@blamejs/pki 0.8.17 → 0.8.19

package/lib/lint.js

@@ -37,6 +37,7 @@ var crlSchema = require("./schema-crl");
 var csrSchema = require("./schema-csr");
 var ocspSchema = require("./schema-ocsp");
 var pkix = require("./schema-pkix");
+var pkiBuild = require("./pki-build");
 var schema = require("./schema-engine");
 var path = require("./path-validate");
 var C = require("./constants");
@@ -84,11 +85,32 @@ function _derivedCert(o) {
   }
 }
 
+/** @internal The bytes a lint verb was handed, as a Buffer, or null where the input is not bytes
+ *  at all and the caller's own branches answer for it. Every parser in this toolkit reads any
+ *  BufferSource, so the one surface that promises never to throw on the data path does not turn
+ *  away a caller holding a Uint8Array from the network or an ArrayBuffer from a reader. Taking a
+ *  snapshot rather than the caller's view is also what closes the detached-backing-buffer hazard,
+ *  since a caller can neuter the buffer between the check and the read. */
+function _derBytesOf(input) {
+  if (!guard.bytes.isByteSource(input)) return null;
+  try {
+    return { der: guard.bytes.snapshotSource(input, LintError, "lint/bad-input", "pki.lint input") };
+  } catch (e) {
+    /** @internal A byte source whose backing buffer was detached is still a byte source, and it
+     * fails at the door rather than at the parse. The data path answers with a verdict either
+     * way, or one neutered buffer aborts the scan of a whole corpus. */
+    return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "pki.lint",
+      message: "input is a byte source whose bytes could not be read", context: { code: e.code } } };
+  }
+}
+
 function _ingest(input) {
   var derived = _derivedCert(input);
   if (derived) return { cert: derived };
   var der;
-  if (Buffer.isBuffer(input)) der = input;
+  var bytes = _derBytesOf(input);
+  if (bytes !== null && bytes.fatal) return { fatal: bytes.fatal };
+  if (bytes !== null) der = bytes.der;
   else if (typeof input === "string") {
     try { der = x509.pemDecode(input, "CERTIFICATE"); }
     catch (e) { return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "pki.lint", message: "input is not a decodable PEM/DER certificate", context: { code: e.code } } }; }
@@ -128,6 +150,14 @@ function _makeCtx(cert, profile) {
   return {
     profile: profile,
     explicitTlsProfile: explicitTls,
+    /** @internal An S/MIME subscriber certificate names its exact profile through a reserved
+     * policy identifier, so unlike the TLS case the rows detect it from the certificate itself and
+     * the flag only records that the caller also named it. */
+    explicitSmimeProfile: profile === "cabf-smime",
+    /** @internal A code signing subscriber certificate names its kind through a reserved policy
+     * identifier the same way, so this flag only records that the caller also named the profile. */
+    explicitCsProfile: profile === "cabf-cs",
+    isCaCert: isCa,
     isTlsServerCert: explicitTls || (_hasEku(cert, "serverAuth") && !isCa),
     decode: function (name) { return _decodeOrNull(cert, name); },
     raw: function (name) { return _findRaw(cert, name); },
@@ -257,23 +287,40 @@ function _hasControlChar(str) {
   }
   return false;
 }
-function _policyDisplayTexts(ctx) {
+/** @internal Every policy qualifier of every PolicyInformation, handed to `fn` as its qualifier
+ *  OID, its value node, and the PolicyInformation carrying it. The decoder surfaces the qualifiers
+ *  as raw DER, because a qualifier may carry any type and the reader does not choose one for the
+ *  caller, so every walk re-decodes bytes that already passed the policy-qualifier door. */
+function _eachPolicyQualifier(ctx, fn) {
   var d = ctx.decode("certificatePolicies");
-  if (!d || !Array.isArray(d.value)) return [];
-  var out = [];
+  if (!d || !Array.isArray(d.value)) return;
   d.value.forEach(function (pi) {
     if (!pi.qualifiersBytes || !pi.qualifiersBytes.length) return;
     var quals;
     // allow:swallow-unverified re-decoding bytes that already decoded under assertPolicyQualifiers cannot throw
-    try { quals = asn1.decode(pi.qualifiersBytes).children; } catch (_e) { return; }
+    try {
+      quals = asn1.decode(pi.qualifiersBytes).children;
+    } catch (_e) {
+      return;
+    }
     (quals || []).forEach(function (pq) {
       var qid;
       // allow:swallow-unverified assertPolicyQualifiers already read this OID, so re-reading it cannot throw
-      try { qid = asn1.read.oid(pq.children[0]); } catch (_e2) { return; }
-      if (qid !== OID_UNOTICE) return;
-      out = out.concat(pkix.userNoticeTexts(pq.children[1]));
+      try {
+        qid = asn1.read.oid(pq.children[0]);
+      } catch (_e2) {
+        return;
+      }
+      fn(qid, pq.children[1], pi);
     });
   });
+}
+function _policyDisplayTexts(ctx) {
+  var out = [];
+  _eachPolicyQualifier(ctx, function (qid, value) {
+    if (qid !== OID_UNOTICE) return;
+    out = out.concat(pkix.userNoticeTexts(value));
+  });
   return out;
 }
 function _hasPolicyDisplayText(cert, ctx) { return _policyDisplayTexts(ctx).length > 0; }
@@ -600,25 +647,1235 @@ function _subjectIsEmpty(cert) {
   return !(Array.isArray(rdns) && rdns.length);
 }
 
-/** @internal Every policy qualifier of every PolicyInformation, as its qualifier OID. The bytes
- *  are re-decoded the way the display-text walk above re-decodes them. */
+/** @internal Every policy qualifier of every PolicyInformation, as its qualifier OID. */
 function _policyQualifierIds(ctx) {
+  var out = [];
+  _eachPolicyQualifier(ctx, function (qid) { out.push(qid); });
+  return out;
+}
+
+/** @internal The S/MIME BR sec. 7.1.6.1 reserved policy identifiers, keyed by OID to the
+ *  generation that OID declares. A subscriber certificate asserts exactly one, so reading it is
+ *  how this profile learns which generation's table to hold the certificate to, and the presence
+ *  of one is also what says the certificate is one of these at all. */
+var SMIME_GENERATION_BY_POLICY = Object.create(null);
+/** @internal The same twelve identifiers keyed to the certificate TYPE they declare. The tables of
+ *  sec. 7.1.2.3 (l) are keyed on the type where the rest of the section is keyed on the
+ *  generation, so both directions of the matrix are read. */
+var SMIME_TYPE_BY_POLICY = Object.create(null);
+["mailbox", "organization", "sponsor", "individual"].forEach(function (type) {
+  ["legacy", "multipurpose", "strict"].forEach(function (gen) {
+    var d = oid.byName("smime-" + type + "-" + gen);
+    if (d) { SMIME_GENERATION_BY_POLICY[d] = gen; SMIME_TYPE_BY_POLICY[d] = type; }
+  });
+});
+
+/** @internal The keyUsage tables of sec. 7.1.2.3 (e). Each cell states its usage MODES (signing
+ *  only, key management only, dual use), and each mode fixes bits with SHALL and admits others
+ *  with MAY, so a conforming certificate asserts every bit of some one mode and no bit outside
+ *  that same mode. Flattening a cell into one permitted set loses that: on RSA, digitalSignature
+ *  with dataEncipherment sets only bits the cell names somewhere and still matches no mode,
+ *  because dataEncipherment belongs to the key-management modes and those require keyEncipherment.
