Skip to content
This repository was archived by the owner on Sep 23, 2025. It is now read-only.

Commit 231ae3c

Browse files
codysoylandcodysoyland
authored
Add support for custom trusted root target path (#1608)
* Add TrustedRootTarget field Signed-off-by: Cody Soyland <[email protected]> * Add support for custom trusted root target Signed-off-by: Cody Soyland <[email protected]> * Regenerate test data and add support for custom trusted root target path Signed-off-by: Cody Soyland <[email protected]> * Update calls to GetSigstoreKeysFromTuf Signed-off-by: Cody Soyland <[email protected]> --------- Signed-off-by: Cody Soyland <[email protected]>
1 parent 430c242 commit 231ae3c

22 files changed

+308
-151
lines changed

‎cmd/tester/trustroot.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,14 +33,14 @@ func GetKeysFromTrustRoot(ctx context.Context, tr *v1alpha1.TrustRoot) (*config.
3333
if err != nil {
3434
return nil, fmt.Errorf("failed to initialize TUF client from remote: %w", err)
3535
}
36-
return trustroot.GetSigstoreKeysFromTuf(ctx, client)
36+
return trustroot.GetSigstoreKeysFromTuf(ctx, client, "")
3737
case tr.Spec.Repository != nil:
3838
client, err := tuf.ClientFromSerializedMirror(context.Background(), tr.Spec.Repository.MirrorFS, tr.Spec.Repository.Root, tr.Spec.Repository.Targets, v1alpha1.DefaultTUFRepoPrefix)
3939
if err != nil {
4040
return nil, fmt.Errorf("failed to initialize TUF client from remote: %w", err)
4141
}
4242

43-
return trustroot.GetSigstoreKeysFromTuf(ctx, client)
43+
return trustroot.GetSigstoreKeysFromTuf(ctx, client, "")
4444
case tr.Spec.SigstoreKeys != nil:
4545
return config.ConvertSigstoreKeys(context.Background(), tr.Spec.SigstoreKeys)
4646
}

‎config/300-trustroot.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,9 @@ spec:
5454
targets:
5555
description: Targets is where the targets live off of the root of the Remote If not specified 'targets' is defaulted.
5656
type: string
57+
trustedRootTarget:
58+
description: TrustedRootTarget is the name of the target containing the JSON trusted root. If not specified, `trusted_root.json` is used.
59+
type: string
5760
repository:
5861
description: Repository contains the serialized TUF remote repository.
5962
type: object
@@ -67,6 +70,9 @@ spec:
6770
targets:
6871
description: Targets is where the targets live off of the root of the Repository above. If not specified 'targets' is defaulted.
6972
type: string
73+
trustedRootTarget:
74+
description: TrustedRootTarget is the name of the target containing the JSON trusted root. If not specified, `trusted_root.json` is used.
75+
type: string
7076
sigstoreKeys:
7177
description: SigstoreKeys contains the serialized keys.
7278
type: object

‎docs/api-types/index-v1alpha1.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ Remote specifies the TUF with trusted initial root and remote mirror where to fe
6464
| root | Root is the base64 encoded, json trusted initial root. | []byte | true |
6565
| mirror | Mirror is the remote mirror, for example: https://tuf-repo-cdn.sigstore.dev | apis.URL | true |
6666
| targets | Targets is where the targets live off of the root of the Remote If not specified 'targets' is defaulted. | string | false |
67+
| trustedRootTarget | TrustedRootTarget is the name of the target containing the JSON trusted root. If not specified, `trusted_root.json` is used. | string | false |
6768

6869
[Back to TOC](#table-of-contents)
6970

@@ -76,6 +77,7 @@ Repository specifies an airgapped TUF. Specifies the trusted initial root as wel
7677
| root | Root is the base64 encoded, json trusted initial root. | []byte | true |
7778
| mirrorFS | MirrorFS is the base64 tarred, gzipped, and base64 encoded remote repository that can be used for example in air-gap environments. Will not make outbound network connections, and must then be kept up to date in some other manner. The repository must contain metadata as well as targets. | []byte | true |
7879
| targets | Targets is where the targets live off of the root of the Repository above. If not specified 'targets' is defaulted. | string | false |
80+
| trustedRootTarget | TrustedRootTarget is the name of the target containing the JSON trusted root. If not specified, `trusted_root.json` is used. | string | false |
7981

