Support fetching intermediates

upki-cli/src/bin/upki.rs

@@ -12,9 +12,11 @@ use tracing::level_filters::LevelFilter;
 use tracing_subscriber::EnvFilter;
 use tracing_subscriber::layer::SubscriberExt;
 use tracing_subscriber::util::SubscriberInitExt;
-use upki::revocation::{Index, RevocationCheckInput};
 #[cfg(feature = "__fetch")]
-use upki::revocation::{Manifest, fetch};
+use upki::intermediates;
+#[cfg(feature = "__fetch")]
+use upki::revocation;
+use upki::revocation::{Index, RevocationCheckInput};
 use upki::{Config, ConfigPath};
 
 #[tokio::main(flavor = "current_thread")]
@@ -47,9 +49,19 @@ async fn main() -> Result<ExitCode, Report> {
 
     Ok(match args.command {
         #[cfg(feature = "__fetch")]
-        Command::Fetch { dry_run } => fetch(dry_run, &config).await?,
+        Command::Fetch { dry_run } => {
+            revocation::fetch(dry_run, &config).await?;
+            intermediates::fetch(dry_run, &config).await?;
+            ExitCode::SUCCESS
+        }
         #[cfg(feature = "__fetch")]
-        Command::Verify => Manifest::from_config(&config)?.verify(&config)?,
+        Command::Verify => {
+            revocation::Manifest::from_config(&config)?.verify(&config)?;
+            if config.intermediates.enabled {
+                intermediates::Manifest::from_config(&config)?.verify(&config)?;
+            }
+            ExitCode::SUCCESS
+        }
         Command::ShowConfigPath => unreachable!(),
         Command::ShowConfig => {
             print!(

upki-cli/tests/data/typical-intermediates/intermediates/01.pem

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDejCCAwCgAwIBAgIQDhl+Y1ebEqZMU1NhDojs+zAKBggqhkjOPQQDAzCBiDELM
+AkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNle
+SBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJ
+VVTRVJUcnVzdCBFQ0MgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMjMwODAyM
+DAwMDAwWhcNMzMwODAxMjM1OTU5WjBhMQswCQYDVQQGEwJDTjEtMCsGA1UECgwk5
+bm/5Lic5pe25Luj5LqS6IGU56eR5oqA5pyJ6ZmQ5YWs5Y+4MSMwIQYDVQQDDBrml
+7bku6PkupLogZQgRUNDIERWIFNTTCBDQTBZMBMGByqGSM49AgEGCCqGSM49AwEHA
+0IABPM5xjioDj+MTMUvVcu+mvehklAx8lZtFx1mluI+1sJaQC1WunaAefAn1nyIg
+QvmGX5MOSPkxJgxTaglH57UzI6jggFwMIIBbDAfBgNVHSMEGDAWgBQ64QmG1M8Zw
+pZ2dEl23OA1xmNjmjAdBgNVHQ4EFgQUEatQraNKT0JKMgCCGyLYu5PmPREwDgYDV
+R0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBB
+QUHAwEGCCsGAQUFBwMCMCIGA1UdIAQbMBkwDQYLKwYBBAGyMQECAnAwCAYGZ4EMA
+QIBMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU
+0VSVHJ1c3RFQ0NDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDBxBggrBgEFBQcBA
+QRlMGMwOgYIKwYBBQUHMAKGLmh0dHA6Ly9jcnQudXNlcnRydXN0LmNvbS9VU0VSV
+HJ1c3RFQ0NBQUFDQS5jcnQwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0c
+nVzdC5jb20wCgYIKoZIzj0EAwMDaAAwZQIwFQ10XkI2EJqgq/uimmsknSuJFSrPb
+bpE0T/bZhNwpzYPMHMLvLPHphKVsdZRRl5zAjEA4yfOfGuscopZ5CKd4beKBBuyE
+TD2L1n17Vz1m1MyYdRmDYcnSw1yq/CF14Ug0OtR
+-----END CERTIFICATE-----