+ *  The RSA cell is the one that also differs by GENERATION, Multipurpose and Legacy admitting
+ *  dataEncipherment where Strict does not. The elliptic-curve cell names encipherOnly and
+ *  decipherOnly only in the modes that require keyAgreement, which is how it states "only if
+ *  keyAgreement is set". A certificate declaring no generation is held to the Strict cell, the
+ *  narrowest of the three. */
+function _smimeKuModes(kind, gen) {
+  var relaxed = gen === "multipurpose" || gen === "legacy";
+  if (kind === "rsa") {
+    return [
+      { required: ["digitalSignature"], optional: ["nonRepudiation"] },
+      { required: ["keyEncipherment"], optional: relaxed ? ["dataEncipherment"] : [] },
+      { required: ["digitalSignature", "keyEncipherment"],
+        optional: relaxed ? ["nonRepudiation", "dataEncipherment"] : ["nonRepudiation"] },
+    ];
+  }
+  if (kind === "ec") {
+    return [
+      { required: ["digitalSignature"], optional: ["nonRepudiation"] },
+      { required: ["keyAgreement"], optional: ["encipherOnly", "decipherOnly"] },
+      { required: ["digitalSignature", "keyAgreement"],
+        optional: ["nonRepudiation", "encipherOnly", "decipherOnly"] },
+    ];
+  }
+  if (kind === "eddsa" || kind === "mldsa") {
+    return [{ required: ["digitalSignature"], optional: ["nonRepudiation"] }];
+  }
+  if (kind === "mlkem") return [{ required: ["keyEncipherment"], optional: [] }];
+  return null;
+}
+/** @internal Every bit any mode of the cell names, which is the complement of "Other bit positions
+ *  SHALL NOT be set". */
+function _smimeKuNamedAnywhere(modes) {
+  var out = [];
+  modes.forEach(function (m) {
+    m.required.concat(m.optional).forEach(function (bit) {
+      if (out.indexOf(bit) === -1) out.push(bit);
+    });
+  });
+  return out;
+}
+function _smimeKuAsserted(value) {
+  var out = [];
+  KU_BIT_NAMES.forEach(function (bit) { if (value[bit] === true) out.push(bit); });
+  return out;
+}
+/** @internal Whether the asserted bits are exactly some mode: every bit that mode requires, and no
+ *  bit it does not name. */
+function _smimeKuMatchesAMode(modes, asserted) {
+  for (var i = 0; i < modes.length; i++) {
+    var allowed = modes[i].required.concat(modes[i].optional);
+    var ok = true;
+    modes[i].required.forEach(function (bit) { if (asserted.indexOf(bit) === -1) ok = false; });
+    asserted.forEach(function (bit) { if (allowed.indexOf(bit) === -1) ok = false; });
+    if (ok) return true;
+  }
+  return false;
+}
+
+/** @internal Code Signing BR sec. 7.1.6.1 reserves three policy identifiers, keyed here to the KIND
+ *  of certificate each declares. The EV and the non-EV code signing identifiers declare the same
+ *  kind, because sec. 7.1.2.3 (f) asks one question of both; only the timestamping identifier takes
+ *  the other arm. */
+var CS_KIND_BY_POLICY = Object.create(null);
+[["code-signing", "code-signing"], ["code-signing-ev", "code-signing"],
+  ["code-signing-timestamping", "timestamping"]].forEach(function (row) {
+  var dotted = oid.byName(row[0]);
+  if (dotted) CS_KIND_BY_POLICY[dotted] = row[1];
+});
+/** @internal "Effective September 15, 2026 a Certificate issued to a Subscriber MUST contain
+ *  exactly one of the reserved policy OIDs specified in Section 7.1.6.1" (sec. 7.1.6.4). Dated, so
+ *  a certificate issued before it is not held to a rule that did not yet apply. */
+var CS_RESERVED_POLICY_REQUIRED = new Date("2026-09-15T00:00:00Z");
+/** @internal Sec. 6.3.2 states three ceilings: 39 months for a code signing certificate issued
+ *  before this date, 460 days for one issued on or after it, and 135 months for a timestamp
+ *  certificate whichever side of it. */
+var CS_VALIDITY_DAYS_START = new Date("2026-03-01T00:00:00Z");
+/** @internal Sec. 6.1.5.2, the curves, the modulus floor and the two DSA parameter options for a
+ *  subscriber key. The TLS profile names the same three curves from its own document; these are
+ *  this one's. The section names RSA, ECDSA and DSA, so each family is read on its own terms and a
+ *  family it does not name is what the row reports. */
+var CS_EC_CURVES = ["prime256v1", "secp384r1", "secp521r1"];
+var CS_RSA_MIN_BITS = 3072;
+var CS_DSA_L = 2048;
+var CS_DSA_N = [224, 256];
+/** @internal The DSA key length L and modulus length N, read as the bit lengths of p and q in the
+ *  Dss-Parms the AlgorithmIdentifier carries. */
+function _dsaParamBits(spki) {
+  try {
+    var params = spki.algorithm && spki.algorithm.parameters;
+    if (!Buffer.isBuffer(params)) return null;
+    var seq = asn1.decode(params);
+    if (!seq.children || seq.children.length !== 3) return null;
+    var p = asn1.read.integer(seq.children[0]);
+    var q = asn1.read.integer(seq.children[1]);
+    asn1.read.integer(seq.children[2]);
+    if (p <= 0n || q <= 0n) return null;
+    return { L: p.toString(2).length, N: q.toString(2).length };
+  } catch (_e) { return null; }
+}
+/** @internal Sec. 7.1.2.3 (c) names these two accessMethods and no other. */
+var CS_AIA_METHODS = ["ocsp", "caIssuers"].map(function (n) { return oid.byName(n); });
+/** @internal Sec. 7.1.2.3 (f): forbidden at every kind, and the three the clause names as MAY
+ *  beside id-kp-codeSigning, which the discouraged-purpose row passes over. */
+var CS_FORBIDDEN_EKU = ["anyExtendedKeyUsage", "serverAuth"].map(function (n) { return oid.byName(n); });
+var CS_PERMITTED_EXTRA_EKU = ["ms-lifetime-signing", "emailProtection", "ms-document-signing",
+  "ms-document-signing-as-printed"].map(function (n) { return oid.byName(n); });
+/** @internal Sec. 7.1.2.3 (e) names these two as MUST NOT, and every other bit beside
+ *  digitalSignature as SHOULD NOT, so one sentence becomes two rows at two strengths. */
+var CS_FORBIDDEN_KU = ["keyCertSign", "cRLSign"];
+
+/** @internal The kind the asserted reserved identifier declares, or null where none is asserted. */
+function _csKind(ctx) {
   var d = ctx.decode("certificatePolicies");
+  if (!d || !Array.isArray(d.value)) return null;
+  var found = null;
+  for (var i = 0; i < d.value.length; i++) {
+    var k = CS_KIND_BY_POLICY[d.value[i].policyIdentifier];
+    if (k && found === null) found = k;
+  }
+  return found;
+}
+/** @internal Sec. 7.1.6.3 gives a subordinate CA these identifiers too, so detection asks for the
+ *  identifier AND that the certificate is not a CA, as the S/MIME profile does and for the same
+ *  reason. Naming the profile overrides, which is how a malformed subscriber is checked. */
+function _isCs(cert, ctx) {
+  if (ctx.explicitCsProfile) return true;
+  return _csKind(ctx) !== null && !ctx.isCaCert;
+}
+/** @internal A certificate declaring no kind is read as a code signing one, which is the arm the
+ *  section states first and the only arm a caller who named the profile without a reserved
+ *  identifier can have meant. */
+function _isCsTimestamp(cert, ctx) { return _isCs(cert, ctx) && _csKind(ctx) === "timestamping"; }
+function _isCsCodeSigning(cert, ctx) { return _isCs(cert, ctx) && _csKind(ctx) !== "timestamping"; }
+/** @internal The accessLocation URIs of the two accessMethods sec. 7.1.2.3 (c) names, flat: unlike
+ *  the S/MIME clause this one states one rule for both, so they are not grouped by method. A
+ *  location that is not a uniformResourceIdentifier is kept as null, since the method is still
+ *  provided and still carries no HTTP URL. */
+function _csAiaLocations(ctx) {
+  var d = ctx.decode("authorityInfoAccess");
   if (!d || !Array.isArray(d.value)) return [];
   var out = [];
+  for (var i = 0; i < d.value.length; i++) {
+    var ad = d.value[i];
+    if (CS_AIA_METHODS.indexOf(ad.accessMethod) === -1) continue;
+    var loc = ad.accessLocation;
+    out.push(loc && loc.tag === 6 && typeof loc.value === "string" ? loc.value : null);
+  }
+  return out;
+}
+
+/** @internal Sec. 7.1.2.3 (c) gives a URI scheme table for each of these two accessMethods and
+ *  none for any other, so a scheme is measured on these and an unrecognized accessMethod has no
+ *  table to be held to. */
+var SMIME_AIA_METHODS = ["ocsp", "caIssuers"].map(function (n) { return oid.byName(n); });
+
+/** @internal Sec. 7.1.2.3 (l): the Legal Entity Identifier table is keyed on the certificate type.
+ *  The identifier is prohibited outright for two types; for Organization-validated the role
+ *  identifier alone is prohibited, and Sponsor-validated admits both. */
+var SMIME_LEI_EXTS = Object.assign(Object.create(null), { identifier: "lei-identifier", role: "lei-role" });
+/** @internal Whether the cell for a certificate type ADMITS one of the two extensions. A cell that
+ *  reads "Prohibited" carries no criticality sentence, so the criticality row is asked only where
+ *  this is true and a prohibited extension breaks one clause rather than two. A certificate
+ *  declaring no type names no cell and is held to neither row. */
+function _smimeLeiAdmits(type, which) {
+  if (type === "sponsor") return true;
+  if (type === "organization") return which === "identifier";
+  return false;
+}
+
+/** @internal Sec. 7.1.2.3 (m): both Adobe extensions the table names, prohibited under Strict. */
+var SMIME_ADOBE_EXTS = ["adobe-timestamp", "adobe-archive-rev-info"];
+
+/** @internal Sec. 7.1.2.3 (f): these four SHALL NOT be present at any generation, where any other
+ *  purpose is forbidden under Strict alone. */
+var SMIME_FORBIDDEN_EKU = ["serverAuth", "codeSigning", "timeStamping", "anyExtendedKeyUsage"]
+  .map(function (n) { var d = oid.byName(n); return d ? { name: n, oid: d } : null; })
+  .filter(function (e) { return !!e; });
+
+/** @internal "Effective July 15, 2025 S/MIME Subscriber Certificates SHALL NOT be issued using the
+ *  Legacy Generation profiles" (sec. 7.1.6.1). Dated, so a certificate issued before it is not
+ *  held to a rule that did not yet apply. */
+var SMIME_LEGACY_RETIRED = new Date("2025-07-15T00:00:00Z");
+
+function _smimeGeneration(ctx) {
+  var d = ctx.decode("certificatePolicies");
+  if (!d || !Array.isArray(d.value)) return null;
+  var found = null;
   d.value.forEach(function (pi) {
-    if (!pi.qualifiersBytes || !pi.qualifiersBytes.length) return;
-    var quals;
-    // allow:swallow-unverified bytes that already decoded under the policy-qualifier door cannot throw
-    try { quals = asn1.decode(pi.qualifiersBytes).children; } catch (_e) { return; }
-    (quals || []).forEach(function (pq) {
-      // allow:swallow-unverified the same door already read this OID
-      try { out.push(asn1.read.oid(pq.children[0])); } catch (_e2) { void 0; }
+    var gen = SMIME_GENERATION_BY_POLICY[pi.policyIdentifier];
+    if (gen && found === null) found = gen;
+  });
+  return found;
+}
+/** @internal A reserved policy identifier alone does not make a certificate a SUBSCRIBER one: sec.
