@blamejs/pki 0.7.24 → 0.7.26

package/lib/lint.js

@@ -5,15 +5,16 @@
  * @module pki.lint
  * @nav        Tooling
  * @title      Lint
- * @fullname   Certificate and revocation-list linting against RFC 5280 and CA/Browser Forum
- *             requirements
+ * @fullname   Certificate, revocation-list and OCSP-response linting against RFC 5280, RFC 6960
+ *             and CA/Browser Forum requirements
  * @intro The LINTING engine, the zlint / pkilint of JavaScript. It walks an ALREADY-PARSED
- *   certificate or certificate revocation list (from `pki.schema.x509.parse` or
- *   `pki.schema.crl.parse`, whose extension values it decodes with the shared RFC 5280
- *   decoders) and emits graded, advisory FINDINGS: each with a stable id, a severity
- *   (`fatal` > `error` > `warn` > `notice` > `pass`), a source, a spec-clause citation, and
- *   a human message. It ships the RFC 5280 certificate profile, the RFC 5280 section 5
- *   revocation-list profile, the post-quantum certificate profiles for ML-KEM, ML-DSA and
+ *   certificate, certificate revocation list or OCSP response (from `pki.schema.x509.parse`,
+ *   `pki.schema.crl.parse` or `pki.schema.ocsp.parseResponse`, whose extension values it
+ *   decodes with the shared RFC 5280 decoders) and emits graded, advisory FINDINGS: each with
+ *   a stable id, a severity (`fatal` > `error` > `warn` > `notice` > `pass`), a source, a
+ *   spec-clause citation, and a human message. It ships the RFC 5280 certificate profile, the
+ *   RFC 5280 section 5 revocation-list profile, the RFC 6960 OCSP response profile with the
+ *   RFC 5019 lightweight rows, the post-quantum certificate profiles for ML-KEM, ML-DSA and
  *   SLH-DSA, and a representative CA/Browser Forum TLS Baseline Requirements subset.
  *
  *   Unlike every other toolkit entry, the lint data path never throws. A linter surveys a
@@ -23,8 +24,8 @@
  *   unknown profile, an out-of-range severity threshold, or a wrong-type input), which
  *   raises a typed `LintError`. This deliberate inversion of the toolkit's fail-closed-throw
  *   posture is what lets an operator lint a whole directory without a try/catch per file.
- * @spec RFC 5280, RFC 9881, RFC 9909, RFC 9935, CA/Browser Forum TLS Baseline Requirements
- * @card Lint a certificate or CRL against RFC 5280 + CABF TLS BR, in pure JS.
+ * @spec RFC 5280, RFC 6960, RFC 5019, RFC 9654, RFC 9881, RFC 9909, RFC 9935, CA/Browser Forum TLS Baseline Requirements
+ * @card Lint a certificate, CRL or OCSP response against RFC 5280, RFC 6960 + CABF TLS BR, in pure JS.
  */
 
 var frameworkError = require("./framework-error");
@@ -33,6 +34,7 @@ var guard = require("./guard-all");
 var oid = require("./oid");
 var x509 = require("./schema-x509");
 var crlSchema = require("./schema-crl");
+var ocspSchema = require("./schema-ocsp");
 var pkix = require("./schema-pkix");
 var schema = require("./schema-engine");
 var path = require("./path-validate");
@@ -261,6 +263,13 @@ function _criticalityRule(name, id, severity, citation, message) {
 }
 
 var RFC5280_RULES = [
+  {
+    id: "lint/rfc5280/signature-empty", severity: "error", source: "rfc5280", citation: "RFC 5280 4.1.1.3",
+    /** @internal The strict parser admits an empty BIT STRING, since one is well-formed DER; a
+     * signatureValue that contains no signature is not the field section 4.1.1.3 defines. */
+    message: "the signatureValue contains no signature",
+    check: function (cert) { return cert.signatureValue.bytes.length === 0 ? true : null; },
+  },
   {
     id: "lint/rfc5280/serial-not-positive", severity: "error", source: "rfc5280", citation: "RFC 5280 4.1.2.2",
     message: "the certificate serialNumber must be a positive integer",
@@ -832,6 +841,11 @@ function _criticalityRows(list, table, what) {
  * and a present-but-empty revokedCertificates (sec. 5.1.2.6, `crl/bad-revoked-certificates`). Each
  * reaches a caller as the engine's fatal lint/unparseable carrying that code. */
 var RFC5280_CRL_RULES = [
+  {
+    id: "lint/rfc5280-crl/signature-empty", severity: "error", source: "rfc5280-crl", citation: "RFC 5280 5.1.1.3",
+    message: "the signatureValue contains no signature",
+    check: function (crl) { return crl.signatureValue.bytes.length === 0 ? true : null; },
+  },
   {
     id: "lint/rfc5280-crl/next-update-missing", severity: "error", source: "rfc5280-crl", citation: "RFC 5280 5.1.2.5",
     message: "a conforming CRL issuer includes the nextUpdate field in every CRL",
@@ -1281,6 +1295,398 @@ var RFC5280_CRL_RULES = [
 var CRL_PROFILES = Object.assign(Object.create(null), { "rfc5280-crl": RFC5280_CRL_RULES });
