feat: add trust and expiry annotations to scan, inspect, and WASM

[danielewood]

Summary

• Add trust status (trusted/untrusted/self-signed) and expiry annotations to scan summary, inspect output, and WASM API
• Harden AIA fetchers against SSRF and context cancellation with URL validation, timeouts, and redirect limits
• Fix expired+untrusted double-counting in scan summary and return defensive copies from AllKeys
• Strengthen trust/expiry assertions across all test suites
• Fix error handling (ERR-1/ERR-5), WASM null-safety, and deadlock risks found by adversarial review
• Breaking: refactor VerifyChainTrust to accept VerifyChainTrustInput struct (CS-5 compliance)
• Document accepted risks for DNS rebinding SSRF and shared MozillaRootSubjects map

Commits

• feat: add trust and expiry annotations to scan summary, inspect, and WASM
• fix: strengthen trust verification, fix WASM race and error handling
• fix: harden AIA fetchers against SSRF and context cancellation
• fix: return copy from AllKeys, extract certAnnotation, add --out-file completion
• test: strengthen trust/expiry assertions across all test suites
• fix: prevent expired+untrusted double-counting in scan summary
• chore: add missing PR refs to CHANGELOG entries
• fix: close SSRF bypass, WASM panic, callback leak, and test gaps
• fix: harden SSRF, WASM deadlock, memory leaks, and nil-roots fallback
• fix: harden error handling, WASM safety, and test coverage gaps
• docs: document accepted risks for DNS rebinding and shared map
• fix: address review findings — CS-5, ERR-1, ERR-5 compliance

Test plan

• go test -race ./... passes
• go vet ./... passes
• golangci-lint run passes
• WASM build compiles (GOOS=js GOARCH=wasm go build ./cmd/wasm/)
• certkit scan shows trust/expiry annotations in both text and JSON output
• certkit inspect shows trust annotations
• Expired and untrusted certs are not double-counted in scan summary

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR adds trust status (trusted/untrusted/self-signed) and expiry annotations to scan summary, inspect output, and the WASM API. It also hardens AIA fetchers against SSRF attacks and context cancellation, fixes a race condition in WASM, and prevents double-counting of expired certificates in scan summaries.

Changes:

• Add Expired and Trusted fields to InspectResult and extend ScanSummary with expired/untrusted counts for roots, intermediates, and leaves
• Implement VerifyChainTrust for consistent chain verification and IsMozillaRoot with public key verification to prevent spoofed trust anchors
• Add ValidateAIAURL to block SSRF via non-HTTP schemes and literal private/loopback IP addresses, with redirect validation and context cancellation support in WASM jsFetchURL
• Fix AllKeys() to return a defensive copy using maps.Copy and add sync.RWMutex to protect WASM globalStore from concurrent access
• Integrate AIA resolution into scan command before trust checking and fix expired certificate double-counting logic in ScanSummary
• Add comprehensive test coverage including TestAnnotateInspectTrust, TestMemStore_ScanSummaryTrust, TestHasUnresolvedIssuers, TestIsMozillaRoot, TestVerifyChainTrust, and TestValidateAIAURL