8082
[Back to TOC](#table-of-contents)
8183

‎hack/gentestdata/gentestdata.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,13 @@ func main() {
9393
log.Fatal(err)
9494
}
9595

96+
tufRepoWithCustomTrustedRootJSON, rootJSONWithCustomTrustedRootJSON, err := genTUFRepo(map[string][]byte{
97+
"custom_trusted_root.json": marshalledEntry,
98+
})
99+
if err != nil {
100+
log.Fatal(err)
101+
}
102+
96103
marshalledEntryFromMirrorFS, err := genTrustedRoot(sigstoreKeysMap)
97104
if err != nil {
98105
log.Fatal(err)
@@ -110,6 +117,8 @@ func main() {
110117
mustWriteFile("root.json", rootJSON)
111118
mustWriteFile("tufRepoWithTrustedRootJSON.tar", tufRepoWithTrustedRootJSON)
112119
mustWriteFile("rootWithTrustedRootJSON.json", rootJSONWithTrustedRootJSON)
120+
mustWriteFile("tufRepoWithCustomTrustedRootJSON.tar", tufRepoWithCustomTrustedRootJSON)
121+
mustWriteFile("rootWithCustomTrustedRootJSON.json", rootJSONWithCustomTrustedRootJSON)
113122
}
114123

115124
func mustWriteFile(path string, data []byte) {

‎pkg/apis/policy/v1alpha1/trustroot_types.go‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,11 @@ type Remote struct {
107107
// If not specified 'targets' is defaulted.
108108
// +optional
109109
Targets string `json:"targets,omitempty"`
110+
111+
// TrustedRootTarget is the name of the target containing the JSON trusted
112+
// root. If not specified, `trusted_root.json` is used.
113+
// +optional
114+
TrustedRootTarget string `json:"trustedRootTarget,omitempty"`
110115
}
111116

112117
// Repository specifies an airgapped TUF. Specifies the trusted initial root as
@@ -126,6 +131,11 @@ type Repository struct {
126131
// above. If not specified 'targets' is defaulted.
127132
// +optional
128133
Targets string `json:"targets,omitempty"`
134+
135+
// TrustedRootTarget is the name of the target containing the JSON trusted
136+
// root. If not specified, `trusted_root.json` is used.
137+
// +optional
138+
TrustedRootTarget string `json:"trustedRootTarget,omitempty"`
129139
}
130140

131141
// TransparencyLogInstance describes the immutable parameters from a

‎pkg/reconciler/testing/v1alpha1/trustroot.go‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -104,12 +104,13 @@ func WithSigstoreKeys(sk map[string]string) TrustRootOption {
104104

105105
// WithRepository constructs a TrustRootOption which is suitable
106106
// for reconciler table driven testing.
107-
func WithRepository(targets string, root, repository []byte) TrustRootOption {
107+
func WithRepository(targets string, root, repository []byte, trustedRootTarget string) TrustRootOption {
108108
return func(tr *v1alpha1.TrustRoot) {
109109
tr.Spec.Repository = &v1alpha1.Repository{
110-
Root: root,
111-
Targets: targets,
112-
MirrorFS: repository,
110+
Root: root,
111+
MirrorFS: repository,
112+
Targets: targets,
113+
TrustedRootTarget: trustedRootTarget,
113114
}
114115
}
115116
}

‎pkg/reconciler/trustroot/testdata/ctfeLogID.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1710e23da0651aaa8194bc9652cd00a97c1fda9c76fce12f14eb635e42036954
1+
df8dc4f435a63e8cd48d2557c3c228e9558e04dca899fab5612a6d60d515e8f0