upki-cli/tests/data/typical-intermediates/intermediates/02.pem

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDZjCCAuygAwIBAgIUSqaZqiFHW6RplEGCjSLNztXVwnYwCgYIKoZIzj0EAwMw
+WDELMAkGA1UEBhMCQ04xJTAjBgNVBAoTHFRydXN0QXNpYSBUZWNobm9sb2dpZXMs
+IEluYy4xIjAgBgNVBAMTGVRydXN0QXNpYSBUTFMgRUNDIFJvb3QgQ0EwHhcNMjUx
+MDIxMDYwNzQ2WhcNMzAxMDIxMDYwNzQ1WjBgMQswCQYDVQQGEwJDTjEtMCsGA1UE
+Cgwk5bm/5Lic5aCh5aGU5a6J5YWo5oqA5pyv5pyJ6ZmQ5YWs5Y+4MSIwIAYDVQQD
+DBnlrp3loZQgRFYgVExTIEVDQyBDQSAyMDI1MHYwEAYHKoZIzj0CAQYFK4EEACID
+YgAEZCtNSjEF5wehqx/uvl42QbwTGy+EdS0QOwwJNowLTL3ij851T4RtpKTHomni
+ZG93QY7pBX/PsrJxxfGcDcWiGsLKxl7kzbX+SKxiER3rQ4E839mUL/NAuEX55dt3
+YbCJo4IBbTCCAWkwEgYDVR0TAQH/BAgwBgEB/wIBADAfBgNVHSMEGDAWgBQshVO7
+sUPNMuqeo4f+opioppPpEDCBkQYIKwYBBQUHAQEEgYQwgYEwQAYIKwYBBQUHMAKG
+NGh0dHA6Ly9pY2Eub2VtLnRydXN0Y2EubmV0L1RydXN0QXNpYVRMU0VDQ1Jvb3RD
+QS5jcnQwPQYIKwYBBQUHMAGGMWh0dHA6Ly9vY3NwLm9lbS50cnVzdGNhLm5ldC9U
+cnVzdEFzaWFUTFNFQ0NSb290Q0EwEwYDVR0gBAwwCjAIBgZngQwBAgEwEwYDVR0l
+BAwwCgYIKwYBBQUHAwEwRQYDVR0fBD4wPDA6oDigNoY0aHR0cDovL2NybC5vZW0u
+dHJ1c3RjYS5uZXQvVHJ1c3RBc2lhVExTRUNDUm9vdENBLmNybDAdBgNVHQ4EFgQU
+1/pOVkY1qoJckXd6cBui1ECX/hkwDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMD
+A2gAMGUCMQD0Rc/yrS5puh71tMc5A5Zycj8uIJ3Vy7iv3bOzshO9uSKuSAXvPi+Z
+hlkde+9n6qICMEhD3oLT2RQYvyQh07xOGJtaHSeKL58T2ZJJN9sGzta0/Tp6t3BM
+rrzSTYUYmUJ56w==
+-----END CERTIFICATE-----

