certinspect 2.3.1__tar.gz → 2.3.2__tar.gz

{certinspect-2.3.1/src/certinspect.egg-info → certinspect-2.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: certinspect
-Version: 2.3.1
+Version: 2.3.2
 Summary: Command-line TLS certificate inspector
 Author-email: Michele Angrisano <michele.angrisano@gmail.com>
 License-Expression: MIT

{certinspect-2.3.1 → certinspect-2.3.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "certinspect"
-version = "2.3.1"
+version = "2.3.2"
 description = "Command-line TLS certificate inspector"
 readme = "README.md"
 requires-python = ">=3.12"

{certinspect-2.3.1 → certinspect-2.3.2}/src/certinspect/__init__.py

@@ -1,3 +1,3 @@
 """certinspect — command-line TLS certificate inspector."""
 
-__version__ = "2.3.1"
+__version__ = "2.3.2"

{certinspect-2.3.1 → certinspect-2.3.2}/src/certinspect/cli.py

@@ -26,12 +26,12 @@ from certinspect.discover import (
 )
 from certinspect.fetch import (
     STARTTLS_PORTS,
-    check_revocation,
     get_server_cert,
     retry_network,
     verify_chain,
     verify_chain_offline,
 )
+from certinspect.revocation import check_revocation
 from certinspect.parser import (
     load_certificate,
     load_certificates,

{certinspect-2.3.1 → certinspect-2.3.2}/src/certinspect/discover.py

@@ -14,7 +14,7 @@ import json
 from dataclasses import dataclass
 from urllib.parse import urlencode
 
-from certinspect.fetch import _http
+from certinspect.httpfetch import _http
 
 # crt.sh search front end. The `%` in the query is a SQL LIKE wildcard matching
 # any subdomain label; `output=json` asks for machine-readable results.

certinspect-2.3.2/src/certinspect/exit_codes.py

@@ -0,0 +1,53 @@
+"""Process exit codes and the status-to-code mapping.
+
+Single source of truth for the exit codes certinspect returns, so the
+orchestration (cli) and the reporters (formatter) agree on what each number
+means instead of repeating the literals.
+"""
+
+from enum import IntEnum, StrEnum
+
+
+class ExitCode(IntEnum):
+    """Exit code reflecting the worst certificate state found.
+
+    Kept distinct from argparse's usage error (2) and the generic runtime
+    error (1), which are not certificate states and stay plain integers.
+    """
+
+    OK = 0
+    EXPIRING = 3
+    INVALID = 4  # expired, critical, not-yet-valid or invalid dates
+    HOSTNAME_MISMATCH = 5
+    UNTRUSTED_OR_REVOKED = 6
+    PIN_MISMATCH = 7
+    SAN_MISMATCH = 8
+    POLICY = 9
+
+
+class Status(StrEnum):
+    """Certificate validity status returned by ``certificate_status``.
+
+    A ``StrEnum`` so each member still *is* its plain string ("EXPIRED", ...),
+    keeping the JSON output and every existing string comparison unchanged
+    while giving one authoritative definition of the status set.
+    """
+
+    VALID = "VALID"
+    EXPIRING = "EXPIRING"
+    CRITICAL = "CRITICAL"
+    EXPIRED = "EXPIRED"
+    NOT_YET_VALID = "NOT YET VALID"
+    INVALID_DATES = "INVALID DATES"
+
+
+# Validity status mapped to its exit code; the four non-valid date states all
+# share ExitCode.INVALID.
+EXIT_BY_STATUS: dict[Status, ExitCode] = {
+    Status.VALID: ExitCode.OK,
+    Status.EXPIRING: ExitCode.EXPIRING,
+    Status.CRITICAL: ExitCode.INVALID,
+    Status.EXPIRED: ExitCode.INVALID,
+    Status.INVALID_DATES: ExitCode.INVALID,
+    Status.NOT_YET_VALID: ExitCode.INVALID,
+}

{certinspect-2.3.1 → certinspect-2.3.2}/src/certinspect/fetch.py

@@ -10,78 +10,22 @@ connection failing. Validity is computed later in parser.py.
 """
 
 import base64
-import ipaddress
 import socket
 import ssl
 import time
 import urllib.request
 import warnings
-from datetime import datetime, timedelta, timezone
 from urllib.parse import urlsplit
 
 from cryptography import x509
-from cryptography.hazmat.primitives import hashes, serialization
-from cryptography.x509 import ocsp, verification
-from cryptography.x509.oid import AuthorityInformationAccessOID, ExtensionOID, NameOID
+from cryptography.x509 import verification
+from cryptography.x509.oid import NameOID
 
 
 # Standard plaintext ports for the STARTTLS-capable protocols, used as the
 # default port when --port is left unset.
 STARTTLS_PORTS = {"smtp": 587, "imap": 143, "pop3": 110, "ftp": 21}
 
-# Cap the size of any certificate-supplied HTTP response (OCSP/CRL/CA-Issuer)
-# so a malicious certificate cannot point us at an unbounded download and
-# exhaust memory. Real-world CRLs stay comfortably below this.
-_MAX_HTTP_RESPONSE_BYTES = 16 * 1024 * 1024
-
-# Clock-skew tolerance when judging whether an OCSP response is still fresh.
-_OCSP_CLOCK_SKEW = timedelta(minutes=5)
-
-
-def _is_blocked_fetch_address(
-    ip: ipaddress.IPv4Address | ipaddress.IPv6Address,
-) -> bool:
-    """Return True for addresses a certificate-supplied URL must not reach.
-
-    Loopback, link-local (which covers the cloud metadata endpoint
-    ``169.254.169.254``), unspecified, multicast and reserved ranges are
-    refused. Private RFC1918 ranges are deliberately allowed so revocation
-    still works behind an internal PKI.
-    """
-    return (
-        ip.is_loopback
-        or ip.is_link_local
-        or ip.is_unspecified
-        or ip.is_multicast
-        or ip.is_reserved
-    )
-
-
-def _guard_fetch_host(url: str) -> None:
-    """Refuse to fetch a certificate-supplied URL pointing at an internal host.
-
-    OCSP, CRL and CA-Issuer URLs come from the inspected certificate, i.e. from
-    untrusted input; following them blindly would turn certinspect into an SSRF
-    primitive able to reach the cloud metadata service or a port on localhost.
-    The host is resolved and every returned address checked. The guard is
-    best-effort (the HTTP client resolves DNS again, so a rebinding attacker
-    could still race it) but closes the obvious vectors. Raises ValueError when
-    the target is not allowed, which the callers already treat as a soft-fail.
-    """
-    host = urlsplit(url).hostname
-    if not host:
-        raise ValueError(f"URL has no host: {url}")
-    try:
-        infos = socket.getaddrinfo(host, None, proto=socket.IPPROTO_TCP)
-    except OSError as err:
-        raise ValueError(f"could not resolve {host}: {err}") from err
-    for info in infos:
-        ip = ipaddress.ip_address(info[4][0])
-        if _is_blocked_fetch_address(ip):
-            raise ValueError(
-                f"refusing to fetch {url}: {ip} is a non-routable or internal address"
-            )
-
 
