New release s390-tools-2.32.0

Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>

CHANGELOG.md

@@ -1,6 +1,23 @@
 Release history for s390-tools (MIT version)
 --------------------------------------------
 
+* __v2.32.0 (2024-04-03)__
+
+  For Linux kernel version: 6.8
+
+  Changes of existing tools:
+  - cpumf/lscpumf: add support for machine type 3932
+  - genprotimg, pvattest, and pvsecret accept IBM signing key with Armonk as
+    subject locality
+  - zdump/zipl: Support for List-Directed dump from ECKD DASD
+  - zkey: Detect FIPS mode and generate PBKDF for luksFormat according to it
+
+  Bug Fixes:
+  - dbginfo.sh: dash compatible copy sequence
+  - rust/pv_core: Fix UvDeviceInfo::get() method
+  - zipl/src: Fix leak of files if run with a broken configuration
+  - zkey: Fix convert command to accept only keys of type CCA-AESDATA
+
 * __v2.31.0 (2024-02-02)__
 
   For Linux kernel version: 6.7

common.mak

@@ -32,7 +32,7 @@ endif
 # The variable "DISTRELEASE" should be overwritten in rpm spec files with:
 # "make DISTRELEASE=%{release}" and "make install DISTRELEASE=%{release}"
 VERSION            = 2
-RELEASE            = 31
+RELEASE            = 32
 PATCHLEVEL         = 0
 DISTRELEASE        = build-$(shell date +%Y%m%d)
 S390_TOOLS_RELEASE = $(VERSION).$(RELEASE).$(PATCHLEVEL)-$(DISTRELEASE)

cpumf/lscpumf.c

@@ -3473,6 +3473,7 @@ static struct counters *get_counter(int ctrset, size_t *len)
 			read_ccerror(cp, *len);
 			break;
 		case UTIL_ARCH_MACHINE_TYPE_Z16:
+		case UTIL_ARCH_MACHINE_TYPE_Z16_A02:
 			cp = cpumcf_z16_counters;
 			*len = ARRAY_SIZE(cpumcf_z16_counters);
 		}

etc/sysconfig/dumpconf

@@ -28,6 +28,15 @@
 # DEVICE=0.0.4e13
 # DELAY_MINUTES=5
 
+#
+# Dump on ECKD device (DASD)
+#
+#ON_PANIC=dump
+#DUMP_TYPE=eckd
+#DEVICE=0.0.1004
+#BOOTPROG=0
+#BR_CHR=auto
+
 #
 # Dump on fcp device (SCSI Disk)
 #

genprotimg/Makefile

@@ -3,7 +3,7 @@ include ../common.mak
 
 .DEFAULT_GOAL := all
 
-PKGDATADIR := "$(DESTDIR)$(TOOLS_DATADIR)/genprotimg"
+PKGDATADIR := "$(TOOLS_DATADIR)/genprotimg"
 TESTS :=
 SUBDIRS := boot src man
 RECURSIVE_TARGETS := all-recursive install-recursive clean-recursive
@@ -11,8 +11,8 @@ RECURSIVE_TARGETS := all-recursive install-recursive clean-recursive
 all: all-recursive
 
 install: install-recursive
-	$(INSTALL) -d -m 755 "$(PKGDATADIR)"
-	$(INSTALL) -g $(GROUP) -o $(OWNER) -m 755 samples/check_hostkeydoc "$(PKGDATADIR)"
+	$(INSTALL) -d -m 755 "$(DESTDIR)$(PKGDATADIR)"
+	$(INSTALL) -g $(GROUP) -o $(OWNER) -m 755 samples/check_hostkeydoc "$(DESTDIR)$(PKGDATADIR)"
 
 clean: clean-recursive
 

genprotimg/boot/Makefile

@@ -7,7 +7,7 @@ DEBUG_FILES := $(addsuffix .debug,$(FILES))
 ifeq ($(HOST_ARCH),s390x)
 ZIPL_DIR := $(rootdir)/zipl
 ZIPL_BOOT_DIR := $(ZIPL_DIR)/boot
-PKGDATADIR := $(DESTDIR)$(TOOLS_DATADIR)/genprotimg
+PKGDATADIR := $(TOOLS_DATADIR)/genprotimg
 
 INCLUDE_PATHS := $(ZIPL_BOOT_DIR) $(ZIPL_DIR)/include $(rootdir)/include
 INCLUDE_PARMS := $(addprefix -I,$(INCLUDE_PATHS))
@@ -86,9 +86,9 @@ stage3b.elf: head.o $(ZIPL_OBJS)
 	@chmod a-x $@
 
 install: stage3a.bin stage3b_reloc.bin
-	$(INSTALL) -d -m 755 "$(PKGDATADIR)"
-	$(INSTALL) -g $(GROUP) -o $(OWNER) -m 644 stage3a.bin "$(PKGDATADIR)"
-	$(INSTALL) -g $(GROUP) -o $(OWNER) -m 644 stage3b_reloc.bin "$(PKGDATADIR)"
+	$(INSTALL) -d -m 755 "$(DESTDIR)$(PKGDATADIR)"
+	$(INSTALL) -g $(GROUP) -o $(OWNER) -m 644 stage3a.bin "$(DESTDIR)$(PKGDATADIR)"
+	$(INSTALL) -g $(GROUP) -o $(OWNER) -m 644 stage3b_reloc.bin "$(DESTDIR)$(PKGDATADIR)"
 
 else
 # Don't generate the dependency files (see `common.mak` for the

genprotimg/samples/check_hostkeydoc

@@ -4,7 +4,7 @@
 #
 # Sample script to verify that a host key document is genuine by
 # verifying the issuer, the validity date and the signature.
-# Optionally verify the full trust chain using a CA certficate.
+# Optionally verify the full trust chain using a CA certificate.
 #
 # Sample invocation:
 #
@@ -15,31 +15,33 @@
 # s390-tools is free software; you can redistribute it and/or modify
 # it under the terms of the MIT license. See LICENSE for details.
 
-
 # Allocate temporary files
 ISSUER_PUBKEY_FILE=$(mktemp)
 SIGNATURE_FILE=$(mktemp)
 BODY_FILE=$(mktemp)
 ISSUER_DN_FILE=$(mktemp)
 SUBJECT_DN_FILE=$(mktemp)
-DEF_ISSUER_DN_FILE=$(mktemp)
+DEF_ISSUER_ARMONK_DN_FILE=$(mktemp)
+DEF_ISSUER_POUGHKEEPSIE_DN_FILE=$(mktemp)
 CANONICAL_ISSUER_DN_FILE=$(mktemp)
 CRL_SERIAL_FILE=$(mktemp)
 
 # Cleanup on exit
 cleanup()
 {
-    rm -f $ISSUER_PUBKEY_FILE $SIGNATURE_FILE $BODY_FILE \
-        $ISSUER_DN_FILE $SUBJECT_DN_FILE $DEF_ISSUER_DN_FILE \
-        $CANONICAL_ISSUER_DN_FILE $CRL_SERIAL_FILE
+    rm -f "$ISSUER_PUBKEY_FILE" "$SIGNATURE_FILE" "$BODY_FILE" \
+        "$ISSUER_DN_FILE" "$SUBJECT_DN_FILE" "$DEF_ISSUER_ARMONK_DN_FILE" "$DEF_ISSUER_POUGHKEEPSIE_DN_FILE" \
+        "$CANONICAL_ISSUER_DN_FILE" "$CRL_SERIAL_FILE"
 }
 trap cleanup EXIT
 
 # Enhanced error checking for bash
-if [ -n "${BASH}" ]
-then
+if [ -n "${BASH}" ]; then
+    # shellcheck disable=SC3040
     set -o posix
+    # shellcheck disable=SC3040
     set -o pipefail
+    # shellcheck disable=SC3040
     set -o nounset
 fi
 set -e
@@ -47,8 +49,8 @@ set -e
 # Usage
 usage()
 {
-cat <<-EOF
-Usage: `basename $1` [-d] [-c CA-cert] [-r CRL] host-key-doc signing-key-cert
+    cat <<-EOF
+Usage: $(basename "$1") [-d] [-c CA-cert] [-r CRL] host-key-doc signing-key-cert
 
 Verify an IBM Secure Execution host key document against
 a signing key.
@@ -71,8 +73,7 @@ check_verify_chain()
 {
     # Verify certificate chain in case a CA certificate file/bundle
     # was specified on the command line.
-    if [ $# = 1 ]
-    then
+    if [ -z "$2" ]; then
         cat >&2 <<-EOF
 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
 No CA certificate specified! Skipping trust chain verification.
@@ -80,37 +81,37 @@ Make sure that '$1' is a valid certificate.
 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
 EOF
     else
-        openssl verify -crl_download -crl_check $2 &&
-        openssl verify -crl_download -crl_check -untrusted $2 $1 ||
-        exit 1
+        openssl verify -crl_download -crl_check "$2" &&
+            openssl verify -crl_download -crl_check -untrusted "$2" "$1" ||
+            exit 1
     fi
 }
 
 extract_pubkey()
 {
-    openssl x509 -in $1 -pubkey -noout > $2
+    openssl x509 -in "$1" -pubkey -noout >"$2"
 }
 
 extract_signature()
 {
     # Assuming that the last field is the signature
-    SIGOFFSET=$(openssl asn1parse -in $1 | tail -1 | cut -d : -f 1)
+    SIGOFFSET=$(openssl asn1parse -in "$1" | tail -1 | cut -d : -f 1)
 
-    openssl asn1parse -in $1 -out $2 -strparse $SIGOFFSET -noout
+    openssl asn1parse -in "$1" -out "$2" -strparse "$SIGOFFSET" -noout
 }
 
 extract_body()
 {
     # Assuming that the first field is the full cert body
-    SIGOFFSET=$(openssl asn1parse -in $1 | head -2 | tail -1 | cut -d : -f 1)
+    SIGOFFSET=$(openssl asn1parse -in "$1" | head -2 | tail -1 | cut -d : -f 1)
 
-    openssl asn1parse -in $1 -out $2 -strparse $SIGOFFSET -noout
+    openssl asn1parse -in "$1" -out "$2" -strparse "$SIGOFFSET" -noout
 }
 
 verify_signature()
 {
     # Assuming that the signature algorithm is SHA512 with RSA
-    openssl sha512 -verify $1 -signature $2 $3
+    openssl sha512 -verify "$1" -signature "$2" "$3"
 }
 
 canonical_dn()
@@ -120,18 +121,30 @@ canonical_dn()
     DNTYPE=$3
     OUTPUT=$4
 
-    openssl $OBJTYPE -in $OBJ -$DNTYPE -noout -nameopt multiline \
-        | sort | grep -v $DNTYPE= > $OUTPUT
+    openssl "$OBJTYPE" -in "$OBJ" -"$DNTYPE" -noout -nameopt multiline |
+        LC_ALL=C sort | grep -v "$DNTYPE"= >"$OUTPUT"
 }
 
-default_issuer()
+default_issuer_armonk()
+{
+    cat <<-EOF
+    commonName                = International Business Machines Corporation
+    countryName               = US
+    localityName              = Armonk
+    organizationName          = International Business Machines Corporation
+    organizationalUnitName    = Key Signing Service
+    stateOrProvinceName       = New York
+EOF
+}
+
+default_issuer_pougkeepsie()
 {
     cat <<-EOF
     commonName                = International Business Machines Corporation
     countryName               = US
     localityName              = Poughkeepsie
-    organizationalUnitName    = Key Signing Service
     organizationName          = International Business Machines Corporation
+    organizationalUnitName    = Key Signing Service
     stateOrProvinceName       = New York
 EOF
 }
@@ -141,42 +154,37 @@ EOF
 # stripping off the prefix
 verify_default_issuer()
 {
-    default_issuer > $DEF_ISSUER_DN_FILE
+    default_issuer_pougkeepsie >"$DEF_ISSUER_POUGHKEEPSIE_DN_FILE"
+    default_issuer_armonk >"$DEF_ISSUER_ARMONK_DN_FILE"
 
     sed "s/\(^[ ]*organizationalUnitName[ ]*=[ ]*\).*\(Key Signing Service$\)/\1\2/" \
-	$ISSUER_DN_FILE > $CANONICAL_ISSUER_DN_FILE
+        "$ISSUER_DN_FILE" >"$CANONICAL_ISSUER_DN_FILE"
 
-    if ! diff $CANONICAL_ISSUER_DN_FILE $DEF_ISSUER_DN_FILE
-    then
+    if ! {
+        diff "$CANONICAL_ISSUER_DN_FILE" "$DEF_ISSUER_POUGHKEEPSIE_DN_FILE" ||
+            diff "$CANONICAL_ISSUER_DN_FILE" "$DEF_ISSUER_ARMONK_DN_FILE"
+    } >/dev/null 2>&1; then
         echo Incorrect default issuer >&2 && exit 1
     fi
 }
 
 verify_issuer_files()
 {
-    if [ $1 -eq 1  ]
-    then
-       verify_default_issuer
-    fi
-
-    if diff $ISSUER_DN_FILE $SUBJECT_DN_FILE
-    then
-        echo Issuer verification OK
-    else
-        echo Issuer verification failed >&2 && exit 1
+    if [ "$1" -eq 1 ]; then
+        verify_default_issuer
     fi
 }
 
 cert_time()
 {
-    DATE=$(openssl x509 -in $1 -$2 -noout | sed "s/^.*=//")
+    DATE=$(openssl x509 -in "$1" -"$2" -noout | sed "s/^.*=//")
 
     date -d "$DATE" +%s
 }
 
 crl_time()
 {
-    DATE=$(openssl crl -in $1 -$2 -noout | sed "s/^.*=//")
+    DATE=$(openssl crl -in "$1" -"$2" -noout | sed "s/^.*=//")
 
     date -d "$DATE" +%s
 }
@@ -188,8 +196,7 @@ verify_dates()
     MSG="${3:-Certificate}"
     NOW=$(date +%s)
 
-    if [ $START -le $NOW -a $NOW -le $END ]
-    then
+    if [ "$START" -le "$NOW" ] && [ "$NOW" -le "$END" ]; then
         echo "${MSG} dates are OK"
     else
         echo "${MSG} date verification failed" >&2 && exit 1
@@ -198,22 +205,21 @@ verify_dates()
 
 crl_serials()
 {
-    openssl crl -in $1 -text -noout | \
-        grep "Serial Number" > $CRL_SERIAL_FILE
+    openssl crl -in "$1" -text -noout |
+        grep "Serial Number" >"$CRL_SERIAL_FILE"
 }
 
 check_serial()
 {
-    CERT_SERIAL=$(openssl x509 -in $1 -noout -serial | cut -d = -f 2)
+    CERT_SERIAL=$(openssl x509 -in "$1" -noout -serial | cut -d = -f 2)
 
-    grep -q $CERT_SERIAL $CRL_SERIAL_FILE
+    grep -q "$CERT_SERIAL" "$CRL_SERIAL_FILE"
 }
 
 check_file()
 {
-    [ $# = 0 ] ||
     [ -e "$1" ] ||
-    (echo "File '$1' not found" >&2 && exit 1)
+        (echo "File '$1' not found" >&2 && exit 1)
 }
 
 # check args
@@ -221,28 +227,25 @@ CRL_FILE=
 CA_FILE=
 CHECK_DEFAULT_ISSUER=1
 
-args=$(getopt -qu "dr:c:h" $*)
-if [ $? = 0 ]
-then
-    set -- $args
-    while [ $1 != "" ]
-    do
-        case $1 in
-            -d) CHECK_DEFAULT_ISSUER=0; shift;;
-            -r) CRL_FILE=$2; shift 2;;
-            -c) CA_FILE=$2; shift 2;;
-            -h) usage $0; exit 0;;
-            --) shift; break;;
-        esac
-    done
-else
-    usage $0 >&2
-    exit 1
-fi
+while getopts 'dr:c:h' opt; do
+    case $opt in
+    d) CHECK_DEFAULT_ISSUER=0 ;;
+    r) CRL_FILE=$OPTARG ;;
+    c) CA_FILE=$OPTARG ;;
+    h)
+        usage "$0"
+        exit 0
+        ;;
+    ?)
+        usage "$0"
+        exit 1
+        ;;
+    esac
+done
+shift "$((OPTIND - 1))"
 
-if [ $# -ne 2  ]
-then
-    usage $0 >&2
+if [ $# -ne 2 ]; then
+    usage "$0" >&2
     exit 1
 fi
 
@@ -250,51 +253,51 @@ HKD_FILE=$1
 HKSK_FILE=$2
 
 # Check whether all specified files exist
-check_file $HKD_FILE
-check_file $HKSK_FILE
-check_file $CA_FILE
-check_file $CRL_FILE
+check_file "$HKD_FILE"
+check_file "$HKSK_FILE"
+# CA and CRL are optional arguments
+[ -n "$CA_FILE" ] && check_file "$CA_FILE"
+[ -n "$CRL_FILE" ] && check_file "$CRL_FILE"
 
 # Check trust chain
-check_verify_chain $HKSK_FILE $CA_FILE
+check_verify_chain "$HKSK_FILE" "$CA_FILE"
 
 # Verify host key document signature
-echo -n "Checking host key document signature: "
-extract_pubkey $HKSK_FILE $ISSUER_PUBKEY_FILE &&
-extract_signature $HKD_FILE $SIGNATURE_FILE &&
-extract_body $HKD_FILE $BODY_FILE &&
-verify_signature $ISSUER_PUBKEY_FILE $SIGNATURE_FILE $BODY_FILE ||
-exit 1
+printf "Checking host key document signature: "
+extract_pubkey "$HKSK_FILE" "$ISSUER_PUBKEY_FILE" &&
+    extract_signature "$HKD_FILE" "$SIGNATURE_FILE" &&
+    extract_body "$HKD_FILE" "$BODY_FILE" &&
+    verify_signature "$ISSUER_PUBKEY_FILE" "$SIGNATURE_FILE" "$BODY_FILE" ||
+    exit 1
 
 # Verify the issuer
-canonical_dn x509 $HKD_FILE issuer $ISSUER_DN_FILE
-canonical_dn x509 $HKSK_FILE subject $SUBJECT_DN_FILE
+canonical_dn x509 "$HKD_FILE" issuer "$ISSUER_DN_FILE"
+canonical_dn x509 "$HKSK_FILE" subject "$SUBJECT_DN_FILE"
 verify_issuer_files $CHECK_DEFAULT_ISSUER
 
 # Verify dates
-verify_dates $(cert_time $HKD_FILE startdate) $(cert_time $HKD_FILE enddate)
+verify_dates "$(cert_time "$HKD_FILE" startdate)" "$(cert_time "$HKD_FILE" enddate)"
 
 # Check CRL if specified
-if [ -n "$CRL_FILE" ]
-then
-    echo -n "Checking CRL signature: "
-    extract_signature $CRL_FILE $SIGNATURE_FILE &&
-    extract_body $CRL_FILE $BODY_FILE &&
-    verify_signature $ISSUER_PUBKEY_FILE $SIGNATURE_FILE $BODY_FILE ||
-    exit 1
+if [ -n "$CRL_FILE" ]; then
+    printf "Checking CRL signature: "
+    extract_signature "$CRL_FILE" "$SIGNATURE_FILE" &&
+        extract_body "$CRL_FILE" "$BODY_FILE" &&
+        verify_signature "$ISSUER_PUBKEY_FILE" "$SIGNATURE_FILE" "$BODY_FILE" ||
+        exit 1
 
-    echo -n "CRL "
-    canonical_dn crl $CRL_FILE issuer $ISSUER_DN_FILE
-    canonical_dn x509 $HKSK_FILE subject $SUBJECT_DN_FILE
+    printf "CRL "
+    canonical_dn crl "$CRL_FILE" issuer "$ISSUER_DN_FILE"
+    canonical_dn x509 "$HKSK_FILE" subject "$SUBJECT_DN_FILE"
     verify_issuer_files $CHECK_DEFAULT_ISSUER
 
-    verify_dates $(crl_time $CRL_FILE lastupdate) $(crl_time $CRL_FILE nextupdate) 'CRL'
+    verify_dates "$(crl_time "$CRL_FILE" lastupdate)" "$(crl_time "$CRL_FILE" nextupdate)" 'CRL'
 
-    crl_serials $CRL_FILE
-    check_serial $HKD_FILE &&
-    echo  "Certificate is revoked, do not use it anymore!" >&2 &&
-    exit 1
+    crl_serials "$CRL_FILE"
+    check_serial "$HKD_FILE" &&
+        echo "Certificate is revoked, do not use it anymore!" >&2 &&
+        exit 1
 fi
 
 # We made it
-echo All checks reqested for \'$HKD_FILE\' were successful
+echo All checks requested for \'"$HKD_FILE"\' were successful

genprotimg/src/Makefile

@@ -3,7 +3,7 @@ include ../../common.mak
 
 bin_PROGRAM = genprotimg
 
-PKGDATADIR ?= "$(DESTDIR)$(TOOLS_DATADIR)/genprotimg"
+PKGDATADIR ?= "$(TOOLS_DATADIR)/genprotimg"
 SRC_DIR := $(dir $(realpath $(firstword $(MAKEFILE_LIST))))
 TOP_SRCDIR := $(SRC_DIR)/../
 ROOT_DIR = $(TOP_SRC_DIR)/../../

genprotimg/src/include/pv_crypto_def.h

@@ -17,7 +17,8 @@
 /* IBM signing key subject */
 #define PV_IBM_Z_SUBJECT_COMMON_NAME "International Business Machines Corporation"
 #define PV_IBM_Z_SUBJECT_COUNTRY_NAME "US"
-#define PV_IBM_Z_SUBJECT_LOCALITY_NAME "Poughkeepsie"
+#define PV_IBM_Z_SUBJECT_LOCALITY_NAME_POUGHKEEPSIE	   "Poughkeepsie"
+#define PV_IBM_Z_SUBJECT_LOCALITY_NAME_ARMONK		   "Armonk"
 #define PV_IBM_Z_SUBJECT_ORGANIZATIONONAL_UNIT_NAME_SUFFIX "Key Signing Service"
 #define PV_IBM_Z_SUBJECT_ORGANIZATION_NAME "International Business Machines Corporation"
 #define PV_IBM_Z_SUBJECT_STATE "New York"

genprotimg/src/utils/crypto.c

@@ -664,62 +664,9 @@ static gboolean x509_name_data_by_nid_equal(X509_NAME *name, gint nid,
 	return memcmp(data, y, data_len) == 0;
 }
 
-static gboolean own_X509_NAME_ENTRY_equal(const X509_NAME_ENTRY *x,
-					  const X509_NAME_ENTRY *y)
-{
-	const ASN1_OBJECT *x_obj = X509_NAME_ENTRY_get_object(x);
-	const ASN1_STRING *x_data = X509_NAME_ENTRY_get_data(x);
-	const ASN1_OBJECT *y_obj = X509_NAME_ENTRY_get_object(y);
-	const ASN1_STRING *y_data = X509_NAME_ENTRY_get_data(y);
-	gint x_len = ASN1_STRING_length(x_data);
-	gint y_len = ASN1_STRING_length(y_data);
-
-	if (x_len < 0 || x_len != y_len)
-		return FALSE;
-
-	/* ASN1_STRING_cmp(x_data, y_data) == 0 doesn't work because it also
-	 * compares the type, which is sometimes different.
-	 */
-	return OBJ_cmp(x_obj, y_obj) == 0 &&
-		memcmp(ASN1_STRING_get0_data(x_data),
-		       ASN1_STRING_get0_data(y_data),
-		       (unsigned long)x_len) == 0;
-}
-
-static gboolean own_X509_NAME_equal(const X509_NAME *x, const X509_NAME *y)
-{
-	gint x_count = X509_NAME_entry_count(x);
-	gint y_count = X509_NAME_entry_count(y);
-
-	if (x != y && (!x || !y))
-		return FALSE;
-
-	if (x_count != y_count)
-		return FALSE;
-
-	for (gint i = 0; i < x_count; i++) {
-		const X509_NAME_ENTRY *entry_i = X509_NAME_get_entry(x, i);
-		gboolean entry_found = FALSE;
-
-		for (gint j = 0; j < y_count; j++) {
-			const X509_NAME_ENTRY *entry_j =
-				X509_NAME_get_entry(y, j);
-
-			if (own_X509_NAME_ENTRY_equal(entry_i, entry_j)) {
-				entry_found = TRUE;
-				break;
-			}
-		}
-
-		if (!entry_found)
-			return FALSE;
-	}
-	return TRUE;
-}
-
 /* Checks whether the subject of @cert is a IBM signing key subject. For this we
  * must check that the subject is equal to: 'C = US, ST = New York, L =
- * Poughkeepsie, O = International Business Machines Corporation, CN =
+ * Poughkeepsie or Armonk, O = International Business Machines Corporation, CN =
  * International Business Machines Corporation' and the organization unit (OUT)
  * must end with the suffix ' Key Signing Service'.
  */
@@ -743,8 +690,10 @@ static gboolean has_ibm_signing_subject(X509 *cert)
 					 PV_IBM_Z_SUBJECT_STATE))
 		return FALSE;
 
