Shared storage infrastructure and provider capability routing for certificate management by ChansAlive · Pull Request #160 · eclipse-score/inc_security_crypto

ChansAlive · 2026-08-13T09:51:45Z

Foundational groundwork for the certificate management daemon component.

Shared deployment storage (daemon/common/storage/) extracted from key_management — reusable KV loader/writer and atomic file I/O primitives backed by score::filesystem baselibs.
Provider capability selection extended to route certificate context types to the correct provider (software-first for kCertManagement).
Certificate API types and contexts promoted from api/future/ to stable namespaces.

Closes #162

github-actions · 2026-08-13T09:53:11Z

License Check Results

🚀 The license check job ran with the Bazel command:

bazel run --lockfile_mode=error //:license-check

Status: ⚠️ Needs Review

Click to expand output

[License Check Output]
Extracting Bazel installation...
Starting local Bazel server (8.6.0) and connecting to it...
INFO: Invocation ID: bb3823a8-8abe-4b5d-a675-3411d4c41528
Computing main repo mapping: 
Computing main repo mapping: 
DEBUG: Rule 'score_baselibs_rust+' indicated that a canonical reproducible form can be obtained by modifying arguments integrity = "sha256-4kzcXcvGi9xBEEnrPOiSEvteITZMPKmK3MNgJXQIGtY="
DEBUG: Repository score_baselibs_rust+ instantiated at:
  <builtin>: in <toplevel>
Repository rule http_archive defined at:
  /home/runner/.bazel/external/bazel_tools/tools/build_defs/repo/http.bzl:431:31: in <toplevel>
DEBUG: Rule 'score_logging+' indicated that a canonical reproducible form can be obtained by modifying arguments integrity = "sha256-/Q5+YfLkbMpz5PfvOkNS7qA3ehzth4emFhTcsk4q3zQ="
DEBUG: Repository score_logging+ instantiated at:
  <builtin>: in <toplevel>
Repository rule http_archive defined at:
  /home/runner/.bazel/external/bazel_tools/tools/build_defs/repo/http.bzl:431:31: in <toplevel>
DEBUG: Rule 'abseil-cpp+' indicated that a canonical reproducible form can be obtained by modifying arguments integrity = "sha256-m3oGQwXp/ZTRJP+mzDWFkutCtdpYj7TgfQklSqQAhts="
DEBUG: Repository abseil-cpp+ instantiated at:
  <builtin>: in <toplevel>
Repository rule http_archive defined at:
  /home/runner/.bazel/external/bazel_tools/tools/build_defs/repo/http.bzl:431:31: in <toplevel>
Computing main repo mapping: 
DEBUG: Rule 'grpc+' indicated that a canonical reproducible form can be obtained by modifying arguments integrity = "sha256-CvN7gAlTEwtHwHW1ZoPuYL3D7aPDf8YAQZP1tWl1ggQ="
DEBUG: Repository grpc+ instantiated at:
  <builtin>: in <toplevel>
Repository rule http_archive defined at:
  /home/runner/.bazel/external/bazel_tools/tools/build_defs/repo/http.bzl:431:31: in <toplevel>
Computing main repo mapping: 
DEBUG: Rule 'protobuf+' indicated that a canonical reproducible form can be obtained by modifying arguments integrity = "sha256-w6Cp7OiTLjHDtzbi2xixxC5wcM2biBOIsm0BqnHiTKI="
DEBUG: Repository protobuf+ instantiated at:
  <builtin>: in <toplevel>
Repository rule http_archive defined at:
  /home/runner/.bazel/external/bazel_tools/tools/build_defs/repo/http.bzl:431:31: in <toplevel>
Computing main repo mapping: 
Loading: 
Loading: 1 packages loaded
Loading: 1 packages loaded
    currently loading: 
Loading: 1 packages loaded
    currently loading: 
Loading: 1 packages loaded
    currently loading: 
WARNING: Target pattern parsing failed.
ERROR: Skipping '//:license-check': no such target '//:license-check': target 'license-check' not declared in package '' defined by /home/runner/work/inc_security_crypto/inc_security_crypto/BUILD
ERROR: no such target '//:license-check': target 'license-check' not declared in package '' defined by /home/runner/work/inc_security_crypto/inc_security_crypto/BUILD
INFO: Elapsed time: 12.874s
INFO: 0 processes.
ERROR: Build did NOT complete successfully
ERROR: Build failed. Not running target

github-actions · 2026-08-13T09:54:41Z

The created documentation from the pull request is available at: docu-html

ugeshmunirjulu · 2026-09-09T11:35:33Z

+
+load("@rules_cc//cc:defs.bzl", "cc_library")
+
+cc_library(


cert_types.hpp is pure enums. i_ocsp_request_export.hpp is a polymorphic interface and bundling them under one target named cert_types:
Forces every consumer of the enums (lightweight, stable) to also depend on the interface (heavier, unstable/inactive), inflating the rebuild graph for unrelated changes.
split into two cc_library targets (cert_types for enums, i_ocsp_request_export for the interface)

ugeshmunirjulu · 2026-09-09T11:59:30Z

+    /// @brief Removes the CRL stored in a certificate slot.
+    /// @param cert_slot Handle to the slot whose CRL should be removed (type = kCertSlot)
+    /// @return std::monostate on success, error if no CRL is present or access is denied
+    virtual score::Result<std::monostate> DeleteCrl(const CryptoResourceId& cert_slot) = 0;


