config: add linting fields to signing profile config

Daniel · Daniel · commit f02ee2f11504 · 2019-06-28T11:46:13.000-04:00
diff --git a/config/config.go b/config/config.go
@@ -90,6 +90,19 @@ type SigningProfile struct {
 	CTLogServers        []string     `json:"ct_log_servers"`
 	AllowedExtensions   []OID        `json:"allowed_extensions"`
 	CertStore           string       `json:"cert_store"`
+	// LintErrLevel controls preissuance linting for the signing profile.
+	// 0 = no linting is performed [default]
+	// 2..3 = reserved
+	// 3 = all lint results except pass are considered errors
+	// 4 = all lint results except pass and notice are considered errors
+	// 5 = all lint results except pass, notice and warn are considered errors
+	// 6 = all lint results except pass, notice, warn and error are considered errors.
+	// 7 = lint is performed, no lint results are treated as errors.
+	LintErrLevel int `json:"lint_error_level"`
+	// IgnoredLints lists zlint lint names to ignore. Any lint results from
+	// matching lints will be ignored no matter what the configured LintErrLevel
+	// is.
+	IgnoredLints []string `json:"ignored_lints"`
 
 	Policies                    []CertificatePolicy
 	Expiry                      time.Duration
@@ -427,7 +440,8 @@ func (p *SigningProfile) Usages() (ku x509.KeyUsage, eku []x509.ExtKeyUsage, unk
 // valid local default profile has defined at least a default expiration.
 // A valid remote profile (default or not) has remote signer initialized.
 // In addition, a remote profile must has a valid auth provider if auth
-// key defined.
+// key defined. A valid profile must not include a lint_error_level outside of
+// [0,8).
 func (p *SigningProfile) validProfile(isDefault bool) bool {
 	if p == nil {
 		return false
@@ -484,6 +498,11 @@ func (p *SigningProfile) validProfile(isDefault bool) bool {
 		}
 	}
 
+	if p.LintErrLevel < 0 || p.LintErrLevel >= 8 {
+		log.Debugf("invalid profile: lint_error_level outside of range [0,8)")
+		return false
+	}
+
 	log.Debugf("profile is valid")
 	return true
 }
diff --git a/config/config_test.go b/config/config_test.go
@@ -17,6 +17,11 @@ var invalidProfileConfig = &Config{
 				Expiry: expiry,
 			},
 			"empty": {},
+			"invalid-lint": {
+				Usage:        []string{"digital signature"},
+				Expiry:       expiry,
+				LintErrLevel: 9000,
+			},
 		},
 		Default: &SigningProfile{
 			Usage:  []string{"digital signature"},
@@ -45,6 +50,12 @@ var validConfig = &Config{
 				Usage:  []string{"digital signature"},
 				Expiry: expiry,
 			},
+			"valid-lint": {
+				Usage:        []string{"digital signature"},
+				Expiry:       expiry,
+				LintErrLevel: 5,
+				IgnoredLints: []string{"n_subject_common_name_included"},
+			},
 		},
 		Default: &SigningProfile{
 			Usage:  []string{"digital signature"},
@@ -254,6 +265,10 @@ func TestInvalidProfile(t *testing.T) {
 		t.Fatal("invalid profile accepted as valid")
 	}
 
+	if invalidProfileConfig.Signing.Profiles["invalid-lint"].validProfile(false) {
+		t.Fatal("invalid profile accepted as valid")
+	}
+
 	if invalidProfileConfig.Valid() {
 		t.Fatal("invalid config accepted as valid")
 	}