-	if (!x509_name_data_by_nid_equal(subject, NID_localityName,
-					 PV_IBM_Z_SUBJECT_LOCALITY_NAME))
+	if (!(x509_name_data_by_nid_equal(subject, NID_localityName,
+					  PV_IBM_Z_SUBJECT_LOCALITY_NAME_POUGHKEEPSIE) ||
+	      x509_name_data_by_nid_equal(subject, NID_localityName,
+					  PV_IBM_Z_SUBJECT_LOCALITY_NAME_ARMONK)))
 		return FALSE;
 
 	if (!x509_name_data_by_nid_equal(subject, NID_organizationName,
@@ -806,6 +755,39 @@ static X509_NAME *x509_name_reorder_attributes(const X509_NAME *name, const gint
 	return g_steal_pointer(&ret);
 }
 
+/** Replace locality 'Armonk' with 'Pougkeepsie'. If Armonk was not set return
+ *  `NULL`.
+ */
+static X509_NAME *x509_armonk_locality_fixup(const X509_NAME *name)
+{
+	g_autoptr(X509_NAME) ret = NULL;
+	int pos;
+
+	/* Check if ``L=Armonk`` */
+	if (!x509_name_data_by_nid_equal((X509_NAME *)name, NID_localityName,
+					 PV_IBM_Z_SUBJECT_LOCALITY_NAME_ARMONK))
+		return NULL;
+
+	ret = X509_NAME_dup((X509_NAME *)name);
+	if (!ret)
+		g_abort();
+
+	pos = X509_NAME_get_index_by_NID(ret, NID_localityName, -1);
+	if (pos == -1)
+		return NULL;
+
+	X509_NAME_ENTRY_free(X509_NAME_delete_entry(ret, pos));
+
+	/* Create a new name entry at the same position as before */
+	if (X509_NAME_add_entry_by_NID(
+		    ret, NID_localityName, MBSTRING_UTF8,
+		    (const unsigned char *)&PV_IBM_Z_SUBJECT_LOCALITY_NAME_POUGHKEEPSIE,
+		    sizeof(PV_IBM_Z_SUBJECT_LOCALITY_NAME_POUGHKEEPSIE) - 1, pos, 0) != 1)
+		return NULL;
+
+	return g_steal_pointer(&ret);
+}
+
 /* In RFC 5280 the attributes of a (subject/issuer) name is not mandatory
  * ordered. The problem is that our certificates are not consistent in the order
  * (see https://tools.ietf.org/html/rfc5280#section-4.1.2.4 for details).
@@ -828,24 +810,10 @@ X509_NAME *c2b_name(const X509_NAME *name)
 	return X509_NAME_dup((X509_NAME *)name);
 }
 
-/* Verify that: subject(issuer) == issuer(crl) and SKID(issuer) == AKID(crl) */
+/* Verify that SKID(issuer) == AKID(crl) if available */
 static gint check_crl_issuer(X509_CRL *crl, X509 *issuer, GError **err)
 {
-	const X509_NAME *crl_issuer = X509_CRL_get_issuer(crl);
-	const X509_NAME *issuer_subject = X509_get_subject_name(issuer);
-	AUTHORITY_KEYID *akid = NULL;
-
-	if (!own_X509_NAME_equal(issuer_subject, crl_issuer)) {
-		g_autofree char *issuer_subject_str = X509_NAME_oneline(issuer_subject,
-									NULL, 0);
-		g_autofree char *crl_issuer_str = X509_NAME_oneline(crl_issuer, NULL, 0);
-
-		g_set_error(err, PV_CRYPTO_ERROR,
-			    PV_CRYPTO_ERROR_CRL_SUBJECT_ISSUER_MISMATCH,
-			    _("issuer mismatch:\n%s\n%s"),
-			    issuer_subject_str, crl_issuer_str);
-		return -1;
-	}
+	g_autoptr(AUTHORITY_KEYID) akid = NULL;
 
 	/* If AKID(@crl) is specified it must match with SKID(@issuer) */
 	akid = X509_CRL_get_ext_d2i(crl, NID_authority_key_identifier, NULL, NULL);
@@ -881,7 +849,6 @@ gint check_crl_valid_for_cert(X509_CRL *crl, X509 *cert,
 		return -1;
 	}
 
-	/* check that the @crl issuer matches with the subject name of @cert*/
 	if (check_crl_issuer(crl, cert, err) < 0)
 		return -1;
 
@@ -910,6 +877,60 @@ gint check_crl_valid_for_cert(X509_CRL *crl, X509 *cert,
 	return 0;
 }
 
+/* This function contains work-arounds for some known subject(CRT)<->issuer(CRL)
+ * issues.
+ */
+static STACK_OF_X509_CRL *quirk_X509_STORE_ctx_get1_crls(X509_STORE_CTX *ctx,
+							 const X509_NAME *subject, GError **err)
+{
+	g_autoptr(X509_NAME) fixed_subject = NULL;
+	g_autoptr(STACK_OF_X509_CRL) ret = NULL;
+
+	ret = Pv_X509_STORE_CTX_get1_crls(ctx, subject);
+	if (ret && sk_X509_CRL_num(ret) > 0)
+		return g_steal_pointer(&ret);
+
+	/* Workaround to fix the mismatch between issuer name of the * IBM
+	 * signing CRLs and the IBM signing key subject name. Locality name has
+	 * changed from Poughkeepsie to Armonk.
+	 */
+	fixed_subject = x509_armonk_locality_fixup(subject);
+	/* Was the locality replaced? */
+	if (fixed_subject) {
+		X509_NAME *tmp;
+
+		sk_X509_CRL_free(ret);
+		ret = Pv_X509_STORE_CTX_get1_crls(ctx, fixed_subject);
+		if (ret && sk_X509_CRL_num(ret) > 0)
+			return g_steal_pointer(&ret);
+
+		/* Workaround to fix the ordering mismatch between issuer name
+		 * of the IBM signing CRLs and the IBM signing key subject name.
+		 */
+		tmp = fixed_subject;
+		fixed_subject = c2b_name(fixed_subject);
+		X509_NAME_free(tmp);
+		sk_X509_CRL_free(ret);
+		ret = Pv_X509_STORE_CTX_get1_crls(ctx, fixed_subject);
+		if (ret && sk_X509_CRL_num(ret) > 0)
+			return g_steal_pointer(&ret);
+		X509_NAME_free(fixed_subject);
+		fixed_subject = NULL;
+	}
+
+	/* Workaround to fix the ordering mismatch between issuer name of the
+	 * IBM signing CRLs and the IBM signing key subject name.
+	 */
+	fixed_subject = c2b_name(subject);
+	sk_X509_CRL_free(ret);
+	ret = Pv_X509_STORE_CTX_get1_crls(ctx, fixed_subject);
+	if (ret && sk_X509_CRL_num(ret) > 0)
+		return g_steal_pointer(&ret);
+
+	g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_NO_CRL, _("no CRL found"));
+	return NULL;
+}
+
 /* Given a certificate @cert try to find valid revocation lists in @ctx. If no
  * valid CRL was found NULL is returned.
  */
@@ -927,20 +948,9 @@ STACK_OF_X509_CRL *store_ctx_find_valid_crls(X509_STORE_CTX *ctx, X509 *cert,
 		return NULL;
 	}
 
-	ret = X509_STORE_CTX_get1_crls(ctx, subject);
-	if (!ret) {
-		/* Workaround to fix the mismatch between issuer name of the
-		 * IBM Z signing CRLs and the IBM Z signing key subject name.
-		 */
-		g_autoptr(X509_NAME) broken_subject = c2b_name(subject);
-
-		ret = X509_STORE_CTX_get1_crls(ctx, broken_subject);
-		if (!ret) {
-			g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_NO_CRL,
-				    _("no CRL found"));
-			return NULL;
-		}
-	}
+	ret = quirk_X509_STORE_ctx_get1_crls(ctx, subject, err);
+	if (!ret)
+		return NULL;
 
 	/* Filter out non-valid CRLs for @cert */
 	for (gint i = 0; i < sk_X509_CRL_num(ret); i++) {
@@ -1328,32 +1338,14 @@ gint check_chain_parameters(const STACK_OF_X509 *chain,
 
 /* It's almost the same as X509_check_issed from OpenSSL does except that we
  * don't check the key usage of the potential issuer. This means we check:
- * 1. issuer_name(cert) == subject_name(issuer)
- * 2. Check whether the akid(cert) (if available) matches the issuer skid
- * 3. Check that the cert algrithm matches the subject algorithm
- * 4. Verify the signature of certificate @cert is using the public key of
+ * 1. Check whether the akid(cert) (if available) matches the issuer skid
+ * 2. Check that the cert algrithm matches the subject algorithm
+ * 3. Verify the signature of certificate @cert is using the public key of
  *    @issuer.
  */
 static gint check_host_key_issued(X509 *cert, X509 *issuer, GError **err)
 {
-	const X509_NAME *issuer_subject = X509_get_subject_name(issuer);
-	const X509_NAME *cert_issuer = X509_get_issuer_name(cert);
-	AUTHORITY_KEYID *akid = NULL;
-
-	/* We cannot use X509_NAME_cmp() because it considers the order of the
-	 * X509_NAME_Entries.
-	 */
-	if (!own_X509_NAME_equal(issuer_subject, cert_issuer)) {
-		g_autofree char *issuer_subject_str =
-			X509_NAME_oneline(issuer_subject, NULL, 0);
-		g_autofree char *cert_issuer_str =
-			X509_NAME_oneline(cert_issuer, NULL, 0);
-		g_set_error(err, PV_CRYPTO_ERROR,
-			    PV_CRYPTO_ERROR_CERT_SUBJECT_ISSUER_MISMATCH,
-			    _("Subject issuer mismatch:\n'%s'\n'%s'"),
-			    issuer_subject_str, cert_issuer_str);
-		return -1;
-	}
+	g_autoptr(AUTHORITY_KEYID) akid = NULL;
 
 	akid = X509_get_ext_d2i(cert, NID_authority_key_identifier, NULL, NULL);
 	if (akid && X509_check_akid(issuer, akid) != X509_V_OK) {
@@ -1834,14 +1826,12 @@ static gint __encrypt_decrypt_bio(const struct cipher_parms *parms, BIO *b_in,
 		g_assert(out_len >= 0);
 
 		num_bytes_written = BIO_write(b_out, out_buf, out_len);
-		if (num_bytes_written < 0) {
+		if (num_bytes_written != out_len) {
 			g_set_error(err, PV_CRYPTO_ERROR,
 				    PV_CRYPTO_ERROR_INTERNAL,
 				    _("Failed to write"));
 			return -1;
 		}
-		g_assert(num_bytes_written == out_len);
-
 		tmp_size_out += (guint)num_bytes_written;
 
 		/* Set new tweak value. Please keep in mind that the

genprotimg/src/utils/crypto.h

@@ -75,6 +75,7 @@ void x509_pair_free(x509_pair *pair);
 /* Register auto cleanup functions */
 WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(ASN1_INTEGER, ASN1_INTEGER_free)
 WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(ASN1_OCTET_STRING, ASN1_OCTET_STRING_free)
+WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(AUTHORITY_KEYID, AUTHORITY_KEYID_free)
 WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(BIGNUM, BN_free)
 WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(BIO, BIO_free_all)
 WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(BN_CTX, BN_CTX_free)

include/dump/s390_dump.h

@@ -26,6 +26,17 @@
 #define DF_S390_EM_STR		"DUMP_END"
 #define DF_S390_CPU_MAX		512
 #define DF_S390_MAGIC_BLK_ECKD	3
+#define DF_S390_DUMPER_MAGIC_SIZE	7
+#define DF_S390_DUMPER_MAGIC32		"ZECKD31"
+#define DF_S390_DUMPER_MAGIC64		"ZECKD64"
+#define DF_S390_DUMPER_MAGIC_EXT	"XECKD64"
+#define DF_S390_DUMPER_MAGIC32_FBA	"ZDFBA31"
+#define DF_S390_DUMPER_MAGIC64_FBA	"ZDFBA64"
+#define DF_S390_DUMPER_MAGIC_FBA_EXT	"XDFBA64"
+#define DF_S390_DUMPER_MAGIC_MV		"ZMULT64"
+#define DF_S390_DUMPER_MAGIC_MV_EXT	"XMULT64"
+#define OLD_DUMPER_HEX_INSTR1 "\x0d\x10\x47\xf0" /* BASR + 1st halfword of BC */
+#define OLD_DUMPER_HEX_INSTR2 "\x0d\xd0" /* BASR 13,0 */
 
 /*
  * Architecture of dumped system

include/lib/util_arch.h

@@ -27,6 +27,7 @@ enum util_arch_machine_type {
 	UTIL_ARCH_MACHINE_TYPE_Z15	= 8561,
 	UTIL_ARCH_MACHINE_TYPE_Z15_T02	= 8562,
 	UTIL_ARCH_MACHINE_TYPE_Z16	= 3931,
+	UTIL_ARCH_MACHINE_TYPE_Z16_A02	= 3932,
 };
 
 int util_arch_machine_type(void);

include/lib/vtoc.h

@@ -40,6 +40,7 @@
 #define LV_COMPAT_CYL 0xFFFE
 
 #define VTOC_ERROR "VTOC error:"
+#define MAX_VTOC_ENTRIES 9 /* max number of VTOC labels for cdl formatted DASD */
 
 typedef struct ttr 
 {

include/libpv/cert.h

@@ -16,7 +16,8 @@
 
 #define PV_IBM_Z_SUBJECT_COMMON_NAME "International Business Machines Corporation"
 #define PV_IBM_Z_SUBJECT_COUNTRY_NAME "US"
-#define PV_IBM_Z_SUBJECT_LOCALITY_NAME "Poughkeepsie"
+#define PV_IBM_Z_SUBJECT_LOCALITY_NAME_POUGHKEEPSIE "Poughkeepsie"
+#define PV_IBM_Z_SUBJECT_LOCALITY_NAME_ARMONK "Armonk"
 #define PV_IBM_Z_SUBJECT_ORGANIZATIONAL_UNIT_NAME_SUFFIX "Key Signing Service"
 #define PV_IBM_Z_SUBJECT_ORGANIZATION_NAME "International Business Machines Corporation"
 #define PV_IBM_Z_SUBJECT_STATE "New York"

libpv/cert.c

@@ -857,7 +857,7 @@ static gboolean x509_name_data_by_nid_equal(X509_NAME *name, int nid, const char
 
 /* Checks whether the subject of @cert is a IBM signing key subject. For this we
  * must check that the subject is equal to: 'C = US, ST = New York, L =
- * Poughkeepsie, O = International Business Machines Corporation, CN =
+ * Poughkeepsie or Armonk, O = International Business Machines Corporation, CN =
  * International Business Machines Corporation' and the organization unit (OUT)
  * must end with the suffix ' Key Signing Service'.
  */
@@ -879,7 +879,10 @@ static gboolean has_ibm_signing_subject(X509 *cert)
 	if (!x509_name_data_by_nid_equal(subject, NID_stateOrProvinceName, PV_IBM_Z_SUBJECT_STATE))
 		return FALSE;
 
-	if (!x509_name_data_by_nid_equal(subject, NID_localityName, PV_IBM_Z_SUBJECT_LOCALITY_NAME))
+	if (!(x509_name_data_by_nid_equal(subject, NID_localityName,
+					  PV_IBM_Z_SUBJECT_LOCALITY_NAME_POUGHKEEPSIE) ||
+	      x509_name_data_by_nid_equal(subject, NID_localityName,
+					  PV_IBM_Z_SUBJECT_LOCALITY_NAME_ARMONK)))
 		return FALSE;
 
 	if (!x509_name_data_by_nid_equal(subject, NID_organizationName,
@@ -1085,10 +1088,9 @@ static int check_signature_algo_match(const EVP_PKEY *pkey, const X509 *subject,
 
 /* It's almost the same as X509_check_issed from OpenSSL does except that we
  * don't check the key usage of the potential issuer. This means we check:
- * 1. issuer_name(cert) == subject_name(issuer)
- * 2. Check whether the akid(cert) (if available) matches the issuer skid
- * 3. Check that the cert algrithm matches the subject algorithm
- * 4. Verify the signature of certificate @cert is using the public key of
+ * 1. Check whether the akid(cert) (if available) matches the issuer skid
+ * 2. Check that the cert algrithm matches the subject algorithm
+ * 3. Verify the signature of certificate @cert is using the public key of
  *    @issuer.
  */
 static int check_host_key_issued(X509 *cert, X509 *issuer, GError **error)
@@ -1097,19 +1099,6 @@ static int check_host_key_issued(X509 *cert, X509 *issuer, GError **error)
 	const X509_NAME *cert_issuer = X509_get_issuer_name(cert);
 	g_autoptr(AUTHORITY_KEYID) akid = NULL;
 
-	/* We cannot use X509_NAME_cmp() because it considers the order of the
-	 * X509_NAME_Entries.
-	 */
-	if (!own_X509_NAME_equal(issuer_subject, cert_issuer)) {
-		g_autofree char *issuer_subject_str = pv_X509_NAME_oneline(issuer_subject);
-		g_autofree char *cert_issuer_str = pv_X509_NAME_oneline(cert_issuer);
-
-		g_set_error(error, PV_CERT_ERROR, PV_CERT_ERROR_CERT_SUBJECT_ISSUER_MISMATCH,
-			    _("Subject issuer mismatch:\n'%s'\n'%s'"), issuer_subject_str,
-			    cert_issuer_str);
-		return -1;
-	}
-
 	akid = X509_get_ext_d2i(cert, NID_authority_key_identifier, NULL, NULL);
 	if (akid && X509_check_akid(issuer, akid) != X509_V_OK) {
 		g_set_error(error, PV_CERT_ERROR, PV_CERT_ERROR_SKID_AKID_MISMATCH,
@@ -1286,21 +1275,10 @@ int pv_verify_cert(X509_STORE_CTX *ctx, X509 *cert, GError **error)
 	return 0;
 }
 
-/* Verify that: subject(issuer) == issuer(crl) and SKID(issuer) == AKID(crl) */
+/* Verify that SKID(issuer) == AKID(crl) */
 static int check_crl_issuer(X509_CRL *crl, X509 *issuer, GError **error)
 {
-	const X509_NAME *crl_issuer = X509_CRL_get_issuer(crl);
-	const X509_NAME *issuer_subject = X509_get_subject_name(issuer);
-	AUTHORITY_KEYID *akid = NULL;
-
-	if (!own_X509_NAME_equal(issuer_subject, crl_issuer)) {
-		g_autofree char *issuer_subject_str = pv_X509_NAME_oneline(issuer_subject);
-		g_autofree char *crl_issuer_str = pv_X509_NAME_oneline(crl_issuer);
-
-		g_set_error(error, PV_CERT_ERROR, PV_CERT_ERROR_CRL_SUBJECT_ISSUER_MISMATCH,
-			    _("issuer mismatch:\n%s\n%s"), issuer_subject_str, crl_issuer_str);
-		return -1;
-	}
+	g_autoptr(AUTHORITY_KEYID) akid = NULL;
 
 	/* If AKID(@crl) is specified it must match with SKID(@issuer) */
 	akid = X509_CRL_get_ext_d2i(crl, NID_authority_key_identifier, NULL, NULL);
@@ -1325,7 +1303,6 @@ int pv_verify_crl(X509_CRL *crl, X509 *cert, int verify_flags, GError **error)
 		return -1;
 	}
 
-	/* check that the @crl issuer matches with the subject name of @cert*/
 	if (check_crl_issuer(crl, cert, error) < 0)
 		return -1;
 
@@ -1393,6 +1370,93 @@ int pv_check_chain_parameters(const STACK_OF_X509 *chain, GError **error)
 	return 0;
 }
 
+/** Replace locality 'Armonk' with 'Pougkeepsie'. If Armonk was not set return
+ *  `NULL`.
+ */
+static X509_NAME *x509_armonk_locality_fixup(const X509_NAME *name)
+{
+	g_autoptr(X509_NAME) ret = NULL;
+	int pos;
+
+	/* Check if ``L=Armonk`` */
+	if (!x509_name_data_by_nid_equal((X509_NAME *)name, NID_localityName,
+					 PV_IBM_Z_SUBJECT_LOCALITY_NAME_ARMONK))
+		return NULL;
+
+	ret = X509_NAME_dup((X509_NAME *)name);
+	if (!ret)
+		g_abort();
+
+	pos = X509_NAME_get_index_by_NID(ret, NID_localityName, -1);
+	if (pos == -1)
+		return NULL;
+
+	X509_NAME_ENTRY_free(X509_NAME_delete_entry(ret, pos));
+
+	/* Create a new name entry at the same position as before */
+	if (X509_NAME_add_entry_by_NID(
+		    ret, NID_localityName, MBSTRING_UTF8,
+		    (const unsigned char *)&PV_IBM_Z_SUBJECT_LOCALITY_NAME_POUGHKEEPSIE,
+		    sizeof(PV_IBM_Z_SUBJECT_LOCALITY_NAME_POUGHKEEPSIE) - 1, pos, 0) != 1)
+		return NULL;
+
+	return g_steal_pointer(&ret);
+}
+
+/* This function contains work-arounds for some known subject(CRT)<->issuer(CRL)
+ * issues.
+ */
+static STACK_OF_X509_CRL *quirk_X509_STORE_ctx_get1_crls(X509_STORE_CTX *ctx,
+							 const X509_NAME *subject, GError **err)
+{
+	g_autoptr(X509_NAME) fixed_subject = NULL;
+	g_autoptr(STACK_OF_X509_CRL) ret = NULL;
+
+	ret = pv_X509_STORE_CTX_get1_crls(ctx, subject);
+	if (ret && sk_X509_CRL_num(ret) > 0)
+		return g_steal_pointer(&ret);
+
+	/* Workaround to fix the mismatch between issuer name of the * IBM
+	 * signing CRLs and the IBM signing key subject name. Locality name has
+	 * changed from Poughkeepsie to Armonk.
+	 */
+	fixed_subject = x509_armonk_locality_fixup(subject);
+	/* Was the locality replaced? */
+	if (fixed_subject) {
+		X509_NAME *tmp;
+
+		sk_X509_CRL_free(ret);
+		ret = pv_X509_STORE_CTX_get1_crls(ctx, fixed_subject);
+		if (ret && sk_X509_CRL_num(ret) > 0)
+			return g_steal_pointer(&ret);
+
+		/* Workaround to fix the ordering mismatch between issuer name
+		 * of the IBM signing CRLs and the IBM signing key subject name.
+		 */
+		tmp = fixed_subject;
+		fixed_subject = pv_c2b_name(fixed_subject);
+		X509_NAME_free(tmp);
+		sk_X509_CRL_free(ret);
+		ret = pv_X509_STORE_CTX_get1_crls(ctx, fixed_subject);
+		if (ret && sk_X509_CRL_num(ret) > 0)
+			return g_steal_pointer(&ret);
+		X509_NAME_free(fixed_subject);
+		fixed_subject = NULL;
+	}
+
+	/* Workaround to fix the ordering mismatch between issuer name of the
+	 * IBM signing CRLs and the IBM signing key subject name.
+	 */
+	fixed_subject = pv_c2b_name(subject);
+	sk_X509_CRL_free(ret);
+	ret = pv_X509_STORE_CTX_get1_crls(ctx, fixed_subject);
+	if (ret && sk_X509_CRL_num(ret) > 0)
+		return g_steal_pointer(&ret);
+
+	g_set_error(err, PV_CERT_ERROR, PV_CERT_ERROR_NO_CRL, _("no CRL found"));
+	return NULL;
+}
+
 /* Given a certificate @cert try to find valid revocation lists in @ctx. If no
  * valid CRL was found NULL is returned.
  */
@@ -1412,21 +1476,9 @@ STACK_OF_X509_CRL *pv_store_ctx_find_valid_crls(X509_STORE_CTX *ctx, X509 *cert,
 		return NULL;
 	}
 
-	ret = pv_X509_STORE_CTX_get1_crls(ctx, subject);
-	if (!ret) {
-		/* Workaround to fix the mismatch between issuer name of the
-		 * IBM Z signing CRLs and the IBM Z signing key subject name.
-		 */
-		g_autoptr(X509_NAME) broken_subject = pv_c2b_name(subject);
-
-		ret = pv_X509_STORE_CTX_get1_crls(ctx, broken_subject);
-		if (!ret) {
-			g_set_error(error, PV_CERT_ERROR, PV_CERT_ERROR_NO_CRL, _("no CRL found"));
-			g_info("ERROR: %s", (*error)->message);
-			return NULL;
-		}
-	}
-
+	ret = quirk_X509_STORE_ctx_get1_crls(ctx, subject, error);
+	if (!ret)
+		return NULL;
 	/* Filter out non-valid CRLs for @cert */
 	for (int i = 0; i < sk_X509_CRL_num(ret); i++) {
 		X509_CRL *crl = sk_X509_CRL_value(ret, i);

libutil/util_arch.c

@@ -90,10 +90,10 @@ const char *util_arch_machine_type_to_str(int type)
 	case UTIL_ARCH_MACHINE_TYPE_Z14_ZR1:
 		return "IBM z14 ZR1";
 	case UTIL_ARCH_MACHINE_TYPE_Z15:
-		return "IBM z15";
 	case UTIL_ARCH_MACHINE_TYPE_Z15_T02:
-		return "IBM z15 Model T02";
+		return "IBM z15";
 	case UTIL_ARCH_MACHINE_TYPE_Z16:
+	case UTIL_ARCH_MACHINE_TYPE_Z16_A02:
 		return "IBM z16";
 	default:
 		return "Unknown machine type";
@@ -111,6 +111,7 @@ unsigned long util_arch_hsa_maxsize(void)
 	case UTIL_ARCH_MACHINE_TYPE_Z15:
 	case UTIL_ARCH_MACHINE_TYPE_Z15_T02:
 	case UTIL_ARCH_MACHINE_TYPE_Z16:
+	case UTIL_ARCH_MACHINE_TYPE_Z16_A02:
 		return HSA_SIZE_512M;
 	default:
 		return HSA_SIZE_32M;

man/dumpconf.8

@@ -45,7 +45,7 @@ vmcmd: Trigger CP command according to the 'VMCMD_X' configuration in
 
 .TP
 \fB  - DUMP_TYPE:\fR
-Type of dump device. Possible values are 'ccw', 'fcp' and 'nvme'.
+Type of dump device. Possible values are 'ccw', 'eckd', 'fcp' and 'nvme'.
 