Reviewed changes

Copilot reviewed 22 out of 22 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
internal/inspect.go	Add Expired and Trusted pointer fields to InspectResult, add unexported cert field for trust annotation, implement AnnotateInspectTrust function
internal/inspect_test.go	Add TestAnnotateInspectTrust covering self-signed, expired, Mozilla roots, and intermediate chains
internal/format.go	New file with CertAnnotation helper for formatting trust/expiry counts in scan summary
internal/format_test.go	New file with TestCertAnnotation covering all four code paths
internal/certstore/summary.go	Add ScanSummaryInput struct and extend ScanSummary with 6 new count fields for expired/untrusted certificates
internal/certstore/memstore.go	Update ScanSummary to accept ScanSummaryInput, add trust/expiry checking logic, fix AllKeys to return defensive copy
internal/certstore/memstore_test.go	Add TestMemStore_ScanSummaryTrust and TestMemStore_AllKeys_ReturnsCopy
internal/certstore/testhelpers_test.go	Add newExpiredRoot test helper function
internal/certstore/sqlite_test.go	Update ScanSummary call to pass ScanSummaryInput{}
internal/certstore/aia.go	Add HasUnresolvedIssuers function to gate AIA resolution
internal/certstore/aia_test.go	Add TestHasUnresolvedIssuers with comprehensive coverage
cmd/certkit/scan.go	Integrate AIA resolution before trust checking, add httpAIAFetcher and aiaHTTPClient with SSRF protection, update summary output formatting
cmd/certkit/inspect.go	Call AnnotateInspectTrust before filtering, simplify expired check using r.Expired field
cmd/certkit/completions.go	Add fileCompletion helper
cmd/certkit/bundle.go	Update warning output to use slog.Warn, add --out-file completion
cmd/wasm/store.go	Add storeMu sync.RWMutex to protect globalStore
cmd/wasm/main.go	Add mutex protection to addFiles, getState, exportBundlesJS, resetStore, fix error handling in getState
cmd/wasm/aia.go	Update jsFetchURL to respect context cancellation
bundle.go	Add IsMozillaRoot, VerifyChainTrust, ValidateAIAURL functions with SSRF hardening
bundle_test.go	Update test to use localhost instead of 127.0.0.1 to pass SSRF validation
certkit_test.go	Add TestIsMozillaRoot, TestVerifyChainTrust, TestValidateAIAURL
CHANGELOG.md	Document all changes with PR references

[Copilot]

Pull request overview

Copilot reviewed 23 out of 23 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 23 out of 23 changed files in this pull request and generated 1 comment.

[claude]

test

[claude]

Code review

Found 4 issues: 1 CLAUDE.md compliance violation and 3 bugs.

---

API-1 (MUST) — VerifyChainTrust missing godoc comment

File: bundle.go:230

The comment block at lines 211–223 is a single contiguous // block. The final line, // VerifyChainTrustInput holds parameters for VerifyChainTrust., has no blank line between it and type VerifyChainTrustInput struct — so the entire block attaches to the struct, not to func VerifyChainTrust. The function has no godoc comment.

Violates CLAUDE.md API-1: "Exported functions: doc comment required (godoc style). No exceptions."

Fix: move VerifyChainTrustInput before the function's doc comment (satisfying CS-6 as well), giving each declaration its own godoc block:

// VerifyChainTrustInput holds parameters for VerifyChainTrust.
type VerifyChainTrustInput struct {
	Cert          *x509.Certificate
	Roots         *x509.CertPool
	Intermediates *x509.CertPool
}

// VerifyChainTrust reports whether the given certificate chains to a trusted
// root. Cross-signed roots (same Subject and public key as a Mozilla root)
// are trusted directly. For expired certificates, verification is performed
// at a time just after the certificate's NotBefore to determine if the chain
// was ever valid — this is more robust than checking just before NotAfter,
// because intermediates that expired between issuance and the leaf's expiry
// will still be valid at NotBefore time.
//
// Known limitation: if an intermediate expired before the leaf's NotBefore,
// the time-shifted verification will still fail because the intermediate is
// invalid at the leaf's issuance time. This is an uncommon edge case in
// practice (intermediates outlive the leaves they sign).
func VerifyChainTrust(input VerifyChainTrustInput) bool {

---

Bug — Non-deferred storeMu.Unlock() in addFiles (permanent deadlock on panic)

File: cmd/wasm/main.go:65

storeMu.Lock() at line 65 is released with a plain storeMu.Unlock() at line 92 — no defer. The intervening loop accesses JS values (filesArg.Index(i), file.Get("name"), file.Get("data"), js.CopyBytesToGo) and calls certstore.ProcessData on untrusted input. A panic in any of these permanently deadlocks the store — all future calls to getState, exportBundlesJS, resetStore, and addFiles will block forever.

This PR fixed the same class of bug in exportBundlesJS (defer storeMu.RUnlock() at line 272), but addFiles was not updated consistently.