 def _read_connect_response(sock: socket.socket) -> bytes:
     """Read an HTTP CONNECT response up to the end of its header block."""
@@ -494,263 +438,3 @@ def verify_chain_offline(
     except verification.VerificationError as err:
         return False, str(err), []
     return True, None, list(verified)
-
-
-def _aia_urls(cert: x509.Certificate) -> tuple[list[str], list[str]]:
-    """Return (ocsp_urls, ca_issuer_urls) from the certificate's AIA extension.
-
-    Both lists are empty when the Authority Information Access extension is
-    absent.
-    """
-    try:
-        aia = cert.extensions.get_extension_for_oid(
-            ExtensionOID.AUTHORITY_INFORMATION_ACCESS
-        ).value
-    except x509.ExtensionNotFound:
-        return [], []
-
-    ocsp_urls: list[str] = []
-    issuer_urls: list[str] = []
-    for desc in aia:
-        location = desc.access_location.value
-        if desc.access_method == AuthorityInformationAccessOID.OCSP:
-            ocsp_urls.append(location)
-        elif desc.access_method == AuthorityInformationAccessOID.CA_ISSUERS:
-            issuer_urls.append(location)
-    return ocsp_urls, issuer_urls
-
-
-def _http(url: str, *, data: bytes | None = None, timeout: float) -> bytes:
-    """Perform a minimal HTTP(S) GET/POST and return the response body.
-
-    Only ``http`` and ``https`` URLs are accepted; the URLs come from the
-    certificate's own AIA/CRL extensions, i.e. from untrusted input, so the
-    target host is screened against internal/non-routable addresses and the
-    response size is capped. A POST is used when ``data`` is given.
-    """
-    if not url.lower().startswith(("http://", "https://")):
-        raise ValueError(f"unsupported URL scheme: {url}")
-    _guard_fetch_host(url)
-    headers = {"Content-Type": "application/ocsp-request"} if data else {}
-    request = urllib.request.Request(url, data=data, headers=headers)
-    with urllib.request.urlopen(request, timeout=timeout) as response:  # noqa: S310
-        body = response.read(_MAX_HTTP_RESPONSE_BYTES + 1)
-    if len(body) > _MAX_HTTP_RESPONSE_BYTES:
-        raise ValueError(
-            f"response from {url} exceeds the {_MAX_HTTP_RESPONSE_BYTES}-byte limit"
-        )
-    return body
-
-
-def _fetch_issuer(cert: x509.Certificate, timeout: float) -> x509.Certificate | None:
-    """Download the issuer certificate via the AIA "CA Issuers" URL.
-
-    Return None when no usable issuer can be retrieved.
-    """
-    _, issuer_urls = _aia_urls(cert)
-    for url in issuer_urls:
-        try:
-            return x509.load_der_x509_certificate(_http(url, timeout=timeout))
-        except (OSError, ValueError):
-            continue
-    return None
-
-
-def _crl_urls(cert: x509.Certificate) -> list[str]:
-    """Return the HTTP(S) CRL distribution-point URLs from the certificate.
-
-    Only ``http``/``https`` distribution points are returned (LDAP and other
-    schemes are skipped). The list is empty when the CRLDistributionPoints
-    extension is absent or carries no usable URL.
-    """
-    try:
-        dps = cert.extensions.get_extension_for_oid(
-            ExtensionOID.CRL_DISTRIBUTION_POINTS
-        ).value
-    except x509.ExtensionNotFound:
-        return []
-
-    urls: list[str] = []
-    for dp in dps:
-        for name in dp.full_name or []:
-            value = getattr(name, "value", None)
-            if isinstance(value, str) and value.lower().startswith(
-                ("http://", "https://")
-            ):
-                urls.append(value)
-    return urls
-
-
-def _ocsp_response_stale(response: ocsp.OCSPResponse) -> str | None:
-    """Return a reason when the OCSP response is outside its validity window.
-
-    A response whose ``nextUpdate`` is already in the past (or whose
-    ``thisUpdate`` lies in the future) may be a replayed or stale answer and
-    must not back a trusted GOOD verdict; a small clock-skew tolerance is
-    allowed. Missing timestamps or parse errors return None ("cannot tell"),
-    preserving the browser-like soft-fail behaviour.
-    """
-    now = datetime.now(timezone.utc)
-    try:
-        this_update = response.this_update_utc
-        next_update = response.next_update_utc
-    except (ValueError, AttributeError):
-        return None
-    if this_update is not None and this_update - _OCSP_CLOCK_SKEW > now:
-        return f"OCSP response not yet valid (thisUpdate {this_update})"
-    if next_update is not None and next_update + _OCSP_CLOCK_SKEW < now:
-        return f"OCSP response is stale (nextUpdate {next_update})"
-    return None
-
-
-def _check_ocsp(
-    cert: x509.Certificate,
-    issuer: x509.Certificate | None,
-    timeout: float,
-) -> tuple[str, str | None]:
-    """Check revocation via OCSP. See ``check_revocation`` for the status set."""
-    ocsp_urls, _ = _aia_urls(cert)
-    if not ocsp_urls:
-        return "UNAVAILABLE", "no OCSP responder in AIA extension"
-    if issuer is None:
-        return "UNAVAILABLE", "issuer certificate could not be retrieved"
-
-    # OCSP CertID conventionally uses SHA-1 for the issuer name/key hashes;
-    # many responders reject other digests.
-    builder = ocsp.OCSPRequestBuilder().add_certificate(cert, issuer, hashes.SHA1())
-    der_request = builder.build().public_bytes(serialization.Encoding.DER)
-
-    try:
-        raw = _http(ocsp_urls[0], data=der_request, timeout=timeout)
-    except (OSError, ValueError) as err:
-        return "UNAVAILABLE", f"OCSP request failed: {err}"
-
-    # Parsing must soft-fail too: some responders (e.g. DigiCert/GitHub) return
-    # a BasicOCSPResponse whose signatureAlgorithm the strict ASN.1 parser
-    # rejects with a ValueError. A malformed response must not abort the whole
-    # inspection — degrade to UNAVAILABLE and let the CRL fallback take over.
-    try:
-        response = ocsp.load_der_ocsp_response(raw)
-        if response.response_status != ocsp.OCSPResponseStatus.SUCCESSFUL:
-            return (
-                "UNAVAILABLE",
-                f"OCSP response status: {response.response_status.name}",
-            )
-        status = response.certificate_status
-    except ValueError as err:
-        return "UNAVAILABLE", f"OCSP response could not be parsed: {err}"
-
-    if status == ocsp.OCSPCertStatus.GOOD:
-        stale = _ocsp_response_stale(response)
-        if stale is not None:
-            return "UNAVAILABLE", stale
-        return "GOOD", None
-    if status == ocsp.OCSPCertStatus.REVOKED:
-        when = getattr(response, "revocation_time_utc", None)
-        return "REVOKED", f"revoked at {when}" if when else "revoked"
-    return "UNKNOWN", "responder does not know this certificate"
-
-
-def _load_crl(raw: bytes) -> x509.CertificateRevocationList | None:
-    """Parse a CRL from DER or PEM bytes, or return None when neither works."""
-    try:
-        return x509.load_der_x509_crl(raw)
-    except ValueError:
-        try:
-            return x509.load_pem_x509_crl(raw)
-        except ValueError:
-            return None
-
-
-def _crl_stale(crl: x509.CertificateRevocationList) -> str | None:
-    """Return a reason when a CRL is outside its validity window."""
-    now = datetime.now(timezone.utc)
-    try:
-        last_update = crl.last_update_utc
-        next_update = crl.next_update_utc
-    except (ValueError, AttributeError):
-        return None
-    if last_update is not None and last_update - _OCSP_CLOCK_SKEW > now:
-        return f"CRL is not yet valid (lastUpdate {last_update})"
-    if next_update is not None and next_update + _OCSP_CLOCK_SKEW < now:
-        return f"CRL is stale (nextUpdate {next_update})"
-    return None
-
-
-def _check_crl(
-    cert: x509.Certificate,
-    issuer: x509.Certificate | None,
-    timeout: float,
-) -> tuple[str, str | None]:
-    """Check revocation via the certificate's CRL distribution points.
-
-    Download each CRL in turn and look up the certificate's serial number.
-    When ``issuer`` is known the CRL signature is verified and a CRL that
-    fails the check is skipped. The first CRL that yields a verdict wins;
-    otherwise the status is ``"UNAVAILABLE"`` (soft-fail).
-    """
-    urls = _crl_urls(cert)
-    if not urls:
-        return "UNAVAILABLE", "no CRL distribution point in extension"
-
-    for url in urls:
-        try:
-            raw = _http(url, timeout=timeout)
-        except (OSError, ValueError):
-            continue
-        crl = _load_crl(raw)
-        if crl is None:
-            continue
-        if issuer is not None and not crl.is_signature_valid(issuer.public_key()):
-            continue
-
-        revoked = crl.get_revoked_certificate_by_serial_number(cert.serial_number)
-        if revoked is not None:
-            when = getattr(revoked, "revocation_date_utc", None)
-            detail = f"revoked at {when}" if when else "revoked"
-            return "REVOKED", f"{detail} (via CRL)"
-        stale = _crl_stale(crl)
-        if stale is not None:
-            return "UNAVAILABLE", stale
-        return "GOOD", "via CRL"
-
-    return "UNAVAILABLE", "CRL could not be retrieved"
-
-
-def check_revocation(
-    cert: x509.Certificate,
-    timeout: float = 5.0,
-    issuer: x509.Certificate | None = None,
-) -> tuple[str, str | None]:
-    """Check the certificate's revocation status via OCSP, then CRL.
-
-    Return ``(status, detail)`` where status is one of:
-
-    * ``"GOOD"`` — the certificate is confirmed valid.
-    * ``"REVOKED"`` — the certificate is confirmed revoked.
-    * ``"UNKNOWN"`` — the OCSP responder does not know this certificate.
-    * ``"UNAVAILABLE"`` — neither OCSP nor CRL gave an answer (soft-fail,
-      like a browser).
-
-    OCSP is tried first. When it soft-fails (no responder, issuer unavailable,
-    network or responder error) the certificate's CRL distribution points are
-    queried as a fallback. ``detail`` carries extra context (e.g. the
-    revocation time, or which source answered) when useful.
-
-    When ``issuer`` is provided (e.g. from the verified TLS chain) it is used
-    directly; otherwise the issuer is downloaded via the AIA "CA Issuers" URL.
-    """
-    if issuer is None:
-        issuer = _fetch_issuer(cert, timeout)
-
-    status, detail = _check_ocsp(cert, issuer, timeout)
-    if status != "UNAVAILABLE":
-        return status, detail
-
-    crl_status, crl_detail = _check_crl(cert, issuer, timeout)
-    if crl_status != "UNAVAILABLE":
-        return crl_status, crl_detail
-
-    # Both soft-failed: report the OCSP reason, which is usually the more
-    # informative of the two.
-    return status, detail

