Parse SCT and CRL Distribution Points extensions - #20
Conversation
Instead of showing raw hex for OID 1.3.6.1.4.1.11129.2.4.2 (SCT) and 2.5.29.31 (CRL DP), parse them into human-readable data: - SCT: log name (via known-logs lookup), timestamp, algorithm, signature - CRL DP: distribution point URIs extracted from DER tree Split CustomExtensionDecoders into focused per-domain files (SCTDecoder, CRLDistributionPointsDecoder, CertificatePoliciesDecoder). Add scripts/update_ct_logs.py to regenerate the known CT logs table from Google's official log list. Closes #19
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances the certificate inspection capabilities by introducing robust parsing for Signed Certificate Timestamps (SCTs) and CRL Distribution Points. It provides a more detailed and structured view of these critical certificate extensions, improving the clarity and depth of information available to users. The changes also include a refactoring of extension decoders for better organization and maintainability, alongside an automated mechanism to keep the Certificate Transparency log list up-to-date. Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces parsing for two important certificate extensions: Signed Certificate Timestamps (SCT) for Certificate Transparency and CRL Distribution Points. The changes are well-structured, with new decoders in separate files, a lookup table for known CT logs, and a script to keep it updated. The UI is also updated to display this new information.
My review focuses on a few areas for improvement:
- There's an opportunity to significantly simplify the
CRLDistributionPointsDecoderby using the parsing capabilities already present in theswift-x509dependency, which would make the code more robust and easier to maintain. - A minor performance optimization in
SCTDecoderto avoid re-creating a date formatter in a loop. - A consistency fix in
CertificatePoliciesDecoderto add an OID check, aligning it with the other new decoders.
Overall, this is a great addition that provides valuable information about certificates.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e6f9568fc4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| for op in data.get("operators", []): | ||
| op_name = op["name"] | ||
| for log in op.get("logs", []): | ||
| log_id_b64 = log["log_id"] |
There was a problem hiding this comment.
This generator now builds KnownCTLogs solely from the current entries in Google's log_list.json, and the committed table therefore starts at 2026-era logs. SCTDecoder uses that table for every live certificate, so certificates issued in late 2025 that are still valid on 2026-03-20 will render their SCTs as Unknown (...) even though those log IDs are well-known. To keep real-world chains readable, the generated map needs an archive/historical source instead of only today's active list.
Useful? React with 👍 / 👎.
- Add custom Decodable init to CertificateDetails so persisted data from older builds without sctList/crlDistributionPoints still decodes (defaults to empty arrays) - Hoist ISO8601DateFormatter out of the SCT parsing loop - Add OID guard to CertificatePoliciesDecoder for consistency
…s from raw list - Use inspectDisplayString (e.g. "Nov 12, 2025, 4:13:59 AM") instead of ISO 8601 for SCT timestamps - Filter SCT and CRL DP from the generic Extensions section since they already have dedicated display sections
- Move ByteReader to its own file as a public struct with readUInt24 and skip methods for broader reuse across TLS parsing code - Remove superficial comments from test builders
- Create Certificate.Extension mock factory methods (mockSCTList, mockCRLDistributionPoints, mockCertificatePolicies) in shared CertificateExtensionFixtures helper - Move certificate tests into Certificate/ subdirectory - Move TLS tests into TLS/ subdirectory - Move shared helpers into Helpers/ subdirectory - Remove duplicate URL normalizer tests from CertificateParserTests
1 participant
Summary
1.3.6.1.4.1.11129.2.4.2) from raw hex into structured fields: log name, timestamp, signature algorithm, and signature (RFC 6962)2.5.29.31) from raw hex into distribution point URIsscripts/update_ct_logs.pyto regenerate the lookup table from https://www.gstatic.com/ct/log_list/v3/log_list.jsonCustomExtensionDecodersinto focused files:SCTDecoder,CRLDistributionPointsDecoder,CertificatePoliciesDecoderCloses #19
Test plan
python3 scripts/update_ct_logs.pyregenerates KnownCTLogs.swift from upstream