‎pkg/reconciler/trustroot/testdata/ctfePublicKey.pem‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
-----BEGIN PUBLIC KEY-----
2-
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEBQY7A479x/VleGrvxp1gQAykOZMj
3-
ld4J6VWVLnN0WLiqOesr9QkSBVnBkYKw0pr6Bgr8Qjg6NA3x470DLPxrDQ==
2+
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEklvaOetNsPoZt+BHsE0bbHybxHsk
3+
ImD/Swu8QyDZONn2hnJNxEImaz6Xzv7+/bzns9y0/b9NadWbeDht3KGBBg==
44
-----END PUBLIC KEY-----

‎pkg/reconciler/trustroot/testdata/fulcioCertChain.pem‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,18 @@
11
-----BEGIN CERTIFICATE-----
2-
MIIBPTCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI0
3-
MDMyMjIwNDczOVoXDTM0MDMyMjIwNDczOVowDzENMAsGA1UEAxMEbGVhZjBZMBMG
4-
ByqGSM49AgEGCCqGSM49AwEHA0IABNr99Dzn4PLhw3a9dP8YLwZaPnm3hpF3vt/5
5-
5rMc7N194IPRB+qCDQIKIsyFMQ937IA+ylxdYvwYPB30kw/nie+jMzAxMA4GA1Ud
6-
DwEB/wQEAwIGwDAfBgNVHSMEGDAWgBSgpcC8Rht4JttKz/d6pqb87A+f+zAKBggq
7-
hkjOPQQDAgNIADBFAiEAtuSOJ8LaCp6OrUIo8eKz7iYFEeOMI5d3aBEUSUp8y64C
8-
IHnTyu87fhXigrwrrhx0mEluHBfqeBpJilenwWjcUzYT
2+
MIIBPDCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI0
3+
MDgzMDE4NTczOFoXDTM0MDgzMDE4NTczOFowDzENMAsGA1UEAxMEbGVhZjBZMBMG
4+
ByqGSM49AgEGCCqGSM49AwEHA0IABAJCeHCU8sFwES7vmf4dAABk7HC2hclCwgAM
5+
CwPbdJAXRyA9wWFQhWM8osvic/LMq5m0AfVi4y1hjhFkrLjfbHejMzAxMA4GA1Ud
6+
DwEB/wQEAwIGwDAfBgNVHSMEGDAWgBRQn62BEmrPPx7tr1ZIcgrTbMrj8DAKBggq
7+
hkjOPQQDAgNHADBEAiAS77lBrjWbbYKGBJ/i5ag/Rmsml+oECQ/GMmxdEZ/MzAIg
8+
cjfmUGYXufT/lX2VXsvkFzfVQH1fG0g5i03NWSFYDB4=
99
-----END CERTIFICATE-----
1010
-----BEGIN CERTIFICATE-----
11-
MIIBSTCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI0
12-
MDMyMjIwNDczOVoXDTM0MDMyMjIwNDczOVowDTELMAkGA1UEAxMCY2EwWTATBgcq
13-
hkjOPQIBBggqhkjOPQMBBwNCAATpp0ZNVPLAIzjTPkYzluuwuJxo4kmCLQRmznmz
14-
9GE89huCeLhyLbgj6xLgLrlZPwEnlGRKdiba+pLxUzKVKTPAo0IwQDAOBgNVHQ8B
15-
Af8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUoKXAvEYbeCbbSs/3
16-
eqam/OwPn/swCgYIKoZIzj0EAwIDRwAwRAIgPpFwR+kjxrG75XPEQCiKPwF1Zg55
17-
FZVT7PlNJKyIPYACIFMMqZ4//ncJoBxMtvTsr3++2d91SPpyis2cLiDcr3kW
11+
MIIBSjCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI0
12+
MDgzMDE4NTczOFoXDTM0MDgzMDE4NTczOFowDTELMAkGA1UEAxMCY2EwWTATBgcq
13+
hkjOPQIBBggqhkjOPQMBBwNCAAR3h5jys9TUi2KTcvbxjCpkC+qoHcVikiWRdkp1
14+
WAMg1fJAQvqPX8kB8OSXc2v8pTBKmzMteEvZJW+9kkybobtKo0IwQDAOBgNVHQ8B
15+
Af8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUUJ+tgRJqzz8e7a9W
16+
SHIK02zK4/AwCgYIKoZIzj0EAwIDSAAwRQIgUVBM1Lkvf7DVjG6hygMVTK2cWkHD
17+
djL4MW8wCFaKV9YCIQC2DtPtWvu/VgaI0QGI+v7iGNnPf7USY0qlJwWWGvAaWw==
1818
-----END CERTIFICATE-----