 var ALL_CRL_RULES = RFC5280_CRL_RULES;
 
+
+/** @internal The extensions RFC 6960 and RFC 9654 place on a response, by the list each belongs
+ * in. The nonce and the extended revoked definition are response extensions; the archive cutoff and
+ * the CRL references are single extensions, and sec. 4.4.5 carries every RFC 5280 sec. 5.3 CRL
+ * entry extension into a SingleResponse as well. Three more are defined for REQUESTS only. */
+var OCSP_RESPONSE_KNOWN = Object.create(null);
+["ocspNonce", "ocspExtendedRevoke"].forEach(function (n) { OCSP_RESPONSE_KNOWN[oid.byName(n)] = true; });
+var OCSP_SINGLE_KNOWN = Object.create(null);
+["ocspArchiveCutoff", "ocspCrl", "reasonCode", "invalidityDate", "certificateIssuer"]
+  .forEach(function (n) { OCSP_SINGLE_KNOWN[oid.byName(n)] = true; });
+var OCSP_REQUEST_ONLY = Object.create(null);
+[["ocspResponse", "RFC 6960 4.4.3"], ["ocspServiceLocator", "RFC 6960 4.4.6"], ["ocspPrefSigAlgs", "RFC 6960 4.4.7"]]
+  .forEach(function (r) { OCSP_REQUEST_ONLY[oid.byName(r[0])] = r[1]; });
+/** @internal Only the criticality a clause states. Sec. 4.4.8 forbids a critical extended revoked
+ * definition; sec. 4.4.5 carries the RFC 5280 sec. 5.3 rules for the three entry extensions. RFC
+ * 6960 states nothing about the criticality of the nonce, the archive cutoff or the CRL references,
+ * so they are absent here. */
+var OCSP_RESPONSE_CRITICALITY = Object.create(null);
+OCSP_RESPONSE_CRITICALITY[oid.byName("ocspExtendedRevoke")] = false;
+var OCSP_SINGLE_CRITICALITY = CRL_ENTRY_CRITICALITY;
+
+var OID_OCSP_NONCE = oid.byName("ocspNonce");
+var OID_OCSP_EXTENDED_REVOKE = oid.byName("ocspExtendedRevoke");
+var OID_OCSP_ARCHIVE_CUTOFF = oid.byName("ocspArchiveCutoff");
+var OID_OCSP_CRL = oid.byName("ocspCrl");
+var OID_REASON_CODE = oid.byName("reasonCode");
+
+/** @internal How each single extension the OCSP parser leaves opaque is read: reasonCode and
+ * invalidityDate through the CRL parser's own entry-extension reader, so the linter and the CRL
+ * parser cannot disagree about what a well-formed one is, and certificateIssuer through the shared
+ * GeneralNames walk the CRL rows use. The parser decodes the nonce, the archive cutoff and the CRL
+ * references itself and refuses a malformed one, so an entry for any of those would be dead. */
+var OCSP_SINGLE_VALUE_READER = Object.create(null);
+OCSP_SINGLE_VALUE_READER[OID_REASON_CODE] = function (bytes) {
+  crlSchema.decodeExtension({ oid: OID_REASON_CODE, name: "reasonCode", critical: false, value: bytes });
+};
+OCSP_SINGLE_VALUE_READER[oid.byName("invalidityDate")] = function (bytes) {
+  crlSchema.decodeExtension({ oid: oid.byName("invalidityDate"), name: "invalidityDate", critical: false, value: bytes });
+};
+OCSP_SINGLE_VALUE_READER[oid.byName("certificateIssuer")] = CRL_ENTRY_VALUE_READER[oid.byName("certificateIssuer")];
+var OCSP_RESPONSE_VALUE_READER = Object.create(null);
+/** @internal Read through the codec's NULL reader, which refuses content octets as well as a wrong
+ * tag; the decoder alone frames `05 01 00` as a NULL carrying one octet. */
+OCSP_RESPONSE_VALUE_READER[OID_OCSP_EXTENDED_REVOKE] = function (bytes) {
+  asn1.read.nullValue(asn1.decode(bytes));
+};
+
+function _ocspBasic(resp) { return resp.basicResponse; }
+/** @internal The parser refuses an empty `responses`, so the list is never empty here. */
+function _ocspResponses(resp) { return _ocspBasic(resp).responses; }
+function _ocspResponseExts(resp) { return _ocspBasic(resp).responseExtensions || []; }
+function _ocspSingleExts(sr) { return sr.singleExtensions || []; }
+function _extIn(list, dotted) {
+  for (var i = 0; i < list.length; i++) { if (list[i].oid === dotted) return list[i]; }
+  return null;
+}
+/** @internal The revocation reason a single extension carries, read with the CRL parser's reader,
+ * or null when the extension is absent or does not read (the value-syntax row reports that). */
+function _singleReasonCode(sr) {
+  var e = _extIn(_ocspSingleExts(sr), OID_REASON_CODE);
+  if (!e || !Buffer.isBuffer(e.value)) return null;
+  // allow:swallow-unverified a value the CRL reader refuses carries no reason; the value-syntax row reports it
+  try { return crlSchema.decodeExtension(e).value; }
+  catch (_e) { return null; }
+}
+/** @internal RFC 6960 sec. 2.2 gives a "revoked" answer for a non-issued certificate a fixed shape:
+ * the reason certificateHold and the revocation time January 1, 1970. That shape is how a response
+ * says it is answering for a certificate that was never issued, and the rows that hold such an
+ * answer to the rest of sec. 2.2 recognize it by exactly those two values. */