{certinspect-2.3.1 → certinspect-2.3.2}/src/certinspect/formatter.py

@@ -9,7 +9,7 @@ import csv
 import io
 import json
 
-from certinspect.exit_codes import ExitCode
+from certinspect.exit_codes import ExitCode, Status
 from certinspect.models import CertificateInfo
 from certinspect.parser import certificate_status
 
@@ -104,10 +104,10 @@ def format_human(
         if not info["pin_match"]:
             lines.append("WARNING: fingerprint does not match the expected pin")
 
-    if status == "CRITICAL":
+    if status == Status.CRITICAL:
         lines.append("")
         lines.append(f"CRITICAL: certificate expires in {days} days")
-    elif status == "NOT YET VALID":
+    elif status == Status.NOT_YET_VALID:
         lines.append("")
         lines.append(
             f"WARNING: certificate is not valid until {info['not_valid_before']}"
@@ -369,9 +369,9 @@ def format_summary(
             status = info.get("status") or certificate_status(
                 info, warn_days, critical_days
             )
-            if status == "CRITICAL":
+            if status == Status.CRITICAL:
                 counts["critical"] += 1
-            elif status == "NOT YET VALID":
+            elif status == Status.NOT_YET_VALID:
                 counts["not-yet-valid"] += 1
             else:
                 counts["expired"] += 1
@@ -496,7 +496,8 @@ def format_prometheus(
         days = info["days_to_expire"]
         is_valid = (
             0
-            if certificate_status(info, warn_days) in ("EXPIRED", "INVALID DATES")
+            if certificate_status(info, warn_days)
+            in (Status.EXPIRED, Status.INVALID_DATES)
             else 1
         )
         up.append(f'certinspect_up{{target="{label}"}} 1')

