Re: [PATCH] Relax X509 CA cert sanity checking

[Daniel P . Berrangé]

On Tue, Dec 14, 2021 at 02:55:02PM +0000, Henry Kleynhans wrote:
> Hi Daniel,
> 
> I agree that this would allow QEMU startup with a broken
> TLS setup.  Maybe the better solution is to only validate
> the chain of trust.  Would a patch that does that be acceptable?

Yes, that would be fine. It was only ever intended to validate
the chain of trust needed for QEMU's usage. It simply never
occurred to me that someone who have extra redundant certs in
their bundle, so I didn't do anything special to handle that.

BTW, there's a decent amount of unit test coverage for this code
in tests/unit/test-crypto-tlscredsx509.c which could be fairly
easily extended to cover the scenarios of extra certs outside
the required chain of trust.

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|