release (docs/P5-TRUST-MODEL-PLAN.md): they say when the chain ended, not whether it may be believed." + } } diff --git a/evidence/time/digicert-2026-11-03/verify.sh b/evidence/time/digicert-2026-11-03/verify.sh index abb9186..d4a0e5f 100755 --- a/evidence/time/digicert-2026-11-03/verify.sh +++ b/evidence/time/digicert-2026-11-03/verify.sh @@ -1,47 +1,113 @@ #!/usr/bin/env bash -# Verifies the RFC 3161 time-stamp tokens of this directory, offline, against the self-signed DigiCert Trusted Root G4 kept in trust-anchor/. +# Verifies the RFC 3161 time-stamp tokens of this directory, offline, and that each stamp lies inside the validity of the CIC certificates that signed the records. # # verify.sh run from a clone of cic-primitives that holds the three release commits (git history); exit 0 only if every check holds -# verify.sh --selftest the same, and then the NEGATIVE controls: a record changed by one byte and a wrong anchor must FAIL; if one of them passes, this script fails +# verify.sh --selftest the same, and then the NEGATIVE controls, which must FAIL; if one of them passes, this script fails # -# What it checks, for each of the three releases: (1) the anchor is the one whose figures are written in manifest.json; (2) the record, read from git at its release -# commit, has the SHA-256 the manifest names; (3) the token is valid for that record, chained to the anchor, and its time stamp lies inside the validity of every -# certificate (openssl ts -verify -attime ). Needs openssl, git, python3 (json only). No network. +# THE TIME. The time of a stamp is read from the TOKEN (the signed genTime), never from manifest.json; the manifest value is only compared with it. EVERY token check runs +# at that time (-attime), so a later end of the TSA chain does not change the result, and the check does not depend on the clock of the machine. +# +# Per release it checks: (1) the record, read from git at its release commit, has the SHA-256 the manifest names; (2) the token answers our request, covers the record file, +# and chains to the self-signed DigiCert root kept in trust-anchor/, all three AT genTime; (3) the CIC certificates kept in cic-chain/ are the ones the record carries +# (developer, Source CA, root), the Developer CA that the record does NOT carry really issues the developer certificate, and genTime lies inside the validity window of +# EACH of the four (not before, not after), checked twice: openssl verify -attime over both chains, and plain arithmetic on the dates. +# Needs openssl, git, python3 with PyYAML (to read the certificates out of the record). No network. set -u HERE=$(cd "$(dirname "$0")" && pwd) M="$HERE/manifest.json" ANCHOR="$HERE/trust-anchor/DigiCert_Trusted_Root_G4.pem" +C="$HERE/cic-chain" fail=0 say() { printf '%s\n' "$*"; } bad() { say "FAIL $*"; fail=1; } ok() { say "ok $*"; } +mj() { python3 -c 'import json,sys;o=json.load(open(sys.argv[1])) +for k in sys.argv[2].split("."): o=o[int(k)] if isinstance(o,list) else o[k] +print(o)' "$M" "$1"; } +fp() { openssl x509 -in "$1" -noout -fingerprint -sha256 | cut -d= -f2; } +epoch() { date -u -d "$1" +%s; } +notbefore() { epoch "$(openssl x509 -in "$1" -noout -startdate | cut -d= -f2)"; } +notafter() { epoch "$(openssl x509 -in "$1" -noout -enddate | cut -d= -f2)"; } + +# the four CIC certificates must lie around a time: plain arithmetic, fail closed. Prints nothing; returns 0 only if EVERY one holds at $1 (epoch). +cic_window_ok() { + local t=$1 f + for f in developer.pem developer-ca.pem source-ca.pem root.pem; do + [ "$(notbefore "$C/$f")" -le "$t" ] && [ "$t" -le "$(notafter "$C/$f")" ] || return 1 + done +} +# the same time, by openssl over the two chains the records use (developer <- Developer CA <- root, and Source CA <- root) +cic_chains_ok() { + local t=$1 + openssl verify -attime "$t" -CAfile "$C/root.pem" -untrusted "$C/developer-ca.pem" "$C/developer.pem" >/dev/null 2>&1 && + openssl verify -attime "$t" -CAfile "$C/root.pem" "$C/source-ca.pem" >/dev/null 2>&1 +} -want256=$(python3 -c 'import json,sys;print(json.load(open(sys.argv[1]))["trust_anchor"]["sha256"])' "$M") -want1=$(python3 -c 'import json,sys;print(json.load(open(sys.argv[1]))["trust_anchor"]["sha1"])' "$M") -got256=$(openssl x509 -in "$ANCHOR" -noout -fingerprint -sha256 | cut -d= -f2) -got1=$(openssl x509 -in "$ANCHOR" -noout -fingerprint -sha1 | cut -d= -f2) -[ "$got256" = "$want256" ] && [ "$got1" = "$want1" ] && ok "trust anchor $got256" || bad "trust anchor differs from the manifest ($got256)" +# ---- the anchors and the kept certificates are the ones the manifest names +want256=$(mj trust_anchor.sha256); want1=$(mj trust_anchor.sha1) +[ "$(fp "$ANCHOR")" = "$want256" ] && [ "$(openssl x509 -in "$ANCHOR" -noout -fingerprint -sha1 | cut -d= -f2)" = "$want1" ] && ok "TSA trust anchor $want256" || bad "TSA trust anchor differs from the manifest" +for name in developer developer-ca source-ca root; do + want=$(mj "cic_chain.