+function _isNonIssuedShape(sr) {
+  var st = sr.certStatus;
+  return !!st && st.type === "revoked" && st.revocationReason === "certificateHold" &&
+    guard.time.isDate(st.revocationTime) && guard.time.instantOf(st.revocationTime) === 0;
+}
+/** @internal The rows in one list that carry a per-response index, so a finding names which
+ * SingleResponse it is about the way the CRL entry rows name their entry. */
+function _perResponse(resp, fn) {
+  var rows = [];
+  _ocspResponses(resp).forEach(function (sr, i) {
+    var out = fn(sr, i);
+    if (out == null) return;
+    (Array.isArray(out) ? out : [out]).forEach(function (row) { row.context.response = i; rows.push(row); });
+  });
+  return rows.length ? rows : null;
+}
+/** @internal A CertID as one lookup key, every field included, so two SingleResponses name the same
+ * certificate under the same hash exactly when their keys match. Keyed rather than compared
+ * pairwise: a response lists as many SingleResponses as its author chooses, and this verb exists to
+ * survey ones that arrived from elsewhere, so a pairwise scan would be quadratic in that choice. */
+function _certIdKey(c) {
+  return c.hashAlgorithm.algorithm + "|" + c.issuerNameHash.toString("hex") + "|" + c.issuerKeyHash.toString("hex") + "|" + c.serialNumberHex;
+}
+function _statusKey(st) {
+  return st.type + (st.type === "revoked" ? ":" + guard.time.instantOf(st.revocationTime) + ":" + (st.revocationReason || "") : "");
+}
+/** @internal The placement rows share one shape: an extension found in the list the specification
+ * does not define it for. `where` names the list it was found in; `context.placed` says where the
+ * specification puts it. */
+function _placementRow(name, placed, where) {
+  return { context: { extension: name, placed: placed, was: where } };
+}
+
+/** @internal Four sec. 4.2 rules have no row because the strict parser refuses them first and a rule
+ * for them would be dead: a version other than v1 (sec. 4.2.2.3, `ocsp/bad-version`), an undefined
+ * CRLReason value (`ocsp/bad-revocation-reason`), an empty extension list (`ocsp/bad-extensions`)
+ * and a repeated extension (`ocsp/duplicate-extension`); so are an empty `responses`
+ * (`ocsp/bad-responses`), a nonce outside 1..128 octets (`ocsp/bad-nonce`), a malformed archive
+ * cutoff or CrlID, a responseStatus that disagrees with responseBytes, and every time-format rule of
+ * RFC 5019 sec. 2.2.4, which the DER codec enforces. Each reaches a caller as the engine's fatal
+ * lint/unparseable carrying that code. */
+var RFC6960_OCSP_RULES = [
+  {
+    id: "lint/rfc6960/signature-empty", severity: "error", source: "rfc6960", citation: "RFC 6960 2.2",
+    message: "a definitive response shall be digitally signed; the signature BIT STRING is empty",
+    check: function (resp) { return _ocspBasic(resp).signature.length === 0 ? true : null; },
+  },
+  {
+    id: "lint/rfc6960/update-times-inverted", severity: "error", source: "rfc6960", citation: "RFC 6960 2.4 / 4.2.2.1",
+    /** @internal Sec. 4.2.2.1 defines the two as a validity interval and says it corresponds to the
+     * CRL's, whose inversion the CRL profile grades the same way; an interval whose end precedes
+     * its start is a fault of definition, like an extension on the wrong list, rather than a
+     * reading, and pki.ocsp.sign refuses to write one. */
+    message: "a SingleResponse's thisUpdate must not follow its nextUpdate",
+    check: function (resp) {
+      return _perResponse(resp, function (sr) {
+        // allow:nan-date-comparison-unguarded -- both are codec-parsed OCSP times (asn1 readTime rejects a NaN instant).
+        if (sr.nextUpdate === null) return null;
+        return guard.time.instantOf(sr.thisUpdate) > guard.time.instantOf(sr.nextUpdate) ? { context: {} } : null;
+      });
+    },
+  },
+  {
+    id: "lint/rfc6960/produced-before-this-update", severity: "notice", source: "rfc6960", citation: "RFC 6960 2.4 / 2.5",
+    /** @internal producedAt is the time the responder signed, thisUpdate the most recent time the
+     * status was known to be correct; a response signed before that time certifies status it did
+     * not yet know. No clause forbids it, so this is advisory. */
+    message: "producedAt is earlier than a SingleResponse's thisUpdate, so the response was signed before the status it certifies was known",
+    check: function (resp) {
+      var produced = _ocspBasic(resp).producedAt;
+      return _perResponse(resp, function (sr) {
+        // allow:nan-date-comparison-unguarded -- both are codec-parsed OCSP times (asn1 readTime rejects a NaN instant).