+ *  7.1.6.3 says a certificate issued to a Subordinate CA "SHALL include one or more explicit policy
+ *  identifiers defined in Section 7.1.6.1", so an intermediate carries them too. Detection
+ *  therefore asks for the identifier AND that the certificate is not a CA, or these subscriber-only
+ *  rows would report an intermediate for asserting cA and keyCertSign and naming no mailbox.
+ *  Naming the profile still overrides, which is how a malformed subscriber is checked. */
+function _isSmime(cert, ctx) {
+  if (ctx.explicitSmimeProfile) return true;
+  return _smimeGeneration(ctx) !== null && !ctx.isCaCert;
+}
+function _smimeStrict(cert, ctx) { return _isSmime(cert, ctx) && _smimeGenerationOrStrict(ctx) === "strict"; }
+/** @internal The cell every table in sec. 7.1.2.3 is read against. A certificate declaring no
+ *  generation names no cell, and is held to Strict, the narrowest of the three. */
+function _smimeGenerationOrStrict(ctx) {
+  var gen = _smimeGeneration(ctx);
+  return gen === null ? "strict" : gen;
+}
+/** @internal The certificate type the asserted reserved identifier declares, for the sec.
+ *  7.1.2.3 (l) tables. Null where none is asserted, which is every certificate the caller named
+ *  the profile for rather than one that declared itself. */
+function _smimeType(ctx) {
+  var d = ctx.decode("certificatePolicies");
+  if (!d || !Array.isArray(d.value)) return null;
+  var found = null;
+  for (var i = 0; i < d.value.length; i++) {
+    var t = SMIME_TYPE_BY_POLICY[d.value[i].policyIdentifier];
+    if (t && found === null) found = t;
+  }
+  return found;
+}
+
+/** @internal Which sec. 7.1.2.3 (e) table applies, from the subject key's own algorithm. A key
+ *  outside them has no table to be held to. */
+function _smimeKeyKind(cert) {
+  var spki = cert.subjectPublicKeyInfo;
+  var name = spki && spki.algorithm && spki.algorithm.name;
+  if (RSA_KEY_ALGS[name]) return "rsa";
+  if (name === "ecPublicKey") return "ec";
+  if (name === "Ed25519" || name === "Ed448") return "eddsa";
+  if (typeof name === "string" && name.indexOf("ml-dsa") !== -1) return "mldsa";
+  if (typeof name === "string" && name.indexOf("ml-kem") !== -1) return "mlkem";
+  return null;
+}
+
+/** @internal The URI of a GeneralName carried as raw DER, or null where it is not one. The
+ *  cRLDistributionPoints decoder surfaces each fullName entry as bytes, since a distribution point
+ *  may name any GeneralName type and the reader does not choose one for the caller. */
+function _generalNameUri(der) {
+  var n;
+  // allow:swallow-unverified an entry that does not decode is answered by the extension-syntax row
+  try { n = asn1.decode(der); } catch (_e) { return null; }
+  if (!n || n.tagClass !== "context" || n.tagNumber !== 6) return null;
+  return n.content.toString("latin1");
+}
+/** @internal HTTP, not HTTPS. The S/MIME BR distinguishes the two by wording: the policy qualifier
+ *  of sec. 7.1.2.3 (a) "SHALL be a HTTP or HTTPS URL", where the distribution point and access
+ *  method tables say "SHALL have the URI scheme HTTP" and "Other schemes SHALL NOT be present".
+ *  HTTPS is another scheme, and a revocation list fetched over TLS is a circular dependency.
+ *  Having that scheme means being a URI of it, so both readings go through the one place that
+ *  decides what an http or https URL is and differ only in which answer they accept. */
+function _isHttpUri(u) {
+  return pkiBuild.httpUrlScheme(u) === "http";
+}
+/** @internal The policy-qualifier clause of sec. 7.1.2.3 (a) names both schemes, where the URI
+ *  scheme tables name HTTP alone. It also asks for a URL rather than a scheme, so a bare
+ *  "http://" naming no host does not satisfy it. The shape is the one a reader holds a URL it was
+ *  given to, not the narrower one the builders hold what they emit to. */
+function _isHttpOrHttpsUrl(u) {
+  return pkiBuild.httpUrlScheme(u) !== null;
+}
+/** @internal The accessLocation URIs of sec. 7.1.2.3 (c), grouped BY accessMethod. The clause
+ *  gives id-ad-ocsp and id-ad-caIssuers a table each, where clause (b) gives the whole extension
+ *  one, so each method's URIs answer that method's table alone and an accessMethod with no table
+ *  is not measured. An accessLocation of another GeneralName type carries no URI to measure a
+ *  scheme on. */
+function _smimeAiaLocationsByMethod(ctx) {
+  var d = ctx.decode("authorityInfoAccess");
+  var out = Object.create(null);
+  if (!d || !Array.isArray(d.value)) return out;
+  for (var i = 0; i < d.value.length; i++) {
+    var ad = d.value[i];
+    if (SMIME_AIA_METHODS.indexOf(ad.accessMethod) === -1) continue;
+    if (!out[ad.accessMethod]) out[ad.accessMethod] = [];
+    /** @internal A location that is not a uniformResourceIdentifier carries no scheme, so it is
+     * kept as null rather than dropped: the method is still provided and still has no HTTP URI. */
+    var loc = ad.accessLocation;
+    out[ad.accessMethod].push(loc && loc.tag === 6 && typeof loc.value === "string" ? loc.value : null);
+  }
+  return out;
+}
+function _crldpUris(ctx) {
+  var d = ctx.decode("cRLDistributionPoints");
+  if (!d || !Array.isArray(d.value)) return [];
+  var out = [];
+  d.value.forEach(function (dp) {
+    var point = dp.distributionPoint;
+    if (!point || point.kind !== "fullName" || !Array.isArray(point.names)) return;
+    point.names.forEach(function (raw) {
+      var u = _generalNameUri(raw);
+      if (u !== null) out.push(u);
     });
   });
   return out;
 }
 
+var SMIME_OID_SMTP_UTF8 = oid.byName("smtpUtf8Mailbox");
+
+/** @internal The nine named keyUsage bits of RFC 5280 sec. 4.2.1.3, in their bit order. */
+var KU_BIT_NAMES = ["digitalSignature", "nonRepudiation", "keyEncipherment", "dataEncipherment",
+  "keyAgreement", "keyCertSign", "cRLSign", "encipherOnly", "decipherOnly"];
+
+/** @internal The type OID of an otherName GeneralName. Every otherName is a [0], so the type is
+ *  the only thing telling one apart from another, and a decoded entry carries it on `value` where
+ *  the reader recognized the form and as bytes where it did not. */
+function _otherNameTypeOf(gn) {
+  if (gn && gn.value && typeof gn.value.typeId === "string") return gn.value.typeId;
+  if (gn && gn.value && typeof gn.value.type === "string") return gn.value.type;
+  var src = gn && (gn.bytes || gn.value);
+  if (!Buffer.isBuffer(src)) return null;
+  var n;
+  // allow:swallow-unverified an entry that does not decode is answered by the extension-syntax row
+  try { n = asn1.decode(src); } catch (_e) { return null; }
+  if (!n || !n.children || !n.children.length) return null;
+  // allow:swallow-unverified a first child that is not an OID is not an otherName type
+  try { return asn1.read.oid(n.children[0]); } catch (_e2) { return null; }
+}
+
+var CABF_SMIME_RULES = [
+  {
+    id: "lint/cabf-smime/policies-critical", severity: "warn", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (a)",
+    /** @internal SHOULD NOT, so a warning rather than an error: the clause states a preference and
+     * the certificate is still conformant against the MUSTs around it. */
+    message: "certificatePolicies should not be marked critical",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { var e = ctx.raw("certificatePolicies"); return (e && e.critical === true) ? true : null; },
+  },
+  {
+    id: "lint/cabf-smime/policies-missing", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (a)",
+    /** @internal Reachable only where the caller named the profile: without the extension there is
+     * no reserved identifier, and the reserved identifier is what otherwise says the certificate
+     * is one of these. Naming the profile is the caller supplying that statement. */
+    message: "a subscriber certificate must carry a certificatePolicies extension",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { return ctx.raw("certificatePolicies") ? null : true; },
+  },
+  {
+    id: "lint/cabf-smime/policies-reserved-identifier-count", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (a)",
+    /** @internal "It SHALL include exactly one of the reserved policyIdentifiers", so two is as
+     * much a fault as none and the count says which. A certificate's own generation is read from
+     * that identifier, so two of them also leaves the generation ambiguous. */
+    message: "certificatePolicies must include exactly one reserved policy identifier",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      /** @internal An absent extension is the presence row's answer, not this one's, so it is
+       * skipped here and counted where it is present but names no reserved identifier. */
+      if (!ctx.raw("certificatePolicies")) return null;
+      var d = ctx.decode("certificatePolicies");
+      var list = (d && Array.isArray(d.value)) ? d.value : [];
+      var found = list.filter(function (pi) { return !!SMIME_GENERATION_BY_POLICY[pi.policyIdentifier]; });
+      return found.length === 1 ? null : { context: { count: found.length } };
+    },
+  },
+  {
+    id: "lint/cabf-smime/legacy-generation-retired", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.6.1",
+    message: "a subscriber certificate must not be issued under a Legacy generation profile",
+    appliesTo: _isSmime,
+    effectiveDate: SMIME_LEGACY_RETIRED,
+    check: function (cert, ctx) {