 .TP
 \fB  - DEVICE:\fR
@@ -71,6 +71,11 @@ Namespace ID for NVMe dump device.
 \fB  - BOOTPROG:\fR
 Boot program selector.
 
+.TP
+\fB  - BR_CHR:\fR
+Boot record location in "C,H,R" format (comma separated values for
+Cylinder, Head and Record) or "auto".
+
 .TP
 \fB  - BR_LBA:\fR
 Boot record logical block address.
@@ -146,6 +151,23 @@ DEVICE=0.0.1234
 DELAY_MINUTES=5
 .br
 
+#
+.br
+# Example configuration for an ECKD dump device (DASD)
+.br
+#
+.br
+ON_PANIC=dump
+.br
+DUMP_TYPE=eckd
+.br
+DEVICE=0.0.1004
+.br
+BOOTPROG=0
+.br
+BR_CHR=auto
+.br
+
 #
 .br
 # Example configuration for an FCP dump device (SCSI Disk)

pvattest/Makefile

@@ -3,7 +3,6 @@ include ../common.mak
 
 .DEFAULT_GOAL := all
 
-PKGDATADIR := "$(DESTDIR)$(TOOLS_DATADIR)/pvattest"
 SUBDIRS := src man tools
 RECURSIVE_TARGETS := all-recursive clean-recursive install-recursive
 

pvattest/src/Makefile

@@ -1,10 +1,7 @@
 include ../../common.mak
 
 BIN_PROGRAM = pvattest
-PKGDATADIR ?= "$(DESTDIR)$(TOOLS_DATADIR)/$(BIN_PROGRAM)"
-
 SRC_DIR := $(dir $(realpath $(firstword $(MAKEFILE_LIST))))
-PVATTESTDIR := $(rootdir)/pvattest
 INCLUDE_PATHS = "$(SRC_DIR)" "$(rootdir)/include"
 INCLUDE_PARMS = $(addprefix -I,$(INCLUDE_PATHS))
 
@@ -35,8 +32,7 @@ LIBCRYPTO_LIBS := $(shell $(PKG_CONFIG) --silence-errors --libs libcrypto)
 LIBCURL_CFLAGS := $(shell $(PKG_CONFIG) --silence-errors --cflags libcurl)
 LIBCURL_LIBS := $(shell $(PKG_CONFIG) --silence-errors --libs libcurl)
 
-ALL_CFLAGS += -DPKGDATADIR=$(PKGDATADIR) \
-	      -DOPENSSL_API_COMPAT=0x10101000L \
+ALL_CFLAGS += -DOPENSSL_API_COMPAT=0x10101000L \
 	      $(GLIB2_CFLAGS) \
 	      $(LIBCRYPTO_CFLAGS) \
 	      $(LIBCURL_CFLAGS) \

pvattest/src/argparse.c

@@ -192,13 +192,13 @@ static gboolean hex_str_toull(const char *nptr, uint64_t *dst, GError **error)
 	}
 
 /* NOTE REQUIRED */
-#define _entry_root_ca(__arg_data, __indent)                                              \
-	{                                                                                 \
-		.long_name = "root-ca", .short_name = 0, .flags = G_OPTION_FLAG_NONE,     \
-		.arg = G_OPTION_ARG_FILENAME_ARRAY, .arg_data = __arg_data,               \
-		.description = "Use FILE as the trusted root CA instead the\n" __indent   \
-			       "root CAs that are installed on the system (optional).\n", \
-		.arg_description = "FILE",                                                \
+#define _entry_root_ca(__arg_data, __indent)                                                       \
+	{                                                                                          \
+		.long_name = "root-ca", .short_name = 0, .flags = G_OPTION_FLAG_NONE,              \
+		.arg = G_OPTION_ARG_FILENAME, .arg_data = __arg_data,                              \
+		.description = "Use FILE as the trusted root CA instead the\n" __indent            \
+			       "root CAs that are installed on the system (optional).\n",          \
+		.arg_description = "FILE",                                                         \
 	}
 
 /* NOTE REQUIRED */

rust/Cargo.lock

@@ -2,21 +2,6 @@
 # It is not intended for manual editing.
 version = 3
 
-[[package]]
-name = "addr2line"
-version = "0.21.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a30b2e23b9e17a9f90641c7ab1549cd9b44f296d3ccbf309d2863cfe398a0cb"
-dependencies = [
- "gimli",
-]
-
-[[package]]
-name = "adler"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
-
 [[package]]
 name = "aho-corasick"
 version = "1.1.2"
@@ -81,37 +66,12 @@ version = "1.0.71"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9c7d0618f0e0b7e8ff11427422b64564d5fb0be1940354bfe2e0529b18a9d9b8"
 
-[[package]]
-name = "assert-json-diff"
-version = "2.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47e4f2b81832e72834d7518d8487a0396a28cc408186a2e8854c0f98011faf12"
-dependencies = [
- "serde",
- "serde_json",
-]
-
 [[package]]
 name = "autocfg"
 version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
 
-[[package]]
-name = "backtrace"
-version = "0.3.69"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2089b7e3f35b9dd2d0ed921ead4f6d318c27680d4a5bd167b3ee120edb105837"
-dependencies = [
- "addr2line",
- "cc",
- "cfg-if",
- "libc",
- "miniz_oxide",
- "object",
- "rustc-demangle",
-]
-
 [[package]]
 name = "bitflags"
 version = "1.3.2"
@@ -130,12 +90,6 @@ version = "1.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
 
-[[package]]
-name = "bytes"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2bd12c1caf447e69cd4528f47f94d203fd2582878ecb9e9465484c4148a8223"
-
 [[package]]
 name = "cc"
 version = "1.0.79"
@@ -208,15 +162,15 @@ dependencies = [
  "openssl-probe",
  "openssl-sys",
  "schannel",
- "socket2 0.4.9",
+ "socket2",
  "winapi",
 ]
 
 [[package]]
 name = "curl-sys"
-version = "0.4.68+curl-8.4.0"
+version = "0.4.72+curl-8.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4a0d18d88360e374b16b2273c832b5e57258ffc1d4aa4f96b108e0738d5752f"
+checksum = "29cbdc8314c447d11e8fd156dcdd031d9e02a7a976163e396b548c03153bc9ea"
 dependencies = [
  "cc",
  "libc",
@@ -224,15 +178,9 @@ dependencies = [
  "openssl-sys",
  "pkg-config",
  "vcpkg",
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
 ]
 
-[[package]]
-name = "equivalent"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
-
 [[package]]
 name = "errno"
 version = "0.3.1"
@@ -254,12 +202,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "fnv"
-version = "1.0.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
-
 [[package]]
 name = "foreign-types"
 version = "0.3.2"
@@ -275,104 +217,6 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
 
-[[package]]
-name = "form_urlencoded"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a62bc1cf6f830c2ec14a513a9fb124d0a213a629668a4186f329db21fe045652"
-dependencies = [
- "percent-encoding",
-]
-
-[[package]]
-name = "futures"
-version = "0.3.29"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da0290714b38af9b4a7b094b8a37086d1b4e61f2df9122c3cad2577669145335"
-dependencies = [
- "futures-channel",
- "futures-core",
- "futures-executor",
- "futures-io",
- "futures-sink",
- "futures-task",
- "futures-util",
-]
-
-[[package]]
-name = "futures-channel"
-version = "0.3.29"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff4dd66668b557604244583e3e1e1eada8c5c2e96a6d0d6653ede395b78bbacb"
-dependencies = [
- "futures-core",
- "futures-sink",
-]
-
-[[package]]
-name = "futures-core"
-version = "0.3.29"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb1d22c66e66d9d72e1758f0bd7d4fd0bee04cad842ee34587d68c07e45d088c"
-
-[[package]]
-name = "futures-executor"
-version = "0.3.29"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f4fb8693db0cf099eadcca0efe2a5a22e4550f98ed16aba6c48700da29597bc"
-dependencies = [
- "futures-core",
- "futures-task",
- "futures-util",
-]
-
-[[package]]
-name = "futures-io"
-version = "0.3.29"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8bf34a163b5c4c52d0478a4d757da8fb65cabef42ba90515efee0f6f9fa45aaa"
-
-[[package]]
-name = "futures-macro"
-version = "0.3.29"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53b153fd91e4b0147f4aced87be237c98248656bb01050b96bf3ee89220a8ddb"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "futures-sink"
-version = "0.3.29"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e36d3378ee38c2a36ad710c5d30c2911d752cb941c00c72dbabfb786a7970817"
-
-[[package]]
-name = "futures-task"
-version = "0.3.29"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "efd193069b0ddadc69c46389b740bbccdd97203899b48d09c5f7969591d6bae2"
-
-[[package]]
-name = "futures-util"
-version = "0.3.29"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a19526d624e703a3179b3d322efec918b6246ea0fa51d41124525f00f1cc8104"
-dependencies = [
- "futures-channel",
- "futures-core",
- "futures-io",
- "futures-macro",
- "futures-sink",
- "futures-task",
- "memchr",
- "pin-project-lite",
- "pin-utils",
- "slab",
-]
-
 [[package]]
 name = "getrandom"
 version = "0.2.10"
@@ -384,43 +228,12 @@ dependencies = [
  "wasi",
 ]
 
-[[package]]
-name = "gimli"
-version = "0.28.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4271d37baee1b8c7e4b708028c57d816cf9d2434acb33a549475f78c181f6253"
-
-[[package]]
-name = "h2"
-version = "0.3.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4d6250322ef6e60f93f9a2162799302cd6f68f79f6e5d85c8c16f14d1d958178"
-dependencies = [
- "bytes",
- "fnv",
- "futures-core",
- "futures-sink",
- "futures-util",
- "http",
- "indexmap 2.1.0",
- "slab",
- "tokio",
- "tokio-util",
- "tracing",
-]
-
 [[package]]
 name = "hashbrown"
 version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
 
-[[package]]
-name = "hashbrown"
-version = "0.14.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "290f1a1d9242c78d09ce40a5e87e7554ee637af1351968159f4952f028f75604"
-
 [[package]]
 name = "heck"
 version = "0.4.1"
@@ -433,64 +246,6 @@ version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fed44880c466736ef9a5c5b5facefb5ed0785676d0c02d612db14e54f0d84286"
 
-[[package]]
-name = "http"
-version = "0.2.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8947b1a6fad4393052c7ba1f4cd97bed3e953a95c79c92ad9b051a04611d9fbb"
-dependencies = [
- "bytes",
- "fnv",
- "itoa",
-]
-
-[[package]]
-name = "http-body"
-version = "0.4.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5f38f16d184e36f2408a55281cd658ecbd3ca05cce6d6510a176eca393e26d1"
-dependencies = [
- "bytes",
- "http",
- "pin-project-lite",
-]
-
-[[package]]
-name = "httparse"
-version = "1.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d897f394bad6a705d5f4104762e116a75639e470d80901eed05a860a95cb1904"
-
-[[package]]
-name = "httpdate"
-version = "1.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
-
-[[package]]
-name = "hyper"
-version = "0.14.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ffb1cfd654a8219eaef89881fdb3bb3b1cdc5fa75ded05d6933b2b382e395468"
-dependencies = [
- "bytes",
- "futures-channel",
- "futures-core",
- "futures-util",
- "h2",
- "http",
- "http-body",
- "httparse",
- "httpdate",
- "itoa",
- "pin-project-lite",
- "socket2 0.4.9",
- "tokio",
- "tower-service",
- "tracing",
- "want",
-]
-
 [[package]]
 name = "indexmap"
 version = "1.9.3"
@@ -498,17 +253,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
 dependencies = [
  "autocfg",
- "hashbrown 0.12.3",
-]
-
-[[package]]
-name = "indexmap"
-version = "2.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d530e1a18b1cb4c484e6e34556a0d948706958449fca0cab753d649f2bce3d1f"
-dependencies = [
- "equivalent",
- "hashbrown 0.14.3",
+ "hashbrown",
 ]
 
 [[package]]
@@ -570,16 +315,6 @@ version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ef53942eb7bf7ff43a617b3e2c1c4a5ecf5944a7c1bc12d7ee39bbb15e5c1519"
 
-[[package]]
-name = "lock_api"
-version = "0.4.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c168f8615b12bc01f9c17e2eb0cc07dcae1940121185446edc3744920e8ef45"
-dependencies = [
- "autocfg",
- "scopeguard",
-]
-
 [[package]]
 name = "log"
 version = "0.4.19"
@@ -592,63 +327,6 @@ version = "2.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f665ee40bc4a3c5590afb1e9677db74a508659dfd71e126420da8274909a0167"
 
-[[package]]
-name = "miniz_oxide"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7810e0be55b428ada41041c41f32c9f1a42817901b4ccf45fa3d4b6561e74c7"
-dependencies = [
- "adler",
-]
-
-[[package]]
-name = "mio"
-version = "0.8.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "927a765cd3fc26206e66b296465fa9d3e5ab003e651c1b3c060e7956d96b19d2"
-dependencies = [
- "libc",
- "wasi",
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "mockito"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8d3038e23466858569c2d30a537f691fa0d53b51626630ae08262943e3bbb8b"
-dependencies = [
- "assert-json-diff",
- "futures",
- "hyper",
- "log",
- "rand",
- "regex",
- "serde_json",
- "serde_urlencoded",
- "similar",
- "tokio",
-]
-
-[[package]]
-name = "num_cpus"
-version = "1.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
-dependencies = [
- "hermit-abi",
- "libc",
-]
-
-[[package]]
-name = "object"
-version = "0.32.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cf5f9dd3933bd50a9e1f149ec995f39ae2c496d31fd772c1fd45ebc27e902b0"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "once_cell"
 version = "1.19.0"
@@ -710,47 +388,6 @@ dependencies = [
  "openssl-sys",
 ]
 
-[[package]]
-name = "parking_lot"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3742b2c103b9f06bc9fff0a37ff4912935851bee6d36f3c02bcc755bcfec228f"
-dependencies = [
- "lock_api",
- "parking_lot_core",
-]
-
-[[package]]
-name = "parking_lot_core"
-version = "0.9.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c42a9226546d68acdd9c0a280d17ce19bfe27a46bf68784e4066115788d008e"
-dependencies = [
- "cfg-if",
- "libc",
- "redox_syscall",
- "smallvec",
- "windows-targets",
-]
-
-[[package]]
-name = "percent-encoding"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b2a4787296e9989611394c33f193f676704af1686e70b8f8033ab5ba9a35a94"
-
-[[package]]
-name = "pin-project-lite"
-version = "0.2.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8afb450f006bf6385ca15ef45d71d2288452bc3683ce2e2cacc0d18e4be60b58"
-
-[[package]]
-name = "pin-utils"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
-
 [[package]]
 name = "pkg-config"
 version = "0.3.27"
@@ -780,8 +417,6 @@ dependencies = [
  "clap",
  "curl",
  "log",
- "mockito",
- "once_cell",
  "openssl",
  "openssl_extensions",
  "pv_core",
@@ -797,10 +432,8 @@ name = "pv_core"
 version = "1.0.0"
 dependencies = [
  "byteorder",
- "lazy_static",
  "libc",
  "log",
- "mockito",
  "serde",
  "serde_test",
  "thiserror",
@@ -875,15 +508,6 @@ dependencies = [
  "getrandom",
 ]
 
-[[package]]
-name = "redox_syscall"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4722d768eff46b75989dd134e5c353f0d6296e5aaa3132e776cbdb56be7731aa"
-dependencies = [
- "bitflags 1.3.2",
-]
-
 [[package]]
 name = "regex"
 version = "1.10.2"
@@ -913,12 +537,6 @@ version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
 
-[[package]]
-name = "rustc-demangle"
-version = "0.1.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d626bb9dae77e28219937af045c257c28bfd3f69333c512553507f5f9798cb76"
-
 [[package]]
 name = "rustix"
 version = "0.37.27"
@@ -948,12 +566,6 @@ dependencies = [
  "windows-sys 0.42.0",
 ]
 
-[[package]]
-name = "scopeguard"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
-
 [[package]]
 name = "serde"
 version = "1.0.164"
@@ -974,17 +586,6 @@ dependencies = [
  "syn",
 ]
 
-[[package]]
-name = "serde_json"
-version = "1.0.99"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46266871c240a00b8f503b877622fe33430b3c7d963bdc0f2adc511e54a1eae3"
-dependencies = [
- "itoa",
- "ryu",
- "serde",
-]
-
 [[package]]
 name = "serde_test"
 version = "1.0.176"
@@ -994,61 +595,19 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "serde_urlencoded"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
-dependencies = [
- "form_urlencoded",
- "itoa",
- "ryu",
- "serde",
-]
-
 [[package]]
 name = "serde_yaml"
 version = "0.9.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9d684e3ec7de3bf5466b32bd75303ac16f0736426e5a4e0d6e489559ce1249c"
 dependencies = [
- "indexmap 1.9.3",
+ "indexmap",
  "itoa",
  "ryu",
  "serde",
  "unsafe-libyaml",
 ]
 
-[[package]]
-name = "signal-hook-registry"
-version = "1.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8229b473baa5980ac72ef434c4415e70c4b5e71b423043adb4ba059f89c99a1"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "similar"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2aeaf503862c419d66959f5d7ca015337d864e9c49485d771b732e2a20453597"
-
-[[package]]
-name = "slab"
-version = "0.4.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f92a496fb766b417c996b9c5e57daf2f7ad3b0bebe1ccfca4856390e3d3bb67"
-dependencies = [
- "autocfg",
-]
-
-[[package]]
-name = "smallvec"
-version = "1.11.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4dccd0940a2dcdf68d092b8cbab7dc0ad8fa938bf95787e1b916b0e3d0e8e970"
-
 [[package]]
 name = "socket2"
 version = "0.4.9"
@@ -1059,16 +618,6 @@ dependencies = [
  "winapi",
 ]
 
-[[package]]
-name = "socket2"
-version = "0.5.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4031e820eb552adee9295814c0ced9e5cf38ddf1e8b7d566d6de8e2538ea989e"
-dependencies = [
- "libc",
- "windows-sys 0.48.0",
-]
-
 [[package]]
 name = "strsim"
 version = "0.10.0"
@@ -1116,81 +665,6 @@ dependencies = [
  "syn",
 ]
 
-[[package]]
-name = "tokio"
-version = "1.33.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f38200e3ef7995e5ef13baec2f432a6da0aa9ac495b2c0e8f3b7eec2c92d653"
-dependencies = [
- "backtrace",
- "bytes",
- "libc",
- "mio",
- "num_cpus",
- "parking_lot",
- "pin-project-lite",
- "signal-hook-registry",
- "socket2 0.5.4",
- "tokio-macros",
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "tokio-macros"
-version = "2.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "630bdcf245f78637c13ec01ffae6187cca34625e8c63150d424b59e55af2675e"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "tokio-util"
-version = "0.7.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5419f34732d9eb6ee4c3578b7989078579b7f039cbbb9ca2c4da015749371e15"
-dependencies = [
- "bytes",
- "futures-core",
- "futures-sink",
- "pin-project-lite",
- "tokio",
- "tracing",
-]
-
-[[package]]
-name = "tower-service"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6bc1c9ce2b5135ac7f93c72918fc37feb872bdc6a5533a8b85eb4b86bfdae52"
-
-[[package]]
-name = "tracing"
-version = "0.1.40"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3523ab5a71916ccf420eebdf5521fcef02141234bbc0b8a49f2fdc4544364ef"
-dependencies = [
- "pin-project-lite",
- "tracing-core",
-]
-
-[[package]]
-name = "tracing-core"
-version = "0.1.32"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c06d3da6113f116aaee68e4d601191614c9053067f9ab7f6edbcb161237daa54"
-dependencies = [
- "once_cell",
-]
-
-[[package]]
-name = "try-lock"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3528ecfd12c466c6f163363caf2d02a71161dd5e1cc6ae7b34207ea2d42d81ed"
-
 [[package]]
 name = "unicode-ident"
 version = "1.0.9"
@@ -1219,15 +693,6 @@ version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
 
-[[package]]
-name = "want"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
-dependencies = [
- "try-lock",
-]
-
 [[package]]
 name = "wasi"
 version = "0.11.0+wasi-snapshot-preview1"
@@ -1277,7 +742,16 @@ version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
 dependencies = [
- "windows-targets",
+ "windows-targets 0.48.0",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.4",
 ]
 
 [[package]]
@@ -1295,6 +769,21 @@ dependencies = [
  "windows_x86_64_msvc 0.48.0",
 ]
 
+[[package]]
+name = "windows-targets"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7dd37b7e5ab9018759f893a1952c9420d060016fc19a472b4bb20d1bdd694d1b"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.4",
+ "windows_aarch64_msvc 0.52.4",
+ "windows_i686_gnu 0.52.4",
+ "windows_i686_msvc 0.52.4",
+ "windows_x86_64_gnu 0.52.4",
+ "windows_x86_64_gnullvm 0.52.4",
+ "windows_x86_64_msvc 0.52.4",
+]
+
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.42.2"
@@ -1307,6 +796,12 @@ version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "91ae572e1b79dba883e0d315474df7305d12f569b400fcf90581b06062f7e1bc"
 
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bcf46cf4c365c6f2d1cc93ce535f2c8b244591df96ceee75d8e83deb70a9cac9"
+
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.42.2"
@@ -1319,6 +814,12 @@ version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b2ef27e0d7bdfcfc7b868b317c1d32c641a6fe4629c171b8928c7b08d98d7cf3"
 
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da9f259dd3bcf6990b55bffd094c4f7235817ba4ceebde8e6d11cd0c5633b675"
+
 [[package]]
 name = "windows_i686_gnu"
 version = "0.42.2"
@@ -1331,6 +832,12 @@ version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "622a1962a7db830d6fd0a69683c80a18fda201879f0f447f065a3b7467daa241"
 
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b474d8268f99e0995f25b9f095bc7434632601028cf86590aea5c8a5cb7801d3"
+
 [[package]]
 name = "windows_i686_msvc"
 version = "0.42.2"
@@ -1343,6 +850,12 @@ version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4542c6e364ce21bf45d69fdd2a8e455fa38d316158cfd43b3ac1c5b1b19f8e00"
 
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1515e9a29e5bed743cb4415a9ecf5dfca648ce85ee42e15873c3cd8610ff8e02"
+
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.42.2"
@@ -1355,6 +868,12 @@ version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ca2b8a661f7628cbd23440e50b05d705db3686f894fc9580820623656af974b1"
 
