On Thu, Sep 24, 2026 at 01:15:37PM +0200, Theo Buehler wrote:
> Next step: rename valid_cert() to valid_resources(), make it static and
> call it at the end of valid_x509(). This is another missing check for EE
> certs, namely that the resources are covered by the issuing cert. This
> check isn't super expensive since valid_resources() uses a logic similar
> to partial chains.
> 
> valid_resources() isn't a particularly great name but I think it is
> better than valid_cert() for this function. This frees up valid_cert()
> which will become the new name of valid_x509() in the last step.

OK job@