$name.sha256"); got=$(fp "$C/$name.pem") + [ "$got" = "$want" ] && ok "CIC certificate $name $got" || bad "CIC certificate $name differs from the manifest ($got)" +done n=$(python3 -c 'import json,sys;print(len(json.load(open(sys.argv[1]))["stamps"]))' "$M") tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT for i in $(seq 0 $((n - 1))); do - f() { python3 -c 'import json,sys;d=json.load(open(sys.argv[1]))["stamps"][int(sys.argv[2])];o=d -for k in sys.argv[3].split("."): o=o[k] -print(o)' "$M" "$i" "$1"; } - rel=$(f release); commit=$(f record.git_commit); path=$(f record.path); rsha=$(f record.sha256) - tsr="$HERE/$(f response.file)"; tsq="$HERE/$(f request.file)"; stamp=$(f response.stamp_time_utc) + rel=$(mj "stamps.$i.release"); commit=$(mj "stamps.$i.record.git_commit"); path=$(mj "stamps.$i.record.path"); rsha=$(mj "stamps.$i.record.sha256") + tsr="$HERE/$(mj "stamps.$i.response.file")"; tsq="$HERE/$(mj "stamps.$i.request.file")"; manifest_time=$(mj "stamps.$i.response.stamp_time_utc") if ! git cat-file -e "$commit^{commit}" 2>/dev/null; then bad "$rel: the commit $commit is not in this clone (fetch the full history)"; continue; fi git show "$commit:$path" > "$tmp/rec-$rel.yaml" 2>/dev/null - [ "$(sha256sum "$tmp/rec-$rel.yaml" | cut -d' ' -f1)" = "$rsha" ] && ok "$rel: the record at $commit has sha256 ${rsha:0:16}..." || { bad "$rel: the record at $commit is not the one in the manifest"; continue; } - at=$(date -u -d "$stamp" +%s) - openssl ts -verify -queryfile "$tsq" -in "$tsr" -CAfile "$ANCHOR" >/dev/null 2>&1 && ok "$rel: the token answers our request (digest and nonce) and chains to the anchor" || bad "$rel: the token does not answer the request / does not chain to the anchor" - openssl ts -verify -data "$tmp/rec-$rel.yaml" -in "$tsr" -CAfile "$ANCHOR" >/dev/null 2>&1 && ok "$rel: the token covers the record file" || bad "$rel: the token does not cover the record file" - openssl ts -verify -data "$tmp/rec-$rel.yaml" -in "$tsr" -CAfile "$ANCHOR" -attime "$at" >/dev/null 2>&1 && ok "$rel: valid at the time stamp ($stamp)" || bad "$rel: not valid at the time stamp" + [ "$(sha256sum "$tmp/rec-$rel.yaml" | cut -d' ' -f1)" = "$rsha" ] && ok "$rel: the record at ${commit:0:8} has sha256 ${rsha:0:16}..." || { bad "$rel: the record at $commit is not the one in the manifest"; continue; } + + # the time, from the token + token_time=$(openssl ts -reply -in "$tsr" -text 2>/dev/null | sed -n 's/^Time stamp: //p') + if [ -z "$token_time" ]; then bad "$rel: no time stamp could be read from the token"; continue; fi + at=$(epoch "$token_time") + [ "$token_time" = "$manifest_time" ] && ok "$rel: the time in the token ($token_time) equals the manifest" || bad "$rel: the time in the token ($token_time) is not the manifest's ($manifest_time)" + + # the token, ALL checks at the stamp time + openssl ts -verify -queryfile "$tsq" -in "$tsr" -CAfile "$ANCHOR" -attime "$at" >/dev/null 2>&1 && ok "$rel: the token answers our request (digest and nonce) and chains to the anchor, at $token_time" || bad "$rel: the token does not answer the request / does not chain to the anchor at the stamp time" + openssl ts -verify -data "$tmp/rec-$rel.yaml" -in "$tsr" -CAfile "$ANCHOR" -attime "$at" >/dev/null 2>&1 && ok "$rel: the token covers the record file, at $token_time" || bad "$rel: the token does not cover the record file at the stamp time" + + # the CIC certificates: the kept ones are the record's own, the Developer CA is the issuer, and the stamp lies inside every window + # compared as CERTIFICATES (the SHA-256 of the DER), not as text: the field of a record may be a plain PEM (v0.1.5) or the printed text of openssl x509 -text with the PEM + # block at its end (v0.2.0, v0.2.1); a record is not changed for that, and the same certificate