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5eee091590e89cc02ad514ffe3ead9eb6b660aedca2183455434b93546371a03"
+
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.42.2"
@@ -1367,6 +886,12 @@ version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7896dbc1f41e08872e9d5e8f8baa8fdd2677f29468c4e156210174edc7f7b953"
 
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ca79f2451b49fa9e2af39f0747fe999fcda4f5e241b2898624dca97a1f2177"
+
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.42.2"
@@ -1379,6 +904,12 @@ version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1a515f5799fe4961cb532f983ce2b23082366b898e52ffbce459c86f67c8378a"
 
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32b752e52a2da0ddfbdbcc6fceadfeede4c939ed16d13e648833a61dfb611ed8"
+
 [[package]]
 name = "zerocopy"
 version = "0.7.32"

rust/pv/Cargo.toml

@@ -19,6 +19,4 @@ openssl_extensions = { path = "openssl_extensions" }
 pv_core = { path = "../pv_core" }
 
 [dev-dependencies]
-mockito = {version = "1", default-features = false }
-once_cell = "1.19"
 serde_test = "1"

rust/pv/src/verify.rs

@@ -3,12 +3,17 @@
 // Copyright IBM Corp. 2023
 
 use core::slice;
-use log::debug;
+use log::{debug, trace};
+use openssl::error::ErrorStack;
 use openssl::stack::Stack;
 use openssl::x509::store::X509Store;
-use openssl::x509::{CrlStatus, X509Ref, X509StoreContext, X509};
-use openssl_extensions::crl::StackableX509Crl;
-use openssl_extensions::crl::X509StoreContextExtension;
+use openssl::x509::{CrlStatus, X509NameRef, X509Ref, X509StoreContext, X509StoreContextRef, X509};
+use openssl_extensions::crl::{StackableX509Crl, X509StoreContextExtension, X509StoreExtension};
+
+#[cfg(not(test))]
+use helper::download_first_crl_from_x509;
+#[cfg(test)]
+use test::download_first_crl_from_x509;
 
 use crate::error::bail_hkd_verify;
 use crate::misc::{read_certs, read_file};
@@ -82,8 +87,8 @@ impl HkdVerifier for CertVerifier {
         if verified_crls.is_empty() {
             bail_hkd_verify!(NoCrl);
         }
-        for crl in &verified_crls {
-            match crl.get_by_cert(&hkd.to_owned()) {
+        for crl in verified_crls {
+            match crl.get_by_serial(hkd.serial_number()) {
                 CrlStatus::NotRevoked => (),
                 _ => bail_hkd_verify!(HdkRevoked),
             }
@@ -94,26 +99,59 @@ impl HkdVerifier for CertVerifier {
 }
 
 impl CertVerifier {
+    fn quirk_crls(
+        ctx: &mut X509StoreContextRef,
+        subject: &X509NameRef,
+    ) -> Result<Stack<StackableX509Crl>, ErrorStack> {
+        match ctx.crls(subject) {
+            Ok(ret) if !ret.is_empty() => return Ok(ret),
+            _ => (),
+        }
+
+        // Armonk/Poughkeepsie fixup
+        trace!("quirk_crls: Try Locality");
+        if let Some(locality_subject) = helper::armonk_locality_fixup(subject) {
+            match ctx.crls(&locality_subject) {
+                Ok(ret) if !ret.is_empty() => return Ok(ret),
+                _ => (),
+            }
+
+            // reorder
+            trace!("quirk_crls: Try Locality+Reorder");
+            if let Ok(locality_ordered_subject) = helper::reorder_x509_names(&locality_subject) {
+                match ctx.crls(&locality_ordered_subject) {
+                    Ok(ret) if !ret.is_empty() => return Ok(ret),
+                    _ => (),
+                }
+            }
+        }
+
+        // reorder unchanged loaciliy subject
+        trace!("quirk_crls: Try Reorder");
+        if let Ok(ordered_subject) = helper::reorder_x509_names(subject) {
+            match ctx.crls(&ordered_subject) {
+                Ok(ret) if !ret.is_empty() => return Ok(ret),
+                _ => (),
+            }
+        }
+        // nothing found, return empty stack
+        Stack::new()
+    }
+
     ///Download the CLRs that a HKD refers to.
     pub fn hkd_crls(&self, hkd: &X509Ref) -> Result<Stack<StackableX509Crl>> {
         let mut ctx = X509StoreContext::new()?;
         // Unfortunately we cannot use a dedicated function here and have to use a closure (E0434)
         // Otherwise, we cannot refer to self
+        // Search for local CRLs
         let mut crls = ctx.init_opt(&self.store, None, None, |ctx| {
             let subject = self.ibm_z_sign_key.subject_name();
-            match ctx.crls(subject) {
-                Ok(crls) => Ok(crls),
-                _ => {
-                    // reorder the name and try again
-                    let broken_subj = helper::reorder_x509_names(subject)?;
-                    ctx.crls(&broken_subj).or_else(helper::stack_err_hlp)
-                }
-            }
+            Self::quirk_crls(ctx, subject)
         })?;
 
         if !self.offline {
             // Try to download a CRL if defined in the HKD
-            if let Some(crl) = helper::download_first_crl_from_x509(hkd)? {
+            if let Some(crl) = download_first_crl_from_x509(hkd)? {
                 crl.into_iter().try_for_each(|c| crls.push(c.into()))?;
             }
         }
@@ -143,7 +181,11 @@ impl CertVerifier {
         for path in cert_paths {
             let mut crt = read_certs(&read_file(path, "certificate")?)?;
             if !offline {
-                helper::download_crls_into_store(&mut store, &crt)?;
+                for c in &crt {
+                    if let Some(crl) = download_first_crl_from_x509(c)? {
+                        crl.iter().try_for_each(|c| store.add_crl(c))?;
+                    }
+                }
             }
             untr_certs.append(&mut crt);
         }

rust/pv/src/verify/helper.rs

@@ -3,29 +3,25 @@
 // Copyright IBM Corp. 2023
 
 use crate::error::bail_hkd_verify;
-use crate::misc::read_crls;
 use crate::HkdVerifyErrorType::*;
 use crate::{Error, Result};
-use curl::easy::{Easy2, Handler, WriteError};
 use log::debug;
 use openssl::{
     asn1::{Asn1Time, Asn1TimeRef},
     error::ErrorStack,
     nid::Nid,
     ssl::SslFiletype,
-    stack::{Stack, Stackable},
+    stack::Stack,
     x509::{
-        store::{File, X509Lookup, X509StoreBuilder, X509StoreBuilderRef, X509StoreRef},
+        store::{File, X509Lookup, X509StoreBuilder, X509StoreRef},
         verify::{X509VerifyFlags, X509VerifyParam},
-        X509Crl, X509CrlRef, X509Name, X509NameRef, X509PurposeId, X509Ref, X509StoreContext,
+        X509CrlRef, X509Name, X509NameRef, X509PurposeId, X509Ref, X509StoreContext,
         X509StoreContextRef, X509VerifyResult, X509,
     },
 };
-use openssl_extensions::{
-    akid::{AkidCheckResult, AkidExtension},
-    crl::X509StoreExtension,
-};
-use std::{cmp::Ordering, ffi::c_int, time::Duration, usize};
+use openssl_extensions::akid::{AkidCheckResult, AkidExtension};
+use std::str::from_utf8;
+use std::{cmp::Ordering, ffi::c_int, usize};
 
 /// Minimum security level for the keys/certificates used to establish a chain of
 /// trust (see https://www.openssl.org/docs/man1.1.1/man3/X509_VERIFY_PARAM_set_auth_level.html
@@ -39,7 +35,6 @@ const SECURITY_CHAIN_MAX_LEN: c_int = 2;
 /// verifies that the HKD
 /// * has enough security bits
 /// * is inside its validity period
-/// * issuer name is the subject name of the [`sign_key`]
 /// * the Authority Key ID matches the Signing Key ID of the  [`sign_key`]
 pub fn verify_hkd_options(hkd: &X509Ref, sign_key: &X509Ref) -> Result<()> {
     let hk_pkey = hkd.public_key()?;
@@ -53,9 +48,6 @@ pub fn verify_hkd_options(hkd: &X509Ref, sign_key: &X509Ref) -> Result<()> {
     // verify that the hkd is still valid
     check_validity_period(hkd.not_before(), hkd.not_after())?;
 
-    // check if hkd.issuer_name == issuer.subject
-    check_x509_name_equal(sign_key.subject_name(), hkd.issuer_name())?;
-
     // verify that the AKID of the hkd matches the SKID of the issuer
     if let Some(akid) = hkd.akid() {
         if akid.check(sign_key) != AkidCheckResult::OK {
@@ -75,9 +67,6 @@ pub fn verify_crl(crl: &X509CrlRef, issuer: &X509Ref) -> Option<()> {
             return None;
         }
     }
-
-    check_x509_name_equal(crl.issuer_name(), issuer.subject_name()).ok()?;
-
     match crl.verify(issuer.public_key().ok()?.as_ref()).ok()? {
         true => Some(()),
         false => None,
@@ -192,22 +181,12 @@ pub fn extract_ibm_sign_key(certs: Vec<X509>) -> Result<(X509, Stack<X509>)> {
     Ok((ibm_z_sign_key, chain))
 }
 
-/// for all certs load the first CRL specified into our store
-pub fn download_crls_into_store(store: &mut X509StoreBuilderRef, crts: &[X509]) -> Result<()> {
-    for crt in crts {
-        debug!("Download crls for {crt:?}");
-        if let Some(crl) = download_first_crl_from_x509(crt)? {
-            crl.iter().try_for_each(|c| store.add_crl(c))?;
-        }
-    }
-    Ok(())
-}
-
 // Name Entry values of an IBM Z key signing cert
 //Asn1StringRef::as_slice aka ASN1_STRING_get0_data gives a string without \0 delimiter
 const IBM_Z_COMMON_NAME: &[u8; 43usize] = b"International Business Machines Corporation";
 const IBM_Z_COUNTRY_NAME: &[u8; 2usize] = b"US";
-const IBM_Z_LOCALITY_NAME: &[u8; 12usize] = b"Poughkeepsie";
+const IBM_Z_LOCALITY_NAME_POUGHKEEPSIE: &[u8; 12usize] = b"Poughkeepsie";
+const IBM_Z_LOCALITY_NAME_ARMONK: &[u8; 6usize] = b"Armonk";
 const IBM_Z_ORGANIZATIONAL_UNIT_NAME_SUFFIX: &str = "Key Signing Service";
 const IBM_Z_ORGANIZATION_NAME: &[u8; 43usize] = b"International Business Machines Corporation";
 const IBM_Z_STATE: &[u8; 8usize] = b"New York";
@@ -226,7 +205,8 @@ fn is_ibm_signing_cert(cert: &X509) -> bool {
     if subj.entries().count() != IMB_Z_ENTRY_COUNT
         || !name_data_eq(subj, Nid::COUNTRYNAME, IBM_Z_COUNTRY_NAME)
         || !name_data_eq(subj, Nid::STATEORPROVINCENAME, IBM_Z_STATE)
-        || !name_data_eq(subj, Nid::LOCALITYNAME, IBM_Z_LOCALITY_NAME)
+        || !(name_data_eq(subj, Nid::LOCALITYNAME, IBM_Z_LOCALITY_NAME_POUGHKEEPSIE)
+            || name_data_eq(subj, Nid::LOCALITYNAME, IBM_Z_LOCALITY_NAME_ARMONK))
         || !name_data_eq(subj, Nid::ORGANIZATIONNAME, IBM_Z_ORGANIZATION_NAME)
         || !name_data_eq(subj, Nid::COMMONNAME, IBM_Z_COMMON_NAME)
     {
@@ -319,14 +299,17 @@ pub fn x509_dist_points(cert: &X509Ref) -> Vec<String> {
     res
 }
 
-const CRL_TIMEOUT_MAX: Duration = Duration::from_secs(3);
-
 /// Searches for CRL Distribution points and downloads the CRL. Stops after the first successful
 /// download.
 ///
 /// Error if sth bad(=unexpected) happens (not bad: crl not available at link, unexpected format)
 /// Other  issues are mapped to Ok(None)
-pub fn download_first_crl_from_x509(cert: &X509Ref) -> Result<Option<Vec<X509Crl>>> {
+#[cfg(not(test))]
+pub fn download_first_crl_from_x509(cert: &X509Ref) -> Result<Option<Vec<openssl::x509::X509Crl>>> {
+    use crate::misc::read_crls;
+    use curl::easy::{Easy2, Handler, WriteError};
+    use std::time::Duration;
+    const CRL_TIMEOUT_MAX: Duration = Duration::from_secs(3);
     struct Buf(Vec<u8>);
 
     impl Handler for Buf {
@@ -367,24 +350,6 @@ fn check_validity_period(not_before: &Asn1TimeRef, not_after: &Asn1TimeRef) -> R
     }
 }
 
-fn check_x509_name_equal(lhs: &X509NameRef, rhs: &X509NameRef) -> Result<()> {
-    if lhs.entries().count() != rhs.entries().count() {
-        bail_hkd_verify!(IssuerMismatch);
-    }
-
-    for l in lhs.entries() {
-        // search for the matching value in the rhs names
-        // found none? -> names are not equal
-        if !rhs
-            .entries()
-            .any(|r| l.data().as_slice() == r.data().as_slice())
-        {
-            bail_hkd_verify!(IssuerMismatch);
-        }
-    }
-    Ok(())
-}
-
 const NIDS_CORRECT_ORDER: [Nid; 6] = [
     Nid::COUNTRYNAME,
     Nid::ORGANIZATIONNAME,
@@ -407,21 +372,34 @@ pub fn reorder_x509_names(subject: &X509NameRef) -> std::result::Result<X509Name
     Ok(correct_subj.build())
 }
 
-pub fn stack_err_hlp<T: Stackable>(
-    e: ErrorStack,
-) -> std::result::Result<Stack<T>, openssl::error::ErrorStack> {
-    match e.errors().len() {
-        0 => Stack::<T>::new(),
-        _ => Err(e),
+/**
+* Workaround for potential locality mismatches between CRLs and Certs
+* # Return
+* fixed subject or none if locality was not Armonk or any OpenSSL error
+*/
+pub fn armonk_locality_fixup(subject: &X509NameRef) -> Option<X509Name> {
+    if !name_data_eq(subject, Nid::LOCALITYNAME, IBM_Z_LOCALITY_NAME_ARMONK) {
+        return None;
     }
+
+    let mut ret = X509Name::builder().ok()?;
+    for entry in subject.entries() {
+        match entry.object().nid() {
+            nid @ Nid::LOCALITYNAME => ret
+                .append_entry_by_nid(nid, from_utf8(IBM_Z_LOCALITY_NAME_POUGHKEEPSIE).ok()?)
+                .ok()?,
+            _ => {
+                ret.append_entry(entry).ok()?;
+            }
+        }
+    }
+    Some(ret.build())
 }
 
 #[cfg(test)]
 /// tests for some private functions
 mod test {
 
-    use openssl_extensions::x509_crl_eq;
-
     use super::*;
     use crate::test_utils::*;
     use std::time::{Duration, SystemTime};
@@ -451,20 +429,6 @@ mod test {
         ));
     }
 
-    #[test]
-    fn x509_name_equal() {
-        let sign_crt = load_gen_cert("ibm.crt");
-        let hkd = load_gen_cert("host.crt");
-        let other = load_gen_cert("inter_ca.crt");
-
-        assert!(super::check_x509_name_equal(sign_crt.subject_name(), hkd.issuer_name()).is_ok(),);
-
-        assert!(matches!(
-            super::check_x509_name_equal(other.subject_name(), hkd.subject_name()),
-            Err(Error::HkdVerify(IssuerMismatch))
-        ));
-    }
-
     #[test]
     fn is_ibm_z_sign_key() {
         let ibm_crt = load_gen_cert("ibm.crt");
@@ -497,20 +461,4 @@ mod test {
         ));
         assert!(super::get_ibm_z_sign_key(&[ibm_crt, no_sign_crt]).is_ok(),);
     }
-
-    #[test]
-    fn download_first_crl_from_x509() {
-        let ibm_crt = load_gen_cert("ibm.crt");
-        let inter_crl = load_gen_crl("inter_ca.crl");
-        let _m_inter = super::super::test::mock_endpt("inter_ca.crl");
-
-        let crl_d = super::download_first_crl_from_x509(&ibm_crt)
-            .unwrap()
-            .unwrap();
-        assert_eq!(crl_d.len(), 1);
-        assert!(x509_crl_eq(
-            crl_d.first().unwrap().as_ref(),
-            inter_crl.as_ref()
-        ));
-    }
 }

rust/pv/src/verify/test.rs

@@ -5,32 +5,30 @@
 #![cfg(test)]
 
 use super::{helper, helper::*, *};
-use crate::{Error, HkdVerifyErrorType::*};
-use core::slice;
-use once_cell::sync::OnceCell;
-use openssl::stack::Stack;
-use std::sync::Mutex;
+use crate::{misc::read_crls, Error, HkdVerifyErrorType::*};
+use openssl::{stack::Stack, x509::X509Crl};
+use std::path::Path;
 
 use crate::test_utils::*;
 
-pub fn mock_endpt(res: &str) -> mockito::Mock {
-    static MOCK_SERVER: OnceCell<Mutex<mockito::Server>> = OnceCell::new();
+//mock function
+pub fn download_first_crl_from_x509(cert: &X509Ref) -> Result<Option<Vec<X509Crl>>> {
+    fn mock_download<P: AsRef<Path>>(path: P) -> Result<Vec<X509Crl>> {
+        read_crls(&std::fs::read(path)?)
+    }
 
-    let res_path = get_cert_asset_path(res);
-
-    MOCK_SERVER
-        .get_or_init(|| mockito::Server::new_with_port(1234).into())
-        .lock()
-        .expect("COULD NOT GET THE MOCK_SERVER LOCK")
-        .mock("GET", format!("/crl/{res}").as_str())
-        .with_header("content-type", "application/pkix-crl")
-        .with_body_from_file(res_path)
-        .create()
-}
-
-#[test]
-fn mockito_server_available() {
-    let _mock = mock_endpt("ibm.crt");
+    for dist_point in x509_dist_points(cert) {
+        {
+            let path = get_cert_asset_path(&dist_point);
+            let crls = if let Ok(buf) = mock_download(&path) {
+                buf
+            } else {
+                continue;
+            };
+            return Ok(Some(crls));
+        }
+    }
+    Ok(None)
 }
 
 #[test]
@@ -44,22 +42,12 @@ fn store_setup() {
 
 #[test]
 fn verify_chain_online() {
-    let ibm_crt = load_gen_cert("ibm.crt");
-    let inter_crt = load_gen_cert("inter_ca.crt");
+    let ibm_crt = get_cert_asset_path_string("ibm.crt");
+    let inter_crt = get_cert_asset_path_string("inter_ca.crt");
     let root_crt = get_cert_asset_path_string("root_ca.chained.crt");
 
-    let mock_inter = mock_endpt("inter_ca.crl");
-
-    let mut store = helper::store_setup(&Some(root_crt), &[], &[]).unwrap();
-    download_crls_into_store(&mut store, slice::from_ref(&ibm_crt)).unwrap();
-    let store = store.build();
-
-    mock_inter.assert();
-
-    let mut sk = Stack::<X509>::new().unwrap();
-    sk.push(inter_crt).unwrap();
-    verify_chain(&store, &sk, &[ibm_crt.clone()]).unwrap();
-    assert!(verify_chain(&store, &sk, &[ibm_crt]).is_ok());
+    let ret = CertVerifier::new(&[ibm_crt, inter_crt], &[], &root_crt.into(), false);
+    assert!(ret.is_ok(), "CertVerifier::new failed: {ret:?}");
 }
 
 #[test]
@@ -79,90 +67,82 @@ fn verify_chain_offline() {
 }
 
 #[test]
-fn verify_online() {
+fn dist_points() {
+    let crt = load_gen_cert("ibm.crt");
+    let res = x509_dist_points(&crt);
+    let exp = vec!["inter_ca.crl"];
+    assert_eq!(res, exp);
+}
+
+fn verify(offline: bool, ibm_crt: &'static str, ibm_crl: &'static str, hkd: &'static str) {
     let root_crt = get_cert_asset_path_string("root_ca.chained.crt");
     let inter_crt = get_cert_asset_path_string("inter_ca.crt");
-    let ibm_crt = get_cert_asset_path_string("ibm.crt");
-    let hkd_revoked = load_gen_cert("host_rev.crt");
-    let hkd_inv = load_gen_cert("host_invalid_signing_key.crt");
-    let hkd_exp = load_gen_cert("host_crt_expired.crt");
-    let hkd = load_gen_cert("host.crt");
-
-    let mock_inter = mock_endpt("inter_ca.crl");
-    let mock_ibm = mock_endpt("ibm.crl");
-
     let inter_crl = get_cert_asset_path_string("inter_ca.crl");
-    let ibm_crl = get_cert_asset_path_string("ibm.crl");
+    let ibm_crt = get_cert_asset_path_string(ibm_crt);
+    let ibm_crl = get_cert_asset_path_string(ibm_crl);
+    let hkd_revoked = load_gen_cert("host_rev.crt");
+    let hkd_exp = load_gen_cert("host_crt_expired.crt");
+    let hkd = load_gen_cert(hkd);
+
+    let crls = &[ibm_crl, inter_crl];
     let verifier = CertVerifier::new(
         &[ibm_crt, inter_crt],
-        &[ibm_crl, inter_crl],
+        if offline { crls } else { &[] },
         &Some(root_crt),
-        false,
+        offline,
     )
     .unwrap();
 
-    mock_inter.assert();
+    let res = verifier.verify(&hkd);
+    assert!(res.is_ok(), "Verify failed: res: {res:?}");
 
-    verifier.verify(&hkd).unwrap();
-
-    mock_ibm.assert();
     assert!(matches!(
         verifier.verify(&hkd_revoked),
         Err(Error::HkdVerify(HdkRevoked))
     ));
 
-    assert!(matches!(
-        verifier.verify(&hkd_inv),
-        Err(Error::HkdVerify(IssuerMismatch))
-    ));
-
     assert!(matches!(
         verifier.verify(&hkd_exp),
         Err(Error::HkdVerify(AfterValidity))
     ));
 }
 
+#[test]
+fn verify_online() {
+    verify(false, "ibm.crt", "ibm.crl", "host.crt")
+}
+
 #[test]
 fn verify_offline() {
-    let root_crt = get_cert_asset_path_string("root_ca.chained.crt");
-    let inter_crt = get_cert_asset_path_string("inter_ca.crt");
-    let inter_crl = get_cert_asset_path_string("inter_ca.crl");
-    let ibm_crt = get_cert_asset_path_string("ibm.crt");
-    let ibm_crl = get_cert_asset_path_string("ibm.crl");
-    let hkd_revoked = load_gen_cert("host_rev.crt");
-    let hkd_inv = load_gen_cert("host_invalid_signing_key.crt");
-    let hkd_exp = load_gen_cert("host_crt_expired.crt");
-    let hkd = load_gen_cert("host.crt");
-
-    let verifier = CertVerifier::new(
-        &[ibm_crt, inter_crt],
-        &[ibm_crl, inter_crl],
-        &Some(root_crt),
-        true,
-    )
-    .unwrap();
-
-    verifier.verify(&hkd).unwrap();
-    assert!(matches!(
-        verifier.verify(&hkd_revoked),
-        Err(Error::HkdVerify(HdkRevoked))
-    ));
-
-    assert!(matches!(
-        verifier.verify(&hkd_inv),
-        Err(Error::HkdVerify(IssuerMismatch))
-    ));
-
-    assert!(matches!(
-        verifier.verify(&hkd_exp),
-        Err(Error::HkdVerify(AfterValidity))
-    ));
+    verify(true, "ibm.crt", "ibm.crl", "host.crt")
 }
 