+      return _smimeGeneration(ctx) === "legacy" ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/crldp-missing", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (b)",
+    message: "a subscriber certificate must carry a cRLDistributionPoints extension",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { return ctx.raw("cRLDistributionPoints") ? null : true; },
+  },
+  {
+    id: "lint/cabf-smime/crldp-non-http-uri", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (b)",
+    /** @internal The scheme rule differs by generation: Strict and Multipurpose require EVERY
+     * uniformResourceIdentifier to be HTTP, where Legacy requires at least one and permits others
+     * beside it. One row measures both, because the generation decides which question to ask. */
+    message: "a cRLDistributionPoints URI does not meet the URI scheme rule for this generation",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      /** @internal An extension carrying no URI at all fails both readings: every generation
+       * requires an HTTP one, so an empty list is a violation rather than nothing to measure. The
+       * presence row answers only for the extension being absent. */
+      if (!ctx.raw("cRLDistributionPoints")) return null;
+      var uris = _crldpUris(ctx);
+      var gen = _smimeGeneration(ctx);
+      if (gen === "legacy" || !uris.length) {
+        return uris.some(_isHttpUri) ? null : { context: { generation: gen || "strict", uris: uris } };
+      }
+      var bad = uris.filter(function (u) { return !_isHttpUri(u); });
+      return bad.length ? { context: { generation: gen, uris: bad } } : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/aia-critical", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (c)",
+    message: "authorityInformationAccess must not be marked critical",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { var e = ctx.raw("authorityInfoAccess"); return (e && e.critical === true) ? true : null; },
+  },
+  {
+    id: "lint/cabf-smime/basic-constraints-ca-true", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (d)",
+    message: "a subscriber certificate's basicConstraints cA field must not be true",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var d = ctx.decode("basicConstraints");
+      return (d && d.value && d.value.cA === true) ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/basic-constraints-path-len", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (d)",
+    message: "a subscriber certificate's basicConstraints must not carry a pathLenConstraint",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var d = ctx.decode("basicConstraints");
+      var pl = d && d.value ? d.value.pathLenConstraint : null;
+      return pl === null || pl === undefined ? null : { context: { pathLenConstraint: pl } };
+    },
+  },
+  {
+    id: "lint/cabf-smime/key-usage-missing", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (e)",
+    message: "a subscriber certificate must carry a keyUsage extension",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { return ctx.raw("keyUsage") ? null : true; },
+  },
+  {
+    id: "lint/cabf-smime/key-usage-forbidden-bit", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (e)",
+    /** @internal "Other bit positions SHALL NOT be set", over a table that differs by key
+     * algorithm: keyEncipherment belongs to the RSA table and keyAgreement to the EC one, so the
+     * same bit is conformant on one key and not on the other. A key algorithm the section gives no
+     * table for is held to neither. "Other bit positions" reaches past the nine RFC 5280 names as
+     * well, so a bit set beyond them is reported for every key algorithm. */
+    message: "a keyUsage bit this key algorithm's table does not permit is set",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var d = ctx.decode("keyUsage");
+      if (!d || !d.value) return null;
+      var kind = _smimeKeyKind(cert);
+      if (kind === null) return null;
+      var modes = _smimeKuModes(kind, _smimeGeneration(ctx));
+      if (modes === null) return null;
+      var named = _smimeKuNamedAnywhere(modes);
+      var out = [];
+      KU_BIT_NAMES.forEach(function (bit) {
+        if (d.value[bit] === true && named.indexOf(bit) === -1) {
+          out.push({ context: { keyUsage: bit, keyAlgorithm: kind } });
+        }
+      });
+      if (d.value.reservedBitsSet === true) {
+        out.push({ context: { reservedBitSet: true, keyAlgorithm: kind } });
+      }
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/key-usage-matches-no-mode", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (e)",
+    /** @internal A cell is a set of modes rather than a set of bits, so bits that all appear
+     * somewhere in the cell can still combine into no mode: digitalSignature with dataEncipherment
+     * on RSA, or encipherOnly without keyAgreement on an elliptic curve. This row runs only where
+     * every asserted bit is one the cell names, since a bit outside the cell is the row above. */
+    message: "the keyUsage bits set match no usage mode of this key algorithm's table",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var d = ctx.decode("keyUsage");
+      if (!d || !d.value || d.value.reservedBitsSet === true) return null;
+      var kind = _smimeKeyKind(cert);
+      if (kind === null) return null;
+      var gen = _smimeGeneration(ctx);
+      var modes = _smimeKuModes(kind, gen);
+      if (modes === null) return null;
+      var asserted = _smimeKuAsserted(d.value);
+      var named = _smimeKuNamedAnywhere(modes);
+      for (var i = 0; i < asserted.length; i++) {
+        if (named.indexOf(asserted[i]) === -1) return null;
+      }
+      return _smimeKuMatchesAMode(modes, asserted)
+        ? null
+        : { context: { keyAlgorithm: kind, generation: gen || "strict", keyUsage: asserted } };
+    },
+  },
+  {
+    id: "lint/cabf-smime/eku-missing-email-protection", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (f)",
+    message: "extKeyUsage must include id-kp-emailProtection",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var d = ctx.decode("extKeyUsage");
+      if (!d || !Array.isArray(d.value)) return true;
+      return d.value.indexOf(oid.byName("emailProtection")) === -1 ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/eku-forbidden-purpose", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (f)",
+    message: "a key purpose the profile forbids at every generation is present in extKeyUsage",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var d = ctx.decode("extKeyUsage");
+      if (!d || !Array.isArray(d.value)) return null;
+      var out = [];
+      SMIME_FORBIDDEN_EKU.forEach(function (e) {
+        if (d.value.indexOf(e.oid) !== -1) out.push({ context: { keyPurpose: e.name, oid: e.oid } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/eku-extra-purpose-strict", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (f)",
+    /** @internal Strict alone says "Other values SHALL NOT be present"; Multipurpose and Legacy
+     * say they MAY be. So this row is the one place the generation turns a permission into a
+     * prohibition, and it runs only where the certificate declared Strict. The four values the
+     * sentence after the table forbids at every generation are left to the row that owns them, so
+     * one purpose draws one finding citing the narrower of the two rules it breaks. */
+    message: "under the Strict generation, extKeyUsage must carry no purpose beyond id-kp-emailProtection",
+    appliesTo: _smimeStrict,
+    check: function (cert, ctx) {
+      var d = ctx.decode("extKeyUsage");
+      if (!d || !Array.isArray(d.value)) return null;
+      var email = oid.byName("emailProtection");
+      var extra = d.value.filter(function (o) {
+        if (o === email) return false;
+        for (var i = 0; i < SMIME_FORBIDDEN_EKU.length; i++) {
+          if (SMIME_FORBIDDEN_EKU[i].oid === o) return false;
+        }
+        return true;
+      });
+      return extra.length ? { context: { purposes: extra } } : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/aki-missing", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (g)",
+    message: "a subscriber certificate must carry an authorityKeyIdentifier extension",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { return ctx.raw("authorityKeyIdentifier") ? null : true; },
+  },
+  {
+    id: "lint/cabf-smime/aki-critical", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (g)",
+    message: "authorityKeyIdentifier must not be marked critical",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { var e = ctx.raw("authorityKeyIdentifier"); return (e && e.critical === true) ? true : null; },
+  },
+  {
+    id: "lint/cabf-smime/san-no-mailbox", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.4.2.1",
+    /** @internal "SHALL contain at least one GeneralName entry of the following types: Rfc822Name
+     * and/or otherName of type id-on-SmtpUTF8Mailbox". An otherName is read for its type OID,
+     * since any otherName is a [0] and only that one carries a mailbox. */
+    message: "subjectAltName must carry at least one rfc822Name or SmtpUTF8Mailbox otherName",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var d = ctx.decode("subjectAltName");
+      if (!d || !d.value || !Array.isArray(d.value.names)) return true;
+      var found = d.value.names.some(function (gn) {
+        if (gn.tagNumber === 1) return true;