certinspect-2.3.2/src/certinspect/httpfetch.py

@@ -0,0 +1,84 @@
+"""SSRF-guarded HTTP GET/POST for certificate- and CT-log-supplied URLs.
+
+OCSP, CRL, CA-Issuer and Certificate Transparency URLs all come from untrusted
+input, so this small client screens the target host against internal or
+non-routable addresses and caps the response size. Shared by the revocation
+checks and the CT-log discovery.
+"""
+
+import ipaddress
+import socket
+import urllib.request
+from urllib.parse import urlsplit
+
+# Cap the size of any certificate-supplied HTTP response (OCSP/CRL/CA-Issuer)
+# so a malicious certificate cannot point us at an unbounded download and
+# exhaust memory. Real-world CRLs stay comfortably below this.
+_MAX_HTTP_RESPONSE_BYTES = 16 * 1024 * 1024
+
+
+def _is_blocked_fetch_address(
+    ip: ipaddress.IPv4Address | ipaddress.IPv6Address,
+) -> bool:
+    """Return True for addresses a certificate-supplied URL must not reach.
+
+    Loopback, link-local (which covers the cloud metadata endpoint
+    ``169.254.169.254``), unspecified, multicast and reserved ranges are
+    refused. Private RFC1918 ranges are deliberately allowed so revocation
+    still works behind an internal PKI.
+    """
+    return (
+        ip.is_loopback
+        or ip.is_link_local
+        or ip.is_unspecified
+        or ip.is_multicast
+        or ip.is_reserved
+    )
+
+
+def _guard_fetch_host(url: str) -> None:
+    """Refuse to fetch a certificate-supplied URL pointing at an internal host.
+
+    OCSP, CRL and CA-Issuer URLs come from the inspected certificate, i.e. from
+    untrusted input; following them blindly would turn certinspect into an SSRF
+    primitive able to reach the cloud metadata service or a port on localhost.
+    The host is resolved and every returned address checked. The guard is
+    best-effort (the HTTP client resolves DNS again, so a rebinding attacker
+    could still race it) but closes the obvious vectors. Raises ValueError when
+    the target is not allowed, which the callers already treat as a soft-fail.
+    """
+    host = urlsplit(url).hostname
+    if not host:
+        raise ValueError(f"URL has no host: {url}")
+    try:
+        infos = socket.getaddrinfo(host, None, proto=socket.IPPROTO_TCP)
+    except OSError as err:
+        raise ValueError(f"could not resolve {host}: {err}") from err
+    for info in infos:
+        ip = ipaddress.ip_address(info[4][0])
+        if _is_blocked_fetch_address(ip):
+            raise ValueError(
+                f"refusing to fetch {url}: {ip} is a non-routable or internal address"
+            )
+
+
+def _http(url: str, *, data: bytes | None = None, timeout: float) -> bytes:
+    """Perform a minimal HTTP(S) GET/POST and return the response body.
+
+    Only ``http`` and ``https`` URLs are accepted; the URLs come from the
+    certificate's own AIA/CRL extensions, i.e. from untrusted input, so the
+    target host is screened against internal/non-routable addresses and the
+    response size is capped. A POST is used when ``data`` is given.
+    """
+    if not url.lower().startswith(("http://", "https://")):
+        raise ValueError(f"unsupported URL scheme: {url}")
+    _guard_fetch_host(url)
+    headers = {"Content-Type": "application/ocsp-request"} if data else {}
+    request = urllib.request.Request(url, data=data, headers=headers)
+    with urllib.request.urlopen(request, timeout=timeout) as response:  # noqa: S310
+        body = response.read(_MAX_HTTP_RESPONSE_BYTES + 1)
+    if len(body) > _MAX_HTTP_RESPONSE_BYTES:
+        raise ValueError(
+            f"response from {url} exceeds the {_MAX_HTTP_RESPONSE_BYTES}-byte limit"
+        )
+    return body

{certinspect-2.3.1 → certinspect-2.3.2}/src/certinspect/parser.py

@@ -9,6 +9,7 @@ from cryptography import x509
 from cryptography.hazmat.primitives import hashes, serialization
 from cryptography.hazmat.primitives.asymmetric import dsa, ec, rsa
 from cryptography.x509.oid import AuthorityInformationAccessOID, ExtensionOID, NameOID
+from certinspect.exit_codes import Status
 from certinspect.models import CertificateInfo
 
 
@@ -404,7 +405,7 @@ def analyze(cert: x509.Certificate) -> CertificateInfo:
 
 def certificate_status(
     info: CertificateInfo, warn_days: int = 30, critical_days: int | None = None
-) -> str:
+) -> Status:
     """Return the validity status derived from the analyzed data.
 
     One of: 'INVALID DATES', 'NOT YET VALID', 'EXPIRED', 'CRITICAL',
@@ -415,17 +416,17 @@ def certificate_status(
     window is reported as 'CRITICAL' instead.
     """
     if info["not_valid_before"] > info["not_valid_after"]:
-        return "INVALID DATES"
+        return Status.INVALID_DATES
     if info["not_valid_before"] > datetime.now(timezone.utc):
-        return "NOT YET VALID"
+        return Status.NOT_YET_VALID
     days = info["days_to_expire"]
     if days < 0:
-        return "EXPIRED"
+        return Status.EXPIRED
     if critical_days is not None and days < critical_days:
-        return "CRITICAL"
+        return Status.CRITICAL
     if days < warn_days:
-        return "EXPIRING"
-    return "VALID"
+        return Status.EXPIRING
+    return Status.VALID
 