 #[test]
-fn dist_points() {
-    let crt = load_gen_cert("ibm.crt");
-    let res = x509_dist_points(&crt);
-    let exp = vec!["http://127.0.0.1:1234/crl/inter_ca.crl"];
-    assert_eq!(res, exp);
+fn verify_armonk_crt_online() {
+    verify(false, "ibm_armonk.crt", "ibm.crl", "host.crt")
+}
+
+#[test]
+fn verify_armonk_crt_offline() {
+    verify(true, "ibm_armonk.crt", "ibm.crl", "host.crt")
+}
+
+#[test]
+fn verify_armonk_crl_online() {
+    verify(false, "ibm_armonk.crt", "ibm_armonk.crl", "host.crt")
+}
+
+#[test]
+fn verify_armonk_crl_offline() {
+    verify(true, "ibm_armonk.crt", "ibm_armonk.crl", "host.crt")
+}
+
+#[test]
+fn verify_armonk_hkd_online() {
+    verify(false, "ibm_armonk.crt", "ibm_armonk.crl", "host_armonk.crt")
+}
+
+#[test]
+fn verify_armonk_hkd_offline() {
+    verify(true, "ibm_armonk.crt", "ibm_armonk.crl", "host_armonk.crt")
 }

rust/pv/tests/assets/cert/fake_host.crt

@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIE/TCCAuWgAwIBAgIUWT/F3gP9fOTTq3yOMVskcXM8vOAwDQYJKoZIhvcNAQEN
+BQAwgcwxCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
+ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
+IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
+azEVMBMGA1UEBwwMUG91Z2hrZWVwc2llMScwJQYDVQQLDB5JQk0gWiBIb3N0IEtl
+eSBTaWduaW5nIFNlcnZpY2UwIBcNMjQwMzIxMTQ1MjM5WhgPMjM4ODEyMjMxNDUy
+MzlaMIG2MQswCQYDVQQGEwJVUzE0MDIGA1UECgwrSW50ZXJuYXRpb25hbCBCdXNp
+bmVzcyBNYWNoaW5lcyBDb3Jwb3JhdGlvbjE0MDIGA1UEAwwrSW50ZXJuYXRpb25h
+bCBCdXNpbmVzcyBNYWNoaW5lcyBDb3Jwb3JhdGlvbjERMA8GA1UECAwITmV3IFlv
+cmsxDzANBgNVBAcMBkFybW9uazEXMBUGA1UECwwOSUJNIFogSG9zdCBLZXkwgZsw
+EAYHKoZIzj0CAQYFK4EEACMDgYYABAAT1zpBNemPCT0tEx2S9qnlPxyBgxKl6BSX
+ghqf3MfOqQKIUdKEbxP0nr2QtIR/MwvBp4YhjxZ9AZtzVtXbQrULTAGlKK4qcf1I
+W1rYZ5S0b4dmvh2HbIv9wZLWKaZ/ovnvAJk949WDCbBzC3Dy1E3zCaYPefLHHNve
+dWX8RtFUhnTqm6NxMG8wHQYDVR0fBBYwFDASoBCgDoYMZmFrZV9pYm0uY3J0MA4G
+A1UdDwEB/wQEAwIDCDAfBgNVHSMEGDAWgBSQCOxEmGwiupA2ER7srMBydGO1aTAd
+BgNVHQ4EFgQUUl5SPIEseFNeneyuOidsw06L7gQwDQYJKoZIhvcNAQENBQADggIB
+AFAg/hFlaBT+WNlUmVJlAd6FYr6vvRjJiKxcNBZ5wElzxA5OjuGX6pLYiNkzXSy2
+N/4nQ3a8fr04IB9Uhx5ncMzSKVkG+4mbN3xmR7f6zZuFWV/T9Aom3LIbQ5KYR2wW
+EvX8b2xbvd74rKAgavq/iuFRn8skQJGgQk9J2YEApOW9wkoFQRgziuu55Cw5GT+f
+w9rKgAFTN33ZwfWs86ELJlDOY0aX5373WGccuEKm8y+l2UVLlly125eezz84RSh7
+5j0VUTjK4ZqpSD8yiPxN+vocV+nY52cgWxrVf7g7wlPunxXWX4rxR0z/mEVDDBAC
+y7cAxsa4HtmJexuZbjEh8TEgDZXDA24BuFXqtkwqnUpv8KghyKb0KgTQecP9rRhL
+b2iHdQrALnddMzJzp7Tn+jsR2A2G0lLLsIuIRFR/1eAxecgTMoxXV8N0SJHn6emH
+Uwif1Qr5JVw4UOFSLW3MT3f70hY5hMzrxowOapcYhyR0vbhGFrF1YI8YmAuk2m4P
+Dfd5Za5cnfVJiAdNBnNPtV/5wiViX1VJGCrIxgDN6B2VE0VQLp2gKwpsSmhqN4CA
+qHzAi3Yj3F8vQ2mWQeuABWLAJrIoxXpVYQvTf4uij0ARZRbajQXx+LZnAUsCi5eZ
+LaYrTVn8NzHlGQocUWljG06GaLY8GNqKPQrZD/+6hIYK
+-----END CERTIFICATE-----

rust/pv/tests/assets/cert/fake_host.key

@@ -0,0 +1,8 @@
+-----BEGIN PRIVATE KEY-----
+MIHuAgEAMBAGByqGSM49AgEGBSuBBAAjBIHWMIHTAgEBBEIAXR6FCIgd+fjhO/WJ
+KwLTP01mBDtYkWbVE71jshjLLpZHunRpsYKbQKCwaDmMYLRrQnTxPgZH1PVKzguI
+7M7n9zyhgYkDgYYABAAT1zpBNemPCT0tEx2S9qnlPxyBgxKl6BSXghqf3MfOqQKI
+UdKEbxP0nr2QtIR/MwvBp4YhjxZ9AZtzVtXbQrULTAGlKK4qcf1IW1rYZ5S0b4dm
+vh2HbIv9wZLWKaZ/ovnvAJk949WDCbBzC3Dy1E3zCaYPefLHHNvedWX8RtFUhnTq
+mw==
+-----END PRIVATE KEY-----

rust/pv/tests/assets/cert/fake_ibm.crl

@@ -0,0 +1,20 @@
+-----BEGIN X509 CRL-----
+MIIDVTCCAT0CAQEwDQYJKoZIhvcNAQENBQAwgcwxCzAJBgNVBAYTAlVTMTQwMgYD
+VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
+MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
+cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEVMBMGA1UEBwwMUG91Z2hrZWVwc2ll
+MScwJQYDVQQLDB5JQk0gWiBIb3N0IEtleSBTaWduaW5nIFNlcnZpY2UXDTI0MDMx
+MTE1NTIzOVoYDzIzODgxMjIzMTU1MjM5WjAVMBMCAgIrFw0yNDAzMjAxNTUyMzla
+oCMwITAfBgNVHSMEGDAWgBSQCOxEmGwiupA2ER7srMBydGO1aTANBgkqhkiG9w0B
+AQ0FAAOCAgEAsRE3oW/VAx2JPESuWDZVbKIX9n26BZUZ2mdmUocRmn7KQ6CAi0Ac
+L5YRUvYt7kmGo6BSA6rUa0TMoMBtFzfIJ6HQZzEoA/LOkIKMfNHsFFzpIJxghPYJ
+PfPkXoLpAOBcLDrYWr1bJ3mkvrd6Tuyx02wJEhVmTcF8W/18AFRPuEVg/u3vJmeQ
+yMdwQZG42kEslvhCTO688vozYeX+dXO1/AXamzYQZyEWk2cBQ28DIc5eg39Tq77N
+89xqWNK/FWKkF4USn9psiBJQpKEjq+P1jTgdpuN3IGv618hlxS455eGyJrbiTxjD
+osWGShI+ZVznnqw98aX558hnNWHic+5JVvdJAwNaMMuNNkApFdz328z9dPtcUAZT
+7mNcKAuY1NcqdxKTPwkGWfmZm+WndGwKLwpshBhF/ImiAb/UiDrLh0jGbQ/FDE3j
+DtWs4k8eXIibtzGhgjfewdXO66jw5Z55FajcOPgja3uw2g2KEhJ+/VP1YtCvCpkm
+NX0liKgKLzUGDCbzyrH7QD16T633ebLbak3CtNMMlxZRQO8DQDbDsEKybCG62f/w
+OmM+QmL7lRFcXDbtVNxBSQKaDBDlNaEGEjM8phz166g+UMD7M6xJjmwJx/G/QvUd
+98YQfMEIt8IlrIbIfHXnAlj4SJwWNfOw+SN0dCqD5CDEYzYVtZgrNXY=
+-----END X509 CRL-----

rust/pv/tests/assets/cert/fake_ibm.crt

@@ -0,0 +1,38 @@
+-----BEGIN CERTIFICATE-----
+MIIGrTCCBJWgAwIBAgIUMCRfNPXX7mCzJea1P3mCUDqZdB0wDQYJKoZIhvcNAQEL
+BQAwgbUxCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
+ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
+IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
+azEPMA0GA1UEBwwGQXJtb25rMRYwFAYDVQQLDA1JQk0gWiBSb290IENBMCAXDTI0
+MDMyMTE0NTIzOVoYDzIzODgxMjIzMTQ1MjM5WjCBzDELMAkGA1UEBhMCVVMxNDAy
+BgNVBAoMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29ycG9yYXRp
+b24xNDAyBgNVBAMMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29y
+cG9yYXRpb24xETAPBgNVBAgMCE5ldyBZb3JrMRUwEwYDVQQHDAxQb3VnaGtlZXBz
+aWUxJzAlBgNVBAsMHklCTSBaIEhvc3QgS2V5IFNpZ25pbmcgU2VydmljZTCCAiIw
+DQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALIvcLAKt2DM5rTc1nOhyVT2EbNy
+CA1Sy+l1mSloBRVqjyk464mvlqq9p/CDO1e6tWiFhdEFChuTYzzDOxHazLjPc2Y5
+U+r0QYYY8KK6jLQDj4crChPMJoJ0HZbmlWe/3uMl7lmrVMyHgqqOftQ52etBCGDn
+d/RV7U4OC+MJ01ePYUcABxPh3APA+DDV5eZ2b1k74JzLvXa+SGA82MPDQYc70Waf
+CcsfCw04Adnc968CEUbNQYxdfXZfL0Uvi44bohuaB5b07KY4cCetdMaBIuowgVsa
+d3Zo3pI/vaj8nlAIVmYNbG4aVmItG2q+3K8Zt11A1WXMCfVBfzg4aHAmEPJzVD+s
+u0maCTrRwRfKudHU+FFI36x4aqauNj0jAoQtuACYLS+69z6G0MKHd50jQXYiGwKP
+LaTI+mWJ2+GBPMZpRFKyFlAXTFBFCIpZopAdfhgCMkbb212cARGD9N55xjx0F5u5
+kuXWhyF/0Zq7IdXdBlR9/0uc2I0z2P2RpQ1x1TExjqZoEt6WrpYuWPHtKqeLV1zu
+PonIPZFsKXJDtxoJhvhk/Aivv0329faKxqtIlH1W7b2BrrkC1UYh4+w9f/CVG2tD
+FRkXDEdgyknFsGarHSIGtrIr4vRGAh2p6a+7lNnb9GgpGshFIaOnXf1SXFLgdBwb
+mEPx8pjT7Fnu01HxAgMBAAGjgZkwgZYwIQYDVR0fBBowGDAWoBSgEoYQZmFrZV9y
+b290X2NhLmNybDAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUE
+DDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBQsIzqwsaKXaQyBeov7u8c7q8IEdzAd
+BgNVHQ4EFgQUkAjsRJhsIrqQNhEe7KzAcnRjtWkwDQYJKoZIhvcNAQELBQADggIB
+AL+JmoykUGjMygjv23qdStop7VI2ekieYBKJANlq1eEoICLW0yIw9B57pxR6iFpS
+ClulV5vU4GvXlOAP7mTJJQWeuU5Z+sn9s+nLMkwZQj6QBpYwVru3SWx7H4XojRkk
+bVhN7hTrfXfQAkTLuol9PHNrGiTNGKRultBg6votpMSyd2wWgli7nt0QUydhquEL
+2kROaUlHRLo9cKttyy6MIypWlneGx9KC3X/UMoZgxCygpCDQycIp1oU53ZlHO4AZ
+7WeJ/FjEM2PIy6EiBnhrfmRimDjghPM8c8OIMx7fVjc5yS7KnryZ8HuzIeO6CPL+
+/9+bJASuSAHmAZN3qKmiVUVfYhcbU+hKuCS2HRNkRhE/fZidp3K02OqSiRegiPRC
+TIcIXJ/SZ8M345yjGekAJ/M7RGIoirbdLYmpOpvHDg0qMlKFsCdpqasivPFjtLpX
+M1hvu9Ahz2HteKhm7WV9tOQ2lzMdqFDNTbxhhGzy7NJf+20zooTZCDwlNlo5JmKl
+Bg/Tns0rE5ZN2j5iVvv32Bp5CrY8oy8Xq8NJitaEb4JQKSLIya++rot+OTnX7inc
+LzsAwru4YgT+jGnHxEQslPcLMjuLdgZZGyXlKit+8KyslwaAb5Yv5e2rP90gYFFG
+5ZxgKxI1NfJZXgPXjrnDv/FPJZe+agqlTJ0RYCJeSmCu
+-----END CERTIFICATE-----

rust/pv/tests/assets/cert/fake_ibm.key

@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQCyL3CwCrdgzOa0
+3NZzoclU9hGzcggNUsvpdZkpaAUVao8pOOuJr5aqvafwgztXurVohYXRBQobk2M8
+wzsR2sy4z3NmOVPq9EGGGPCiuoy0A4+HKwoTzCaCdB2W5pVnv97jJe5Zq1TMh4Kq
+jn7UOdnrQQhg53f0Ve1ODgvjCdNXj2FHAAcT4dwDwPgw1eXmdm9ZO+Ccy712vkhg
+PNjDw0GHO9FmnwnLHwsNOAHZ3PevAhFGzUGMXX12Xy9FL4uOG6IbmgeW9OymOHAn
+rXTGgSLqMIFbGnd2aN6SP72o/J5QCFZmDWxuGlZiLRtqvtyvGbddQNVlzAn1QX84
+OGhwJhDyc1Q/rLtJmgk60cEXyrnR1PhRSN+seGqmrjY9IwKELbgAmC0vuvc+htDC
+h3edI0F2IhsCjy2kyPplidvhgTzGaURSshZQF0xQRQiKWaKQHX4YAjJG29tdnAER
+g/TeecY8dBebuZLl1ochf9GauyHV3QZUff9LnNiNM9j9kaUNcdUxMY6maBLelq6W
+Lljx7Sqni1dc7j6JyD2RbClyQ7caCYb4ZPwIr79N9vX2isarSJR9Vu29ga65AtVG
+IePsPX/wlRtrQxUZFwxHYMpJxbBmqx0iBrayK+L0RgIdqemvu5TZ2/RoKRrIRSGj
+p139UlxS4HQcG5hD8fKY0+xZ7tNR8QIDAQABAoICAA3bS5edFbqk5JIPFGxEmhwN
+0L2UMhUbKblbiFAkgzSxpzVs9EAuU/iuLAezpONDJUVeENR64FjZot+ATTErwzzi
+ARbjgWelnAzaFqiI+lUra7d2vN9iQmJltkFcaCT70lD2y6zUepE3Po2V7D4Dy7MU
+SRsEFRt+rSgjRoBe7L0D7OwxD9vXdh0ingpqL+k2r50QX3zCCVdZH9bAFJlQr2Fd
+YQDqgD/4B4t9HgO7v9Uvw3kukBji0lVovIvUUTV5Z6de2JVAMcERZYNoZUrkkvsE
+T6LukXi3WgukglLIZmVR6KoiBBsh2DLlUBsCgbXqOYy6dH3omqOkdsi/9js2cp3O
+6waEBmtrH4qmOzXOnmdchg5zNs5eKVwpsrMc04sS74Xr/CWlUPlMsbL4lV3sdAsW
+jL/iJO/3VSUwPHPfIbQgt7AJrkP31ESDSGNN5ac4er/ltcmB1r2MI5kuPgWL2psh
+ILNFViwarwzPFHLJyiAYSW44p7kzvltoPyOfNyO5ekgeJKuYUfZiNyKYRwrStO4X
+FsukIbYLnPa3ZIb3C0RVBx+lTUU+eyGd/rt/rWFA3Lnvbx4r3FdcYj2DnRM1ukgK
+1QnmqUbWpRQ2wFZsdOPtMva2AUOurzv7Fze83ZyaijAmLnphnpUjqPbj2RYVWzwv
+R7FUHThkc+uzcWhcOnVbAoIBAQDXRKxscm8eurBSQwPx64Td7tmPqvkzANFG9Flv
+GC1FnwP/UpKXkEQe2cMu4hvVAnS3awVAfPkRvyPZDJbL5jjvDdLtXbCtbnZEEriI
+TqT2UU0cnRxUybVesU+cT95PAWiEEvxFTHxOlv2rtKx0fZrd/ft530V3U7UeH7fk
+lZbpEGqmbZn3hGt2UNAXItwi6FT1OjGmOXfBVZUOUSOTDeEX8Dtx+H81ReXTRslA
+QXRruHDZX7x8Tw8YWL5Cq0eCPv5+Bm2DxLkzk616C7icv3qrJQS7u/nijg+qGec4
+aKqFGy+Gvc12cGUt6FoWG+6zS+NAihawxind+V/JYnIt1ulLAoIBAQDT5oPaWE1b
+Vkm2RqVscq5dnKT+ImmIyUfM7lC6Ff6tf7CyxPumHwrMRnqfas8L5KnvgVQi33rn
+OJ5SXoTSJDvU42eqFXD4fAKpsIwbxYi+pY2RPH+PxYNtMvWTMmKZnrqVowFAUHyG
+f6yTIHqIZcy4Ll8wrq+Z2ZNQZAMtllXHLgdlFxDcReGmWvhtEtF2yc36DalQPWuS
+XvC4Zf1ja37Mslst42MdYNBi9QxE4CKVIaDWnF1Yh5xq8i0DIbJt37xpweXtkT9R
+Z6Fefc+hx7A/A5i8bSK6QQsrdL3CokZHY2dbYqDSNlD+21QgEI7wK6ivkS7XkUD/
+fSVIRD7SWYgzAoIBAAoI4ny/rNxi2XtMMm/hibUKwEuJLcqp3BeRpmWeW+Xl7rrF
+L54vFG3XutiBo8h/L8+pBnqmGLoyDcq9Yn4owjiqjU2RU34SKyMrODzqZZgx3AVc
+cYimSnUakNp5gqRuLWASvn3Aff7v3O1XI77eaAy3HTTmKofQeB3qXpkiPAGrST1u
+2IGIQ7YlOD4L2vUpnWQ9DTlxblqt0Z/0OlNNj1OdWDgM3GkwU/FQWGtNYc7vrxsC
+8ndc/Bgnct8Kuu+gXh6j0BEXZ4a2+Jw61aVA68f0ls7liVV9R8+nG3cusdw4kzOV
+v3Eo9h54uVJUhQEIpZRJm5sr8aGuUT/C/g2S+hcCggEAW91HtFUr1DkoY7lk5gsh
+xLuwW+yXTBHW6uU2YjY+3wDInfgAERjMGZtEdfBcKo/LjGXJEAVKxwsouBT6CBBl
+T/n2ayo4e8FndiFv3GpayiwDn79WngHG5IR/Kn1hea/yvASa+kLqeXTIYFBoTtGz
+WvXflr9kqZJF50g0iILwVRWDZzQEvzochX5SzRancJQ0k/9wM7Us+ZvnSEoO/BcS
+NbPtC4vU4FukfAI4e3OgCn81t1S6szK3gTXUhdMKA9BHYqIJCGE7zhLbRpfMeBqW
+MfthL+8wawbfzMsjqUmopjJWEKxFhFy/6H01j2EeVsjWrKaIZDQ4tYqPqzDK+26N
+OQKCAQAV5336ahvQ504soqkNpOiVplH0Ksl3r3/WuO1xr/Hq4A8YXbPFeSFkztxg
+kjZABH6c7rV3/8NHJx86MAxXCAlLTIkR5aXmPrBI+EYm/fle9q/AbK+ppq3IUHVF
+KXpost8YysCRlel2QrhkTln5PJd4oN2xoMWKPHEuc+mhxBMQdq30JtmlVRfm9JaN
+ba3PoW9ecZG5eLP7pZi+AW+KfsaSg9U54jZToYVWeTnTzd7LD70hstun9E+FZAyh
+lrTkZuq578ltOuUWwDgKOly0bCAO+q6KMdb7pbPxbtqtdNGbFpXaChLcKB8lwa+8
+vpiaRjhZtk5MLPJs9mTHq1STrzL9
+-----END PRIVATE KEY-----

rust/pv/tests/assets/cert/fake_inter_ca.crl

@@ -1,19 +1,20 @@
 -----BEGIN X509 CRL-----
-MIIDITCCAQkCAQEwDQYJKoZIhvcNAQELBQAwgb0xCzAJBgNVBAYTAlVTMTQwMgYD
+MIIDRjCCAS4CAQEwDQYJKoZIhvcNAQENBQAwgb0xCzAJBgNVBAYTAlVTMTQwMgYD
 VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
 MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
 cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEPMA0GA1UEBwwGQXJtb25rMR4wHAYD
-VQQLDBVJQk0gWiBJbnRlcm1lZGlhdGUgQ0EXDTIzMDMxOTExMDQ0N1oYDzIzODcx
-MjMxMTEwNDQ3WjAVMBMCAgG8Fw0yMzAzMjgxMTA0NDdaMA0GCSqGSIb3DQEBCwUA
-A4ICAQA+KQrjx/6nKzPggDpKEAzH6XxhUU4CZmyUKFirUdenQBjYLag2Nono75o8
-9DVK3vuK7aeg4tIkUYOBcOEgYx0wEPU6PEE+yOO6KErn7qilN9gRnDHOTrfT0iNY
-Rabyeat256gyfrsS84ZB7MnbhecWwC6sP2NiH18VCprH865X6sm5SxAfez1zITV3
-YVtudX4UczqbfpDgP4BU5ERMI71tqj4gKjaHFkC0TGizSphiINDKPmUMbd1w7FHg
-Ilj+7pNZS377GCX9JzoTaKLuMBiblkwSTUJic7Z2BJZlTgm18hhfT3AZQDVvkq0A
-AEPxQzm3be3ZUb+zJvueTeizVHkd3Eufnk69p7w4wNRQMwfj/icm27RZa3bBpF2o
-esr2Ptik9ZBN81oMAakONZ4Wxuf0n/KBd6VBjy6WkbalKGVoZn70Nke3+9HGWSIh
-bgbuHt7XAlvsgVChtZWsGsyxYw4p2ku4T2ajUfpxqQY1DDCAThweuHl2FND87Kr1
-5sblLLhA3QdjQ0EavsCV1646xorvoyw7YdHkqCPjRb1FsPWm/IePbtu+w9/VjDRF
-KcHgBZBWmmQHj/9ykSI9pA5J7R7Nij6sX6Iu1g2yKiPnXeRQFiwhgsxslNk8eJfq
-cK4c4HhnNtXa/c8jHcbymwqkF8Qltz0cbEW1usxZ2u6153pyPQ==
+VQQLDBVJQk0gWiBJbnRlcm1lZGlhdGUgQ0EXDTI0MDMxMTE1NTIzOFoYDzIzODgx
+MjIzMTU1MjM4WjAVMBMCAgG8Fw0yNDAzMjAxNTUyMzhaoCMwITAfBgNVHSMEGDAW
+gBSMe9JFoed6PvsUVY3z4MU6KhnKCjANBgkqhkiG9w0BAQ0FAAOCAgEATjy3crOb
+zDvF2CiBxmDMvOK8E/fhQ1BSUOB2qc/OiqK6zb1Q2MFvni945+Q+TwbHJqWBfU2z
+QHuhOQHUQQNnIvMPXgjJuT32eF2Y7J4weaQOHNjrt1dwE6TPC1DLNUzibbjKr5x1
+/scmCiXWYxjeLvS7aTACNaD1UmUxyroK6h4oc968ofdPURK54sAiddY+VBA4KW4B
+WlAjxGSErZk0DIg5SXakSQbTkz8+pLnrqqtmvwQXk92lyfrwsSiZhHlcfBrJ6+mp
+1Mho9H5r97mO/LRRV+2CRShqTElxVORbW3Q2ku6RGJHEUB7AssIeKBtEma8yfUff
+S2bX0P82ETUCT3CPZK29QJ8eaxxH+PaRnyiT/W8vWuo+BRw8XqQ2AsM22vVCPP61
+mg6VNsPJkJ8UaUF/S41aGMS21HNGk4Ik0iv0wiuu3q2rcFwGuuWB/gRUfSuPfFSO
+K5sEf47dBPB5kMZCSEkX1RvHPWAYwd6g8GgVdlQEt/IIX4ChoASES5JNhDFar7tg
+6h72VhfTtwEkGqg/z8vI1zP1Qzl2bZ773B/k/TAJ3j6N1JXiHUKioL1hAnA9glrj
+3hnZQEQSewPf8opPe/l7UEQNXGlamYic5WRsm8xbN1KL6HARLqxkiC7K8SS6U99s
+T7L2jh4egE5kyM4lLOFYfEugj4s6Soq6XuU=
 -----END X509 CRL-----

