Add CRL creation to FFI by arckoor · Pull Request #5166 · randombit/botan

arckoor · 2025-11-21T17:04:38Z

Adds methods to create, update and view CRLs to the FFI.
CRL part of #4877.

coveralls · 2025-11-21T18:05:10Z

coverage: 90.342% (+0.009%) from 90.333%
when pulling 457353a on arckoor:x509-crl-ffi
into 5166623 on randombit:master.

Copilot

Pull request overview

This pull request adds CRL (Certificate Revocation List) creation, updating, and viewing functionality to Botan's FFI, enhancing the library's X.509 certificate management capabilities. The changes include new FFI functions for CRL operations, corresponding Python bindings, comprehensive tests, and documentation.

Key Changes

Added FFI functions for CRL creation (botan_x509_crl_create), updating (botan_x509_crl_update), and inspection
Implemented Python wrapper classes (X509CRL, X509CRLReason, X509CRLEntry) with methods for CRL operations
Introduced FFI API version 20260203 for Botan 3.11.0

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
`src/lib/ffi/ffi_cert.h`	New internal header declaring FFI certificate/CRL structure types
`src/lib/ffi/ffi_cert.cpp`	Implementation of CRL creation, update, viewing, and inspection functions
`src/lib/ffi/ffi.h`	Public FFI API declarations for new CRL functions and reason code enum
`src/lib/ffi/ffi.cpp`	FFI version support registration for API 20260203
`src/lib/ffi/info.txt`	Updated FFI version constant and added internal header
`src/tests/test_ffi.cpp`	C++ tests for CRL creation, updating, and verification
`src/tests/data/x509/crl/ca.crt`	Test CA certificate for CRL testing
`src/tests/data/x509/crl/sub1.crt`	Test subordinate certificate 1 for CRL testing
`src/tests/data/x509/crl/sub2.crt`	Test subordinate certificate 2 for CRL testing
`src/python/botan3.py`	Python bindings with X509CRL class, reason enum, and entry class
`src/scripts/test_python.py`	Python tests for CRL creation, revocation, and verification
`doc/api_ref/ffi.rst`	Documentation for new CRL-related FFI functions

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

arckoor · 2025-12-27T14:06:22Z

@randombit I have removed the dependency on the python doc, so this is now a standalone PR. I hope this makes it a bit easier to take a look here.

randombit

Thanks for the rebase that helps a lot. Generally looks fine, I think though for the CRL entry getters we'll go with the approach added in #5220. It's probably easiest to just rebase this PR onto #5220 (or alternately wait for #5220 to merge then rebase onto master, which is a bit slower but likely to be less aggravating since there is a lot of FFI work going in at once for 3.11 it seems)

reneme

Frankly, I didn't realize that this PR had so much overlap with our work on #5220 and #5188. I'm sorry to barge in like that after it's been open for like six weeks. 😨

Anyway, I think we should ensure that the APIs for reading and writing CRLs are aligning nicely. I added some suggestions below.

Please note that despite having merged #5220 already, I don't consider those changes to be set in stone before they make it into a release. I'm definitely open to re-evaluate them as needed.

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

arckoor · 2026-01-27T16:11:18Z

+         TEST_FFI_OK(botan_x509_crl_update,
+                     (&new_crl, empty_crl, rng, ca_cert, ca_key, now, 86400, crl_entries, 1, nullptr, nullptr));


I'd love to test this with ..., crl_entries, 2, ..., but asan won't let me (which is fair). In local testing it did return a ERR_NULL_POINTER like I expected though.

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

randombit

LGTM thanks @arckoor

@reneme did you have any final comments?

reneme

Looks good to me too. Thanks for adapting this to the botan_x509_crl_entry_t construction. Nice to see that this is now all concise. :)

arckoor commented Nov 21, 2025

View reviewed changes

Comment thread doc/api_ref/ffi.rst Outdated

arckoor force-pushed the x509-crl-ffi branch from e3227a2 to 97f4590 Compare November 21, 2025 17:10

KaganCanSit reviewed Nov 22, 2025

View reviewed changes

Comment thread src/lib/ffi/ffi_cert.cpp

arckoor force-pushed the x509-crl-ffi branch from 97f4590 to 3f051b3 Compare November 22, 2025 13:26

randombit requested a review from Copilot December 14, 2025 10:55

Copilot started reviewing on behalf of randombit December 14, 2025 10:56 View session

