unikernel/duniverse/ca-certs-nss/lib/ca_certs_nss.ml

@@ -0,0 +1,15 @@
+let trust_anchors =
+  List.fold_left
+    (fun acc data ->
+       Result.bind acc (fun acc ->
+           Result.map
+             (fun cert -> cert :: acc)
+             (X509.Certificate.decode_der data)))
+    (Ok []) Trust_anchor.certificates
+
+let authenticator =
+  let time () = Some (Mirage_ptime.now ()) in
+  fun ?crls ?allowed_hashes () ->
+    Result.map
+      (X509.Authenticator.chain_of_trust ~time ?crls ?allowed_hashes)
+      trust_anchors

unikernel/duniverse/ca-certs-nss/lib/ca_certs_nss.mli

@@ -0,0 +1,11 @@
+val trust_anchors : (X509.Certificate.t list, [> `Msg of string ]) result
+(** [trust_anchors] are the trust anchors extracted from NSS certdata.txt. *)
+
+val authenticator :
+  ?crls:X509.CRL.t list ->
+  ?allowed_hashes:Digestif.hash' list ->
+  unit ->
+  (X509.Authenticator.t, [> `Msg of string ]) result
+(** [authenticator ~crls ~hash_whitelist ()] is an authenticator with the
+    provided revocation lists, and allowed_hashes. The trust anchors are based
+    on the extraction from NSS' certdata.txt. *)

unikernel/duniverse/ca-certs-nss/lib/dune

@@ -0,0 +1,22 @@
+; to update, browse to https://hg.mozilla.org/projects/nss/tags
+; find the last release (click on the tag, find the "changeset .. ID" line)
+; rm -f lib/certdata.txt
+; dune build lib/certdata.txt
+; mv _build/default/lib/certdata.txt lib
+;(rule
+; (targets certdata.txt)
+; (action
+;  (bash
+;    "wget https://hg.mozilla.org/projects/nss/raw-file/6f5cf4984f6b0873cb689dd0c1f50a9264741b93/lib/ckfw/builtins/certdata.txt -O %{targets}")))
+
+(rule
+ (targets trust_anchor.ml)
+ (deps certdata.txt)
+ (action
+  (run %{bin:extract-from-certdata} certdata.txt --output trust_anchor.ml)))
+
+(library
+ (name ca_certs_nss)
+ (public_name ca-certs-nss)
+ (modules ca_certs_nss trust_anchor)
+ (libraries x509 mirage-ptime digestif))