upki-cli/tests/data/typical-intermediates/intermediates/ff.pem

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDATCCAoegAwIBAgIQbqITfZL8UTBF2jH1eJ5SxTAKBggqhkjOPQQDAzBPMQsw
+CQYDVQQGEwJVUzEYMBYGA1UECgwPU1NMIENvcnBvcmF0aW9uMSYwJAYDVQQDDB1T
+U0wuY29tIFRMUyBUcmFuc2l0IEVDQyBDQSBSMjAeFw0yNTA1MDcxOTE1MjVaFw0z
+NTA1MDUxOTE1MjRaMFIxCzAJBgNVBAYTAkNOMSIwIAYDVQQKDBlab1RydXMgVGVj
+aG5vbG9neSBMaW1pdGVkMR8wHQYDVQQDDBZab1RydXMgRFYgVExTIEVDQyBDQSAx
+MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE3csCtDZ+nT94AFGWZ5KYelpbAvmJ8pjM
+hhI4TYf/2VCJVJgVmi/PQZAVZ6GRzFNUsUyyuTm09GPIyjFoxEtno2do62a6ACoe
+DzZO4nwTX3oZ44mzpV8ouS5PLJ1RwnDyo4IBIzCCAR8wEgYDVR0TAQH/BAgwBgEB
+/wIBADAfBgNVHSMEGDAWgBQyosfYWIv/f8A88lVpM+zOzB+8lzBIBggrBgEFBQcB
+AQQ8MDowOAYIKwYBBQUHMAKGLGh0dHA6Ly9jZXJ0LnNzbC5jb20vU1NMLmNvbS1U
+TFMtVC1FQ0MtUjIuY2VyMBEGA1UdIAQKMAgwBgYEVR0gADAdBgNVHSUEFjAUBggr
+BgEFBQcDAgYIKwYBBQUHAwEwPQYDVR0fBDYwNDAyoDCgLoYsaHR0cDovL2NybHMu
+c3NsLmNvbS9TU0wuY29tLVRMUy1ULUVDQy1SMi5jcmwwHQYDVR0OBBYEFPYfkvjv
+FR3ijLztfWArkrX5uSnHMA4GA1UdDwEB/wQEAwIBhjAKBggqhkjOPQQDAwNoADBl
+AjEA8NMnFZKKerkWdIDnbA3I1YuZzsv0scy1YC0GPgDVHbldqZ6grtTbDNl2UHVO
+9mLkAjAfz7nkpaDPiXVBVSeYz1kOFUlMh/09er0rK4AVlGSz5KFjattSiFtQZVjk
+yi2JzP4=
+-----END CERTIFICATE-----

upki-cli/tests/data/typical-intermediates/intermediates/manifest.json

@@ -0,0 +1,21 @@
+{
+  "generated_at": 1765445031,
+  "comment": "typical test manifest for intermediates",
+  "files": [
+    {
+      "filename": "01.pem",
+      "size": 1265,
+      "hash": "e1b2101ca9bbe7efd8056da198db614d0af067c877b751c167d4f645a0b85621"
+    },
+    {
+      "filename": "02.pem",
+      "size": 1241,
+      "hash": "2181939592dc7ec156e9d11e927733465346978e6d8b95bdd4d8195db3414118"
+    },
+    {
+      "filename": "ff.pem",
+      "size": 1103,
+      "hash": "cf2ea11741268b27a36f90324a068b2e7c07d656c6455b31e9c986d080d2360d"
+    }
+  ]
+}

upki-cli/tests/data/typical-intermediates/revocation/manifest.json

@@ -0,0 +1,5 @@
+{
+  "generated_at": 1765445031,
+  "comment": "empty manifest",
+  "files": []
+}

upki-cli/tests/data/verify_non_existent_dir/config.toml

@@ -2,3 +2,7 @@ cache-dir = "not-exist/"
 
 [revocation]
 fetch-url = ""
+
+[intermediates]
+enabled = false
+fetch-url = ""

upki-cli/tests/data/verify_of_empty_intermediates_manifest/config.toml

@@ -0,0 +1,8 @@
+cache-dir = "tests/data/verify_of_empty_intermediates_manifest/"
+
+[revocation]
+fetch-url = ""
+
+[intermediates]
+enabled = true
+fetch-url = ""

upki-cli/tests/data/verify_of_empty_intermediates_manifest/intermediates/manifest.json

@@ -0,0 +1,5 @@
+{
+  "generated_at": 1765445031,
+  "comment": "empty manifest",
+  "files": []
+}

upki-cli/tests/data/verify_of_empty_intermediates_manifest/revocation/manifest.json

@@ -0,0 +1,5 @@
+{
+  "generated_at": 1765445031,
+  "comment": "empty manifest",
+  "files": []
+}