+        return guard.time.instantOf(produced) < guard.time.instantOf(sr.thisUpdate) ? { context: {} } : null;
+      });
+    },
+  },
+  {
+    id: "lint/rfc6960/certs-present-but-empty", severity: "warn", source: "rfc6960", citation: "RFC 6960 4.2.1",
+    message: "certs should be absent when no certificates are included",
+    check: function (resp) { var bs = _ocspBasic(resp); return bs.certsPresent === true && bs.certs.length === 0 ? true : null; },
+  },
+  {
+    id: "lint/rfc6960/response-extension-criticality", severity: "error", source: "rfc6960", citation: "RFC 6960 4.4.8",
+    message: "a response extension is marked with a criticality the profile does not allow",
+    check: function (resp) {
+      var rows = _criticalityRows(_ocspResponseExts(resp), OCSP_RESPONSE_CRITICALITY, "responseExtensions");
+      return rows.length ? rows : null;
+    },
+  },
+  {
+    id: "lint/rfc6960/single-extension-criticality", severity: "error", source: "rfc6960", citation: "RFC 6960 4.4.5 / RFC 5280 5.3.1 / 5.3.2 / 5.3.3",
+    message: "a single extension is marked with a criticality the profile does not allow",
+    check: function (resp) {
+      return _perResponse(resp, function (sr) { return _criticalityRows(_ocspSingleExts(sr), OCSP_SINGLE_CRITICALITY, "singleExtensions"); });
+    },
+  },
+  {
+    id: "lint/rfc6960/extended-revoke-value-not-null", severity: "error", source: "rfc6960", citation: "RFC 6960 4.4.8",
+    message: "the value of the extended revoked definition extension shall be NULL",
+    check: function (resp) {
+      var e = _extIn(_ocspResponseExts(resp), OID_OCSP_EXTENDED_REVOKE);
+      return e && _valueSyntaxFault(e, OCSP_RESPONSE_KNOWN, OCSP_RESPONSE_VALUE_READER) !== null ? true : null;
+    },
+  },
+  {
+    id: "lint/rfc6960/extended-revoke-in-single-extensions", severity: "error", source: "rfc6960", citation: "RFC 6960 4.4.8",
+    message: "the extended revoked definition extension must be placed in responseExtensions and must not appear in singleExtensions",
+    check: function (resp) {
+      return _perResponse(resp, function (sr) {
+        return _extIn(_ocspSingleExts(sr), OID_OCSP_EXTENDED_REVOKE) ? _placementRow("ocspExtendedRevoke", "responseExtensions", "singleExtensions") : null;
+      });
+    },
+  },
+  {
+    id: "lint/rfc6960/non-issued-without-extended-revoke", severity: "error", source: "rfc6960", citation: "RFC 6960 2.2",
+    message: "a revoked answer for a non-issued certificate (certificateHold at January 1, 1970) must be accompanied by the extended revoked definition response extension",
+    check: function (resp) {
+      if (_extIn(_ocspResponseExts(resp), OID_OCSP_EXTENDED_REVOKE)) return null;
+      return _perResponse(resp, function (sr) { return _isNonIssuedShape(sr) ? { context: {} } : null; });
+    },
+  },
+  {
+    id: "lint/rfc6960/non-issued-with-crl-extensions", severity: "error", source: "rfc6960", citation: "RFC 6960 2.2",
+    message: "a revoked answer for a non-issued certificate must not include a CRL references extension or any CRL entry extension",
+    check: function (resp) {
+      return _perResponse(resp, function (sr) {
+        if (!_isNonIssuedShape(sr)) return null;
+        var rows = [];
+        _ocspSingleExts(sr).forEach(function (e) {
+          if (e.oid === OID_OCSP_CRL || CRL_ENTRY_CRITICALITY[e.oid] !== undefined) rows.push({ context: { extension: e.name } });
+        });
+        return rows.length ? rows : null;
+      });
+    },
+  },
+  {
+    id: "lint/rfc6960/archive-cutoff-in-response-extensions", severity: "error", source: "rfc6960", citation: "RFC 6960 4.4.4",
+    message: "an archive cutoff shall be provided as a singleExtensions extension",
+    check: function (resp) {
+      return _extIn(_ocspResponseExts(resp), OID_OCSP_ARCHIVE_CUTOFF) ? _placementRow("ocspArchiveCutoff", "singleExtensions", "responseExtensions") : null;
+    },
+  },
+  {
+    id: "lint/rfc6960/crl-references-in-response-extensions", severity: "error", source: "rfc6960", citation: "RFC 6960 4.4.2",
+    message: "the CRL references extension is specified as a singleExtensions extension",
+    check: function (resp) {
+      return _extIn(_ocspResponseExts(resp), OID_OCSP_CRL) ? _placementRow("ocspCrl", "singleExtensions", "responseExtensions") : null;
+    },
+  },
+  {
+    id: "lint/rfc6960/nonce-in-single-extensions", severity: "error", source: "rfc6960", citation: "RFC 9654 2.1",
+    message: "in a response the nonce is included as one of the responseExtensions",
+    check: function (resp) {
+      return _perResponse(resp, function (sr) {
+        return _extIn(_ocspSingleExts(sr), OID_OCSP_NONCE) ? _placementRow("ocspNonce", "responseExtensions", "singleExtensions") : null;
+      });
+    },
+  },
+  {
+    id: "lint/rfc6960/request-extension-in-response", severity: "error", source: "rfc6960", citation: "RFC 6960 4.4.3 / 4.4.6 / 4.4.7",
+    message: "an extension defined for OCSP requests only is carried on a response",
+    check: function (resp) {
+      var rows = [];
+      _ocspResponseExts(resp).forEach(function (e) {
+        if (OCSP_REQUEST_ONLY[e.oid] !== undefined) rows.push({ context: { extension: e.name, defined: OCSP_REQUEST_ONLY[e.oid], was: "responseExtensions" } });
+      });
+      var per = _perResponse(resp, function (sr) {
+        var out = [];
+        _ocspSingleExts(sr).forEach(function (e) {
+          if (OCSP_REQUEST_ONLY[e.oid] !== undefined) out.push({ context: { extension: e.name, defined: OCSP_REQUEST_ONLY[e.oid], was: "singleExtensions" } });
+        });
+        return out.length ? out : null;
+      });
+      if (per) per.forEach(function (row) { rows.push(row); });
+      return rows.length ? rows : null;
+    },
+  },
+  {
+    id: "lint/rfc6960/archive-cutoff-after-produced-at", severity: "notice", source: "rfc6960", citation: "RFC 6960 4.4.4",
+    /** @internal The archive cutoff is defined as producedAt minus the responder's retention
+     * interval, so a cutoff after producedAt states a negative interval. Stated by definition
+     * rather than as a requirement, so advisory. */
+    message: "an archive cutoff later than producedAt implies a negative retention interval",
+    check: function (resp) {
+      var produced = _ocspBasic(resp).producedAt;
+      return _perResponse(resp, function (sr) {
+        var e = _extIn(_ocspSingleExts(sr), OID_OCSP_ARCHIVE_CUTOFF);
+        // allow:nan-date-comparison-unguarded -- both are codec-parsed OCSP times (the parser refuses an archive cutoff that is not a GeneralizedTime).
