Repository navigation
fix(bep): cap host names at 253 bytes and the leaf CN at 64
PASS_WITH_CONDITIONS
Baseline: the PASS_WITH_CONDITIONS ruling on ad01f993 (this PR) stands for everything the compare does not touch. I confirmed that since.diff equals git diff ad01f993 47b905e7. It is one commit, 47b905e, and it changes only crates/bep/src/ca.rs.
Governs: Gatehouse §6.10 (specs/authn-authz/gatehouse-spec.md). Lifecycle, un-enrolled (line 839) requires a self-signed root that carries the name constraints itself, a keychain-held signing CA and per-hostname leaves. The constraints are the module host sets ∪ the registered authorities, minus the fixed deny set. Trust-store injection (line 821) requires a keyid-only AKID on the certificates below the root.
Compare: dns_host now skips a registered host longer than 253 bytes, with the existing warn!. Because the union is the root's permitted-subtree source and the issue_leaf admission set, the skipped name is out of both, and a leaf request for it is refused with the OutsideUnion log line. That is fail-closed (rule 7). sign_leaf omits the subject CN for a hostname over 64 bytes and keeps the name in the SAN. The design is silent on the leaf subject. It requires only per-hostname leaves under the signing CA, and the test validates such a leaf against the root alone with webpki.
Ruling: the compare conforms. Two interims from earlier heads stay open, and the code still says that their issues are not filed. One is that no production key implements CaKey, so the signing CA is not yet keychain-held (line 839). The other is that DENY_SET is a partial deny set (line 839). A residual with no issue is refused (rule 6), so C1 and C2 stay as conditions until the issues exist.
Not checked: whether rcgen 0.14 marks the SAN critical when the leaf subject is empty (RFC 5280 §4.2.1.6). The rcgen source is not in this sandbox, and the design does not state the rule. webpki accepts the leaf. A strict OpenSSL validator can refuse a non-critical SAN on an empty subject. This affects only names of 65 bytes or more.
Conditions
- C1: File the issue for the keychain
CaKeywork: implementca::CaKeyfor thekeys.rskeychain key (SecKeycreate_signature, ECDSA P-256 SHA-256) and forMemoryKey. Incrates/bep/src/ca.rs, theCaKeydoc comment (line 79), replace "The issue that tracks it is not filed yet." with the issue URL. Name the issue in the PR body as a residual. - C2: File the issue for the full fixed deny set (the BEP-034 infrastructure names that replace
DENY_SET). Incrates/bep/src/ca.rs, theDENY_SETdoc comment (line 50), replace "The issue that tracks the full set is not filed yet." with the issue URL. Name the issue in the PR body as a residual.
Ruled at 47b905e against gominimal/arch@3dab1097cda1 by claude-opus-5-5; arch_rulings 64, job c036b459-c800-459c-a18a-7d67a40e5902.