Implement scoped authority trust overlay

trustlab/fixtures/tls.js

@@ -5,13 +5,13 @@ export const validPublicCertificate = {
   validation: "success",
   errors: [],
   presentedChain: [
-    { subject: "CN=example.test", sha256: "leaf-valid-public" },
-    { subject: "CN=Example Intermediate", sha256: "intermediate-public" },
+    leaf("CN=example.test", "leaf-valid-public"),
+    ca("CN=Example Intermediate", "intermediate-public"),
   ],
   constructedChain: [
-    { subject: "CN=example.test", sha256: "leaf-valid-public" },
-    { subject: "CN=Example Intermediate", sha256: "intermediate-public" },
-    { subject: "CN=Example Root", sha256: "root-public" },
+    leaf("CN=example.test", "leaf-valid-public"),
+    ca("CN=Example Intermediate", "intermediate-public"),
+    ca("CN=Example Root", "root-public", { selfSigned: true }),
   ],
   tls: { version: "TLSv1.3", alpn: "h2" },
 };
@@ -29,12 +29,12 @@ export const unknownLocalAuthority = {
     summary: "The candidate authority is not trusted by the current Firefox policy.",
   },
   presentedChain: [
-    { subject: "CN=library.village", sha256: "leaf-village-library" },
-    { subject: "CN=Village Services CA", sha256: "ca-village-services" },
+    leaf("CN=library.village", "leaf-village-library"),
+    ca("CN=Village Services CA", "ca-village-services", { selfSigned: true }),
   ],
   constructedChain: [
-    { subject: "CN=library.village", sha256: "leaf-village-library" },
-    { subject: "CN=Village Services CA", sha256: "ca-village-services" },
+    leaf("CN=library.village", "leaf-village-library"),
+    ca("CN=Village Services CA", "ca-village-services", { selfSigned: true }),
   ],
   tls: { version: "TLSv1.3", alpn: "h2" },
 };
@@ -52,23 +52,19 @@ export const expiredLeafCertificate = {
     summary: "The server certificate expired 46 days ago.",
   },
   presentedChain: [
-    {
-      subject: "CN=archive.village",
-      sha256: "leaf-expired-archive",
+    leaf("CN=archive.village", "leaf-expired-archive", {
       validFrom: "2025-06-01T00:00:00Z",
       validUntil: "2026-07-01T00:00:00Z",
-    },
-    { subject: "CN=Village Public Services CA", sha256: "ca-village-public" },
+    }),
+    ca("CN=Village Public Services CA", "ca-village-public"),
   ],
   constructedChain: [
-    {
-      subject: "CN=archive.village",
-      sha256: "leaf-expired-archive",
+    leaf("CN=archive.village", "leaf-expired-archive", {
       validFrom: "2025-06-01T00:00:00Z",
       validUntil: "2026-07-01T00:00:00Z",
-    },
-    { subject: "CN=Village Public Services CA", sha256: "ca-village-public" },
-    { subject: "CN=Regional Root CA", sha256: "root-regional" },
+    }),
+    ca("CN=Village Public Services CA", "ca-village-public"),
+    ca("CN=Regional Root CA", "root-regional", { selfSigned: true }),
   ],
   tls: { version: "TLSv1.3", alpn: "h2" },
 };
@@ -86,21 +82,17 @@ export const hostnameMismatch = {
     summary: "The certificate identifies files.village, not records.village.",
   },
   presentedChain: [
-    {
-      subject: "CN=files.village",
-      sha256: "leaf-wrong-host",
+    leaf("CN=files.village", "leaf-wrong-host", {
       dnsNames: ["files.village"],
-    },
-    { subject: "CN=Village Public Services CA", sha256: "ca-village-public" },
+    }),
+    ca("CN=Village Public Services CA", "ca-village-public"),
   ],
   constructedChain: [
-    {
-      subject: "CN=files.village",
-      sha256: "leaf-wrong-host",
+    leaf("CN=files.village", "leaf-wrong-host", {
       dnsNames: ["files.village"],
-    },
-    { subject: "CN=Village Public Services CA", sha256: "ca-village-public" },
-    { subject: "CN=Regional Root CA", sha256: "root-regional" },
+    }),
+    ca("CN=Village Public Services CA", "ca-village-public"),
+    ca("CN=Regional Root CA", "root-regional", { selfSigned: true }),
   ],
   tls: { version: "TLSv1.3", alpn: "h2" },
 };
@@ -118,13 +110,15 @@ export const explicitlyDistrustedAuthority = {
     summary: "A local Browsec rule explicitly distrusts this root authority.",
   },
   presentedChain: [
-    { subject: "CN=registry.example", sha256: "leaf-registry" },
-    { subject: "CN=Commercial Issuing CA", sha256: "ca-commercial-issuing" },
+    leaf("CN=registry.example", "leaf-registry"),
+    ca("CN=Commercial Issuing CA", "ca-commercial-issuing"),
   ],
   constructedChain: [
-    { subject: "CN=registry.example", sha256: "leaf-registry" },
-    { subject: "CN=Commercial Issuing CA", sha256: "ca-commercial-issuing" },
-    { subject: "CN=Globally Trusted but Locally Rejected Root", sha256: "root-distrusted" },
+    leaf("CN=registry.example", "leaf-registry"),
+    ca("CN=Commercial Issuing CA", "ca-commercial-issuing"),
+    ca("CN=Globally Trusted but Locally Rejected Root", "root-distrusted", {
+      selfSigned: true,
+    }),
   ],
   tls: { version: "TLSv1.3", alpn: "h2" },
 };
@@ -133,3 +127,25 @@ export const conflictingCommunityAdvice = {
   ...unknownLocalAuthority,
   connectionId: "connection-conflicting-community-advice",
 };
+
+function leaf(subject, sha256, extra = {}) {
+  return {
+    subject,
+    sha256,
+    isCa: false,
+    keyUsages: ["digitalSignature", "keyEncipherment"],
+    selfSigned: false,
+    ...extra,
+  };
+}
+
+function ca(subject, sha256, extra = {}) {
+  return {
+    subject,
+    sha256,
+    isCa: true,
+    keyUsages: ["keyCertSign", "crlSign"],
+    selfSigned: false,
+    ...extra,
+  };
+}