rust/pv/tests/assets/cert/fake_inter_ca.crt

@@ -1,38 +1,37 @@
 -----BEGIN CERTIFICATE-----
-MIIGpjCCBI6gAwIBAgIUMp+RLATMshrQnbOfPkwKoDNyYhcwDQYJKoZIhvcNAQEL
+MIIGjDCCBHSgAwIBAgIUKp3mjstxJ9gXt3S7lpKjri2dEUwwDQYJKoZIhvcNAQEL
 BQAwgbUxCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
 ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
 IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
-azEPMA0GA1UEBwwGQXJtb25rMRYwFAYDVQQLDA1JQk0gWiBSb290IENBMCAXDTIz
-MDMyOTA5MDQ0N1oYDzIzODcxMjMxMDkwNDQ3WjCBvTELMAkGA1UEBhMCVVMxNDAy
+azEPMA0GA1UEBwwGQXJtb25rMRYwFAYDVQQLDA1JQk0gWiBSb290IENBMCAXDTI0
+MDMyMTE0NTIzOFoYDzIzODgxMjIzMTQ1MjM4WjCBvTELMAkGA1UEBhMCVVMxNDAy
 BgNVBAoMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29ycG9yYXRp
 b24xNDAyBgNVBAMMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29y
 cG9yYXRpb24xETAPBgNVBAgMCE5ldyBZb3JrMQ8wDQYDVQQHDAZBcm1vbmsxHjAc
 BgNVBAsMFUlCTSBaIEludGVybWVkaWF0ZSBDQTCCAiIwDQYJKoZIhvcNAQEBBQAD
-ggIPADCCAgoCggIBAK75zkJO8mpqPrD9vlSsfJgW7hbioQpuphSo1+3q9cAAWKFg
-TYUcGBUNR/lUVdYqgzo3AglUwldWfeO9mBCIGNSN/heLFt1KzNutBsnE3YEeGKpM
-7nHhMzh41otFdpZEZfrsGXGok07dy2mEV0mx72e9ALWbXFhxYsdWdSSVTlBH8xcd
-38rAzfAiTbjgAUnTIdCPjAJKbXSDBXGXZ3+iuhFxNtSWyJr1AsxPzESErCPzUQjr
-m8TM24lKq69zimTEkN4uwP5U8s2JPzbKosg2k24RbpDgkjO8iNK7RL9SMRUE8daP
-+eru5EwN4BlZfsNpZDFbILxbt/2sxqmdsx/Nupa5ZAfcHRs88p4l1D3QIiZzaSEc
-nCotM/kmnHWbgeJbkGbC9fD23dNJ29uqZU0fbRnG4HpSutrYD6lPg7PXnMt5tT+f
-0+wQds38woXT9qW/kN/2WtkVYDhyVjxCgD8iHOZpz2LUmvJfi7Gz9B/DeW1dzgbo
-cGxz9ee+R+T5KcKg+XvHD6slk82GrSM21b7zJeK92bJtjkqxBtQf+YgcKtOO7QX7
-37C1XvSHFnKvyyRJrldJFGEKfK2C66hdASHRdbUhWHFo1AA7VqzKB1fU9M2+ltUZ
-zRpYD7X36OtRY1KsHHn+SVvsn404hWwgPblZ04nsMPanj+jsN//6M9r5lMezAgMB
-AAGjgaEwgZ4wOwYDVR0fBDQwMjAwoC6gLIYqaHR0cDovLzEyNy4wLjAuMToxMjM0
-L2NybC9mYWtlX3Jvb3RfY2EuY3JsMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/
-BAQDAgEGMB8GA1UdIwQYMBaAFNnX872GsEyiVMz7up1p/Nq/K+0VMB0GA1UdDgQW
-BBT2zEtzeetYaOXAVw0Z9Pda1V9n1DANBgkqhkiG9w0BAQsFAAOCAgEAb7xPI93b
-gqpXi4E/hAl7Vh354kKV+1smd1Omf7mQZbTrKBo6o1s0ZpXCbC9+WzK47R21VPNe
-EgZ3uzTkURu4AX+5OnAMiWDFAGRSDt8ZXk6ZukWP7OmHsnLCu2strdhrvC4EhMF5
-G9VPIQsTx16CpprrVjzVzJg4i/X+U9dypvnAQeneyz4Ul/kPr6di8bOB3FiBeEDu
-dOkVTbnlDa+wMQlCvqlFroFjEHZBKK/+PVIx9cJYj1grmzgqzm2FGUs5Wvcixpgb
-uSHCQY9JP8Hy0xl3wx58VaymUK4EMfs612CfzOMClaiooDYuZgzVfhalU6g268nc
-PQ9RCRJtJuda4mJ2H3Rag79sIiCVV31tE6tLXjOGebuO0vEB8wOjJc4YW1gtrZFy
-GltT+HMdFgjO2c6HynpkmtqS8axQAw2hVaOpdJbDW+R0jHihO98FAgXR27TqTFp9
-sjBacfITeYRXGjQTDU1qxuEfoLnTZRIct1TjRTI1HBT8fl1exxgKUyEawH3MUCo7
-LsTPSNASKkJH3Rp29be9xTejUx2HUUwOE/DIF0HKaN+aAc8TR31/4HvC3bf5VPyD
-wIwazpjVDZlQ2w+Wry1zNezNCPKiWtkfkj+TkT32h4ZfQEX8t0MUpKnL1LOSV/8h
-PV357EenQb+f9DeC4BIbmipovLaUWmml10c=
+ggIPADCCAgoCggIBAK+kNJHAUL4dcMnjElivyuzkO2UwTUlJcKQCBmWRHYQjRbP5
+akJx8SZ+wI0Spo00hG4sV2BxA83J+Yrked53DEzlR+RxojA16vXzlUO8c9KH2dJQ
+E17PgZnu7/hECmQcT69ZJAOh78ILEXRYk+2ixSTaZRTtchJdzfXIQ0633O2Mi/7z
+z5idQmQeXbitC3QIZeNzwitl2FLXPIw6MUnktOKNjQSNxMr9AU8q1cfOoICJQs0J
+wYVpby0dv1z0f2N21JJywaeAImHa2h58sSX6uqwOXtzdwcPlr2+iJ09YwHM8uO0D
+rtPx3bLHfkvbpMd5cCKjSeFozP1nVnlKJUmAZ8UXk4MAFKCtuLv2/InA8MkclZmX
+1IzBbvYDOw7AnsAN2VQYZSgM8vCmnRCzpTmtvb3ysSo32sTUjGW44giuRtGqh5Ct
+LeRpZZVm6zDFY6cjpr34+3Vc4pys81d3Dq+Sos4YVPXhTKW3I1VtFIdCeNyey7hv
+epjna6/JvOzQuwK90+t9VmZk7jTY2WOUNXJhzDTeDku/aTMIeXUZrAxg3pOvl/wf
+SN5i4Gauhl7URDx3nI0jc4Y2u9NGFi0TYJMCRVVLknAcre5cDKFyf9ts1gDyxTDc
++orszCE3ZQzXZeEY6aiQPihhL1YDk5SkkTI6XHmUqLW3HFlfg2aFH/oI+VGBAgMB
+AAGjgYcwgYQwIQYDVR0fBBowGDAWoBSgEoYQZmFrZV9yb290X2NhLmNybDAPBgNV
+HRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAfBgNVHSMEGDAWgBQsIzqwsaKX
+aQyBeov7u8c7q8IEdzAdBgNVHQ4EFgQUjHvSRaHnej77FFWN8+DFOioZygowDQYJ
+KoZIhvcNAQELBQADggIBAD4GmfmI5R6cy/Sp37buyO53azgw4RvVclIy/2qSPHVX
+Os0pPPIIXLsbJMy7M6rDvKx/thZ27BDwms5dNuDynZ494XjqTmwzbBr+qEIzCNpa
+QiX0MHf9JqFq5hkcZihfJ8PZL9JWIjiRfMI6AERd1pU1QJI/G8ha1vAkPfcA7GvH
+NBBwKBm63iHYhp+zmnEEh85lpj4pEq+hOLK+mJxu55BodbNiBlBGu4EbalZlwXFp
+7lGHLPkxuXZndrlrm8Lk+hi558NgNFxqz6qYtUc7txajViU2xFjEkTcQ0FKNiFpV
+eHn5TNjwh4QucnWc7wI9hcDoADrekTEr8mUKrJXgxaBLIXEShC0ZDBnJsEwW4xbg
+GQD9qXyo0h8cYx2NngvL+9Ee3rzdYAaSfAnZOU0xxrqZt+2dstNqi3pLKdS6RpA/
+3Dt3cAnf0mQQSUP6oZQpfdSEJ9uggT9h+kgJz5RGOQfEELKA5RxHtTe7249J3vDv
+hoy0Uy6+w3Ji5AQdn3G5uUGxLsBh/uS1dl8hq4gihrpPbKVJHVxqPL0HCx7DyhRw
+hx53GXhGIgZN7QSGTrB5iz9YyzejsnysS0Um+figkxtC1atqhVkqzMDZBHUwRPfy
+wq8PREXoRITJHfSkg01bInRFMMNWDQuPwSHDX9OYNqpkXzlV8/ao9Rx6JOtiG0a8
 -----END CERTIFICATE-----

rust/pv/tests/assets/cert/fake_inter_ca.key

@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQCvpDSRwFC+HXDJ
+4xJYr8rs5DtlME1JSXCkAgZlkR2EI0Wz+WpCcfEmfsCNEqaNNIRuLFdgcQPNyfmK
+5HnedwxM5UfkcaIwNer185VDvHPSh9nSUBNez4GZ7u/4RApkHE+vWSQDoe/CCxF0
+WJPtosUk2mUU7XISXc31yENOt9ztjIv+88+YnUJkHl24rQt0CGXjc8IrZdhS1zyM
+OjFJ5LTijY0EjcTK/QFPKtXHzqCAiULNCcGFaW8tHb9c9H9jdtSScsGngCJh2toe
+fLEl+rqsDl7c3cHD5a9voidPWMBzPLjtA67T8d2yx35L26THeXAio0nhaMz9Z1Z5
+SiVJgGfFF5ODABSgrbi79vyJwPDJHJWZl9SMwW72AzsOwJ7ADdlUGGUoDPLwpp0Q
+s6U5rb298rEqN9rE1IxluOIIrkbRqoeQrS3kaWWVZuswxWOnI6a9+Pt1XOKcrPNX
+dw6vkqLOGFT14UyltyNVbRSHQnjcnsu4b3qY52uvybzs0LsCvdPrfVZmZO402Nlj
+lDVyYcw03g5Lv2kzCHl1GawMYN6Tr5f8H0jeYuBmroZe1EQ8d5yNI3OGNrvTRhYt
+E2CTAkVVS5JwHK3uXAyhcn/bbNYA8sUw3PqK7MwhN2UM12XhGOmokD4oYS9WA5OU
+pJEyOlx5lKi1txxZX4NmhR/6CPlRgQIDAQABAoICAAzvUnVE5NVZaPHfPH3GRXMc
+bEDblad+5nIXmZW/gf1WFScnyDLoPf6MIV1KSTR3MIUGFDG8pO9x70QSpyRyXzgm
+/vxEf5GeGOV/yKduQJfZrBmMTt7huH1H/slpZlwAx0AGOCwhz/y58LFBKDS9Ethv
+0nef9HGEkbtG4ikRCo6+dd1i4nAObcIeh9+ms8QZ7bn6T4t/YrbYFcQMcY6L7qPM
+EZ1rHNnnl8H3KTr/nSuWIDKmJCexb+/yQ8JiWaLPMKCv3ZHasn2DHuLVozylKjvr
+S4JnvOIyvzChEBTMeBDMgSBoT+bZJi7pOOR4gpozl+XfIVzdqVIEmxZP1u7iq1GV
+0jS/NwIAiZyp0e4YC+joS81AaskqoiTnk59inipWgtXaqz9peSd5hDA2u4mfSCVY
+aKHEDv3dUYyc++JTr0qjAlxuu0SJjPZMTeIbMoVX+7RTwEHyQoiHzNLzBXo5yGm8
+b29oOqA4DePMt9+J/h3xuiUH9SmYxTkSX6oGZAJC2qEELGFbpN61zLSjJOlv+wfC
+Nmpd8O88q6dSG9Tk2o2xeLRXAEulEtmIwjr0x8S10pieJ+ZhoaHAyIRWnbVfwj78
+pKLdpd8MPToTS4f98nkkVfbmc7ymVdz4JhnYTco4aqmtai/8yVUzzIjOLfJ6bp1s
+N9okI+1fKgTVlyNj40opAoIBAQDeZqJLT9DTAhxZqa+ZUYc/ztoKiT1JLXDZDWhO
+J2MVqFdTs7sAw/NhVx7Buf2VBmRBZ8jW/izrING228bCkpIvF8Kf5Fz5busJcJB5
+E2xhnIKRVrnw30JCxF0dGCqpfA79GyhfSsAdcx8ou0TUAgznvYHz6BvdYL8VuGuB
+YQ5uJNSykrtHsZBwsk143VrwmUyL/HEiq/btVJ5vRLKtbR59+KOzqgZKTgjDZDm9
+8HwA8Nw45GqFdXUIHJwCwbK0+YE9qW/QCLDtx3wct+E1fs0C6TuMfLrh5khHUa6P
+EZKLzkTRm7VHYrFFSGQBQBQ9mMalEttkrHmnHwfd5PAgCGH5AoIBAQDKLSVff0GB
+5uadXXcRMRrhA+crUud8RUi9BEXdcUJR4fLosJl6dEBkhrC9pxVpfczAL5zXaqFg
+Z4R3AinWB7trIGC1MaVc1CZenBtiVsPHNzOkqeZdcpK/WZcqJ/6AiDrXWYDu5N2n
+hsff3Wtp2QqqhrrsP9pZnyrikAYeBvtuys28wpe4L8fZhwyRNry2jziIlmomtHyX
+vr1xjfwQyVNno0RpppgAdul3RqBUV1HCpL7pndhfwWRCnW7fVDawYqSpIXUHjW8E
+3+RgpHh0/YtLNinRKe2cDYorgxF02B1YCcSignh1msIbuJcH1MI7N2C0C2atiGYE
+eSK+R12HcM3JAoIBAHaHXJemwjSzO0jOFrgvq1VmeO6ElhUaErqbWqvMchJo1aHW
+eCPAS0XlmI7HAU8bSPNSzMdIT8hAhYRfPV8VnrNahm+Q1bxaUQmG5Hii0XB0aWHs
+Rs0JL9dFsBqBdrs9Uv+yKaIfxKPtZv3eUKBtN1OKvGexnKgvl6eL0j/x6i7pkjJZ
+4VYkXEazwHZaAs2X5iP1Npaz77YtEwNaKaAkN8wLZ7OpOhD/5cu87sk8Edqug7AO
+jHb0UpswJDWT5hptn2OtmdnVx/XyC0OC/JP2MG0MwJ/vGeqrQHpCHjZBt0irdiIA
+SmzxPGkgW6wO6rqpYbU4h5TwFyXqc9be3Ns1nIECggEAYZUIxN8XLyvTg4DpR1L8
+Nj88BJ0vPbvzL8gwMIHKENuN8uHKMmCJ8/tOsztCCni9qsVQXmkJGw7b0NUqfDOf
+MkWeZ9Zeij+bhW6ziPN361+pfYDDv7bdPZ5wZ9iF7mPSgr6gjK3KjmFvd43Xmm83
+xrbg4cawDTHV8SSyzytvkDoyszj5Id1uCIA2gKB61WKrVsHC2oui11so9PYjA7co
+mo0jKBtQomjCpt9f41WCEQCTZQ7asN0XF1AFg6WR//CcqUWMxuhs/V1TTZIU0eLO
+qK6r4FjsZrXiSr4oXs0w3J1aW1W97oWTyu19eDooxYwlEMGv/XIoS2BsdIrdidHY
+gQKCAQBrA0X+AwT9xgEwYaXnA9RINBPSnzruv1giHHAmY9iS0V6BNJUzlJDyASdT
+7drV0YRY7bKCguZYNVZh3o259OXNsAOStd9yiyFzZr6bAVvTVXIkrB040Rd1xptC
+yl+kxYEfDeENkCR6h8JkFDupG4xF0PT70sE1sUGgFg3585nWzhN/s6xC9vxtBNHc
+R+a1UmoH8pYSONttldtW7g2kB5uuQTU0lZVSHDj9B8z0Twj3b6+kQlXt0ielrVV2
+TSVZcmbIyyEYBDcAxOCvHN+rzKbP7H+7JqHVgnbe12pnVoN7WVMbR2v3F4pK+0aA
+M9Wd2js5nPPh0AN3Px1643vFYcAQ
+-----END PRIVATE KEY-----

rust/pv/tests/assets/cert/fake_root_ca.crl

@@ -0,0 +1,20 @@
+-----BEGIN X509 CRL-----
+MIIDPjCCASYCAQEwDQYJKoZIhvcNAQENBQAwgbUxCzAJBgNVBAYTAlVTMTQwMgYD
+VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
+MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
+cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEPMA0GA1UEBwwGQXJtb25rMRYwFAYD
+VQQLDA1JQk0gWiBSb290IENBFw0yNDAzMTExNTUyMzhaGA8yMzg4MTIyMzE1NTIz
+OFowFTATAgIBTRcNMjQwMzIwMTU1MjM4WqAjMCEwHwYDVR0jBBgwFoAULCM6sLGi
+l2kMgXqL+7vHO6vCBHcwDQYJKoZIhvcNAQENBQADggIBAJB5ERfMQEZ5Pdc3A8+d
+gDiY53VEdA0Zd8MDv+j+Mgu1qn7IW2rpE313yVHieclZ65ReEtb825St8UBJtjiZ
+9Vd4lK9FUQKKCblCYNrEbu9cvqNeHDGxldQPUkEoz+z5kielcEwD6RUsK5fSYe3Y
+6E3jc9mMHw7xWCSiolvNr5y6AUymfu22v41qgfaB0yNe5uz6vRgRoiy+OTP3Z7oc
+ls7o73F9O4k6QYdba8us4v0TSwZAAPO16TsHhmyHcBe3w23UIusTU/c+6A++hGdU
+TNUW3OZl+hv+4BcnClrVBDfWiExOMNzIhH9hzlXQ2qNPNqz2ymlH8Wgpf1TBYJ8m
+xe8EuGGrDFuewa45kA8uxuHCiSLCsBowDEXXkswaSF4E4yzYZqcNDcLOedK7vG9G
++zXYHOpLsZMyfgauxjuWtwR/ma+ub85CHy+eUC2waI+Mk0Uk0Lr5y0Jdp8ztxakp
+UlVHYNU/Q+kwHfmKztkOsedomOf1/8IvzE930ZB8rv0G8ok2HXYvA3+r3lcDSG/V
+7+yq3HcJezw0XCDtc5mv8dWI6pUv8siWFKok+hlkZpeSXgtqRhF2rzI8yz+lk5Cr
+5yCWroPI0T44o2RzjfGZAViRH0nnYF1GoBORSZORppubcjmiTy46OFG/fiWKGKV1
+sngAoQ4TCDQzId0zwGLtUCHu
+-----END X509 CRL-----

rust/pv/tests/assets/cert/fake_root_ca.crt

@@ -0,0 +1,37 @@
+-----BEGIN CERTIFICATE-----
+MIIGXzCCBEegAwIBAgIUC2OH79tloDOfMBeyDBA84epTMKYwDQYJKoZIhvcNAQEL
+BQAwgbUxCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
+ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
+IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
+azEPMA0GA1UEBwwGQXJtb25rMRYwFAYDVQQLDA1JQk0gWiBSb290IENBMCAXDTI0
+MDMyMTE0NTIzOFoYDzIzODgxMjIzMTQ1MjM4WjCBtTELMAkGA1UEBhMCVVMxNDAy
+BgNVBAoMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29ycG9yYXRp
+b24xNDAyBgNVBAMMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29y
+cG9yYXRpb24xETAPBgNVBAgMCE5ldyBZb3JrMQ8wDQYDVQQHDAZBcm1vbmsxFjAU
+BgNVBAsMDUlCTSBaIFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK
+AoICAQDK+jIoIZVYyEq7ZrxfKv/TQQWCgI5C8BewYkB+/rt8NY0fn/aAZbvJdnDX
+cQCLpCeETDi7C2hGujnZQN68otr2GpJVQ/kgKnM8yU/p9yBSUan9Zo/195a9YytF
+6Ys/Yc0HApoPtB3t85NHNjAvhzdcBKWMb+/2FiJ61gdnrO/zORnxp/BejxTMyB6r
+0mhhVX4wwdl5vfkX/qS3TL0rajEz0V+SwneDiIomoVJCnco40Km1M20qU5L7EpNH
+IMEP00hcj40zO0jJ8cGDNoKgTHsZPovYfFmWITVOFvaPcKaloUU67dYEg0fv3ypX
+aYHRszcd794VOWQ85r/mlFSSELwoUrVH7G0t6wnzOawW2kk7ZYndbo+Z1ZFb1Ul+
+iVwUAHzx/ylmOORJNM4JGiYyC5+1481MLeB+37+V3TJaBe4IoKqVo/OCBsaPt7x1
+rMpZLw4gXj3A0Hh8gi0z5HDkKolMSawuU8dpFeI0GN+4hJN9DNQh0OTGLEfzeo+1
+lNzsF+jGT9B0tApWhBq/QTyHXvJREVx32hPd/1X6bVbd9mik0bexg6bVpZVNG1sn
+7GsVO2wq5OWKe3UtSh8wJcjGdW38fPAB46oIBQ7x0HGdp/KFiBTWxrexLThMFvYL
+wPtWedj8ntgOBoH5MJgL1XkVYP+1EQYaBJNfswvF4CrvPRCtCwIDAQABo2MwYTAP
+BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAfBgNVHSMEGDAWgBQsIzqw
+saKXaQyBeov7u8c7q8IEdzAdBgNVHQ4EFgQULCM6sLGil2kMgXqL+7vHO6vCBHcw
+DQYJKoZIhvcNAQELBQADggIBALZNLMgm7RqIKY++Blc2qeIDrwlx1U/PPN/PsZsN
+cQR48Bq+vQ4cV9hOcZC3jfRbkkDho8jxVTXdEOcpDyU4zNSLG1+b1FNRvqjq2L+d
+ow190dYqvfgbdNFo8V6kLdRFe5aCLhHTWGLTbl0vvkc99h1Lt9ZXr6LzhFwbXSGr
+Q/qJoLZFVBwJZmfZY3VmL661sBcTmzDDGJxg00fg+1jCIk2Ot3dn+7jQ8g6HYMQv
+8GrqGKcFia8fXcTTmcH+Swr8rps1MYypjkpX/zVHsFuENdqZNkqU+OLTaifkrBuO
+6evTTjEOcDzMFs5Uipjvq7XOBg5rz9BKRXrjDMdI4CmUzMR272lToNw7lHqqNDKi
+nxAzPjPWVwXQTu2LFY3NwubWkPAVsd6FsHKzQHlq97N4sj+vp6vctaEUgFS4pUlL
+tbjw6AtQA72z4uIpcAzE2ctTj831QeQSZGKBUpeNPjuK/NjytXQm8MvW7LI2OgaI
+H5B9+KE9KjqijpNiiOoidYVwFRrZniIQii06qXwQUgz2gGIzYPER9+3PijrtOY+t
+K/vS6NohUYb16PhbbvzFktSGBtvp1kUF4fB2NJh0z6OiZXVEHlCYEDTv78RS36iU
+PXijR+rALi20P4Sg6picuvmt2epfSMQ4ynNxPhbSG7wMp+Zp5tOrZcmg4jN0Yt56
+tACH
+-----END CERTIFICATE-----