 
 # CA/Browser Forum TLS validity cap and its scheduled reductions (ballot

certinspect-2.3.2/src/certinspect/revocation.py

@@ -0,0 +1,257 @@
+"""Certificate revocation checking via OCSP and CRL.
+
+Given a certificate (and, ideally, its issuer) determine whether it has been
+revoked, trying OCSP first and falling back to the CRL distribution points.
+Both soft-fail like a browser when no authoritative answer is available. The
+HTTP transport is the SSRF-guarded client in :mod:`certinspect.httpfetch`.
+"""
+
+from datetime import datetime, timedelta, timezone
+
+from cryptography import x509
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.x509 import ocsp
+from cryptography.x509.oid import AuthorityInformationAccessOID, ExtensionOID
+
+from certinspect.httpfetch import _http
+
+# Clock-skew tolerance when judging whether an OCSP response is still fresh.
+_OCSP_CLOCK_SKEW = timedelta(minutes=5)
+
+
+def _aia_urls(cert: x509.Certificate) -> tuple[list[str], list[str]]:
+    """Return (ocsp_urls, ca_issuer_urls) from the certificate's AIA extension.
+
+    Both lists are empty when the Authority Information Access extension is
+    absent.
+    """
+    try:
+        aia = cert.extensions.get_extension_for_oid(
+            ExtensionOID.AUTHORITY_INFORMATION_ACCESS
+        ).value
+    except x509.ExtensionNotFound:
+        return [], []
+
+    ocsp_urls: list[str] = []
+    issuer_urls: list[str] = []
+    for desc in aia:
+        location = desc.access_location.value
+        if desc.access_method == AuthorityInformationAccessOID.OCSP:
+            ocsp_urls.append(location)
+        elif desc.access_method == AuthorityInformationAccessOID.CA_ISSUERS:
+            issuer_urls.append(location)
+    return ocsp_urls, issuer_urls
+
+
+def _fetch_issuer(cert: x509.Certificate, timeout: float) -> x509.Certificate | None:
+    """Download the issuer certificate via the AIA "CA Issuers" URL.
+
+    Return None when no usable issuer can be retrieved.
+    """
+    _, issuer_urls = _aia_urls(cert)
+    for url in issuer_urls:
+        try:
+            return x509.load_der_x509_certificate(_http(url, timeout=timeout))
+        except (OSError, ValueError):
+            continue
+    return None
+
+
+def _crl_urls(cert: x509.Certificate) -> list[str]:
+    """Return the HTTP(S) CRL distribution-point URLs from the certificate.
+
+    Only ``http``/``https`` distribution points are returned (LDAP and other
+    schemes are skipped). The list is empty when the CRLDistributionPoints
+    extension is absent or carries no usable URL.
+    """
+    try:
+        dps = cert.extensions.get_extension_for_oid(
+            ExtensionOID.CRL_DISTRIBUTION_POINTS
+        ).value
+    except x509.ExtensionNotFound:
+        return []
+
+    urls: list[str] = []
+    for dp in dps:
+        for name in dp.full_name or []:
+            value = getattr(name, "value", None)
+            if isinstance(value, str) and value.lower().startswith(
+                ("http://", "https://")
+            ):
+                urls.append(value)
+    return urls
+
+
+def _ocsp_response_stale(response: ocsp.OCSPResponse) -> str | None:
+    """Return a reason when the OCSP response is outside its validity window.
+
+    A response whose ``nextUpdate`` is already in the past (or whose
+    ``thisUpdate`` lies in the future) may be a replayed or stale answer and
+    must not back a trusted GOOD verdict; a small clock-skew tolerance is
+    allowed. Missing timestamps or parse errors return None ("cannot tell"),
+    preserving the browser-like soft-fail behaviour.
+    """
+    now = datetime.now(timezone.utc)
+    try:
+        this_update = response.this_update_utc
+        next_update = response.next_update_utc
+    except (ValueError, AttributeError):
+        return None
+    if this_update is not None and this_update - _OCSP_CLOCK_SKEW > now:
+        return f"OCSP response not yet valid (thisUpdate {this_update})"
+    if next_update is not None and next_update + _OCSP_CLOCK_SKEW < now:
+        return f"OCSP response is stale (nextUpdate {next_update})"
+    return None
+
+
+def _check_ocsp(
+    cert: x509.Certificate,
+    issuer: x509.Certificate | None,
+    timeout: float,
+) -> tuple[str, str | None]:
+    """Check revocation via OCSP. See ``check_revocation`` for the status set."""
+    ocsp_urls, _ = _aia_urls(cert)
+    if not ocsp_urls:
+        return "UNAVAILABLE", "no OCSP responder in AIA extension"
+    if issuer is None:
+        return "UNAVAILABLE", "issuer certificate could not be retrieved"
+
+    # OCSP CertID conventionally uses SHA-1 for the issuer name/key hashes;
+    # many responders reject other digests.
+    builder = ocsp.OCSPRequestBuilder().add_certificate(cert, issuer, hashes.SHA1())
+    der_request = builder.build().public_bytes(serialization.Encoding.DER)
+
+    try:
+        raw = _http(ocsp_urls[0], data=der_request, timeout=timeout)
+    except (OSError, ValueError) as err:
+        return "UNAVAILABLE", f"OCSP request failed: {err}"
+
+    # Parsing must soft-fail too: some responders (e.g. DigiCert/GitHub) return
+    # a BasicOCSPResponse whose signatureAlgorithm the strict ASN.1 parser
+    # rejects with a ValueError. A malformed response must not abort the whole
+    # inspection — degrade to UNAVAILABLE and let the CRL fallback take over.
+    try:
+        response = ocsp.load_der_ocsp_response(raw)
+        if response.response_status != ocsp.OCSPResponseStatus.SUCCESSFUL:
+            return (
+                "UNAVAILABLE",
+                f"OCSP response status: {response.response_status.name}",
+            )
+        status = response.certificate_status
+    except ValueError as err:
+        return "UNAVAILABLE", f"OCSP response could not be parsed: {err}"
+
+    if status == ocsp.OCSPCertStatus.GOOD:
+        stale = _ocsp_response_stale(response)
+        if stale is not None:
+            return "UNAVAILABLE", stale
+        return "GOOD", None
+    if status == ocsp.OCSPCertStatus.REVOKED:
+        when = getattr(response, "revocation_time_utc", None)
+        return "REVOKED", f"revoked at {when}" if when else "revoked"
+    return "UNKNOWN", "responder does not know this certificate"
+
+
+def _load_crl(raw: bytes) -> x509.CertificateRevocationList | None:
+    """Parse a CRL from DER or PEM bytes, or return None when neither works."""
+    try:
+        return x509.load_der_x509_crl(raw)
+    except ValueError:
+        try:
+            return x509.load_pem_x509_crl(raw)
+        except ValueError:
+            return None
+
+
+def _crl_stale(crl: x509.CertificateRevocationList) -> str | None:
+    """Return a reason when a CRL is outside its validity window."""
+    now = datetime.now(timezone.utc)
+    try:
+        last_update = crl.last_update_utc
+        next_update = crl.next_update_utc
+    except (ValueError, AttributeError):
+        return None
+    if last_update is not None and last_update - _OCSP_CLOCK_SKEW > now:
+        return f"CRL is not yet valid (lastUpdate {last_update})"
+    if next_update is not None and next_update + _OCSP_CLOCK_SKEW < now:
+        return f"CRL is stale (nextUpdate {next_update})"
+    return None
+
+
+def _check_crl(
+    cert: x509.Certificate,
+    issuer: x509.Certificate | None,
+    timeout: float,
+) -> tuple[str, str | None]:
+    """Check revocation via the certificate's CRL distribution points.
+
+    Download each CRL in turn and look up the certificate's serial number.
+    When ``issuer`` is known the CRL signature is verified and a CRL that
+    fails the check is skipped. The first CRL that yields a verdict wins;
+    otherwise the status is ``"UNAVAILABLE"`` (soft-fail).
+    """
+    urls = _crl_urls(cert)
+    if not urls:
+        return "UNAVAILABLE", "no CRL distribution point in extension"
+
+    for url in urls:
+        try:
+            raw = _http(url, timeout=timeout)
+        except (OSError, ValueError):
+            continue
+        crl = _load_crl(raw)
+        if crl is None:
+            continue
+        if issuer is not None and not crl.is_signature_valid(issuer.public_key()):
+            continue
+
+        revoked = crl.get_revoked_certificate_by_serial_number(cert.serial_number)
+        if revoked is not None:
+            when = getattr(revoked, "revocation_date_utc", None)
+            detail = f"revoked at {when}" if when else "revoked"
+            return "REVOKED", f"{detail} (via CRL)"
+        stale = _crl_stale(crl)
+        if stale is not None:
+            return "UNAVAILABLE", stale
+        return "GOOD", "via CRL"
+
+    return "UNAVAILABLE", "CRL could not be retrieved"
+
+
+def check_revocation(
+    cert: x509.Certificate,
+    timeout: float = 5.0,
+    issuer: x509.Certificate | None = None,
+) -> tuple[str, str | None]:
+    """Check the certificate's revocation status via OCSP, then CRL.
+
+    Return ``(status, detail)`` where status is one of:
+
+    * ``"GOOD"`` — the certificate is confirmed valid.
+    * ``"REVOKED"`` — the certificate is confirmed revoked.
+    * ``"UNKNOWN"`` — the OCSP responder does not know this certificate.
+    * ``"UNAVAILABLE"`` — neither OCSP nor CRL gave an answer (soft-fail,
+      like a browser).
+
+    OCSP is tried first. When it soft-fails (no responder, issuer unavailable,
+    network or responder error) the certificate's CRL distribution points are
+    queried as a fallback. ``detail`` carries extra context (e.g. the
+    revocation time, or which source answered) when useful.
+
+    When ``issuer`` is provided (e.g. from the verified TLS chain) it is used
+    directly; otherwise the issuer is downloaded via the AIA "CA Issuers" URL.
+    """
+    if issuer is None:
+        issuer = _fetch_issuer(cert, timeout)
+
+    status, detail = _check_ocsp(cert, issuer, timeout)
+    if status != "UNAVAILABLE":
+        return status, detail
+
+    crl_status, crl_detail = _check_crl(cert, issuer, timeout)
+    if crl_status != "UNAVAILABLE":
+        return crl_status, crl_detail
+
+    # Both soft-failed: report the OCSP reason, which is usually the more
+    # informative of the two.
+    return status, detail