+        if (gn.tagNumber !== 0) return false;
+        return _otherNameTypeOf(gn) === SMIME_OID_SMTP_UTF8;
+      });
+      return found ? null : true;
+    },
+  },
+  {
+    id: "lint/cabf-smime/ski-critical", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (n)",
+    message: "subjectKeyIdentifier must not be marked critical",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { var e = ctx.raw("subjectKeyIdentifier"); return (e && e.critical === true) ? true : null; },
+  },
+  {
+    id: "lint/cabf-smime/smime-capabilities-critical", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (i)",
+    message: "smimeCapabilities must not be marked critical",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { var e = ctx.raw("smimeCapabilities"); return (e && e.critical === true) ? true : null; },
+  },
+  {
+    id: "lint/cabf-smime/subject-directory-attributes-prohibited", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (j)",
+    /** @internal Prohibited under Strict and Multipurpose, permitted under Legacy. The generation
+     * the certificate declares decides, so this runs at two of the three. */
+    message: "subjectDirectoryAttributes is prohibited under the Strict and Multipurpose generations",
+    appliesTo: function (cert, ctx) {
+      return _isSmime(cert, ctx) && _smimeGenerationOrStrict(ctx) !== "legacy";
+    },
+    check: function (cert, ctx) { return ctx.raw("subjectDirectoryAttributes") ? true : null; },
+  },
+  {
+    id: "lint/cabf-smime/subject-directory-attributes-critical", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (j)",
+    /** @internal The criticality sentence sits in the Legacy row alone, which reads "MAY be present
+     * and SHALL NOT be marked critical". The other row reads "Prohibited" and carries no
+     * criticality sentence, so a critical extension there breaks one clause rather than two. */
+    message: "subjectDirectoryAttributes must not be marked critical",
+    appliesTo: function (cert, ctx) {
+      return _isSmime(cert, ctx) && _smimeGenerationOrStrict(ctx) === "legacy";
+    },
+    check: function (cert, ctx) {
+      var e = ctx.raw("subjectDirectoryAttributes");
+      return (e && e.critical === true) ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/policies-cps-not-http-url", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (a)",
+    /** @internal "the value of the qualifier SHALL be a HTTP or HTTPS URL". This clause names both
+     * schemes where the URI scheme tables of (b) and (c) name HTTP alone. */
+    message: "an id-qt-cps policy qualifier must be a HTTP or HTTPS URL",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var out = [];
+      _eachPolicyQualifier(ctx, function (qid, value, pi) {
+        if (qid !== OID_CPS) return;
+        var uri = null;
+        // allow:swallow-unverified a CPSuri that will not read as a string is not a URL either, so it falls to the report below rather than out of the rule
+        try {
+          uri = asn1.read.string(value);
+        } catch (_e) {
+          void 0;
+        }
+        if (!_isHttpOrHttpsUrl(uri)) {
+          out.push({ context: { policyIdentifier: pi.policyIdentifier, cps: uri } });
+        }
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/policies-unotice-no-explicit-text", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (a)",
+    /** @internal "If a qualifier of type id-qt-unotice is included, then it SHALL contain
+     * explicitText". Both halves of that sentence are rows, since a notice can fail either. */
+    message: "an id-qt-unotice policy qualifier must contain explicitText",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var out = [];
+      _eachPolicyQualifier(ctx, function (qid, value, pi) {
+        if (qid !== OID_UNOTICE) return;
+        var carries = pkix.userNoticeTexts(value).some(function (t) { return t.field === "explicitText"; });
+        if (!carries) out.push({ context: { policyIdentifier: pi.policyIdentifier } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/policies-unotice-notice-ref", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (a)",
+    /** @internal "...and SHALL NOT contain noticeRef." */
+    message: "an id-qt-unotice policy qualifier must not contain a noticeRef",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var out = [];
+      _eachPolicyQualifier(ctx, function (qid, value, pi) {
+        if (qid !== OID_UNOTICE) return;
+        /** @internal NoticeReference requires its organization DisplayText, which userNoticeTexts
+         * surfaces under that field name, so the field's presence is the noticeRef's presence. */
+        var carries = pkix.userNoticeTexts(value).some(function (t) { return t.field === "organization"; });
+        if (carries) out.push({ context: { policyIdentifier: pi.policyIdentifier } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/crldp-critical", severity: "warn", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (b)",
+    message: "cRLDistributionPoints should not be marked critical",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var e = ctx.raw("cRLDistributionPoints");
+      return (e && e.critical === true) ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/aia-missing", severity: "warn", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (c)",
+    /** @internal "(SHOULD be present)", where the TLS profile's own heading for the same extension
+     * reads SHALL, so the two profiles report it at different strengths. */
+    message: "a subscriber certificate should carry an authorityInformationAccess extension",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { return ctx.raw("authorityInfoAccess") ? null : true; },
+  },
+  {
+    id: "lint/cabf-smime/aia-ca-issuers-missing", severity: "warn", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (c)",
+    /** @internal "SHOULD contain at least one accessMethod value of type id-ad-caIssuers". Read
+     * only where the extension is there at all, since its absence is the row above. */
+    message: "authorityInformationAccess should carry an id-ad-caIssuers accessMethod",
+    appliesTo: function (cert, ctx) { return _isSmime(cert, ctx) && !!ctx.raw("authorityInfoAccess"); },
+    check: function (cert, ctx) {
+      var d = ctx.decode("authorityInfoAccess");
+      if (!d || !Array.isArray(d.value)) return null;
+      var wanted = oid.byName("caIssuers");
+      for (var i = 0; i < d.value.length; i++) {
+        if (d.value[i].accessMethod === wanted) return null;
+      }
+      return true;
+    },
+  },
+  {
+    id: "lint/cabf-smime/aia-non-http-uri", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (c)",
+    /** @internal Strict and Multipurpose require every accessMethod URI to be HTTP, Legacy at
+     * least one. Each accessMethod has its OWN table, so "at least one" is answered per method and
+     * an HTTP URI on one does not satisfy the other's row. */
+    message: "an authorityInformationAccess accessMethod URI does not meet the URI scheme rule for this generation",
+    appliesTo: function (cert, ctx) { return _isSmime(cert, ctx) && !!ctx.raw("authorityInfoAccess"); },
+    check: function (cert, ctx) {
+      var byMethod = _smimeAiaLocationsByMethod(ctx);
+      var gen = _smimeGeneration(ctx);
+      var out = [];
+      function report(method, offending) {
+        out.push({ context: { generation: gen || "strict", accessMethod: oid.name(method) || method,
+          uris: offending.filter(function (u) { return u !== null; }),
+          nonUriLocations: offending.filter(function (u) { return u === null; }).length } });
+      }
+      SMIME_AIA_METHODS.forEach(function (method) {
+        var locs = byMethod[method];
+        if (!locs || !locs.length) return;
+        if (gen === "legacy") {
+          if (!locs.some(_isHttpUri)) report(method, locs);
+          return;
+        }
+        var bad = locs.filter(function (u) { return !_isHttpUri(u); });
+        if (bad.length) report(method, bad);
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/key-usage-not-critical", severity: "warn", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (e)",
+    message: "keyUsage should be marked critical",
+    appliesTo: function (cert, ctx) { return _isSmime(cert, ctx) && !!ctx.raw("keyUsage"); },
+    check: function (cert, ctx) {
+      var e = ctx.raw("keyUsage");
+      return (e && e.critical === true) ? null : true;
+    },
+  },
+  {
+    id: "lint/cabf-smime/aki-key-identifier-missing", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (g)",
+    /** @internal "The keyIdentifier field SHALL be present", which is a field rule rather than the
+     * extension-presence one above it: an authorityKeyIdentifier naming only an issuer and serial
+     * satisfies that row and not this one. */
+    message: "the authorityKeyIdentifier keyIdentifier field must be present",
+    appliesTo: function (cert, ctx) { return _isSmime(cert, ctx) && !!ctx.raw("authorityKeyIdentifier"); },
+    check: function (cert, ctx) {
+      var d = ctx.decode("authorityKeyIdentifier");
+      if (!d || !d.value) return null;
+      var kid = d.value.keyIdentifier;
+      return (kid === null || kid === undefined) ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/aki-issuer-or-serial-present", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (g)",
+    /** @internal "authorityCertIssuer and authorityCertSerialNumber fields SHALL NOT be present."