+        if (!e) return null;
+        return guard.time.instantOf(e.archiveCutoff) > guard.time.instantOf(produced) ? { context: {} } : null;
+      });
+    },
+  },
+  {
+    id: "lint/rfc6960/extension-value-syntax", severity: "error", source: "rfc6960", citation: "RFC 6960 4.4.5 / 4.4.8",
+    message: "a recognized extension's value does not decode as the structure its identifier names",
+    check: function (resp) {
+      var rows = [];
+      _ocspResponseExts(resp).forEach(function (e) {
+        var why = _valueSyntaxFault(e, OCSP_RESPONSE_KNOWN, OCSP_RESPONSE_VALUE_READER);
+        if (why !== null) rows.push({ context: { extension: e.name, scope: "responseExtensions", problem: why } });
+      });
+      var per = _perResponse(resp, function (sr) {
+        var out = [];
+        _ocspSingleExts(sr).forEach(function (e) {
+          var why = _valueSyntaxFault(e, OCSP_SINGLE_KNOWN, OCSP_SINGLE_VALUE_READER);
+          if (why !== null) out.push({ context: { extension: e.name, scope: "singleExtensions", problem: why } });
+        });
+        return out.length ? out : null;
+      });
+      if (per) per.forEach(function (row) { rows.push(row); });
+      return rows.length ? rows : null;
+    },
+  },
+  {
+    id: "lint/rfc6960/unknown-critical-extension", severity: "error", source: "rfc6960", citation: "RFC 6960 4.4 / RFC 5019 2.2.1",
+    /** @internal RFC 6960 adopts the RFC 5280 extension model, under which a consumer that cannot
+     * process a critical extension must not use the structure, and RFC 5019 lets a client ignore
+     * only an unrecognized NON-critical response extension. The recognized set is the one this
+     * profile reads, per list. */
+    message: "a critical extension the profile does not recognize is present",
+    check: function (resp) {
+      var rows = [];
+      _ocspResponseExts(resp).forEach(function (e) {
+        if (e.critical === true && OCSP_RESPONSE_KNOWN[e.oid] === undefined) rows.push({ context: { extension: e.name || e.oid, scope: "responseExtensions" } });
+      });
+      var per = _perResponse(resp, function (sr) {
+        var out = [];
+        _ocspSingleExts(sr).forEach(function (e) {
+          if (e.critical === true && OCSP_SINGLE_KNOWN[e.oid] === undefined) out.push({ context: { extension: e.name || e.oid, scope: "singleExtensions" } });
+        });
+        return out.length ? out : null;
+      });
+      if (per) per.forEach(function (row) { rows.push(row); });
+      return rows.length ? rows : null;
+    },
+  },
+  /** @internal The two reason rules each have two carriers graded apart. The reasonCode single
+   * extension IS the RFC 5280 sec. 5.3.1 extension, carried into a SingleResponse by sec. 4.4.5, so
+   * its rows grade at that clause's strength. RevokedInfo's own revocationReason is a separate field
+   * of the same CRLReason type, and the clause is applied to it by reading, so its rows are advisory. */
+  {
+    id: "lint/rfc6960/reason-code-unspecified", severity: "warn", source: "rfc6960", citation: "RFC 6960 4.4.5 / RFC 5280 5.3.1",
+    message: "a reasonCode single extension of unspecified(0) should be absent instead",
+    check: function (resp) { return _perResponse(resp, function (sr) { return _singleReasonCode(sr) === 0 ? { context: {} } : null; }); },
+  },
+  {
+    id: "lint/rfc6960/remove-from-crl-reason", severity: "error", source: "rfc6960", citation: "RFC 6960 4.4.5 / RFC 5280 5.3.1",
+    message: "a reasonCode of removeFromCRL may only appear in a delta CRL; a status response is not one",
+    check: function (resp) { return _perResponse(resp, function (sr) { return _singleReasonCode(sr) === 8 ? { context: {} } : null; }); },
+  },
+  {
+    id: "lint/rfc6960/revocation-reason-unspecified", severity: "notice", source: "rfc6960", citation: "RFC 6960 4.2.1 / RFC 5280 5.3.1",
+    message: "a revocationReason of unspecified(0) states no reason; the reasonCode extension it mirrors should be absent instead",
+    check: function (resp) {
+      return _perResponse(resp, function (sr) {
+        return sr.certStatus.type === "revoked" && sr.certStatus.revocationReason === "unspecified" ? { context: {} } : null;
+      });
+    },
+  },
+  {
+    id: "lint/rfc6960/revocation-reason-remove-from-crl", severity: "notice", source: "rfc6960", citation: "RFC 6960 4.2.1 / RFC 5280 5.3.1",
+    message: "a revocationReason of removeFromCRL names a delta-CRL action, which a status response cannot state",
+    check: function (resp) {
+      return _perResponse(resp, function (sr) {
+        return sr.certStatus.type === "revoked" && sr.certStatus.revocationReason === "removeFromCRL" ? { context: {} } : null;
+      });
+    },
+  },
+  {