{certinspect-2.3.1 → certinspect-2.3.2/src/certinspect.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: certinspect
-Version: 2.3.1
+Version: 2.3.2
 Summary: Command-line TLS certificate inspector
 Author-email: Michele Angrisano <michele.angrisano@gmail.com>
 License-Expression: MIT

{certinspect-2.3.1 → certinspect-2.3.2}/src/certinspect.egg-info/SOURCES.txt

@@ -10,9 +10,11 @@ src/certinspect/discover.py
 src/certinspect/exit_codes.py
 src/certinspect/fetch.py
 src/certinspect/formatter.py
+src/certinspect/httpfetch.py
 src/certinspect/models.py
 src/certinspect/parser.py
 src/certinspect/render.py
+src/certinspect/revocation.py
 src/certinspect.egg-info/PKG-INFO
 src/certinspect.egg-info/SOURCES.txt
 src/certinspect.egg-info/dependency_links.txt

{certinspect-2.3.1 → certinspect-2.3.2}/tests/test_fetch.py

@@ -2,7 +2,7 @@
 
 import pytest
 
-from certinspect.fetch import check_revocation
+from certinspect.revocation import check_revocation
 from certinspect.parser import load_certificate
 
 
@@ -22,7 +22,7 @@ def test_check_revocation_accepts_explicit_issuer(make_cert):
 
 
 def test_http_rejects_unsupported_scheme():
-    from certinspect.fetch import _http
+    from certinspect.httpfetch import _http
 
     with pytest.raises(ValueError, match="unsupported URL scheme"):
         _http("ftp://example.com/cert", timeout=1.0)
@@ -454,7 +454,7 @@ def _build_crl_pki(
 def test_crl_urls_extracts_http_distribution_points():
     from cryptography.hazmat.primitives import serialization
 
-    from certinspect.fetch import _crl_urls
+    from certinspect.revocation import _crl_urls
 
     _, leaf_cert, _ = _build_crl_pki()
     leaf = load_certificate(leaf_cert.public_bytes(serialization.Encoding.DER))
@@ -464,13 +464,13 @@ def test_crl_urls_extracts_http_distribution_points():
 def test_check_crl_reports_good_when_serial_absent(monkeypatch):
     from cryptography.hazmat.primitives import serialization
 
-    from certinspect import fetch
+    from certinspect import revocation
 
     issuer_cert, leaf_cert, crl = _build_crl_pki(revoked_serials=())
     der_crl = crl.public_bytes(serialization.Encoding.DER)
-    monkeypatch.setattr(fetch, "_http", lambda url, timeout: der_crl)
+    monkeypatch.setattr(revocation, "_http", lambda url, timeout: der_crl)
 
-    status, detail = fetch._check_crl(leaf_cert, issuer_cert, timeout=1.0)
+    status, detail = revocation._check_crl(leaf_cert, issuer_cert, timeout=1.0)
     assert status == "GOOD"
     assert detail == "via CRL"
 
@@ -478,13 +478,13 @@ def test_check_crl_reports_good_when_serial_absent(monkeypatch):
 def test_check_crl_reports_revoked_when_serial_listed(monkeypatch):
     from cryptography.hazmat.primitives import serialization
 
-    from certinspect import fetch
+    from certinspect import revocation
 
     issuer_cert, leaf_cert, crl = _build_crl_pki(revoked_serials=(4242,))
     der_crl = crl.public_bytes(serialization.Encoding.DER)
-    monkeypatch.setattr(fetch, "_http", lambda url, timeout: der_crl)
+    monkeypatch.setattr(revocation, "_http", lambda url, timeout: der_crl)
 
