Closed christopher-henderson closed 1 year ago
I believe there's 9 possible values as defined in X.509 08/2005 and RFC 5280, so it is possible to have a KU BIT STRING whose value component is 2 octets.
Nice catch @CBonnell. It does look that way to me too, even in the Enum in the description.
Yikes, that's an embarassing misstep. Thanks @CBonnell and @zakird!
I swapped up the lint to do the following instead:
int64
.My reasoning is that this lint is primarily enforcing that there are no unknown flags present. That is, it does not concern itself with what combinations of flags may-or-may not be valid vis-a-vis a particular requirement, but rather only that there are no 1
flags set beyond the 9th bit.
@aarongable since you're the one that thought of this lint
As per RFC 5280 Section 4.2.1.3 a key usage is a bit string with only eight possible flags.
This lint checks that, if a KU is present, that it's bitstring is exactly one byte long.