‎pkg/reconciler/trustroot/testdata/marshalledEntry.json‎

Lines changed: 43 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -1,78 +1,78 @@
11
{
2-
"mediaType": "application/vnd.dev.sigstore.trustedroot+json;version=0.1",
3-
"tlogs": [
2+
"mediaType": "application/vnd.dev.sigstore.trustedroot+json;version=0.1",
3+
"tlogs": [
44
{
5-
"baseUrl": "https://rekor.example.com",
6-
"hashAlgorithm": "SHA2_256",
7-
"publicKey": {
8-
"rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Vobk4rjNzYrf/uqDwEd/HDfCro89r63DaHCTRYQJaf/JHdJj/nxBl1e3ZCo0B7kB/uU+e7d56A9gPdelFc51g==",
9-
"keyDetails": "PKIX_ECDSA_P256_SHA_256",
10-
"validFor": {
11-
"start": "1970-01-01T00:00:00Z"
5+
"baseUrl": "https://rekor.example.com",
6+
"hashAlgorithm": "SHA2_256",
7+
"publicKey": {
8+
"rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEoM/qB3YtDs6+rXvxfxZNXH0dfXY85qgGuiJJezpzXjCm6jbiUp15VpzNcdJGzExHNZYZj7l+ma1Fjer68+1+tA==",
9+
"keyDetails": "PKIX_ECDSA_P256_SHA_256",
10+
"validFor": {
11+
"start": "1970-01-01T00:00:00Z"
1212
}
1313
},
14-
"logId": {
15-
"keyId": "YWRjNTE1MWY5OTExZWUxZjAwMWVkYzc0Y2Q3MWNkNThmOGExMWE0ODRhOGM5NzA5NDkwYjRkOTY2NDcxZjQxMQ=="
14+
"logId": {
15+
"keyId": "Yzk5MjkxODU0M2MxNmIwZGY2Y2NkMGQ4ODE2NjVkNDljZGQxZWYzZjM4M2IxNmY5YzRkNjRiODhjZWRmZTAxMA=="
1616
}
1717
}
1818
],
19-
"certificateAuthorities": [
19+
"certificateAuthorities": [
2020
{
21-
"subject": {
22-
"organization": "fulcio-organization",
23-
"commonName": "fulcio-common-name"
21+
"subject": {
22+
"organization": "fulcio-organization",
23+
"commonName": "fulcio-common-name"
2424
},
25-
"uri": "https://fulcio.example.com",
26-
"certChain": {
27-
"certificates": [
25+
"uri": "https://fulcio.example.com",
26+
"certChain": {
27+
"certificates": [
2828
{
29-
"rawBytes": "MIIBPTCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI0MDMyMjIwNDczOVoXDTM0MDMyMjIwNDczOVowDzENMAsGA1UEAxMEbGVhZjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABNr99Dzn4PLhw3a9dP8YLwZaPnm3hpF3vt/55rMc7N194IPRB+qCDQIKIsyFMQ937IA+ylxdYvwYPB30kw/nie+jMzAxMA4GA1UdDwEB/wQEAwIGwDAfBgNVHSMEGDAWgBSgpcC8Rht4JttKz/d6pqb87A+f+zAKBggqhkjOPQQDAgNIADBFAiEAtuSOJ8LaCp6OrUIo8eKz7iYFEeOMI5d3aBEUSUp8y64CIHnTyu87fhXigrwrrhx0mEluHBfqeBpJilenwWjcUzYT"
29+
"rawBytes": "MIIBPDCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI0MDgzMDE4NTczOFoXDTM0MDgzMDE4NTczOFowDzENMAsGA1UEAxMEbGVhZjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABAJCeHCU8sFwES7vmf4dAABk7HC2hclCwgAMCwPbdJAXRyA9wWFQhWM8osvic/LMq5m0AfVi4y1hjhFkrLjfbHejMzAxMA4GA1UdDwEB/wQEAwIGwDAfBgNVHSMEGDAWgBRQn62BEmrPPx7tr1ZIcgrTbMrj8DAKBggqhkjOPQQDAgNHADBEAiAS77lBrjWbbYKGBJ/i5ag/Rmsml+oECQ/GMmxdEZ/MzAIgcjfmUGYXufT/lX2VXsvkFzfVQH1fG0g5i03NWSFYDB4="