-    status, detail = fetch._check_crl(leaf_cert, issuer_cert, timeout=1.0)
+    status, detail = revocation._check_crl(leaf_cert, issuer_cert, timeout=1.0)
     assert status == "REVOKED"
     assert "via CRL" in detail
 
@@ -494,7 +494,7 @@ def test_check_crl_soft_fails_stale_crl_when_serial_absent(monkeypatch):
 
     from cryptography.hazmat.primitives import serialization
 
-    from certinspect import fetch
+    from certinspect import revocation
 
     issuer_cert, leaf_cert, crl = _build_crl_pki(
         revoked_serials=(),
@@ -502,9 +502,9 @@ def test_check_crl_soft_fails_stale_crl_when_serial_absent(monkeypatch):
         crl_next_update_delta=-timedelta(days=1),
     )
     der_crl = crl.public_bytes(serialization.Encoding.DER)
-    monkeypatch.setattr(fetch, "_http", lambda url, timeout: der_crl)
+    monkeypatch.setattr(revocation, "_http", lambda url, timeout: der_crl)
 
-    status, detail = fetch._check_crl(leaf_cert, issuer_cert, timeout=1.0)
+    status, detail = revocation._check_crl(leaf_cert, issuer_cert, timeout=1.0)
     assert status == "UNAVAILABLE"
     assert "stale" in detail
 
@@ -514,7 +514,7 @@ def test_check_crl_reports_revoked_even_when_crl_is_stale(monkeypatch):
 
     from cryptography.hazmat.primitives import serialization
 
-    from certinspect import fetch
+    from certinspect import revocation
 
     issuer_cert, leaf_cert, crl = _build_crl_pki(
         revoked_serials=(4242,),
@@ -522,9 +522,9 @@ def test_check_crl_reports_revoked_even_when_crl_is_stale(monkeypatch):
         crl_next_update_delta=-timedelta(days=1),
     )
     der_crl = crl.public_bytes(serialization.Encoding.DER)
-    monkeypatch.setattr(fetch, "_http", lambda url, timeout: der_crl)
+    monkeypatch.setattr(revocation, "_http", lambda url, timeout: der_crl)
 
-    status, detail = fetch._check_crl(leaf_cert, issuer_cert, timeout=1.0)
+    status, detail = revocation._check_crl(leaf_cert, issuer_cert, timeout=1.0)
     assert status == "REVOKED"
     assert "via CRL" in detail
 
@@ -534,7 +534,7 @@ def test_check_crl_soft_fails_not_yet_valid_crl_when_serial_absent(monkeypatch):
 
     from cryptography.hazmat.primitives import serialization
 
-    from certinspect import fetch
+    from certinspect import revocation
 
     issuer_cert, leaf_cert, crl = _build_crl_pki(
         revoked_serials=(),
@@ -542,9 +542,9 @@ def test_check_crl_soft_fails_not_yet_valid_crl_when_serial_absent(monkeypatch):
         crl_next_update_delta=timedelta(days=2),
     )
     der_crl = crl.public_bytes(serialization.Encoding.DER)
-    monkeypatch.setattr(fetch, "_http", lambda url, timeout: der_crl)
+    monkeypatch.setattr(revocation, "_http", lambda url, timeout: der_crl)
 
-    status, detail = fetch._check_crl(leaf_cert, issuer_cert, timeout=1.0)
+    status, detail = revocation._check_crl(leaf_cert, issuer_cert, timeout=1.0)
     assert status == "UNAVAILABLE"
     assert "not yet valid" in detail
 
@@ -553,17 +553,17 @@ def test_check_crl_skips_crl_with_bad_signature(monkeypatch):
     """A CRL not signed by the issuer is ignored (soft-fail)."""
     from cryptography.hazmat.primitives import serialization
 
-    from certinspect import fetch
+    from certinspect import revocation
 
     _, leaf_cert, _ = _build_crl_pki(revoked_serials=(4242,))
     # CRL signed by an unrelated CA must not be trusted against this issuer.
     other_issuer, _, other_crl = _build_crl_pki(revoked_serials=(4242,))
     der_crl = other_crl.public_bytes(serialization.Encoding.DER)
-    monkeypatch.setattr(fetch, "_http", lambda url, timeout: der_crl)
+    monkeypatch.setattr(revocation, "_http", lambda url, timeout: der_crl)
 
     # Use the first PKI's issuer, whose key did not sign ``other_crl``.
     wrong_issuer, _, _ = _build_crl_pki()
-    status, _ = fetch._check_crl(leaf_cert, wrong_issuer, timeout=1.0)
+    status, _ = revocation._check_crl(leaf_cert, wrong_issuer, timeout=1.0)
     assert status == "UNAVAILABLE"
 
 
@@ -571,13 +571,13 @@ def test_check_revocation_falls_back_to_crl(monkeypatch):
     """With no OCSP responder, check_revocation consults the CRL."""
     from cryptography.hazmat.primitives import serialization
 
-    from certinspect import fetch
+    from certinspect import revocation
 
     issuer_cert, leaf_cert, crl = _build_crl_pki(revoked_serials=(4242,))
     der_crl = crl.public_bytes(serialization.Encoding.DER)
-    monkeypatch.setattr(fetch, "_http", lambda url, timeout: der_crl)
+    monkeypatch.setattr(revocation, "_http", lambda url, timeout: der_crl)
 
-    status, detail = fetch.check_revocation(leaf_cert, issuer=issuer_cert)
+    status, detail = revocation.check_revocation(leaf_cert, issuer=issuer_cert)
     assert status == "REVOKED"
     assert "via CRL" in detail
 
@@ -642,15 +642,15 @@ def test_check_ocsp_soft_fails_on_unparseable_response(monkeypatch):
     signatureAlgorithm the strict ASN.1 parser rejects with a ValueError. That
     must not abort the inspection — the revocation check soft-fails instead.
     """
-    from certinspect import fetch
+    from certinspect import revocation
 
     issuer_cert, leaf_cert = _build_ocsp_pki()
     # Garbage bytes that load_der_ocsp_response cannot parse.
     monkeypatch.setattr(
-        fetch, "_http", lambda url, data=None, timeout=None: b"\x30\x03not-asn1"
+        revocation, "_http", lambda url, data=None, timeout=None: b"\x30\x03not-asn1"
     )
 
-    status, detail = fetch._check_ocsp(leaf_cert, issuer_cert, timeout=1.0)
+    status, detail = revocation._check_ocsp(leaf_cert, issuer_cert, timeout=1.0)
     assert status == "UNAVAILABLE"
     assert "could not be parsed" in detail
 
