feat: PQC-02 certificate-key and PQC-03 SSH host-key checks (v0.7.0) - #10
Conversation
PQC-02: new certificate_key check — leaf certificate fetched via a second openssl s_client probe (probe_raw, no -brief) and parsed with pyca/cryptography; flags RSA < 3072, unapproved EC curves, and DSA. PQC-03: new host_key_algorithms check — server_host_key_algorithms parsed from the same SSH KEXINIT packet (RFC 4253 §7.1); flags ssh-dss and ssh-rsa. Neither check affects the SAFE/UNSAFE verdict (PQC-01 semantics) or the CLI exit code; missing data yields INFO, never ERROR. Status/Verdict enums are unchanged (platform IDR-018 contract). New dependency: cryptography>=42. Bump version to 0.7.0.
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
t0kubetsu has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (12)
📝 WalkthroughWalkthroughVersion 0.7.0 adds TLS certificate-key and SSH host-key algorithm checks. Probes collect the required metadata. The new checks report independently and do not change the PQC SAFE/UNSAFE verdict. ChangesAlgorithm hygiene checks
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant TLSProbe
participant fetch_certificate
participant CertificateInfo
participant build_checks
TLSProbe->>fetch_certificate: retrieve leaf certificate
fetch_certificate->>CertificateInfo: parse certificate key metadata
TLSProbe->>build_checks: pass certificate and SSH host-key data
build_checks-->>TLSProbe: return independent hygiene checks
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
@coderabbitai review |
|
@coderabbitai full review |
|
Merging without a CodeRabbit review: CodeRabbit is failing server-side today (explicit "Review failed" above; same failure on testing-platform-backend PR #35). Two manual triggers over ~35 min got no review. Evidence backing the merge: CI green on Python 3.11/3.12/3.13 with the 100% coverage gate, ruff clean, and live verification against badssl.com (RSA-2048 → FAIL), cloudflare.com (P-256 → PASS, verdict unchanged), github.com:22 (ssh-rsa → FAIL). CodeRabbit can re-review post-merge via @coderabbitai review on main if needed. |
|
|
|
Post-merge ECC review (posted as comment — the GitHub reviews API is returning 503 right now, which likely also explains today's CodeRabbit "Review failed"; adversarial self-review, constants verified against primary sources). Decision: APPROVE with comments — 0 critical, 0 high, 1 medium, 2 low. Standards verification (2026-08-17):
MEDIUM (follow-up, not hotfix): the certificate fetch is a second LOW: Validation: 302 tests / 100% coverage / ruff clean / CI green 3.11–3.13 / live-verified on 4 hosts. |
|
Tip For best results, initiate chat on the files or code changes.
The merge rationale is clear. The reported CI, coverage, lint, and live verification cover the new certificate-key and SSH host-key checks. (ᵕ•ᴗ•) 🐇 You are interacting with an AI system. |
1 participant
Summary
Implements the two remaining v4.0 PQC spec items (Docmost, Test modules → PQC, both "Should, v4.0"):
certificate_keycheck on every TLS/STARTTLS assessment. The leaf certificate is fetched with a secondopenssl s_clientprobe (the primary probe uses-brief, which suppresses cert output) via the existingprobe_raw()helper, then parsed with pyca/cryptography. Flags RSA < 3072 (CNSA 2.0 / BSI TR-02102-2), EC curves outside P-256/P-384/P-521/Brainpool ≥ 256 (NIST SP 800-186), and DSA (FIPS 186-5). Ed25519/Ed448 pass.host_key_algorithmscheck on every SSH assessment. Theserver_host_key_algorithmsname-list is parsed from the same KEXINIT packet already read for the KEX check (RFC 4253 §7.1) — zero extra round-trips. Flagsssh-dssandssh-rsa(plus their*-cert-v01variants).Backend contract (IDR-018) — deliberately preserved
StatusandVerdictenums gained no new members; existing check names untouched.INFO, neverERROR, so a transient second-connection failure cannot force exit code 2 or a bogus platform finding.Design decision
cryptography>=42added as a dependency instead of scrapingopenssl x509 -text: the text output is fragile across OpenSSL versions/locales, and pyca/cryptography is the canonical maintained X.509 parser. The fetch itself still goes throughtls_utilssubprocess calls, so the test mock boundary is unchanged.Testing
Summary by CodeRabbit
New Features
Documentation
Tests