DeleteExpiredCrls of batch expired CRLs method is removed without replacement

ugeshmunirjulu · 2026-09-09T12:05:37Z

+    /// @param issuer_cert Handle to the issuer certificate (type = kCertSlot or kCertificate)
+    /// @param persist     When true, store permanently to the issuer slot (kCertSlot only)
+    /// @return std::monostate on success, error if validation fails or access is denied
+    virtual score::Result<std::monostate> ImportCrl(score::cpp::span<const uint8_t> crl_data,


When you call a function through a base-class pointer/reference, C++ decides which default value to use by looking at the declared type of the variable, not the actual object it points to example persist = false

example:
`class Base
{
public:
virtual void Foo(bool flag = false) = 0;
};

class Derived : public Base
{
public:
void Foo(bool flag = true) override { /* ... */ } // legal, but dangerous
};

Derived d;
Base& b = d;

d.Foo(); // uses Derived's default is flag = true
b.Foo(); // uses Base's default is flag = false (SAME object, DIFFERENT behavior!)`

ugeshmunirjulu · 2026-09-09T12:13:21Z

+    /// @param cert        CryptoResourceId of the certificate to save (type = kCertificate or kCertSlot)
+    /// @param target_slot Handle to the target slot (type = kCertSlot)
+    /// @param with_crl    When true, propagate the associated CRL to the destination slot
+    virtual score::Result<std::monostate> SaveCertificate(const CryptoResourceId& cert,


Managing one certificate" (parse/save/export) and "curating the trust anchor set" (add/remove/enable/disable members) are two different concerns, we need to split the interfaces into the smaller chucks. we shall follow the Single Responsibility Principle

ugeshmunirjulu · 2026-09-09T13:09:50Z

-    /// @brief References an imported CRL for revocation checking.
-    /// @param crl Handle to a previously imported CRL
-    /// @return std::monostate on success, error if handle is invalid
-    virtual score::Result<std::monostate> SetCrl(const CryptoResourceId& crl) = 0;


SetCrl() was deleted, so you can no longer tell the system exactly which revocation list to use — it now guesses automatically, with no documentation on how, and no way to check afterward which one it actually used.

ugeshmunirjulu · 2026-09-09T13:29:53Z

+    ///
+    /// Each entry corresponds to a certificate slot that currently holds a certificate.
+    /// Empty slots (not yet populated) are omitted.
+    virtual const std::vector<MemberInfo>& GetMembers() const noexcept = 0;


GetMembers() returns a snapshot that can go stale. if a compromised trust anchor is disabled or removed elsewhere while your code still holds an older snapshot, it will keep reporting that anchor as trusted/enabled. There's no version marker or refresh method to detect this, so code should always re-fetch a fresh snapshot before using it for any actual trust decision, not just for display/logging.

ugeshmunirjulu · 2026-09-09T13:58:44Z

+        }
+        const std::string key = Trim(trimmed.substr(0U, eq_pos));
+        const std::string value = Trim(trimmed.substr(eq_pos + 1U));
+        descriptor.sections[current_section][key] = value;


Duplicate keys are silently overwritten. for example [key_slots]
slot_1 = /secure/path/a.key
slot_1 = /tmp/attacker_path.key

ugeshmunirjulu · 2026-09-09T14:37:36Z

+    std::unordered_map<std::string, std::unordered_map<std::string, std::string>> sections;
+
+    /// @brief Get a value from a section, returning default_val if absent.
+    [[nodiscard]] const std::string& Get(const std::string& section,


When the section/key isn't found, this returns a reference to the default_val parameter. That's only safe if the caller passes a named object that outlives the call. The most natural calling pattern — passing a string literal as the default. for example const std::string& path = descriptor.Get("key_slots", "slot_1", "/default/path");
// path is dangling here — the literal's temporary was destroyed

ugeshmunirjulu · 2026-09-09T14:44:23Z

+bool FileExists(const std::string& path)
+{
+    score::filesystem::StandardFilesystem fs{};
+    const auto result = fs.IsRegularFile(score::filesystem::Path{path});


How to handle the permissions related issues, actual file present but no access

ugeshmunirjulu · 2026-09-09T15:06:12Z

+    else if (required_capability != common::ProviderCapability::kNone &&
+             requested_provider_type == common::CryptoProviderType::DEFAULT)
+    {
+        provider = m_provider_manager->GetProviderForCapability(required_capability);


In the else branch the provider capablity is not checked, so it will fail on create handler with unsupported algo

ChansAlive had a problem deploying to workflow-approval August 13, 2026 09:51 — with GitHub Actions Failure