must be recognised in both + python3 - "$tmp/rec-$rel.yaml" "$tmp" "$rel" <<'PY' || true +import sys, yaml +rec = yaml.safe_load(open(sys.argv[1], encoding="utf-8")); out, rel = sys.argv[2], sys.argv[3] +fields = {"developer": rec["release"]["createdBy"]["certificate"], "source-ca": rec["cic_countersign"]["authority"]["certificate"], "root": rec["cic_countersign"]["authority"]["root_certificate"]} +for k, v in fields.items(): + i = v.find("-----BEGIN CERTIFICATE-----") + open("%s/%s-%s.pem" % (out, rel, k), "w", encoding="utf-8").write(v[i:] if i >= 0 else "") +PY + diffs="" + for k in developer source-ca root; do + r="$tmp/$rel-$k.pem" + if [ -s "$r" ] && [ "$(fp "$r" 2>/dev/null)" = "$(fp "$C/$k.pem")" ]; then :; else diffs="$diffs $k"; fi + done + [ -z "$diffs" ] && echo SAME > "$tmp/cmp-$rel.txt" || echo "DIFFERENT:$diffs" > "$tmp/cmp-$rel.txt" + [ "$(cat "$tmp/cmp-$rel.txt")" = "SAME" ] && ok "$rel: developer, Source CA and root kept here are the same certificates as the record carries (by DER, not by text)" || bad "$rel: the certificates kept here are not the record's own ($(cat "$tmp/cmp-$rel.txt"))" + cic_chains_ok "$at" && ok "$rel: openssl: both CIC chains are valid at the stamp time, the Developer CA being the issuer of the developer certificate" || bad "$rel: openssl: a CIC chain is NOT valid at the stamp time" + if cic_window_ok "$at"; then + ok "$rel: the stamp ($token_time) is inside the validity of the developer certificate, Developer CA, Source CA and root" + for f in developer developer-ca source-ca root; do say " margin before the end of $f.pem: $(( ($(notafter "$C/$f.pem") - at) / 86400 )) days"; done + else bad "$rel: the stamp is OUTSIDE the validity of at least one CIC certificate"; fi + if [ "${1:-}" = "--selftest" ]; then cp "$tmp/rec-$rel.yaml" "$tmp/alt-$rel.yaml"; printf '#' >> "$tmp/alt-$rel.yaml" - if openssl ts -verify -data "$tmp/alt-$rel.yaml" -in "$tsr" -CAfile "$ANCHOR" >/dev/null 2>&1; then bad "$rel: SELFTEST a record changed by one byte was ACCEPTED"; else ok "$rel: selftest, a record changed by one byte is refused"; fi - if openssl ts -verify -data "$tmp/rec-$rel.yaml" -in "$tsr" -CAfile /usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G2.crt >/dev/null 2>&1; then bad "$rel: SELFTEST a wrong anchor was ACCEPTED"; else ok "$rel: selftest, a wrong anchor is refused"; fi + if openssl ts -verify -data "$tmp/alt-$rel.yaml" -in "$tsr" -CAfile "$ANCHOR" -attime "$at" >/dev/null 2>&1; then bad "$rel: SELFTEST a record changed by one byte was ACCEPTED"; else ok "$rel: selftest, a record changed by one byte is refused"; fi + if openssl ts -verify -data "$tmp/rec-$rel.yaml" -in "$tsr" -CAfile /usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G2.crt -attime "$at" >/dev/null 2>&1; then bad "$rel: SELFTEST a wrong anchor was ACCEPTED"; else ok "$rel: selftest, a wrong anchor is refused"; fi + after=$(epoch "2027-01-15"); before=$(epoch "2026-03-01") + if cic_window_ok "$after" || cic_chains_ok "$after"; then bad "$rel: SELFTEST a stamp in 2027, after the CIC chain ended, was ACCEPTED"; else ok "$rel: selftest, a stamp after the end of the CIC chain is refused (both ways)"; fi + if cic_window_ok "$before" || cic_chains_ok "$before"; then bad "$rel: SELFTEST a stamp before the CIC chain began was ACCEPTED"; else ok "$rel: selftest, a stamp before the CIC chain began is refused (both ways)"; fi + between=$(epoch "2026-12-31 13:22:50") # after the Developer CA (13:22:46) and the Source CA (13:22:39) ended, before the developer certificate (13:22:59) did + if cic_window_ok "$between" || cic_chains_ok "$between"; then bad "$rel: SELFTEST a stamp after ONE of the CIC certificates ended was ACCEPTED"; else ok "$rel: selftest, a stamp when only SOME CIC certificates are still valid is refused"; fi fi done +if [ "${1:-}" = "--selftest" ]; then + # the Developer CA that issues the developer certificate must be the real one: the Source CA in its place is refused + if openssl verify -attime "$(epoch '2026-11-03 22:07:48')" -CAfile "$C/root.pem" -untrusted "$C/source-ca.pem" "$C/developer.pem" >/dev/null 2>&1; then bad "SELFTEST the Source CA was accepted as the issuer of the developer certificate"; else ok "selftest, a wrong issuer of the developer certificate is refused"; fi +fi [ "$fail" = 0 ] && say "ALL CHECKS HOLD" || say "AT LEAST ONE CHECK FAILED" exit "$fail"