+    id: "lint/rfc6960/duplicate-cert-id", severity: "notice", source: "rfc6960", citation: "RFC 6960 4.2.2.3",
+    /** @internal A response carries a SingleResponse per certificate. Two for the same CertID
+     * answer one certificate twice, and when the two statuses differ a relying party cannot tell
+     * which governs; the context says which case it is. No clause forbids the repeat, so advisory. */
+    message: "two SingleResponses answer for the same CertID",
+    check: function (resp) {
+      var rows = [], first = Object.create(null);
+      _ocspResponses(resp).forEach(function (sr, i) {
+        var key = _certIdKey(sr.certID), seen = first[key];
+        if (seen === undefined) { first[key] = { index: i, status: _statusKey(sr.certStatus) }; return; }
+        rows.push({ context: { response: i, first: seen.index, conflicting: seen.status !== _statusKey(sr.certStatus) } });
+      });
+      return rows.length ? rows : null;
+    },
+  },
+];
+
+/** @internal Nothing in a response says which profile its responder follows, so the RFC 5019 rows
+ * run only when that profile is selected and count as not applicable otherwise. */
+function _isLightweight(resp, ctx) { return ctx.profile === "rfc5019"; }
+
+var RFC5019_OCSP_RULES = [
+  {
+    id: "lint/rfc5019/next-update-missing", severity: "error", source: "rfc5019", citation: "RFC 5019 2.2.4",
+    message: "a lightweight-profile responder must always include nextUpdate",
+    appliesTo: _isLightweight,
+    check: function (resp) { return _perResponse(resp, function (sr) { return sr.nextUpdate == null ? { context: {} } : null; }); },
+  },
+  {
+    id: "lint/rfc5019/multiple-single-responses", severity: "warn", source: "rfc5019", citation: "RFC 5019 2.2.1",
+    message: "a lightweight-profile response should include only one SingleResponse",
+    appliesTo: _isLightweight,
+    check: function (resp) { var n = _ocspResponses(resp).length; return n > 1 ? { context: { responses: n } } : null; },
+  },
+  {
+    id: "lint/rfc5019/response-extensions-present", severity: "warn", source: "rfc5019", citation: "RFC 5019 2.2.1",
+    message: "a lightweight-profile responder should not include responseExtensions",
+    appliesTo: _isLightweight,
+    check: function (resp) { return _ocspBasic(resp).responseExtensions ? true : null; },
+  },
+  {
+    id: "lint/rfc5019/responder-id-by-name", severity: "notice", source: "rfc5019", citation: "RFC 5019 2.2.2",
+    /** @internal A SHOULD conditioned on bandwidth being at issue, which the response cannot show,
+     * so it grades as advisory rather than as the warning an unconditional SHOULD would draw. */
+    message: "a lightweight-profile responder should use the byKey ResponderID where reducing bandwidth matters",
+    appliesTo: _isLightweight,
+    check: function (resp) { var rid = _ocspBasic(resp).responderID; return rid && rid.byName !== undefined ? true : null; },
+  },
+];
+
+var OCSP_PROFILES = Object.assign(Object.create(null), { "rfc6960": RFC6960_OCSP_RULES, "rfc5019": RFC5019_OCSP_RULES });
+var ALL_OCSP_RULES = RFC6960_OCSP_RULES.concat(RFC5019_OCSP_RULES);
+
 var PROFILES = Object.assign(Object.create(null), {
   "rfc5280": RFC5280_RULES,
   "rfc9881": RFC9881_RULES,
@@ -1294,6 +1700,7 @@ function _selectRules(profile) {
   if (profile == null || profile === "all" || profile === "default") return ALL_RULES;
   if (!PROFILES[profile]) {
     if (CRL_PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is a CRL profile; lint a CRL with pki.lint.crl");
+    if (OCSP_PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is an OCSP profile; lint a response with pki.lint.ocsp");
     throw _cfg("lint/unknown-profile", "unknown lint profile \"" + profile + "\" (known: " + Object.keys(PROFILES).join(", ") + ")");
   }
   return PROFILES[profile];
@@ -1447,6 +1854,7 @@ function crl(input, opts) {
   if (profile == null || profile === "all" || profile === "default") rules_ = ALL_CRL_RULES;
   else if (CRL_PROFILES[profile]) rules_ = CRL_PROFILES[profile];
   else if (PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is a certificate profile; lint a certificate with pki.lint.certificate");
+  else if (OCSP_PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is an OCSP profile; lint a response with pki.lint.ocsp");
   else throw _cfg("lint/unknown-profile", "unknown CRL lint profile \"" + profile + "\" (known: " + Object.keys(CRL_PROFILES).join(", ") + ")");
 
   var ingested = _ingestCrl(input);
@@ -1462,6 +1870,121 @@ function crl(input, opts) {
   return report;
 }
 
+var _OCSP_OPTS = Object.assign(Object.create(null), { profile: 1, severity: 1 });
+var _OCSP_CLAIM = ["responseStatus", "basicResponse", "tbsResponseDataBytes"];