rust/pv/tests/assets/cert/fake_root_ca.key

@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQDK+jIoIZVYyEq7
+ZrxfKv/TQQWCgI5C8BewYkB+/rt8NY0fn/aAZbvJdnDXcQCLpCeETDi7C2hGujnZ
+QN68otr2GpJVQ/kgKnM8yU/p9yBSUan9Zo/195a9YytF6Ys/Yc0HApoPtB3t85NH
+NjAvhzdcBKWMb+/2FiJ61gdnrO/zORnxp/BejxTMyB6r0mhhVX4wwdl5vfkX/qS3
+TL0rajEz0V+SwneDiIomoVJCnco40Km1M20qU5L7EpNHIMEP00hcj40zO0jJ8cGD
+NoKgTHsZPovYfFmWITVOFvaPcKaloUU67dYEg0fv3ypXaYHRszcd794VOWQ85r/m
+lFSSELwoUrVH7G0t6wnzOawW2kk7ZYndbo+Z1ZFb1Ul+iVwUAHzx/ylmOORJNM4J
+GiYyC5+1481MLeB+37+V3TJaBe4IoKqVo/OCBsaPt7x1rMpZLw4gXj3A0Hh8gi0z
+5HDkKolMSawuU8dpFeI0GN+4hJN9DNQh0OTGLEfzeo+1lNzsF+jGT9B0tApWhBq/
+QTyHXvJREVx32hPd/1X6bVbd9mik0bexg6bVpZVNG1sn7GsVO2wq5OWKe3UtSh8w
+JcjGdW38fPAB46oIBQ7x0HGdp/KFiBTWxrexLThMFvYLwPtWedj8ntgOBoH5MJgL
+1XkVYP+1EQYaBJNfswvF4CrvPRCtCwIDAQABAoICABhe0JAvnWYwK4OIouwCQP5f
+pjEJt7WjF2pewZj92LY3GnSbmNXIYTL1J43rzBb4D06RIEFE7gY1QdDV5b2xsqct
+1Y1V60lzZKv9t7yYUVHQ6vS5JbvF4wa7gMHqIoU/ptrv8wjDpXxLwc52W8ljwL/U
+Rv7aScNlhkpH/FJJr0hSqMzHpH1AofdcZ7eq5vbDdF1CSRbsOkYpQCRJ8G86rCGp
+QoJfxZ24p8ME8i18EyrzKA0mLuCQHED3n/tARtiG6P9ECmiw9jJY9n+x7HPL+v5d
+m3N9//ud4m/ieJlhpdXpIQ4hlDqtJdalGB5aqp2U7kndN5rwwxo/fPb1ru8YAfSB
+TK+5ikIn1lfzkiRoTVAmZubXqSSi1xiudqwL28euIDn0f93aiEInHO7Vx2o4vpgQ
+MJ3Hg5XaGygUAR+ZSnQ7lcv4kKMpSeqYuZSRRLs/RZ2Kw3jCYpyQyr1Ii8qH3H9S
+hUqZqUZK4splagRureExDkFrGvo5cBsmMGZqNfG8Ix9imEC4kRhhraIcmziwY2Ca
+mKqGH+sGpcvHX6vmDe7wZb4fo+Mkkacext42t8dtkPT3nEJhsR0xqmcgvyt6yP5t
+y4mv2hGeDEsclpWNfuug0DeOwXjClATZVrP4baL4rGrP6AGFDiRz0PbWmaJwMLDZ
+D+06rj6nO9Ibu/t5tkWRAoIBAQDw2JSTzLEdrkX4cTaHE7pLWY2BQuiIXdYOdXbW
+jkPytSgqHfpTckCDl8UJWMBzo87xDb5Q9Hmsa37Mj5HIz+lGxLPukuhiRUnu/XJQ
+AxzLXBBmdIsb0Rha1kChNASPHXo2Ozi9OsWB9UC65P+U1cGmE882A/Y4p5ak7C+q
+iQk+IRgSqKrLIIHFG0h6Zi0f+DlXMtsNQ7mjDk62WjWzneS/NPwN99VwGacGqI99
+IOhJIKfhpbIXMg2Wo0Xj3HwaHWccK10Va/x8jvjunX9V0px19yCPnMsMWTZ0WN9F
+CRbeD8zCuwasjQkBkqiqMyShk/gs4K6J9TMc5tprB2xB7+f3AoIBAQDXv6WWdsRa
+NuuMrzJ94ZLESUIHBg/u1uGJgvtckpKAm25SnEB2C4d8u09zey0BsXsxBKLJ/HAp
+Nci07/dKkDlmG6+SkVhcIsEAokw2EFWG/+EQJ1Bd2gbX9RXQv3O2sda/2h3QB8Vu
+BUmvK8nwpFaD5eqrIeFxBhao4vHon80Bv1L1F+QVfbjOgV5eS146VU7Gl7b/LuMk
+yx3I4HwWqNbQUGTnVfC6wprae9G1Tamui+PnCPMdVSP972gxMNfhqkt04BN2j2A5
+/Lat2VdL100W2XFzLEQmfD4sAlsJQ/jTcGhDb9Brxlf9kQYt1r+a8igcJQqoz8yr
+1wLabN6FKuaNAoIBAHALwit0ad2uCt1HBiAXPG77jYpaL0XpqcD2QsAUVWYfgzz8
+z01s9LiDreXoRThHN+oLA8QzyDs/kzDlheQPXa5PqonODJBTPc8SV9EDcazl+rc/
+dswNHbB8xnp4cbqG8ykxqfbW1bXc/C02hfSe8UUrKBYwB6dZyAqX2qESuZsO2F0t
+3K89Q0IIrFJNIKcj2sFHZoMoQ7+o01OgaiVSym1t3+k7qC9Lr9m4J3EGEyqaJ6Ah
+btW9snanJMeZ9p5LmYGQZvClWUQ1W3ffC7NIlQOIYbyOLCRliKDeC5jZXqsWXKMn
+UTaLMmpp6U+tFViaNzXhnTGPQiUq/OgX/vQ6AQcCggEBALGJyY+ZyFacnxU0Do68
+E3Rm/GifOnlGZm4sVQCGtPwT66MbZYg+UI357ZWQJSchj8h0kik5DGs9ER6j4ZGA
+QVufKMmpxVZ8WupUo/ZRVrAy3FfYoi+4/Ky1x+/xvBz5F0jlCmdoHbU9sLbvh8v4
+0CDWEFgnF0dUxUzRBFRzO9ZWRMPflxeAT5XPq4JY7v99t8eAjVxMjyp14tqssDBN
+XAgsP/yGIgTto1RrU9SoRhuWjkJOgREAQQ/z9H+WO/A9nL5ermV/8qWFKibBlS6Z
+y5wj71HheWtaDidVAOkNADOuan4kAxTNMRc+QiFyeFXfM9aFPNJRvZEi6/wmXq6i
+8PkCggEBAMK0qSiZ0kBgTqgYhpKqCwEUgEueTC3EloZQ6CHV1vTEfsyM3gEQ2A5r
+8+viQf1RD4UloCWfOF1CA9SqgtXAAIQyGVAATjG7sbUNAK7jac9UdZOS8QSkcJMS
+UIHXndlct/vijnNe/htGCcu+C2KCJz1lfW07DB8WOoyP/5e7es7e0RGjGgGdRdu2
+MyCXJ3lG0heiVUp2d+5R80UAZQdlHuzo9sItxSUbsO639Q1c+Cew/cM6YPxdcTGo
+LWnAsG3yJZgR3pipS9/GqISY725c8QJijYMG3GFUBD6pMCdD46Kl/rfjUsYK3Aoe
+2lXPecP5/ilaLLUhs7SijqHzcKiNL80=
+-----END PRIVATE KEY-----

rust/pv/tests/assets/cert/fake_root_ca_valid.crl

@@ -0,0 +1,20 @@
+-----BEGIN X509 CRL-----
+MIIDPjCCASYCAQEwDQYJKoZIhvcNAQENBQAwgbUxCzAJBgNVBAYTAlVTMTQwMgYD
+VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
+MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
+cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEPMA0GA1UEBwwGQXJtb25rMRYwFAYD
+VQQLDA1JQk0gWiBSb290IENBFw0yNDAzMTExNTUyMzhaGA8yMzg4MTIyMzE1NTIz
+OFowFTATAgIBTRcNMjQwMzIwMTU1MjM4WqAjMCEwHwYDVR0jBBgwFoAU1p7a8iaQ
+sGamSdR9585yWIW36CowDQYJKoZIhvcNAQENBQADggIBAMcBN8PztJELdCo6fQvw
+C9ZU41AmBZsMdIoacgacupt94gHf8SAO1Ric46j3KERpA0mWKAx6RH1s3OX2qN/C
+YSrVPIZ076Cn9EMVdK9w9hqt6SYHoot9CwPutF6BBG5O2uN6eAsEM21B5Tr6xTZ/
+SUj3fO3+QsePDL84BRfU5vtZcGj1BkULopWwibG82ayEUlbY3J8OPjK5YKuHtxJd
+lI4yfkmrEPwHEm8bwI6lhaIxrtTjoVgoolw+FqtVdVdU6O254AUKwxN88bHoA/sk
+BOr13AoHXiKEBaEJhocTLJRfvUZVRYGll43ELsy60XEH51W27/uULnC92vBkp4Q1
+5hPwSD0RHKfMwsLKqoJaWX1CxfdttapCfriehMXJlv46GPmq6cLIEbbHzJKsyJhN
+4mW8Uiwn1aM5EhMauSLuuwNp8QRo4rmQzUstxwn4O/3HzTcjVWbn0XvBXa2S5HtD
+2kyWwN/qck1N9aXYk/sf2A2py2ECDuXc/Kvh1kDi6ZSaKA0VSS1FX62HvdqZKQb5
+ZmyoQUpg8yv0hholaZd9Jye0pwww/K8CFddsyUMRYDSj0+qiw4pgx6KK3ElKnHeH
+uq+iLxDLWTqrWQw6k0I92B9gSlNKR3Z6Zq2UTxo6hB7IYgZv5nxx3BRxnTm6aH6a
+pIoxgnFnbNnyUIRAkOCHbFqy
+-----END X509 CRL-----

rust/pv/tests/assets/cert/gen/create_certs.py

@@ -4,13 +4,10 @@ import os.path
 from enum import Enum
 
 from cryptography import x509
-from cryptography.x509.oid import NameOID
-from cryptography.hazmat.primitives import hashes
 from cryptography.hazmat.backends import default_backend
-from cryptography.hazmat.primitives import serialization
-from cryptography.hazmat.primitives.asymmetric import ec
-from cryptography.hazmat.primitives.asymmetric import rsa
-
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import ec, rsa
+from cryptography.x509.oid import NameOID
 
 ONE_DAY = datetime.timedelta(1, 0, 0)
 
@@ -25,7 +22,9 @@ def createRSAKeyPair(size=4096):
     )
 
 
-def createCRL(pkey, issuer, serial_numbers=None, last_update=None, next_update=None):
+def createCRL(
+    pkey, issuer, serial_numbers=None, last_update=None, next_update=None, authid=True
+):
     serial_numbers = [333] if serial_numbers is None else serial_numbers
     builder = x509.CertificateRevocationListBuilder()
     builder = builder.issuer_name(issuer)
@@ -43,50 +42,15 @@ def createCRL(pkey, issuer, serial_numbers=None, last_update=None, next_update=N
             .build(default_backend())
         )
         builder = builder.add_revoked_certificate(revoked_cert)
-    crl = builder.sign(
-        private_key=pkey, algorithm=hashes.SHA256(), backend=default_backend()
-    )
-    return crl
-
-
-def createRootCA(pkey, subject):
-    issuer = subject
-    ca = (
-        x509.CertificateBuilder()
-        .subject_name(subject)
-        .issuer_name(issuer)
-        .public_key(pkey.public_key())
-        .serial_number(x509.random_serial_number())
-        .not_valid_before(datetime.datetime.utcnow())
-        .not_valid_after(
-            datetime.datetime.utcnow() + datetime.timedelta(days=365 * 365)
-        )
-        .add_extension(
-            x509.BasicConstraints(ca=True, path_length=None),
-            critical=True,
-            # Sign our certificate with our private key
-        )
-        .add_extension(
-            x509.KeyUsage(
-                digital_signature=False,
-                key_encipherment=False,
-                content_commitment=False,
-                data_encipherment=False,
-                key_agreement=False,
-                encipher_only=False,
-                decipher_only=False,
-                key_cert_sign=True,
-                crl_sign=True,
-            ),
-            critical=True,
-        )
-        .add_extension(
-            x509.SubjectKeyIdentifier.from_public_key(pkey.public_key()),
+    if authid:
+        builder = builder.add_extension(
+            x509.AuthorityKeyIdentifier.from_issuer_public_key(pkey.public_key()),
             critical=False,
         )
-        .sign(pkey, hashes.SHA512(), default_backend())
+    crl = builder.sign(
+        private_key=pkey, algorithm=hashes.SHA512(), backend=default_backend()
     )
-    return ca
+    return crl
 
 
 class CertType(Enum):
@@ -200,9 +164,7 @@ def createCert(
                 critical=True,
             )
             .add_extension(
-                x509.ExtendedKeyUsage(
-                    [x509.oid.ExtendedKeyUsageOID.CODE_SIGNING]
-                ),
+                x509.ExtendedKeyUsage([x509.oid.ExtendedKeyUsageOID.CODE_SIGNING]),
                 critical=False,
             )
         )
@@ -254,8 +216,7 @@ def getPrivKey(path, create_priv_key):
 
 
 if __name__ == "__main__":
-    MOCKUP_CRL_DIST = "http://127.0.0.1:1234/crl/"
-
+    MOCKUP_CRL_DIST = ""
 
     # create root CA
     root_ca_subject = x509.Name(
@@ -310,7 +271,13 @@ if __name__ == "__main__":
         t=CertType.ROOT_CA,
     )
 
-    fake_root_ca_crt = createRootCA(fake_root_ca_pkey, fake_root_ca_subject)
+    fake_root_ca_crt = createCert(
+        pkey=fake_root_ca_pkey,
+        subject=fake_root_ca_subject,
+        issuer_pkey=fake_root_ca_pkey,
+        crl_uri=None,
+        t=CertType.ROOT_CA,
+    )
 
     # create intermediate CA
     inter_ca_pkey = getPrivKey("inter_ca.key", createRSAKeyPair)
@@ -354,7 +321,7 @@ if __name__ == "__main__":
 
     # create ibm certificate
     ibm_pkey = getPrivKey("ibm.key", createRSAKeyPair)
-    ibm_subject = x509.Name(
+    ibm_subject_poughkeepsie = x509.Name(
         [
             x509.NameAttribute(NameOID.COUNTRY_NAME, u"US"),
             x509.NameAttribute(
@@ -371,9 +338,35 @@ if __name__ == "__main__":
             ),
         ]
     )
-    ibm_crt = createCert(
+    ibm_pougkeepsie_crt = createCert(
         pkey=ibm_pkey,
-        subject=ibm_subject,
+        subject=ibm_subject_poughkeepsie,
+        issuer_crt=inter_ca_crt,
+        issuer_pkey=inter_ca_pkey,
+        crl_uri=MOCKUP_CRL_DIST + "inter_ca.crl",
+        t=CertType.SIGNING_CERT,
+    )
+
+    ibm_subject_armonk = x509.Name(
+        [
+            x509.NameAttribute(NameOID.COUNTRY_NAME, u"US"),
+            x509.NameAttribute(
+                NameOID.ORGANIZATION_NAME,
+                u"International Business Machines Corporation",
+            ),
+            x509.NameAttribute(
+                NameOID.COMMON_NAME, u"International Business Machines Corporation"
+            ),
+            x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, u"New York"),
+            x509.NameAttribute(NameOID.LOCALITY_NAME, u"Armonk"),
+            x509.NameAttribute(
+                NameOID.ORGANIZATIONAL_UNIT_NAME, u"IBM Z Host Key Signing Service"
+            ),
+        ]
+    )
+    ibm_armonk_crt = createCert(
+        pkey=ibm_pkey,
+        subject=ibm_subject_armonk,
         issuer_crt=inter_ca_crt,
         issuer_pkey=inter_ca_pkey,
         crl_uri=MOCKUP_CRL_DIST + "inter_ca.crl",
@@ -381,7 +374,7 @@ if __name__ == "__main__":
     )
     ibm_expired_crt = createCert(
         pkey=ibm_pkey,
-        subject=ibm_subject,
+        subject=ibm_subject_poughkeepsie,
         issuer_crt=inter_ca_crt,
         issuer_pkey=inter_ca_pkey,
         crl_uri=MOCKUP_CRL_DIST + "inter_ca.crl",
@@ -390,11 +383,11 @@ if __name__ == "__main__":
         not_after=datetime.datetime.today() - 1 * 365 * ONE_DAY,
     )
 
-    #create revoked ibm certificate
+    # create revoked ibm certificate
     ibm_rev_pkey = getPrivKey("ibm.key", createRSAKeyPair)
     ibm_rev_crt = createCert(
         pkey=ibm_rev_pkey,
-        subject=ibm_subject,
+        subject=ibm_subject_poughkeepsie,
         issuer_crt=inter_ca_crt,
         issuer_pkey=inter_ca_pkey,
         crl_uri=MOCKUP_CRL_DIST + "inter_ca.crl",
@@ -402,7 +395,9 @@ if __name__ == "__main__":
     )
 
     # create inter CLRs
-    inter_ca_crl = createCRL(inter_ca_pkey, inter_ca_subject, [444, ibm_rev_crt.serial_number])
+    inter_ca_crl = createCRL(
+        inter_ca_pkey, inter_ca_subject, [444, ibm_rev_crt.serial_number]
+    )
     inter_ca_invalid_signer_crl = createCRL(root_ca_pkey, inter_ca_subject, [444])
     inter_ca_invalid_date_crl = createCRL(
         inter_ca_pkey,
@@ -431,7 +426,9 @@ if __name__ == "__main__":
             ),
         ]
     )
-    ibm_wrong_subject_crl = createCRL(ibm_wrong_subject_pkey, ibm_wrong_subject_subject, [555])
+    ibm_wrong_subject_crl = createCRL(
+        ibm_wrong_subject_pkey, ibm_wrong_subject_subject, [555]
+    )
     ibm_wrong_subject_crt = createCert(
         pkey=ibm_wrong_subject_pkey,
         subject=ibm_wrong_subject_subject,
@@ -469,7 +466,6 @@ if __name__ == "__main__":
         t=CertType.SIGNING_CERT,
     )
 
-
     def host_subj():
         return x509.Name(
             [
@@ -487,14 +483,13 @@ if __name__ == "__main__":
             ]
         )
 
-
     # create host certificate
     host_pkey = getPrivKey("host.key", createEcKeyPair)
     host_subject = host_subj()
     host_crt = createCert(
         pkey=host_pkey,
         subject=host_subject,
-        issuer_crt=ibm_crt,
+        issuer_crt=ibm_pougkeepsie_crt,
         issuer_pkey=ibm_pkey,
         crl_uri=MOCKUP_CRL_DIST + "ibm.crl",
         t=CertType.HOST_CERT,
@@ -502,7 +497,7 @@ if __name__ == "__main__":
     host_crt_expired = createCert(
         pkey=host_pkey,
         subject=host_subject,
-        issuer_crt=ibm_crt,
+        issuer_crt=ibm_pougkeepsie_crt,
         issuer_pkey=ibm_pkey,
         crl_uri=MOCKUP_CRL_DIST + "ibm.crl",
         t=CertType.HOST_CERT,
@@ -512,7 +507,7 @@ if __name__ == "__main__":
     host_uri_na_crt = createCert(
         pkey=host_pkey,
         subject=host_subject,
-        issuer_crt=ibm_crt,
+        issuer_crt=ibm_pougkeepsie_crt,
         issuer_pkey=ibm_pkey,
         crl_uri=MOCKUP_CRL_DIST + "notavailable",
         t=CertType.HOST_CERT,
@@ -523,7 +518,7 @@ if __name__ == "__main__":
     host_crt = createCert(
         pkey=host_pkey,
         subject=host_subject,
-        issuer_crt=ibm_crt,
+        issuer_crt=ibm_pougkeepsie_crt,
         issuer_pkey=ibm_pkey,
         crl_uri=MOCKUP_CRL_DIST + "ibm.crl",
         t=CertType.HOST_CERT,
@@ -534,35 +529,48 @@ if __name__ == "__main__":
     host_rev_crt = createCert(
         pkey=host_rev_pkey,
         subject=host_rev_subject,
-        issuer_crt=ibm_crt,
+        issuer_crt=ibm_pougkeepsie_crt,
         issuer_pkey=ibm_pkey,
         crl_uri=MOCKUP_CRL_DIST + "ibm.crl",
         t=CertType.HOST_CERT,
     )
 
     # some IBM revocation lists
-    ibm_crl = createCRL(ibm_pkey, ibm_subject, [555, host_rev_crt.serial_number])
+    ibm_poughkeepsie_crl = createCRL(
+        ibm_pkey, ibm_subject_poughkeepsie, [555, host_rev_crt.serial_number]
+    )
+    ibm_armonk_crl = createCRL(
+        ibm_pkey, ibm_subject_armonk, [555, host_rev_crt.serial_number]
+    )
+
     ibm_outdated_early_crl = createCRL(
         ibm_pkey,
-        ibm_subject,
+        ibm_subject_poughkeepsie,
         [],
         last_update=datetime.datetime.today() + 1000 * 365 * ONE_DAY,
         next_update=datetime.datetime.today() + 1001 * 365 * ONE_DAY,
     )
     ibm_outdated_late_crl = createCRL(
         ibm_pkey,
-        ibm_subject,
+        ibm_subject_poughkeepsie,
         [],
         last_update=datetime.datetime.today() - 2 * 365 * ONE_DAY,
         next_update=datetime.datetime.today() - 1 * 365 * ONE_DAY,
     )
-    ibm_wrong_issuer_crl = createCRL(ibm_pkey, inter_ca_subject, [])
+    ibm_wrong_issuer_priv_key_crl = createCRL(
+        ibm_pkey, inter_ca_subject, [], authid=False
+    )
     ibm_invalid_hash_crl = createCRL(
-        inter_ca_pkey, ibm_subject, [555, host_crt.serial_number]
+        inter_ca_pkey,
+        ibm_subject_poughkeepsie,
+        [555, host_crt.serial_number],
+        authid=False,
     )
 
     # create host certificate issued by a non-valid signing key
-    host_invalid_signing_key_pkey = getPrivKey("host_invalid_signing_key.key", createEcKeyPair)
+    host_invalid_signing_key_pkey = getPrivKey(
+        "host_invalid_signing_key.key", createEcKeyPair
+    )
     host_invalid_signing_key_subject = x509.Name(
         [
             x509.NameAttribute(NameOID.COUNTRY_NAME, u"US"),
@@ -606,12 +614,36 @@ if __name__ == "__main__":
     host2_crt = createCert(
         pkey=host2_pkey,
         subject=host2_subject,
-        issuer_crt=ibm_crt,
+        issuer_crt=ibm_pougkeepsie_crt,
         issuer_pkey=ibm_pkey,
         crl_uri=MOCKUP_CRL_DIST + "ibm.crl",
         t=CertType.HOST_CERT,
     )
 
+    host_armonk_pkey = getPrivKey("host.key", createEcKeyPair)
+    host_armonk_subject = x509.Name(
+        [
+            x509.NameAttribute(NameOID.COUNTRY_NAME, u"US"),
+            x509.NameAttribute(
+                NameOID.ORGANIZATION_NAME,
+                u"International Business Machines Corporation",
+            ),
+            x509.NameAttribute(
+                NameOID.COMMON_NAME, u"International Business Machines Corporation"
+            ),
+            x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, u"New York"),
+            x509.NameAttribute(NameOID.LOCALITY_NAME, u"Armonk"),
+            x509.NameAttribute(NameOID.ORGANIZATIONAL_UNIT_NAME, u"IBM Z Host Key"),
+        ]
+    )
+    host_armonk_crt = createCert(
+        pkey=host_armonk_pkey,
+        subject=host_armonk_subject,
+        issuer_crt=ibm_armonk_crt,
+        issuer_pkey=ibm_pkey,
+        crl_uri=MOCKUP_CRL_DIST + "ibm_armonk.crl",
+        t=CertType.HOST_CERT,
+    )
 
     fake_host_pkey = getPrivKey("fake_host.key", createEcKeyPair)
     fake_host_subject = x509.Name(
@@ -637,7 +669,7 @@ if __name__ == "__main__":
         crl_uri=MOCKUP_CRL_DIST + "fake_ibm.crt",
         t=CertType.HOST_CERT,
     )
-    #TODO DER chain
+    # TODO DER chain
 