Copilot AI reviewed Dec 14, 2025

View reviewed changes

Comment thread src/python/botan3.py Outdated

Comment thread src/scripts/test_python.py Outdated

Comment thread src/lib/ffi/ffi_cert.cpp Outdated

Comment thread doc/api_ref/ffi.rst Outdated

Comment thread src/lib/ffi/ffi_cert.cpp Outdated

Comment thread doc/api_ref/ffi.rst Outdated

arckoor force-pushed the x509-crl-ffi branch 2 times, most recently from 22c282f to 7f9f2a1 Compare December 14, 2025 12:55

arckoor force-pushed the x509-crl-ffi branch from 7f9f2a1 to b26c0d5 Compare December 27, 2025 14:02

arckoor mentioned this pull request Dec 27, 2025

FFI: Generic getter(s) for X.509 objects #5188

Merged

randombit reviewed Jan 10, 2026

View reviewed changes

Comment thread doc/api_ref/ffi.rst Outdated

Comment thread doc/api_ref/ffi.rst Outdated

Comment thread src/lib/ffi/ffi_cert.cpp

randombit added this to the Botan 3.11 milestone Jan 10, 2026

reneme requested changes Jan 11, 2026

View reviewed changes

Comment thread src/lib/ffi/ffi.h Outdated

Comment thread src/lib/ffi/ffi.h

Comment thread src/lib/ffi/ffi.h

Comment thread src/lib/ffi/ffi.h Outdated

arckoor force-pushed the x509-crl-ffi branch 3 times, most recently from 6d666d2 to 4098d59 Compare January 11, 2026 20:35

arckoor commented Jan 11, 2026

View reviewed changes

Comment thread src/tests/test_ffi.cpp Outdated

arckoor force-pushed the x509-crl-ffi branch 2 times, most recently from 5ef7637 to a34fc29 Compare January 13, 2026 22:01

arckoor commented Jan 13, 2026

View reviewed changes

Comment thread src/python/botan3.py Outdated

arckoor force-pushed the x509-crl-ffi branch from a34fc29 to 8e7a4e6 Compare January 13, 2026 22:06

arckoor mentioned this pull request Jan 15, 2026

strongSwan: parse/validate X.509 objects in strongSwan's Botan plugin #5219

Closed

arckoor force-pushed the x509-crl-ffi branch from 8e7a4e6 to 4a6b07d Compare January 21, 2026 08:47

arckoor commented Jan 21, 2026

View reviewed changes

Comment thread src/lib/ffi/ffi_cert.cpp

arckoor force-pushed the x509-crl-ffi branch from 4a6b07d to f30c1ef Compare January 21, 2026 08:51

arckoor commented Jan 21, 2026

View reviewed changes

Comment thread src/python/botan3.py Outdated

arckoor requested a review from reneme January 21, 2026 08:52

arckoor requested a review from randombit January 21, 2026 08:52

arckoor force-pushed the x509-crl-ffi branch 2 times, most recently from 49cda16 to d1b6188 Compare January 27, 2026 14:03

arckoor requested a review from Copilot January 27, 2026 14:06

Copilot started reviewing on behalf of arckoor January 27, 2026 14:08 View session

Copilot AI reviewed Jan 27, 2026

View reviewed changes

Comment thread doc/api_ref/ffi.rst Outdated

Comment thread doc/api_ref/ffi.rst Outdated

Comment thread src/lib/ffi/ffi.h Outdated

Comment thread src/lib/ffi/ffi.h Outdated

Comment thread src/python/botan3.py Outdated

arckoor force-pushed the x509-crl-ffi branch 6 times, most recently from fb08294 to 8ad6b5c Compare January 27, 2026 16:09

arckoor commented Jan 27, 2026

View reviewed changes

arckoor force-pushed the x509-crl-ffi branch 2 times, most recently from 0dd1c87 to 4bc8d82 Compare February 14, 2026 21:51

randombit requested a review from Copilot February 19, 2026 09:22

Copilot started reviewing on behalf of randombit February 19, 2026 09:25 View session

Copilot AI reviewed Feb 19, 2026

View reviewed changes

Comment thread src/python/botan3.py Outdated

arckoor mentioned this pull request Feb 22, 2026

Fix memory leak when creating MPIs for ECGroup #5381

Merged

arckoor force-pushed the x509-crl-ffi branch 2 times, most recently from 7fd01f9 to 457353a Compare February 22, 2026 16:29

randombit approved these changes Feb 26, 2026

View reviewed changes

Add CRL creation to FFI

7ab352a

arckoor force-pushed the x509-crl-ffi branch from 457353a to 7ab352a Compare February 26, 2026 21:51

reneme approved these changes Mar 2, 2026

View reviewed changes

randombit merged commit 1afa1b1 into randombit:master Mar 2, 2026
88 of 89 checks passed

arckoor deleted the x509-crl-ffi branch March 24, 2026 11:47

		TEST_FFI_OK(botan_x509_crl_update,
		(&new_crl, empty_crl, rng, ca_cert, ca_key, now, 86400, crl_entries, 1, nullptr, nullptr));

Conversation

arckoor commented Nov 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

coveralls commented Nov 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Key Changes

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

arckoor commented Dec 27, 2025

Uh oh!

randombit left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

reneme left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

arckoor Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

randombit left a comment

Choose a reason for hiding this comment

Uh oh!

reneme left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

arckoor commented Nov 21, 2025 •

edited

Loading

coveralls commented Nov 21, 2025 •

edited

Loading

reneme left a comment •

edited

Loading