+
+/** @internal The door pki.ocsp.verify uses for a parsed response: a result the parser recorded is
+ * re-read from the source it came from, which is the DER when the parser was fed bytes and the PEM
+ * text when it was fed a string, and an object that merely carries a response's field names is
+ * refused as config-time misuse rather than linted, since its fields could describe different
+ * responses. Bytes and PEM take the fatal path below, never a throw. */
+function _ingestOcsp(input) {
+  var der;
+  if (Buffer.isBuffer(input)) der = input;
+  else if (typeof input === "string") {
+    try { der = ocspSchema.pemDecode(input); }
+    catch (e) { return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "pki.lint", message: "input is not a decodable PEM/DER OCSP response", context: { code: e.code } } }; }
+  } else if (input !== null && typeof input === "object" && !guard.bytes.isByteSource(input)) {
+    return { response: guard.parsed.fromTrustedSource(input, "ocspResponse", _OCSP_CLAIM, function (src) {
+      if (!Buffer.isBuffer(src) && typeof src !== "string") throw _cfg("lint/bad-input", "pki.lint.ocsp input must be a parsed OCSP response, a DER Buffer, or a PEM string");
+      return ocspSchema.parseResponse(src);
+    }, _cfg, "lint/bad-input",
+    "pki.lint.ocsp input must be its DER bytes, a PEM string, or an unmodified pki.schema.ocsp.parseResponse result: the signed byte range, the signature and the fields that range encodes are separate properties of a parsed object, so a rebuilt response could have them describe different responses") };
+  } else {
+    throw _cfg("lint/bad-input", "pki.lint.ocsp input must be a parsed OCSP response, a DER Buffer, or a PEM string");
+  }
+  try { return { response: ocspSchema.parseResponse(der) }; }
+  catch (e) { return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "RFC 6960", message: "input is not a well-formed OCSP response", context: { code: e.code } } }; }
+}
+
+/**
+ * @primitive  pki.lint.ocsp
+ * @signature  pki.lint.ocsp(pem | der | parsed, opts?) -> LintReport
+ * @since      0.7.26
+ * @status     stable
+ * @spec       RFC 6960, RFC 5019, RFC 9654
+ * @related    pki.lint.certificate, pki.lint.crl, pki.schema.ocsp.parseResponse, pki.ocsp.sign, pki.ocsp.verify
+ *
+ * Lint an OCSP response against the RFC 6960 profile, and on request against the RFC 5019
+ * lightweight profile. `input` is a PEM string (`OCSP RESPONSE`), a DER `Buffer`, or an
+ * already-parsed `pki.schema.ocsp.parseResponse` object. It returns the same `LintReport` shape
+ * `pki.lint.certificate` returns, and it never throws on the data path: bytes that are not a
+ * well-formed response produce a single `fatal` finding `lint/unparseable` carrying the strict
+ * parser's own code. A non-successful response carries no BasicOCSPResponse and draws no row.
+ *
+ * The `rfc6960` rows cover each SingleResponse's update times and their relation to producedAt,
+ * an empty `certs` field, the extended revoked definition (criticality, value and placement) and
+ * the fixed shape of a revoked answer for a non-issued certificate, the placement of the nonce,
+ * archive cutoff, CRL references and the request-only extensions, an archive cutoff later than
+ * producedAt, the criticality and value syntax of the CRL entry extensions a SingleResponse may
+ * carry, an unrecognized critical extension, the revocation reasons unspecified and removeFromCRL,
+ * and two SingleResponses answering for one CertID. The `rfc5019` rows (nextUpdate present, one
+ * SingleResponse, no responseExtensions, a byKey ResponderID) run only when that profile is
+ * selected, since nothing in a response says which profile its responder follows; in the default
+ * run they count as not applicable.
+ *
+ * Shapes the strict parser refuses never reach a rule and arrive as `lint/unparseable` carrying the
+ * parser's code: a version other than v1, an undefined revocation reason, an empty or repeated
+ * extension, an empty `responses`, a nonce outside 1..128 octets, a malformed archive cutoff or
+ * CRL reference, a responseStatus that disagrees with responseBytes, and a time not in the
+ * `YYYYMMDDHHMMSSZ` form RFC 5019 requires. What needs the issuer or the signature (responder
+ * authorization, the ResponderID matching the signing certificate, freshness against a clock)
+ * is `pki.ocsp.verify`'s, and the certificates in `certs` are linted with `pki.lint.certificate`.
+ *
+ * @opts  profile   `"rfc6960"` or `"rfc5019"` (default runs the rfc6960 rows and marks the rfc5019
+ *                  rows not applicable). A certificate or CRL profile name is refused rather than
+ *                  run against a response.