+     * Either one alone is a violation, so both are reported by name. */
+    message: "the authorityKeyIdentifier must not carry authorityCertIssuer or authorityCertSerialNumber",
+    appliesTo: function (cert, ctx) { return _isSmime(cert, ctx) && !!ctx.raw("authorityKeyIdentifier"); },
+    check: function (cert, ctx) {
+      var d = ctx.decode("authorityKeyIdentifier");
+      if (!d || !d.value) return null;
+      var out = [];
+      ["authorityCertIssuer", "authorityCertSerialNumber"].forEach(function (f) {
+        var v = d.value[f];
+        if (v !== null && v !== undefined) out.push({ context: { field: f } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/san-missing", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (h)",
+    message: "a subscriber certificate must carry a subjectAltName extension",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { return ctx.raw("subjectAltName") ? null : true; },
+  },
+  {
+    id: "lint/cabf-smime/san-critical", severity: "warn", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (h)",
+    /** @internal "SHOULD NOT be marked critical unless the subject field is an empty sequence",
+     * which is the one condition that lifts it, so the subject is read rather than assumed. */
+    message: "subjectAltName should not be marked critical where the subject is not an empty sequence",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var e = ctx.raw("subjectAltName");
+      if (!e || e.critical !== true) return null;
+      var rdns = cert.subject && cert.subject.rdns;
+      var empty = !Array.isArray(rdns) || rdns.length === 0;
+      return empty ? null : true;
+    },
+  },
+  {
+    id: "lint/cabf-smime/qc-statements-critical", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (k)",
+    message: "qcStatements must not be marked critical",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var e = ctx.raw("qcStatements");
+      return (e && e.critical === true) ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/lei-prohibited", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (l)",
+    /** @internal The table is keyed on the certificate TYPE: Mailbox-validated and
+     * Individual-validated admit neither identifier, Organization-validated admits the LEI but not
+     * the role, and Sponsor-validated admits both. A certificate declaring no type is held to
+     * none, since the table has no row to select. */
+    message: "a Legal Entity Identifier extension is prohibited for this certificate type",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var type = _smimeType(ctx);
+      if (type === null) return null;
+      var out = [];
+      ["identifier", "role"].forEach(function (which) {
+        if (_smimeLeiAdmits(type, which)) return;
+        if (ctx.raw(SMIME_LEI_EXTS[which])) out.push({ context: { certificateType: type, extension: which } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/lei-critical", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (l)",
+    /** @internal Where the table admits one it reads "MAY be present and SHALL NOT be marked
+     * critical", so criticality is fixed in the cells that admit it and nowhere else. */
+    message: "a Legal Entity Identifier extension must not be marked critical",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var type = _smimeType(ctx);
+      if (type === null) return null;
+      var out = [];
+      ["identifier", "role"].forEach(function (which) {
+        if (!_smimeLeiAdmits(type, which)) return;
+        var e = ctx.raw(SMIME_LEI_EXTS[which]);
+        if (e && e.critical === true) out.push({ context: { certificateType: type, extension: which } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/adobe-extension-prohibited", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (m)",
+    /** @internal Prohibited under Strict, permitted under Multipurpose and Legacy. */
+    message: "an Adobe extension is prohibited under the Strict generation",
+    appliesTo: function (cert, ctx) {
+      return _isSmime(cert, ctx) && _smimeGenerationOrStrict(ctx) === "strict";
+    },
+    check: function (cert, ctx) {
+      var out = [];
+      SMIME_ADOBE_EXTS.forEach(function (name) {
+        if (ctx.raw(name)) out.push({ context: { extension: name } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/adobe-extension-critical", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (m)",
+    /** @internal The criticality sentence sits in the Multipurpose and Legacy row. The Strict row
+     * reads "Prohibited" and carries none, so a critical extension there breaks one clause. */
+    message: "an Adobe extension must not be marked critical",
+    appliesTo: function (cert, ctx) {
+      return _isSmime(cert, ctx) && _smimeGenerationOrStrict(ctx) !== "strict";
+    },
+    check: function (cert, ctx) {
+      var out = [];
+      SMIME_ADOBE_EXTS.forEach(function (name) {
+        var e = ctx.raw(name);
+        if (e && e.critical === true) out.push({ context: { extension: name } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/ski-missing", severity: "warn", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (n)",
+    /** @internal "(SHOULD be present)". The same clause adds that the value SHOULD be derived from
+     * the public key, which names no derivation, so a certificate using one this cannot recompute
+     * is conformant and no row reports it. */
+    message: "a subscriber certificate should carry a subjectKeyIdentifier extension",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { return ctx.raw("subjectKeyIdentifier") ? null : true; },
+  },
+];
+
+/** @internal The CA/Browser Forum Code Signing BR v3.11.0 subscriber profile. Every severity is
+ *  graded against the clause the row cites, never against the same-named row of another profile:
+ *  this document says MUST where the S/MIME one says SHOULD for cRLDistributionPoints criticality,
+ *  authorityInformationAccess presence and keyUsage criticality. */
+var CABF_CS_RULES = [
+  {
+    id: "lint/cabf-cs/policies-missing", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (a)",
+    message: "a subscriber certificate must carry a certificatePolicies extension",
+    appliesTo: _isCs,
+    check: function (cert, ctx) { return ctx.raw("certificatePolicies") ? null : true; },
+  },
+  {
+    id: "lint/cabf-cs/policies-critical", severity: "warn", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (a)",
+    message: "certificatePolicies should not be marked critical",
+    appliesTo: _isCs,
+    check: function (cert, ctx) {
+      var e = ctx.raw("certificatePolicies");
+      return (e && e.critical === true) ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-cs/policies-reserved-identifier-count", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.6.4",
+    /** @internal "a Certificate issued to a Subscriber MUST contain exactly one of the reserved
+     * policy OIDs specified in Section 7.1.6.1", so both none and two are reported. */
+    message: "a subscriber certificate must assert exactly one reserved code signing policy identifier",
+    appliesTo: _isCs,
+    effectiveDate: CS_RESERVED_POLICY_REQUIRED,
+    check: function (cert, ctx) {
+      var d = ctx.decode("certificatePolicies");
+      if (!d || !Array.isArray(d.value)) return null;
+      var found = d.value.filter(function (pi) { return !!CS_KIND_BY_POLICY[pi.policyIdentifier]; });
+      return found.length === 1 ? null : { context: { count: found.length } };
+    },
+  },
+  {
+    id: "lint/cabf-cs/policies-cps-not-http-url", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (a)",
+    /** @internal "HTTP URL for the Subordinate CA's Certification Practice Statement". This clause
+     * names one scheme where the S/MIME clause for the same qualifier names two, so an HTTPS
+     * qualifier is conformant there and reported here. */
+    message: "an id-qt-cps policy qualifier must be a HTTP URL",
+    appliesTo: _isCs,
+    check: function (cert, ctx) {
+      var out = [];
+      _eachPolicyQualifier(ctx, function (qid, value, pi) {
+        if (qid !== OID_CPS) return;
+        var uri = null;
+        // allow:swallow-unverified a CPSuri that will not read as a string is not a URL either, so it falls to the report below rather than out of the rule
+        try {
+          uri = asn1.read.string(value);
+        } catch (_e) {
+          void 0;
+        }
+        if (pkiBuild.httpUrlScheme(uri) !== "http") {
+          out.push({ context: { policyIdentifier: pi.policyIdentifier, cps: uri } });
+        }
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-cs/crldp-missing", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (b)",
+    message: "a subscriber certificate must carry a cRLDistributionPoints extension",
+    appliesTo: _isCs,
+    check: function (cert, ctx) { return ctx.raw("cRLDistributionPoints") ? null : true; },
+  },
+  {
+    id: "lint/cabf-cs/crldp-critical", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (b)",
+    /** @internal "It MUST NOT be marked critical", where the S/MIME clause for the same extension
+     * says SHOULD NOT, so the same certificate draws an error here and a warning there. */
+    message: "cRLDistributionPoints must not be marked critical",
+    appliesTo: _isCs,
+    check: function (cert, ctx) {
+      var e = ctx.raw("cRLDistributionPoints");
+      return (e && e.critical === true) ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-cs/crldp-no-http-uri", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (b)",