Fix: replace the plain Unlock() with defer storeMu.Unlock() immediately after the lock acquisition and remove the explicit call at line 92.

---

Bug — Non-deferred storeMu.Unlock() in AIA goroutine (permanent deadlock on panic)

File: cmd/wasm/main.go:110

Same pattern: storeMu.Lock() at line 110, plain Unlock() at line 112. resolveAIA fetches and parses untrusted certificate data from the network; a panic inside it permanently deadlocks the store.

Fix: use defer storeMu.Unlock() immediately after the lock acquisition and remove the explicit Unlock() at line 112.

---

ERR-6 (MUST) — Missing return after json.Marshal error

File: cmd/wasm/main.go:118-131

When json.Marshal(warnings) fails, warnJSON is nil and the error is logged. Execution then falls through: the setTimeout callback is still registered and onComplete.Invoke(string(warnJSON)) is called with string(nil) == "", delivering an empty string instead of valid JSON to the JS caller.

Violates CLAUDE.md ERR-6: "Fail fast — return errors immediately, don't accumulate them."

Fix:

warnJSON, err := json.Marshal(warnings)
if err != nil {
	slog.Error("marshaling AIA warnings", "error", err)
	return
}

[claude]

test

[claude]

Code review

Found 2 issues (both CLAUDE.md MUST violations).

Checked for: bugs, CLAUDE.md compliance (API-1, CS-5, CS-6, ERR-1, ERR-5, ERR-6, CC-3, T-2, T-9, T-11, T-12, CL-1–CL-6, CLI-1–CLI-7).

---

Issue 1 — API-1 (MUST): VerifyChainTrust has no godoc comment

File: bundle.go

Rule: API-1 (MUST) — "Exported functions: doc comment required (godoc style). No exceptions."

The intended doc comment for VerifyChainTrust (the long block starting with // VerifyChainTrust reports whether…) is not separated by a blank line from // VerifyChainTrustInput holds parameters for VerifyChainTrust.. In Go, a contiguous block of // comment lines immediately preceding a declaration becomes that declaration's godoc comment — so the entire block (including the VerifyChainTrust description) becomes the godoc for type VerifyChainTrustInput. The function itself ends up with no godoc.

Current (broken):

// VerifyChainTrust reports whether the given certificate chains to a trusted
// root. ...
//
// Known limitation: ...
// practice (intermediates outlive the leaves they sign).
// VerifyChainTrustInput holds parameters for VerifyChainTrust.  ← no blank line before this
type VerifyChainTrustInput struct { ... }

func VerifyChainTrust(input VerifyChainTrustInput) bool {  ← no godoc

Fix: place the short struct comment above the type declaration, add a blank line after it, then put the long VerifyChainTrust description immediately before the function:

// VerifyChainTrustInput holds parameters for VerifyChainTrust.
type VerifyChainTrustInput struct {
	Cert          *x509.Certificate
	Roots         *x509.CertPool
	Intermediates *x509.CertPool
}

// VerifyChainTrust reports whether the given certificate chains to a trusted
// root. Cross-signed roots (same Subject and public key as a Mozilla root)
// are trusted directly. ...
func VerifyChainTrust(input VerifyChainTrustInput) bool {

---

Issue 2 — CL-3/CL-4 (MUST): commit ref b5969b0 does not exist in this PR

File: CHANGELOG.md

Rules: CL-3/CL-4 (MUST) — "Each entry ends with a commit ref. Use the short (7-char) commit SHA."

Three changelog entries and the link definition at the bottom reference [b5969b0], but none of the 12 commits in this PR have a SHA starting with b5969b0. The PR's commits are: 92f1da0, 070ee62, 8491ddc, 15363ef, 129177f, ffe3170, d8702ae, e1a9b0f, 734e4f9, eb244b0, dd090b5, bb66119.

Fix: replace b5969b0 (in the three entry lines and the link definition at the bottom of CHANGELOG.md) with the correct short SHA of the commit that introduced the trust/expiry annotation feature.