On Thu, Sep 24, 2026 at 11:08:29AM +0200, Theo Buehler wrote:
> The second step has two parts to it:
> 
> Match the cert's CRL distribution point against the CA repository from
> which the CRL was obtained. Do this in valid_x509() after successful
> validation. This way we know from X509_V_CHECK_CRL that a CRL was
> present and we also cover all EE certs with the same check. Although a
> TA cert should never get there, I feel better checking the cert->purpose
> for !TA. Use an exit path that frees things rather than adding third copy
> of the same freeing stanza.
> 
> Teach filemode about crl->mftcrldp: the CRL lookup path in the cache.
> To make this work nicely add a file variable that points into the uri.
> The assert() is only there to avoid a possible future leak. This way
> filemode keeps working with the new strcmp() check in valid_cert()
> without special casing in the valid_x509() code.

OK job@