ChansAlive requested a review from OliverHeilwagen August 13, 2026 09:51

ChansAlive force-pushed the feature/cert_api_and_common_refactor branch from d8c0760 to 3806c91 Compare August 13, 2026 20:40

ChansAlive had a problem deploying to workflow-approval August 13, 2026 20:40 — with GitHub Actions Failure

ChansAlive had a problem deploying to workflow-approval August 14, 2026 10:24 — with GitHub Actions Failure

ChansAlive marked this pull request as ready for review August 14, 2026 10:24

ChansAlive requested a review from sunildevda August 14, 2026 10:25

ChansAlive force-pushed the feature/cert_api_and_common_refactor branch from a425c7b to 60c98d8 Compare August 19, 2026 07:31

ChansAlive requested a deployment to workflow-approval August 19, 2026 07:31 — with GitHub Actions Waiting

ChansAlive requested a deployment to workflow-approval August 19, 2026 08:00 — with GitHub Actions Waiting

ChansAlive force-pushed the feature/cert_api_and_common_refactor branch from a0b9c2c to 186e256 Compare August 24, 2026 21:10

ChansAlive requested a deployment to workflow-approval August 24, 2026 21:10 — with GitHub Actions Waiting

ChansAlive requested a deployment to workflow-approval August 25, 2026 10:21 — with GitHub Actions Waiting

ChansAlive force-pushed the feature/cert_api_and_common_refactor branch from 03e9354 to 9d4bc98 Compare August 25, 2026 11:08

ChansAlive requested a deployment to workflow-approval August 25, 2026 11:08 — with GitHub Actions Waiting

ChansAlive force-pushed the feature/cert_api_and_common_refactor branch from 9d4bc98 to cee8b32 Compare August 25, 2026 11:27

ChansAlive requested a deployment to workflow-approval August 25, 2026 11:27 — with GitHub Actions Waiting

ChansAlive requested a deployment to workflow-approval August 25, 2026 12:37 — with GitHub Actions Waiting

sunildevda requested a review from ugeshmunirjulu September 9, 2026 08:52

ChansAlive requested a deployment to workflow-approval September 9, 2026 12:44 — with GitHub Actions Waiting

ugeshmunirjulu reviewed Sep 9, 2026

View reviewed changes

ChansAlive force-pushed the feature/cert_api_and_common_refactor branch from 99970fa to 51f6130 Compare September 10, 2026 20:10

ChansAlive requested a deployment to workflow-approval September 10, 2026 20:10 — with GitHub Actions Waiting

ChansAlive added 18 commits September 11, 2026 10:21

Make shared deployment loader and writer

12bac90

API update for cert mgmnt and ops

03efa7b

Utility fns to Enc/Dec Str to Hex val

c20bdcd

Pvdr mgr fix and capability selection

9aa80f7

Correction in ResourceType

533728b

Capability selection based on ctx id

9c6c031

Common file io with atomic write

00e2128

Formatting fix

e50b019

Added two more file io fn

1733479

Use baselibs for filesystem IO

0d92f72

Minor doc update

dfb6b4b

Make dependancy explicit in keym

29a74bd

Minor code doc fix

f20e622

Cert APIs update and config entry rename

69978ae

Fix name inconsistancy in config

f6d5457

Minor fix on the file write

1870865

API update for cert management

2e4c8f1

Fix coverage workflow

a01368f

ChansAlive force-pushed the feature/cert_api_and_common_refactor branch from 51f6130 to a01368f Compare September 11, 2026 08:22

ChansAlive requested a deployment to workflow-approval September 11, 2026 08:22 — with GitHub Actions Waiting

Navigation Menu

Shared storage infrastructure and provider capability routing for certificate management - #160

Shared storage infrastructure and provider capability routing for certificate management#160
ChansAlive wants to merge 18 commits into
eclipse-score:mainfrom
etas-contrib:feature/cert_api_and_common_refactor

ChansAlive commented Aug 13, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 13, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 13, 2026

Uh oh!

ugeshmunirjulu Sep 9, 2026

Uh oh!

ugeshmunirjulu Sep 9, 2026

Uh oh!

ugeshmunirjulu Sep 9, 2026

Uh oh!

ugeshmunirjulu Sep 9, 2026

Uh oh!

ugeshmunirjulu Sep 9, 2026

Uh oh!

ugeshmunirjulu Sep 9, 2026

Uh oh!

ugeshmunirjulu Sep 9, 2026

Uh oh!

ugeshmunirjulu Sep 9, 2026

Uh oh!

ugeshmunirjulu Sep 9, 2026

Uh oh!

ugeshmunirjulu Sep 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants


		load("@rules_cc//cc:defs.bzl", "cc_library")

		cc_library(

Conversation

ChansAlive commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

License Check Results

Uh oh!

github-actions Bot commented Aug 13, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ChansAlive commented Aug 13, 2026 •

edited

Loading

github-actions Bot commented Aug 13, 2026 •

edited

Loading