+ * @opts  severity  Suppress findings below this floor (default `"notice"`). `counts` and `worst`
+ *                  always reflect the complete, unfiltered result.
+ * @example
+ *   var ca = await pki.key.generate("Ed25519");
+ *   var caKey = await pki.key.export(ca.privateKey);
+ *   var caDer = await pki.x509.sign({ subject: "Example CA", subjectPublicKey: await pki.key.export(ca.publicKey),
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z"),
+ *     extensions: { basicConstraints: { cA: true }, keyUsage: ["keyCertSign"], subjectKeyIdentifier: true } }, { key: caKey });
+ *   var leaf = await pki.key.generate("Ed25519");
+ *   var leafDer = await pki.x509.sign({ subject: "leaf.example", subjectPublicKey: await pki.key.export(leaf.publicKey),
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") },
+ *     { cert: caDer, key: caKey });
+ *   var der = await pki.ocsp.sign({ responderID: "byKey", responses: [{ cert: leafDer, issuer: caDer, status: "good" }] },
+ *     { cert: caDer, key: caKey });
+ *   var report = pki.lint.ocsp(der);
+ *   report.findings.length;                              // -> 0
+ *   pki.lint.ocsp(der, { profile: "rfc5019" }).worst;    // -> null
+ */
+function ocsp(input, opts) {
+  opts = guard.identifier.optionsObject(opts, _cfg, "lint/bad-input", "pki.lint options");
+  guard.identifier.assertKnownKeys(opts, _OCSP_OPTS, _cfg, "lint/bad-input",
+    "pki.lint.ocsp has an unknown option: ");
+  if (opts.severity != null && VALID_SEVERITY.indexOf(opts.severity) === -1) {
+    throw _cfg("lint/bad-severity", "unknown severity threshold \"" + opts.severity + "\" (known: " + VALID_SEVERITY.join(", ") + ")");
+  }
+  var profile = opts.profile;
+  var rules_;
+  if (profile == null || profile === "all" || profile === "default") rules_ = ALL_OCSP_RULES;
+  else if (OCSP_PROFILES[profile]) rules_ = OCSP_PROFILES[profile];
+  else if (PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is a certificate profile; lint a certificate with pki.lint.certificate");
+  else if (CRL_PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is a CRL profile; lint a CRL with pki.lint.crl");
+  else throw _cfg("lint/unknown-profile", "unknown OCSP lint profile \"" + profile + "\" (known: " + Object.keys(OCSP_PROFILES).join(", ") + ")");
+
+  var ingested = _ingestOcsp(input);
+  var report;
+  if (ingested.fatal) {
+    report = { findings: [ingested.fatal], ran: [],
+      counts: Object.assign(Object.create(null), { fatal: 1, error: 0, warn: 0, notice: 0, pass: 0, na: 0, ne: 0 }) };
+  } else if (!ingested.response.basicResponse) {
+    /** @internal A non-successful response carries no BasicOCSPResponse, so every row is not
+     * applicable to it: the profile grades responses, and an error status is not one. */
+    report = { findings: [], ran: [],
+      counts: Object.assign(Object.create(null), { fatal: 0, error: 0, warn: 0, notice: 0, pass: 0, na: rules_.length, ne: 0 }) };
+  } else {
+    report = _runLints(rules_, ingested.response, { profile: profile, decode: function () { return null; }, raw: function () { return null; } });
+  }
+  report.worst = _worst(report.findings);
+  report.findings = _applyThreshold(report, opts.severity);
+  return report;
+}
+
 /**
  * @primitive  pki.lint.rules
  * @signature  pki.lint.rules(profile?) -> [{id, severity, source, citation}]
@@ -1477,8 +2000,8 @@ function crl(input, opts) {
  */
 function rules(profile) {
   var set = profile == null
-    ? ALL_RULES.concat(ALL_CRL_RULES)
-    : (PROFILES[profile] || CRL_PROFILES[profile]
+    ? ALL_RULES.concat(ALL_CRL_RULES).concat(ALL_OCSP_RULES)
+    : (PROFILES[profile] || CRL_PROFILES[profile] || OCSP_PROFILES[profile]
       || (function () { throw _cfg("lint/unknown-profile", "unknown lint profile \"" + profile + "\""); })());
   return set.map(function (r) { return { id: r.id, severity: r.severity, source: r.source, citation: r.citation }; });
 }
@@ -1492,13 +2015,14 @@ function rules(profile) {
  *
  * List the known lint-profile names.
  * @example
- *   pki.lint.profiles();   // -> ["rfc5280", "rfc9881", "rfc9909", "rfc9935", "cabf-tls", "rfc5280-crl"]
+ *   pki.lint.profiles();   // -> ["rfc5280", "rfc9881", "rfc9909", "rfc9935", "cabf-tls", "rfc5280-crl", "rfc6960", "rfc5019"]
  */
-function profiles() { return Object.keys(PROFILES).concat(Object.keys(CRL_PROFILES)); }
+function profiles() { return Object.keys(PROFILES).concat(Object.keys(CRL_PROFILES)).concat(Object.keys(OCSP_PROFILES)); }
 
 module.exports = {
   certificate: certificate,
   crl: crl,
+  ocsp: ocsp,
   rules: rules,
   profiles: profiles,
 };