+    /** @internal "it MUST contain the HTTP URL of the CA's CRL service". One HTTP URL is required
+     * and the clause forbids no other scheme beside it. */
+    message: "cRLDistributionPoints must contain a HTTP URL",
+    appliesTo: function (cert, ctx) { return _isCs(cert, ctx) && !!ctx.raw("cRLDistributionPoints"); },
+    check: function (cert, ctx) {
+      var uris = _crldpUris(ctx);
+      return uris.some(_isHttpUri) ? null : { context: { uris: uris } };
+    },
+  },
+  {
+    id: "lint/cabf-cs/aia-missing", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (c)",
+    /** @internal "This extension MUST be present", where the S/MIME clause asks at SHOULD. */
+    message: "a subscriber certificate must carry an authorityInformationAccess extension",
+    appliesTo: _isCs,
+    check: function (cert, ctx) { return ctx.raw("authorityInfoAccess") ? null : true; },
+  },
+  {
+    id: "lint/cabf-cs/aia-critical", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (c)",
+    message: "authorityInformationAccess must not be marked critical",
+    appliesTo: _isCs,
+    check: function (cert, ctx) {
+      var e = ctx.raw("authorityInfoAccess");
+      return (e && e.critical === true) ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-cs/aia-ca-issuers-missing", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (c)",
+    /** @internal "It MUST contain the HTTP URL of the Issuing CA's certificate", so the method is
+     * required rather than recommended, unlike the S/MIME clause's SHOULD. */
+    message: "authorityInformationAccess must carry an id-ad-caIssuers accessMethod",
+    appliesTo: function (cert, ctx) { return _isCs(cert, ctx) && !!ctx.raw("authorityInfoAccess"); },
+    check: function (cert, ctx) {
+      var d = ctx.decode("authorityInfoAccess");
+      if (!d || !Array.isArray(d.value)) return null;
+      var wanted = oid.byName("caIssuers");
+      for (var i = 0; i < d.value.length; i++) {
+        if (d.value[i].accessMethod === wanted) return null;
+      }
+      return true;
+    },
+  },
+  {
+    id: "lint/cabf-cs/aia-non-http-uri", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (c)",
+    /** @internal The clause states one rule for both accessMethods it names, so unlike the S/MIME
+     * clause there is no table per method and every location is held to the same reading. */
+    message: "an authorityInformationAccess accessLocation must be a HTTP URL",
+    appliesTo: function (cert, ctx) { return _isCs(cert, ctx) && !!ctx.raw("authorityInfoAccess"); },
+    check: function (cert, ctx) {
+      var locs = _csAiaLocations(ctx);
+      var bad = locs.filter(function (u) { return !_isHttpUri(u); });
+      if (!bad.length) return null;
+      return { context: { uris: bad.filter(function (u) { return u !== null; }),
+        nonUriLocations: bad.filter(function (u) { return u === null; }).length } };
+    },
+  },
+  {
+    id: "lint/cabf-cs/basic-constraints-ca-true", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (d)",
+    message: "a subscriber certificate's basicConstraints cA field must not be true",
+    appliesTo: _isCs,
+    check: function (cert, ctx) {
+      var d = ctx.decode("basicConstraints");
+      return (d && d.value && d.value.cA === true) ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-cs/key-usage-missing", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (e)",
+    message: "a subscriber certificate must carry a keyUsage extension",
+    appliesTo: _isCs,
+    check: function (cert, ctx) { return ctx.raw("keyUsage") ? null : true; },
+  },
+  {
+    id: "lint/cabf-cs/key-usage-not-critical", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (e)",
+    /** @internal "MUST be marked critical", where the S/MIME clause says SHOULD. */
+    message: "keyUsage must be marked critical",
+    appliesTo: function (cert, ctx) { return _isCs(cert, ctx) && !!ctx.raw("keyUsage"); },
+    check: function (cert, ctx) {
+      var e = ctx.raw("keyUsage");
+      return (e && e.critical === true) ? null : true;
+    },
+  },
+  {
+    id: "lint/cabf-cs/key-usage-missing-digital-signature", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (e)",
+    message: "keyUsage must assert digitalSignature",
+    appliesTo: function (cert, ctx) { return _isCs(cert, ctx) && !!ctx.raw("keyUsage"); },
+    check: function (cert, ctx) {
+      var d = ctx.decode("keyUsage");
+      if (!d || !d.value) return null;
+      return d.value.digitalSignature === true ? null : true;
+    },
+  },
+  {
+    id: "lint/cabf-cs/key-usage-forbidden-bit", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (e)",
+    /** @internal "Bit positions for keyCertSign and cRLSign MUST NOT be set." The next sentence
+     * covers every other bit at SHOULD NOT, so the two lists are two rows at two strengths. */
+    message: "keyUsage must not assert keyCertSign or cRLSign",
+    appliesTo: _isCs,
+    check: function (cert, ctx) {
+      var d = ctx.decode("keyUsage");
+      if (!d || !d.value) return null;
+      var out = [];
+      CS_FORBIDDEN_KU.forEach(function (bit) {
+        if (d.value[bit] === true) out.push({ context: { keyUsage: bit } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-cs/key-usage-discouraged-bit", severity: "warn", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (e)",
+    /** @internal "All other bit positions SHOULD NOT be set", which reaches every bit other than
+     * the required digitalSignature and the two the row above forbids, including one set past the
+     * nine RFC 5280 names. */
+    message: "keyUsage should not assert a bit beyond digitalSignature",
+    appliesTo: _isCs,
+    check: function (cert, ctx) {
+      var d = ctx.decode("keyUsage");
+      if (!d || !d.value) return null;
+      var out = [];
+      KU_BIT_NAMES.forEach(function (bit) {
+        if (bit === "digitalSignature" || CS_FORBIDDEN_KU.indexOf(bit) !== -1) return;
+        if (d.value[bit] === true) out.push({ context: { keyUsage: bit } });
+      });
+      if (d.value.reservedBitsSet === true) out.push({ context: { reservedBitSet: true } });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-cs/eku-missing-code-signing", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (f)",
+    message: "a code signing certificate must carry id-kp-codeSigning",
+    appliesTo: _isCsCodeSigning,
+    check: function (cert, ctx) {
+      var d = ctx.decode("extKeyUsage");
+      if (!d || !Array.isArray(d.value)) return true;
+      return d.value.indexOf(oid.byName("codeSigning")) === -1 ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-cs/eku-missing-time-stamping", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (f)",
+    message: "a timestamp certificate must carry id-kp-timeStamping",
+    appliesTo: _isCsTimestamp,
+    check: function (cert, ctx) {
+      var d = ctx.decode("extKeyUsage");
+      if (!d || !Array.isArray(d.value)) return true;
+      return d.value.indexOf(oid.byName("timeStamping")) === -1 ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-cs/eku-not-critical-timestamp", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (f)",
+    /** @internal "id-kp-timeStamping MUST be present and MUST be marked critical", the one place
+     * this section requires a critical extKeyUsage. */
+    message: "a timestamp certificate's extKeyUsage must be marked critical",
+    appliesTo: function (cert, ctx) { return _isCsTimestamp(cert, ctx) && !!ctx.raw("extKeyUsage"); },
+    check: function (cert, ctx) {
+      var e = ctx.raw("extKeyUsage");
+      return (e && e.critical === true) ? null : true;
+    },
+  },
+  {
+    id: "lint/cabf-cs/eku-forbidden-purpose", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (f)",
+    message: "extKeyUsage must not carry anyExtendedKeyUsage or id-kp-serverAuth",
+    appliesTo: _isCs,
+    check: function (cert, ctx) {
+      var d = ctx.decode("extKeyUsage");
+      if (!d || !Array.isArray(d.value)) return null;
+      var out = [];
+      CS_FORBIDDEN_EKU.forEach(function (dotted) {
+        if (d.value.indexOf(dotted) !== -1) {
+          out.push({ context: { purpose: dotted, name: oid.name(dotted) || null } });
+        }
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-cs/eku-discouraged-purpose", severity: "warn", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (f)",
+    /** @internal "Other values SHOULD NOT be present." The clause continues that a CA presenting
+     * one must hold a business agreement with a platform vendor, which is a fact about the CA
+     * rather than about the certificate, so this row reports the value and says nothing about the
+     * agreement. The purpose each kind requires, the three the clause names as MAY, and the two
+     * the row above forbids are all passed over here. */
+    message: "extKeyUsage should not carry a purpose beyond the ones this profile names",
+    appliesTo: _isCs,
+    check: function (cert, ctx) {
+      var d = ctx.decode("extKeyUsage");
+      if (!d || !Array.isArray(d.value)) return null;
+      var required = _isCsTimestamp(cert, ctx) ? oid.byName("timeStamping") : oid.byName("codeSigning");
+      var out = [];
+      d.value.forEach(function (dotted) {
+        if (dotted === required) return;
+        if (CS_PERMITTED_EXTRA_EKU.indexOf(dotted) !== -1) return;
+        if (CS_FORBIDDEN_EKU.indexOf(dotted) !== -1) return;