3030
},
3131
{
32-
"rawBytes": "MIIBSTCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI0MDMyMjIwNDczOVoXDTM0MDMyMjIwNDczOVowDTELMAkGA1UEAxMCY2EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATpp0ZNVPLAIzjTPkYzluuwuJxo4kmCLQRmznmz9GE89huCeLhyLbgj6xLgLrlZPwEnlGRKdiba+pLxUzKVKTPAo0IwQDAOBgNVHQ8BAf8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUoKXAvEYbeCbbSs/3eqam/OwPn/swCgYIKoZIzj0EAwIDRwAwRAIgPpFwR+kjxrG75XPEQCiKPwF1Zg55FZVT7PlNJKyIPYACIFMMqZ4//ncJoBxMtvTsr3++2d91SPpyis2cLiDcr3kW"
32+
"rawBytes": "MIIBSjCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI0MDgzMDE4NTczOFoXDTM0MDgzMDE4NTczOFowDTELMAkGA1UEAxMCY2EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAR3h5jys9TUi2KTcvbxjCpkC+qoHcVikiWRdkp1WAMg1fJAQvqPX8kB8OSXc2v8pTBKmzMteEvZJW+9kkybobtKo0IwQDAOBgNVHQ8BAf8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUUJ+tgRJqzz8e7a9WSHIK02zK4/AwCgYIKoZIzj0EAwIDSAAwRQIgUVBM1Lkvf7DVjG6hygMVTK2cWkHDdjL4MW8wCFaKV9YCIQC2DtPtWvu/VgaI0QGI+v7iGNnPf7USY0qlJwWWGvAaWw=="
3333
}
3434
]
3535
},
36-
"validFor": {
37-
"start": "1970-01-01T00:00:00Z"
36+
"validFor": {
37+
"start": "1970-01-01T00:00:00Z"
3838
}
3939
}
4040
],
41-
"ctlogs": [
41+
"ctlogs": [
4242
{
43-
"baseUrl": "https://ctfe.example.com",
44-
"hashAlgorithm": "SHA2_256",
45-
"publicKey": {
46-
"rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEBQY7A479x/VleGrvxp1gQAykOZMjld4J6VWVLnN0WLiqOesr9QkSBVnBkYKw0pr6Bgr8Qjg6NA3x470DLPxrDQ==",
47-
"keyDetails": "PKIX_ECDSA_P256_SHA_256",
48-
"validFor": {
49-
"start": "1970-01-01T00:00:00Z"
43+
"baseUrl": "https://ctfe.example.com",
44+
"hashAlgorithm": "SHA2_256",
45+
"publicKey": {
46+
"rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEklvaOetNsPoZt+BHsE0bbHybxHskImD/Swu8QyDZONn2hnJNxEImaz6Xzv7+/bzns9y0/b9NadWbeDht3KGBBg==",
47+
"keyDetails": "PKIX_ECDSA_P256_SHA_256",
48+
"validFor": {
49+
"start": "1970-01-01T00:00:00Z"
5050
}
5151
},
52-
"logId": {
53-
"keyId": "MTcxMGUyM2RhMDY1MWFhYTgxOTRiYzk2NTJjZDAwYTk3YzFmZGE5Yzc2ZmNlMTJmMTRlYjYzNWU0MjAzNjk1NA=="
52+
"logId": {
53+
"keyId": "ZGY4ZGM0ZjQzNWE2M2U4Y2Q0OGQyNTU3YzNjMjI4ZTk1NThlMDRkY2E4OTlmYWI1NjEyYTZkNjBkNTE1ZThmMA=="
5454
}
5555
}
5656
],
57-
"timestampAuthorities": [
57+
"timestampAuthorities": [
5858
{
59-
"subject": {
60-
