- Encode EC coordinates and private d with curve-width (32/48/66 bytes) to satisfy RFC 7518,
preserving leading zero octets.
- Restrict JWK values to registered JOSE names: P-256, P-384, P-521, secp256k1.
Raise ValueError for unregistered curves (P-192, P-224, Brainpool).
- Add regression tests: deterministic coordinate/private-value widths, leading-zero
preservation, supported curve names, and rejection of unsupported curves.
- Mypy clean; all core and backend tests pass.
- Parse and validate from snapshot JSON, reject future/missing timestamps
- Enforce snapshot age vs in cache and stale fallback (no lifetime extension on repeat S3 reads)
- OCSP: , ,
- Remove unused from signer
- Publisher heartbeats: , republish clean snapshots past interval, preserve dirty-only behavior and concurrency
- Config/env/docker/docs updates for heartbeat
Rolling upgrade: enable publisher heartbeats before deploying the age-enforcing responder so existing snapshots remain within the age window.
Replace the backtracking _PEM_BLOCK regex with a forward-only scanner
that indexes END markers by label, so repeated unterminated headers do
not cause the regex to rescan the remaining input.
Impact: 80 KiB payload went from 8.34 s to 0.001 s.
Add shared serial collision checking against existing certificates and
issuer revocations, reuse it for automatic serial allocation, and enforce
it for user-supplied serials so duplicate serials no longer break the
OCSP snapshot.
make keep_serial renewal require replace_old, refuse keep_serial +
revoke_old, and reject serials already revoked by the issuer so revoked
serials cannot be inherited by renewed certificates.
woggioni