+        out.push({ context: { purpose: dotted, name: oid.name(dotted) || null } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-cs/aki-missing", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (g)",
+    message: "a subscriber certificate must carry an authorityKeyIdentifier extension",
+    appliesTo: _isCs,
+    check: function (cert, ctx) { return ctx.raw("authorityKeyIdentifier") ? null : true; },
+  },
+  {
+    id: "lint/cabf-cs/aki-critical", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (g)",
+    message: "authorityKeyIdentifier must not be marked critical",
+    appliesTo: _isCs,
+    check: function (cert, ctx) {
+      var e = ctx.raw("authorityKeyIdentifier");
+      return (e && e.critical === true) ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-cs/validity-too-long", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 6.3.2",
+    /** @internal Three ceilings, keyed on the kind and on the issuance date: 39 months for a code
+     * signing certificate issued before 1 March 2026, 460 days for one issued on or after it, and
+     * 135 months for a timestamp certificate either side of that date. A ceiling stated in months
+     * is measured in months, through guard.time.addMonths, since how many days 39 months hold
+     * depends on which 39. */
+    message: "the validity period exceeds the maximum this profile gives for the certificate's kind and issuance date",
+    appliesTo: _isCs,
+    check: function (cert, ctx) {
+      var v = cert.validity;
+      if (!guard.time.isDate(v.notBefore) || !guard.time.isDate(v.notAfter)) return null;
+      var notAfter = guard.time.instantOf(v.notAfter);
+      if (_isCsTimestamp(cert, ctx)) {
+        var tsCeiling = guard.time.addMonths(v.notBefore, 135, _cfg, "lint/bad-input", "notBefore");
+        return notAfter > guard.time.instantOf(tsCeiling)
+          ? { context: { maxMonths: 135 } } : null;
+      }
+      if (guard.time.instantOf(v.notBefore) < guard.time.instantOf(CS_VALIDITY_DAYS_START)) {
+        var monthCeiling = guard.time.addMonths(v.notBefore, 39, _cfg, "lint/bad-input", "notBefore");
+        return notAfter > guard.time.instantOf(monthCeiling)
+          ? { context: { maxMonths: 39 } } : null;
+      }
+      var days = (notAfter - guard.time.instantOf(v.notBefore)) / MS_PER_DAY;
+      return days > 460 ? { context: { days: Math.round(days), maxDays: 460 } } : null;
+    },
+  },
+  {
+    id: "lint/cabf-cs/weak-key", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 6.1.5.2",
+    /** @internal The section names RSA, ECDSA and DSA and no other family, so a key outside the
+     * three is reported: a certificate the profile covers must carry one it names. */
+    message: "the subject public key is below the Code Signing BR minimum (RSA < 3072 bits, or a curve or family the section does not name)",
+    appliesTo: _isCs,
+    check: function (cert) {
+      var spki = cert.subjectPublicKeyInfo, name = spki && spki.algorithm && spki.algorithm.name;
+      if (RSA_KEY_ALGS[name]) {
+        var bits = _rsaModulusBits(spki);
+        return (bits === null || bits < CS_RSA_MIN_BITS) ? { context: { rsaBits: bits } } : null;
+      }
+      if (name === "ecPublicKey") {
+        var curve = _ecCurveName(spki);
+        return CS_EC_CURVES.indexOf(curve) === -1 ? { context: { curve: curve } } : null;
+      }
+      if (name === "dsa") {
+        var dsa = _dsaParamBits(spki);
+        if (dsa === null) return { context: { keyAlgorithm: "dsa", dsaL: null, dsaN: null } };
+        return (dsa.L === CS_DSA_L && CS_DSA_N.indexOf(dsa.N) !== -1)
+          ? null : { context: { keyAlgorithm: "dsa", dsaL: dsa.L, dsaN: dsa.N } };
+      }
+      return { context: { keyAlgorithm: name || null } };
+    },
+  },
+];
+
 var CABF_TLS_RULES = [
   {
     id: "lint/cabf-tls/aia-missing", severity: "error", source: "cabf-tls", citation: "CABF TLS BR 7.1.2.7.6",
@@ -2253,28 +3510,33 @@ var CABF_TLS_CSR_RULE_IDS = [
   "lint/cabf-tls/weak-key",
 ];
 
+/** @internal RFC 5280 sec. 4.2 fixes each extension's syntax wherever it is carried. Every row in
+ *  every profile below asks for an extension BY NAME, and the shared decoder returns null both for
+ *  one that is absent and for one whose value does not decode, so without this row a malformed
+ *  value reads as absence and passes every row that asks for it. The certificate's own row is
+ *  reused rather than restated, and it is folded into each named profile rather than into the
+ *  *_RULES arrays, which `ALL_RULES` concatenates and would otherwise report it twice. */
+var RFC5280_EXTENSION_SYNTAX_RULES = RFC5280_RULES.filter(function (r) {
+  return r.id === "lint/rfc5280/extension-undecodable";
+});
 var PROFILES = Object.assign(Object.create(null), {
   "rfc5280": RFC5280_RULES,
-  "rfc9881": RFC9881_RULES,
-  "rfc9909": RFC9909_RULES,
-  "rfc9935": RFC9935_RULES,
-  "cabf-tls": CABF_TLS_RULES,
+  "rfc9881": RFC9881_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
+  "rfc9909": RFC9909_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
+  "rfc9935": RFC9935_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
+  "cabf-tls": CABF_TLS_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
+  "cabf-smime": CABF_SMIME_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
+  "cabf-cs": CABF_CS_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
 });
-var ALL_RULES = RFC5280_RULES.concat(RFC9881_RULES).concat(RFC9909_RULES).concat(RFC9935_RULES).concat(CABF_TLS_RULES);
+var ALL_RULES = RFC5280_RULES.concat(RFC9881_RULES).concat(RFC9909_RULES).concat(RFC9935_RULES)
+  .concat(CABF_TLS_RULES).concat(CABF_SMIME_RULES).concat(CABF_CS_RULES);
 
 var CABF_TLS_CSR_RULES = CABF_TLS_RULES.filter(function (r) {
   return CABF_TLS_CSR_RULE_IDS.indexOf(r.id) !== -1;
 });
-/** @internal RFC 5280 sec. 4.2 fixes each extension's syntax wherever it is carried, and a
- *  requested extension whose value does not decode is the same fault in a request as in a
- *  certificate. The certificate's own row reads `extensions` and the request view supplies it, so
- *  the row is reused rather than restated. Without it a malformed requested value counted as a
- *  passing check, because the shared decoder returns null and every row that asks by name reads
- *  that null as absence. */
-var RFC5280_CSR_RULES = RFC5280_RULES.filter(function (r) {
-  return r.id === "lint/rfc5280/extension-undecodable";
-});
-var CSR_STRUCTURAL_RULES = RFC2986_CSR_RULES.concat(RFC5280_CSR_RULES);
+/** @internal A requested extension whose value does not decode is the same fault in a request as
+ *  in a certificate, so the request profiles take the same row the certificate profiles do. */
+var CSR_STRUCTURAL_RULES = RFC2986_CSR_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES);
 var CSR_PROFILES = Object.assign(Object.create(null), {
   "rfc2986": CSR_STRUCTURAL_RULES,
   "cabf-tls": CSR_STRUCTURAL_RULES.concat(CABF_TLS_CSR_RULES),
@@ -2378,7 +3640,9 @@ function _ingestCsr(input) {
   var derived = _derivedCsr(input);
   if (derived) return { csr: derived };
   var der;
-  if (Buffer.isBuffer(input)) der = input;
+  var bytes = _derBytesOf(input);
+  if (bytes !== null && bytes.fatal) return { fatal: bytes.fatal };
+  if (bytes !== null) der = bytes.der;
   else if (typeof input === "string") {
     try { der = csrSchema.pemDecode(input); }
     catch (e) { return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "pki.lint", message: "input is not a decodable PEM/DER certification request", context: { code: e.code } } }; }
@@ -2487,7 +3751,9 @@ function _ingestCrl(input) {
   var derived = _derivedCrl(input);
   if (derived) return { crl: derived };
   var der;
-  if (Buffer.isBuffer(input)) der = input;
+  var bytes = _derBytesOf(input);
+  if (bytes !== null && bytes.fatal) return { fatal: bytes.fatal };
+  if (bytes !== null) der = bytes.der;
   else if (typeof input === "string") {
     try { der = crlSchema.pemDecode(input); }
     catch (e) { return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "pki.lint", message: "input is not a decodable PEM/DER CRL", context: { code: e.code } } }; }
@@ -2660,7 +3926,9 @@ var _OCSP_CLAIM = ["responseStatus", "basicResponse", "tbsResponseDataBytes"];
  * responses. Bytes and PEM take the fatal path below, never a throw. */
 function _ingestOcsp(input) {
   var der;
-  if (Buffer.isBuffer(input)) der = input;
+  var bytes = _derBytesOf(input);
+  if (bytes !== null && bytes.fatal) return { fatal: bytes.fatal };
+  if (bytes !== null) der = bytes.der;
   else if (typeof input === "string") {
     try { der = ocspSchema.pemDecode(input); }
     catch (e) { return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "pki.lint", message: "input is not a decodable PEM/DER OCSP response", context: { code: e.code } } }; }
@@ -2793,6 +4061,10 @@ var BY_ARTIFACT = Object.assign(Object.create(null), {
 });
 
 function rules(profile, artifact) {
+  /** @internal Every lint verb reads "all" and "default" as naming no profile, so the enumerator
+   * reads them the same way: a caller who linted under one of those names and then asked which
+   * rows ran would otherwise be refused the answer by the same registry that ran them. */
+  if (profile === "all" || profile === "default") profile = null;
   if (artifact != null && !Object.prototype.hasOwnProperty.call(BY_ARTIFACT, artifact)) {
     throw _cfg("lint/bad-input", "unknown lint artifact \"" + artifact +
       "\" (known: " + Object.keys(BY_ARTIFACT).join(", ") + ")");