"organization": "tsa-organization",
61-
"commonName": "tsa-common-name"
59+
"subject": {
60+
"organization": "tsa-organization",
61+
"commonName": "tsa-common-name"
6262
},
63-
"uri": "https://tsa.example.com",
64-
"certChain": {
65-
"certificates": [
63+
"uri": "https://tsa.example.com",
64+
"certChain": {
65+
"certificates": [
6666
{
67-
"rawBytes": "MIIBPTCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI0MDMyMjIwNDczOVoXDTM0MDMyMjIwNDczOVowDzENMAsGA1UEAxMEbGVhZjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABDgjsTzgbEsFFuBFCp1LIRv4SwYLCLL1fxtq95tbtGj/wHQUmrKLxMLMxaxIzdJs54lIDP+LoKeK25+HBPftwtCjMzAxMA4GA1UdDwEB/wQEAwIEEDAfBgNVHSMEGDAWgBRRiPL3dEhG22Qh+0GTFJ/G1SW1yDAKBggqhkjOPQQDAgNIADBFAiABNvVUla7gqF/135UkA55FQ57M6r84IArwk43Zy2aPPgIhAO8/F8k9VB5+I1FSiQL1qsM8yO6SUpVF9E+hNJ9n/6zU"
67+
"rawBytes": "MIIBPTCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI0MDgzMDE4NTczOFoXDTM0MDgzMDE4NTczOFowDzENMAsGA1UEAxMEbGVhZjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABFRMP78f6+Bm7cYAIcANQphYMj0YJHD620uGHPNck0Ei1IKqDCRPCGQDAHprk3y/sBIcLPZU8Hxig5xV0w28qAKjMzAxMA4GA1UdDwEB/wQEAwIEEDAfBgNVHSMEGDAWgBRB+eA8vn2NROBb/iTfLHyr/c1BmDAKBggqhkjOPQQDAgNIADBFAiEA7r8SEfLto3dQDZIqf/0qQy5+q8hiRNbZ3R4JPxPJtugCIFfiAfFrpzUYp6XuJSuOHfgFP2378zn2jl9kUoQYCjNs"
6868
},
6969
{
70-
"rawBytes": "MIIBSzCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI0MDMyMjIwNDczOVoXDTM0MDMyMjIwNDczOVowDTELMAkGA1UEAxMCY2EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARjUhxtm6QXaB2bkGKHenCToVRPhVf0PTkuS7/hTGjHhELoMrD8r3nbqyceFEl4FUTzEMDfrj/YhefX7ZbeesSho0IwQDAOBgNVHQ8BAf8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUUYjy93RIRttkIftBkxSfxtUltcgwCgYIKoZIzj0EAwIDSQAwRgIhAJgRO/ig4ZBrlYjuNYpC/kqUIVsfSKLpS9c4/lkcTGBPAiEAq+euZ8zkevab16uWx7ZaEcElKYY3xzhTr5yQYeJPOcQ="
70+
"rawBytes": "MIIBSjCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI0MDgzMDE4NTczOFoXDTM0MDgzMDE4NTczOFowDTELMAkGA1UEAxMCY2EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASrdvjuuS7ZO/piTX2pxT56yBKhwq+SHeXt8MsaNYPBG84m5G/3m3uLB5YxCRq4o6vhKM0HEU4UcQ3LdKL92Axao0IwQDAOBgNVHQ8BAf8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUQfngPL59jUTgW/4k3yx8q/3NQZgwCgYIKoZIzj0EAwIDSAAwRQIgXeSyRZXqJZPSba7S56k9fce1xLppSN4m9MtfTw7MdpoCIQD3L40eRQUu2YV+74MWm1nGbma5IVfp9tgZxaAw80brWg=="
7171
}
7272
]
7373
},
74-
"validFor": {
75-
"start": "1970-01-01T00:00:00Z"
74+
"validFor": {
75+
"start": "1970-01-01T00:00:00Z"
7676
}
7777
}
7878
]

0 commit comments

Comments
 (0)