2 Commits

Author	SHA1	Message	Date
shankar0123	21aeed4f4e	legal: addlicense headers + normalize legacy variants (Phase 0 RED-4) ... Phase 0 closure (Path B2, post-rewrite): addlicense sweep — adds the canonical certctl LLC copyright + BUSL-1.1 SPDX header to every production Go file. Template: // Copyright 2026 certctl LLC. All rights reserved. // SPDX-License-Identifier: BUSL-1.1 Coverage: 338 / 338 production Go files (cmd/ + internal/, excluding *_test.go and **/testdata/**). Pre-sweep coverage was 22 / 338 (6.5%); post-sweep is 338 / 338 (100%). Normalized 22 pre-existing legacy headers (`// Copyright (c) certctl` + `// SPDX-License-Identifier: BSL-1.1`) and 1 file using a `Certctl Contributors` attribution. The legacy SPDX ID `BSL-1.1` is non-standard; the official SPDX identifier for Business Source License 1.1 is `BUSL-1.1` (capital U). All 338 files now share the canonical form. Generated via: addlicense -c "certctl LLC" -y 2026 \ -f cowork/legal/copyright-header.tpl \ -ignore '**/testdata/**' -ignore '**/*_test.go' \ cmd/ internal/ Verification: find cmd internal -name '*.go' -not -name '*_test.go' \ -not -path '*/testdata/*' \ -exec grep -L '^// Copyright 2026 certctl LLC' {} \; | wc -l Returns: 0 gofmt clean. Header additions are comments only, no compile impact. Closes: cowork/certctl-architecture-diligence-audit.html#fix-RED-4	2026-05-13 21:23:35 +00:00
shankar0123	30765ba1ed	crl/cache: schema + repository for crl_cache + crl_generation_events ... Phase 1 of the CRL/OCSP responder bundle. Adds: * migration 000019 — crl_cache (one row per issuer; pre-generated CRL DER, monotonic crl_number per RFC 5280 §5.2.3, this_update/next_update, generation duration metric, revoked_count) + crl_generation_events (append-only audit log of every regeneration attempt, succeeded + error fields for ops grep) * internal/domain/crl_cache.go — CRLCacheEntry + IsStale helper + CRLGenerationEvent (raw DER omitted from JSON to avoid bloating admin responses; CRLDERBase64 field for explicit transit shaping) * internal/repository/interfaces.go — CRLCacheRepository interface (Get / Put / NextCRLNumber / RecordGenerationEvent / ListGenerationEvents) * internal/repository/postgres/crl_cache.go — Postgres impl with SERIALIZABLE-isolated NextCRLNumber to defeat the monotonicity race between concurrent generations of the same issuer * internal/repository/postgres/crl_cache_test.go — testcontainers suite (round-trip, overwrite, monotonicity, event recording, failure-event-with-error) No behavior change at the HTTP layer yet — Phase 3 wires the cache into GetDERCRL via a new CRLCacheService + crlGenerationLoop.	2026-04-28 23:45:18 +00:00