@@ -673,40 +673,40 @@ def _addrinfo(ip: str):
 def test_guard_fetch_host_blocks_internal_addresses(monkeypatch, ip):
     """Loopback, link-local (cloud metadata), unspecified and multicast
     targets from a certificate URL must be refused."""
-    from certinspect import fetch
+    from certinspect import httpfetch
 
-    monkeypatch.setattr(fetch.socket, "getaddrinfo", lambda *a, **k: _addrinfo(ip))
+    monkeypatch.setattr(httpfetch.socket, "getaddrinfo", lambda *a, **k: _addrinfo(ip))
     with pytest.raises(ValueError, match="non-routable or internal"):
-        fetch._guard_fetch_host("http://danger.example/x")
+        httpfetch._guard_fetch_host("http://danger.example/x")
 
 
 def test_guard_fetch_host_allows_private_pki(monkeypatch):
     """An internal PKI on an RFC1918 address must stay reachable."""
-    from certinspect import fetch
+    from certinspect import httpfetch
 
     monkeypatch.setattr(
-        fetch.socket, "getaddrinfo", lambda *a, **k: _addrinfo("10.10.0.5")
+        httpfetch.socket, "getaddrinfo", lambda *a, **k: _addrinfo("10.10.0.5")
     )
-    assert fetch._guard_fetch_host("http://ocsp.internal.lan/") is None
+    assert httpfetch._guard_fetch_host("http://ocsp.internal.lan/") is None
 
 
 def test_http_refuses_link_local_metadata_address(monkeypatch):
     """The guard is wired into _http, so a metadata URL raises before urlopen."""
-    from certinspect import fetch
+    from certinspect import httpfetch
 
     monkeypatch.setattr(
-        fetch.socket, "getaddrinfo", lambda *a, **k: _addrinfo("169.254.169.254")
+        httpfetch.socket, "getaddrinfo", lambda *a, **k: _addrinfo("169.254.169.254")
     )
     with pytest.raises(ValueError, match="non-routable or internal"):
-        fetch._http("http://metadata.example/ocsp", timeout=1.0)
+        httpfetch._http("http://metadata.example/ocsp", timeout=1.0)
 
 
 def test_http_caps_oversized_response(monkeypatch):
     """A response larger than the cap is rejected instead of read in full."""
-    from certinspect import fetch
+    from certinspect import httpfetch
 
-    monkeypatch.setattr(fetch, "_guard_fetch_host", lambda url: None)
-    monkeypatch.setattr(fetch, "_MAX_HTTP_RESPONSE_BYTES", 10)
+    monkeypatch.setattr(httpfetch, "_guard_fetch_host", lambda url: None)
+    monkeypatch.setattr(httpfetch, "_MAX_HTTP_RESPONSE_BYTES", 10)
 
     class _Resp:
         def __enter__(self):
@@ -718,9 +718,9 @@ def test_http_caps_oversized_response(monkeypatch):
         def read(self, amt=-1):
             return b"x" * amt
 
-    monkeypatch.setattr(fetch.urllib.request, "urlopen", lambda *a, **k: _Resp())
+    monkeypatch.setattr(httpfetch.urllib.request, "urlopen", lambda *a, **k: _Resp())
     with pytest.raises(ValueError, match="exceeds the"):
-        fetch._http("http://big.example/crl", timeout=1.0)
+        httpfetch._http("http://big.example/crl", timeout=1.0)
 
 
 # --- OCSP response freshness ------------------------------------------------
@@ -799,15 +799,15 @@ def test_check_ocsp_good_when_response_is_fresh(monkeypatch):
 
     from cryptography.x509 import ocsp
 
-    from certinspect import fetch
+    from certinspect import revocation
 
     now = datetime.now(timezone.utc)
     issuer_cert, leaf_cert, der = _signed_ocsp(
         ocsp.OCSPCertStatus.GOOD, now - timedelta(hours=1), now + timedelta(days=1)
     )
-    monkeypatch.setattr(fetch, "_http", lambda url, data=None, timeout=None: der)
+    monkeypatch.setattr(revocation, "_http", lambda url, data=None, timeout=None: der)
 
-    status, _ = fetch._check_ocsp(leaf_cert, issuer_cert, timeout=1.0)
+    status, _ = revocation._check_ocsp(leaf_cert, issuer_cert, timeout=1.0)
     assert status == "GOOD"
 
 
@@ -818,15 +818,15 @@ def test_check_ocsp_soft_fails_on_stale_response(monkeypatch):
 
     from cryptography.x509 import ocsp
 
-    from certinspect import fetch
+    from certinspect import revocation
 
     now = datetime.now(timezone.utc)
     issuer_cert, leaf_cert, der = _signed_ocsp(
         ocsp.OCSPCertStatus.GOOD, now - timedelta(days=2), now - timedelta(days=1)
     )
-    monkeypatch.setattr(fetch, "_http", lambda url, data=None, timeout=None: der)
+    monkeypatch.setattr(revocation, "_http", lambda url, data=None, timeout=None: der)
 
-    status, detail = fetch._check_ocsp(leaf_cert, issuer_cert, timeout=1.0)
+    status, detail = revocation._check_ocsp(leaf_cert, issuer_cert, timeout=1.0)
     assert status == "UNAVAILABLE"
     assert "stale" in detail
 

certinspect-2.3.1/src/certinspect/exit_codes.py

@@ -1,37 +0,0 @@
-"""Process exit codes and the status-to-code mapping.
-
-Single source of truth for the exit codes certinspect returns, so the
-orchestration (cli) and the reporters (formatter) agree on what each number
-means instead of repeating the literals.
-"""
-
-from enum import IntEnum
-
-
-class ExitCode(IntEnum):
-    """Exit code reflecting the worst certificate state found.
-
-    Kept distinct from argparse's usage error (2) and the generic runtime
-    error (1), which are not certificate states and stay plain integers.
-    """
-
-    OK = 0
-    EXPIRING = 3
-    INVALID = 4  # expired, critical, not-yet-valid or invalid dates
-    HOSTNAME_MISMATCH = 5
-    UNTRUSTED_OR_REVOKED = 6
-    PIN_MISMATCH = 7
-    SAN_MISMATCH = 8
-    POLICY = 9
-
-
-# Validity status (from certificate_status) mapped to its exit code; the four
-# non-valid date states all share ExitCode.INVALID.
-EXIT_BY_STATUS: dict[str, ExitCode] = {
-    "VALID": ExitCode.OK,
-    "EXPIRING": ExitCode.EXPIRING,
-    "CRITICAL": ExitCode.INVALID,
-    "EXPIRED": ExitCode.INVALID,
-    "INVALID DATES": ExitCode.INVALID,
-    "NOT YET VALID": ExitCode.INVALID,
-}