     # store CA
     with open("root_ca.crt", "wb") as f:
@@ -673,22 +705,26 @@ if __name__ == "__main__":
 
     # store IBM
     with open("ibm.crt", "wb") as f:
-        f.write(ibm_crt.public_bytes(serialization.Encoding.PEM))
+        f.write(ibm_pougkeepsie_crt.public_bytes(serialization.Encoding.PEM))
+    with open("ibm_armonk.crt", "wb") as f:
+        f.write(ibm_armonk_crt.public_bytes(serialization.Encoding.PEM))
     with open("ibm_rev.crt", "wb") as f:
         f.write(ibm_rev_crt.public_bytes(serialization.Encoding.PEM))
     with open("ibm_expired.crt", "wb") as f:
         f.write(ibm_expired_crt.public_bytes(serialization.Encoding.PEM))
     with open("ibm.crl", "wb") as f:
-        f.write(ibm_crl.public_bytes(serialization.Encoding.PEM))
+        f.write(ibm_poughkeepsie_crl.public_bytes(serialization.Encoding.PEM))
+    with open("ibm_armonk.crl", "wb") as f:
+        f.write(ibm_armonk_crl.public_bytes(serialization.Encoding.PEM))
     with open("ibm.chained.crt", "wb") as f:
-        f.write(ibm_crl.public_bytes(serialization.Encoding.PEM))
-        f.write(ibm_crt.public_bytes(serialization.Encoding.PEM))
+        f.write(ibm_poughkeepsie_crl.public_bytes(serialization.Encoding.PEM))
+        f.write(ibm_pougkeepsie_crt.public_bytes(serialization.Encoding.PEM))
     with open("ibm_outdated_early.crl", "wb") as f:
         f.write(ibm_outdated_early_crl.public_bytes(serialization.Encoding.PEM))
     with open("ibm_outdated_late.crl", "wb") as f:
         f.write(ibm_outdated_late_crl.public_bytes(serialization.Encoding.PEM))
     with open("ibm_wrong_issuer.crl", "wb") as f:
-        f.write(ibm_wrong_issuer_crl.public_bytes(serialization.Encoding.PEM))
+        f.write(ibm_wrong_issuer_priv_key_crl.public_bytes(serialization.Encoding.PEM))
     with open("ibm_invalid_hash.crl", "wb") as f:
         f.write(ibm_invalid_hash_crl.public_bytes(serialization.Encoding.PEM))
     with open("ibm_wrong_subject.crt", "wb") as f:
@@ -719,6 +755,10 @@ if __name__ == "__main__":
     with open("host2.crt", "wb") as f:
         f.write(host2_crt.public_bytes(serialization.Encoding.PEM))
 
+    # store host_armonk
+    with open("host_armonk.crt", "wb") as f:
+        f.write(host_armonk_crt.public_bytes(serialization.Encoding.PEM))
+
     # store fake host
     with open("fake_host.crt", "wb") as f:
         f.write(fake_host_crt.public_bytes(serialization.Encoding.PEM))
@@ -728,6 +768,6 @@ if __name__ == "__main__":
 
     # store a DER cert and crl
     with open("der.crt", "wb") as f:
-        f.write(ibm_crt.public_bytes(serialization.Encoding.DER))
+        f.write(ibm_pougkeepsie_crt.public_bytes(serialization.Encoding.DER))
     with open("der.crl", "wb") as f:
-        f.write(ibm_crl.public_bytes(serialization.Encoding.DER))
+        f.write(ibm_poughkeepsie_crl.public_bytes(serialization.Encoding.DER))

rust/pv/tests/assets/cert/host.crt

@@ -1,30 +1,29 @@
 -----BEGIN CERTIFICATE-----
-MIIFFDCCAvygAwIBAgIUO+SNGBgRvkmR/lKiZhiN4l4zS70wDQYJKoZIhvcNAQEN
+MIIE+DCCAuCgAwIBAgIUBSLhuGTvxPbggG70ISL2R6DDGZcwDQYJKoZIhvcNAQEN
 BQAwgcwxCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
 ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
 IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
 azEVMBMGA1UEBwwMUG91Z2hrZWVwc2llMScwJQYDVQQLDB5JQk0gWiBIb3N0IEtl
-eSBTaWduaW5nIFNlcnZpY2UwIBcNMjMwMzI5MDkwNDQ4WhgPMjM4NzEyMzEwOTA0
-NDhaMIG2MQswCQYDVQQGEwJVUzE0MDIGA1UECgwrSW50ZXJuYXRpb25hbCBCdXNp
+eSBTaWduaW5nIFNlcnZpY2UwIBcNMjQwMzIxMTQ1MjM5WhgPMjM4ODEyMjMxNDUy
+MzlaMIG2MQswCQYDVQQGEwJVUzE0MDIGA1UECgwrSW50ZXJuYXRpb25hbCBCdXNp
 bmVzcyBNYWNoaW5lcyBDb3Jwb3JhdGlvbjE0MDIGA1UEAwwrSW50ZXJuYXRpb25h
 bCBCdXNpbmVzcyBNYWNoaW5lcyBDb3Jwb3JhdGlvbjERMA8GA1UECAwITmV3IFlv
 cmsxDzANBgNVBAcMBkFybW9uazEXMBUGA1UECwwOSUJNIFogSG9zdCBLZXkwgZsw
-EAYHKoZIzj0CAQYFK4EEACMDgYYABAF2iBzYS4tt5xI8fpAO33jn97aEmZFGsSY7
-qLhshEfwirbUacKxKO2eHDUBWAWs09MCM9ORIvfi+KocKxR7eIO0BgDDRVbCXPkv
-Kc5mvUQRTWt7PHjhOj+QvbkAQPaHblJi93imGpN9GzSALrJX404Gct1fKjR63aoo
-IDUJKnDDXC55c6OBhzCBhDAyBgNVHR8EKzApMCegJaAjhiFodHRwOi8vMTI3LjAu
-MC4xOjEyMzQvY3JsL2libS5jcmwwDgYDVR0PAQH/BAQDAgMIMB8GA1UdIwQYMBaA
-FN6M1/Do0NgBB3F9b9loWSA+sGd8MB0GA1UdDgQWBBR6ESQ+J+iXQe0a/KZ2+N+Z
-8a9SZjANBgkqhkiG9w0BAQ0FAAOCAgEAVWJHoCxxkqh7b+y93PY4KPy4jJC4gN1S
-dAPqttD/yteJ/4mbVel1/KNSoQBk5EpJmRqeBwHCgGJaT/TxYXNw/b8mRPxe/xbb
-wieZMqlSmH028UjYDku1eM0IgHISgoCesIR95D5iAOWbMMVUwIHIHTfmhK7DmZVe
-SPf7RIkctrpYxZh0Gw8KLZO6Mfy/9tq3dps0A7KS6jjdrF+M9LavPGwFvtfvRMTi
-rdteByO2saGAKDvrjtievwlWCNBJlKV1arW9krN7eqJY5YO6eRbX6UjuhbPRgjte
-eZ4jL121TBJaKZU7Q/lvYHIWfzstwQdiem2Ua1GyiiEvPZrQlmqQ3gDBtwJQGB4Q
-2myP7MY7THiKObjaB8qRsVxKM78ktwAtAYSZv7gZlmSJ/uTMzDV5D2TQxqs7zwCj
-sV+psUn4nvh58xP+DW+MYbF/Cpmzvul9FjMKBs270vE1q+gMot27rbQHRRJ4lVN5
-khiG6Oi6blVkPKExIVIiaZ9diXK6NhtWp15PWljNiDxZO+zpkeuw7cKLn/idzmvP
-Gcj6m7DqcdsSIHNKbR5iM2VuDhg/j8uBD3uF2Wlymp31TBQgdYWSihJpwZKHNqJD
-uq9SmegwI5gYg64KwABZM9hGbl/krXt/0CeCR5HRc+fthanKx/tO2tbCuVT3FR5J
-XpKNUy1D78o=
+EAYHKoZIzj0CAQYFK4EEACMDgYYABAHGO0MnpQa6Q2IxgqV7AGwd3OwBnYOJjYJF
+hzrwY+wQacmJjWeNyHahBCxu4bM8vDr70SF5vZFrWpcWpc9JTY5AagFCFDqIfSvL
+J6lKJuCog5RfMsWJpG2j/MnK7MxG+Ph0R+ItmLFbWFxCV5YOT43olhwYZr/pd9qH
+PAD96UEDM8JanKNsMGowGAYDVR0fBBEwDzANoAugCYYHaWJtLmNybDAOBgNVHQ8B
+Af8EBAMCAwgwHwYDVR0jBBgwFoAUw4weXbTWAZisD86gZSugZ6V1FNkwHQYDVR0O
+BBYEFL4m5UxVbUdEl9yg4sjiWKO/EAxyMA0GCSqGSIb3DQEBDQUAA4ICAQBwaPG5
+Mg3iKtxR6ncteH+YmtMHW4/wB/341pTKFsKBYsMNWuCC5AKbNrshCNbFbctqhLrB
+LmEpmza3/Pk6izO4AozHNl0tRec/HnQr2gonfI48HBDRiV2f40x0gJG9gGCiJy7o
+6iKZDYUnjfnhXVC67RwLMEiIKbeOAWQ9hHqegUjYdaaIlhyiHLMuWMceidvG76nN
+2eyJUNEouT4+UvquD2oqSitB3ZLhWRqPOQn57ME1b0QYF240PN8r21YtzPmSI+s/
+ej04EcQZrlJId6GtU7YwD1767hVw84v/QjPbMqnYQbxX8n3IvOf541rQ0UdjBFc9
+UhbnSn32IGFrRlL1y3MPBF6hLPcpW4P0QrUijc6gZ+x6SNFho8n+dk53F7RvMi1l
+SLgJl7x8pUeqBn5QKMcYYsZG39oZmQj4xHjAABx2hRWayDscvROiQpvLHRtLVmk7
++hq4Q/jalc2cNHZSwLX6Tv5P+8waTnXg8YNEHeAAgcw1lD+uw5HgusjGD4USE7Hq
+Q6EDGzC+Ny3u2+35XWbNaKWVthtKAIcZ9B4LjdJXeQFGcOMr6yV5rKfOFQwXo8bS
+rNy57tiva8KM2weSfRil4f146Rsb3TJzUdlkaN+NVIY0YImiC+rR0qa6Iv6JCio1
+F2lu8m/aRHQQF5J5fD7ge6v7F2D6K3qT9tTlrw==
 -----END CERTIFICATE-----

rust/pv/tests/assets/cert/host.key

@@ -0,0 +1,8 @@
+-----BEGIN PRIVATE KEY-----
+MIHuAgEAMBAGByqGSM49AgEGBSuBBAAjBIHWMIHTAgEBBEIA8rPNC6rxZR+GxSxb
+qWRreFGnWRQGd22nHWKAvQmrA5GlXTtWQMoL8il9Jb1OnrQPPo620nQpzA1GXo4U
+BUqgYoShgYkDgYYABAHGO0MnpQa6Q2IxgqV7AGwd3OwBnYOJjYJFhzrwY+wQacmJ
+jWeNyHahBCxu4bM8vDr70SF5vZFrWpcWpc9JTY5AagFCFDqIfSvLJ6lKJuCog5Rf
+MsWJpG2j/MnK7MxG+Ph0R+ItmLFbWFxCV5YOT43olhwYZr/pd9qHPAD96UEDM8Ja
+nA==
+-----END PRIVATE KEY-----

rust/pv/tests/assets/cert/host2.crt

@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIE+DCCAuCgAwIBAgIUC3KzCH9KUb8ZaY6J/97gqebLoIYwDQYJKoZIhvcNAQEN
+BQAwgcwxCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
+ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
+IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
+azEVMBMGA1UEBwwMUG91Z2hrZWVwc2llMScwJQYDVQQLDB5JQk0gWiBIb3N0IEtl
+eSBTaWduaW5nIFNlcnZpY2UwIBcNMjQwMzIxMTQ1MjM5WhgPMjM4ODEyMjMxNDUy
+MzlaMIG2MQswCQYDVQQGEwJVUzE0MDIGA1UECgwrSW50ZXJuYXRpb25hbCBCdXNp
+bmVzcyBNYWNoaW5lcyBDb3Jwb3JhdGlvbjE0MDIGA1UEAwwrSW50ZXJuYXRpb25h
+bCBCdXNpbmVzcyBNYWNoaW5lcyBDb3Jwb3JhdGlvbjERMA8GA1UECAwITmV3IFlv
+cmsxDzANBgNVBAcMBkFybW9uazEXMBUGA1UECwwOSUJNIFogSG9zdCBLZXkwgZsw
+EAYHKoZIzj0CAQYFK4EEACMDgYYABAE3KDrdCdVeBV34NicA8AoP7hItcwxgXHOQ
+F+V02N6b5AR7w3YDHE/JSzSoZZIYiqdy8SmeD5GtwHLV8tLQ8xnadgHT0BesGS02
+w0H5foGzzZOHZW3AfbdH4MpssR4Bf1jqL0jw6eV+oiMStDuZ44zri7PFjvVByt6M
+oeSvh5qAXCQG/6NsMGowGAYDVR0fBBEwDzANoAugCYYHaWJtLmNybDAOBgNVHQ8B
+Af8EBAMCAwgwHwYDVR0jBBgwFoAUw4weXbTWAZisD86gZSugZ6V1FNkwHQYDVR0O
+BBYEFL8FyjCu1iRcjwx4pzfo+VIQ5NdbMA0GCSqGSIb3DQEBDQUAA4ICAQASxSXu
+RxNw/kSwqedNq9jOTHb5FATNykBIVSuXS9BB2qkjcTVDXNnlsSBrPL/CumRp/TFD
+5VsB2rLhESmUrpghQrODeFvyFE52yVhxvcNCyjz7yIQZvc4qofMQMsg3o0rSqp2s
+lu1PUbcrL2aCG1yxB3isObVqiWaiRdnPxL8aX3Qt6BszlwWUgaFoaH0uZxlgVGKV
+C+dXrn5WkNRVd2ouHSLQE6fIUYIf/TrV+AKu804IEoFRIvMUCqQRUHsj5toKhfDb
+6tl/Xd+EiPCYbnhR2J01I08yxMExvYXfXapY7JJjlWTHKFKaxLoqv++NZRM1bW6s
+uyLWP735Qb+0AmhZ6TfeJM7H77LpQK0WCylaNVJWWjXt9UsnNdirCbp/jpKF8bnG
+2PkjBHKruvCakqw1bDq8eDv9In1Ki+Um4gp7OfjYvcN8zxvGQofgj++UaCy982iX
+WSq14iUyrRDVu8zWghL/F1lUx7ab8UV+OrmZuCALVHZ76YVdwmJXGYll1OBbJbgL
+5xze6p77vKzbgNyABWmR6TlHq/nFDhj9kKirpQaI7WHyOtsGpc7sqd0tT+CeOhNf
+l3xXyFPb6N58aSC2cY0W0Nq6X/mWIgMqHY9lzYLmoLBFFZlIjqWzwyVcajmjrtaK
+rlfs0e9f9DvVV8bMTXFMUBlWrmYDrROKpYLqhg==
+-----END CERTIFICATE-----

rust/pv/tests/assets/cert/host2.key

@@ -0,0 +1,8 @@
+-----BEGIN PRIVATE KEY-----
+MIHuAgEAMBAGByqGSM49AgEGBSuBBAAjBIHWMIHTAgEBBEIAQNfN5BLLLAdhlwGk
+Ve8w2t+9x4LWR9st6CLCYHnTgc2gr4+HqgcMwmNuj3cA8ENBvIShUnHkX2E+9CyP
+3W1ZN8OhgYkDgYYABAE3KDrdCdVeBV34NicA8AoP7hItcwxgXHOQF+V02N6b5AR7
+w3YDHE/JSzSoZZIYiqdy8SmeD5GtwHLV8tLQ8xnadgHT0BesGS02w0H5foGzzZOH
+ZW3AfbdH4MpssR4Bf1jqL0jw6eV+oiMStDuZ44zri7PFjvVByt6MoeSvh5qAXCQG
+/w==
+-----END PRIVATE KEY-----

rust/pv/tests/assets/cert/host_armonk.crt

@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIE+TCCAuGgAwIBAgIUWlKUd1HKU8R7cjv5NJdWhHzhT5cwDQYJKoZIhvcNAQEN
+BQAwgcYxCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
+ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
+IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
+azEPMA0GA1UEBwwGQXJtb25rMScwJQYDVQQLDB5JQk0gWiBIb3N0IEtleSBTaWdu
+aW5nIFNlcnZpY2UwIBcNMjQwMzIxMTQ1MjM5WhgPMjM4ODEyMjMxNDUyMzlaMIG2
+MQswCQYDVQQGEwJVUzE0MDIGA1UECgwrSW50ZXJuYXRpb25hbCBCdXNpbmVzcyBN
+YWNoaW5lcyBDb3Jwb3JhdGlvbjE0MDIGA1UEAwwrSW50ZXJuYXRpb25hbCBCdXNp
+bmVzcyBNYWNoaW5lcyBDb3Jwb3JhdGlvbjERMA8GA1UECAwITmV3IFlvcmsxDzAN
+BgNVBAcMBkFybW9uazEXMBUGA1UECwwOSUJNIFogSG9zdCBLZXkwgZswEAYHKoZI
+zj0CAQYFK4EEACMDgYYABAHGO0MnpQa6Q2IxgqV7AGwd3OwBnYOJjYJFhzrwY+wQ
+acmJjWeNyHahBCxu4bM8vDr70SF5vZFrWpcWpc9JTY5AagFCFDqIfSvLJ6lKJuCo
+g5RfMsWJpG2j/MnK7MxG+Ph0R+ItmLFbWFxCV5YOT43olhwYZr/pd9qHPAD96UED
+M8JanKNzMHEwHwYDVR0fBBgwFjAUoBKgEIYOaWJtX2FybW9uay5jcmwwDgYDVR0P
+AQH/BAQDAgMIMB8GA1UdIwQYMBaAFMOMHl201gGYrA/OoGUroGeldRTZMB0GA1Ud
+DgQWBBS+JuVMVW1HRJfcoOLI4lijvxAMcjANBgkqhkiG9w0BAQ0FAAOCAgEACPbD
+hFuibNamlcpnVG7mgnO56RB/K5otOCGS0hbR3OFUGY1ZDQ++M44OF/b+eNYHgjsr
+ER4r2cne3qBjOArFj/toEDGM2l/DFWDnpOvh1ZItJjpQe07OGn+KpTLf/ZB0Q5D7
+jV/ddjJ0GGyxessjfUvmCT4BVWn1bXKJFSgujic7lgMf8WBGwW+WW3eZecYsh/Cn
+rHWfQYqtvzB1uM89bwZwN+lvHz/QHTreAShDAiCY9M31cemvUvC58z8jPKngFhuf
+C7ZMUXbzu2jYWo3EowzvcRpO1KqlLfNHjGLbaBaZWP2ocK2IUTrsAbr7PTdcAqjX
+TRIds4JlbidA8OziEXFTcM2xShS6WISsO+9JXk5Xxc3+xscjSamHTMwRm2LaKjrr
+d8mOxMs4/5547CBsBFMqu98tiD18K0yqdJiJJRDDOvqVeCvDE6y/pzKaSHIIyA0P
+ATnjQzvgqbcwLrdoJ4WNdTpZieoisUR0oMAKUViPwd0xStzNX6K89PSd5c0Bqbhj
+TwCpaT+DfcvlWk4wqEa9rLn+Su1SUfMSD2dITynLW0UexiKPHZ5epOPu5ho6cOk/
+fe/N1cX7SyOjhErWLwqr974YM0EPiR6f5lNooYXMPbatq8lcG0gpEg5pggHhsLiY
+LGfvu2jQJKGnrBYM3IcRGUsc+VZ6CNTJjaIIbGg=
+-----END CERTIFICATE-----

rust/pv/tests/assets/cert/host_crt_expired.crt

@@ -1,30 +1,29 @@
 -----BEGIN CERTIFICATE-----
-MIIFEjCCAvqgAwIBAgIUMXh4o6xcPRTKpYDr+YgZnmWeatMwDQYJKoZIhvcNAQEN
+MIIE9jCCAt6gAwIBAgIUSpwJMAovpO3Z9SuY7Zw+/pv3bLEwDQYJKoZIhvcNAQEN
 BQAwgcwxCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
 ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
 IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
 azEVMBMGA1UEBwwMUG91Z2hrZWVwc2llMScwJQYDVQQLDB5JQk0gWiBIb3N0IEtl
-eSBTaWduaW5nIFNlcnZpY2UwHhcNMjEwMzI5MTEwNDQ4WhcNMjIwMzI5MTEwNDQ4
+eSBTaWduaW5nIFNlcnZpY2UwHhcNMjIwMzIyMTU1MjM5WhcNMjMwMzIyMTU1MjM5
 WjCBtjELMAkGA1UEBhMCVVMxNDAyBgNVBAoMK0ludGVybmF0aW9uYWwgQnVzaW5l
 c3MgTWFjaGluZXMgQ29ycG9yYXRpb24xNDAyBgNVBAMMK0ludGVybmF0aW9uYWwg
 QnVzaW5lc3MgTWFjaGluZXMgQ29ycG9yYXRpb24xETAPBgNVBAgMCE5ldyBZb3Jr
 MQ8wDQYDVQQHDAZBcm1vbmsxFzAVBgNVBAsMDklCTSBaIEhvc3QgS2V5MIGbMBAG
-ByqGSM49AgEGBSuBBAAjA4GGAAQBdogc2EuLbecSPH6QDt945/e2hJmRRrEmO6i4
-bIRH8Iq21GnCsSjtnhw1AVgFrNPTAjPTkSL34viqHCsUe3iDtAYAw0VWwlz5LynO
-Zr1EEU1rezx44To/kL25AED2h25SYvd4phqTfRs0gC6yV+NOBnLdXyo0et2qKCA1
-CSpww1wueXOjgYcwgYQwMgYDVR0fBCswKTAnoCWgI4YhaHR0cDovLzEyNy4wLjAu
-MToxMjM0L2NybC9pYm0uY3JsMA4GA1UdDwEB/wQEAwIDCDAfBgNVHSMEGDAWgBTe
-jNfw6NDYAQdxfW/ZaFkgPrBnfDAdBgNVHQ4EFgQUehEkPifol0HtGvymdvjfmfGv
-UmYwDQYJKoZIhvcNAQENBQADggIBAEsSd5vd7Vk1y1YsE4eWkrBrMElYa3/O6G2Q
-oMZFo2mzzDH50NBEwYG4K+SjEmqJbAErtNHsAcJLWlvORiNoBmPcB6FEMifgCvuZ
-zbSEiL/tt8XLI1M04DdKjVZ6AIrdhMKPz/AaRycnlHjbq0R0fEJP/SnWxtGnHewB
-QGM8TDGCzXrwXsOr50soxQ+cbXFJ6eQyGrtNP0eyJ7kkIrz6+SJ0dQPXxoZpdtfY
-XEv1OagX0tAuDUG26do6MjwC1qiDKoLdkxSFRkCvyRHqFapKlLhzBMrLhQ+Hl6E/
-kD5ORD2nMvTHcHWbjb7Mr6tcxKG+7CcJO0hYJbdfNCcKYc3EmE49wazSTBKvWfJp
-XObVEGeM/11cdcg6Li1jw/JrrexEeQpjgoNuAgGKRmxzJBOCPNkU8jGs5QEqFCyw
-fpl7BA+ydW2/zAvcr7mZZgyK4KiRTdK5VTGfXuwTv+Q3hsE0CZ6L+byNCZajyGzs
-xq9ydh2G4kIlWFzs+2gSxQWYRiOGt6W7FVdiPYOnAVgzmRJdfR1qVrWZTGbPxJbX
-1O3qYBPQE2tU8xsyl/HuikGProda2xwfTjmRhr7DPYyF75nGPvtGm6vwBBcWm+xl
-jI0a/dHqE5MR6acOrXYNSFflPcfd04vJ87Ajx/wFr0Glo/8LWtzMp0nFpvif9LDX
-3sGEtRA1
+ByqGSM49AgEGBSuBBAAjA4GGAAQBxjtDJ6UGukNiMYKlewBsHdzsAZ2DiY2CRYc6
+8GPsEGnJiY1njch2oQQsbuGzPLw6+9Eheb2Ra1qXFqXPSU2OQGoBQhQ6iH0ryyep
+SibgqIOUXzLFiaRto/zJyuzMRvj4dEfiLZixW1hcQleWDk+N6JYcGGa/6XfahzwA
+/elBAzPCWpyjbDBqMBgGA1UdHwQRMA8wDaALoAmGB2libS5jcmwwDgYDVR0PAQH/
+BAQDAgMIMB8GA1UdIwQYMBaAFMOMHl201gGYrA/OoGUroGeldRTZMB0GA1UdDgQW
+BBS+JuVMVW1HRJfcoOLI4lijvxAMcjANBgkqhkiG9w0BAQ0FAAOCAgEAd9NdTLDK
+fWPdOg78c+CaG2XVnIzBy6niur4vM1DPJYbwabTYbpJM2jtevMo3h96jCd6AfHzv
+cFZ1BzpYsWtjbDFhiqowmKnlFlOIoIDXCaG7vBvDWc4iWGG9PHMWEouSQWxg77bZ
+A8l7+K0VdRWYCqwxxClK8oK3PqGyGqELRDWwlBb0kRi9XRmB+2BjOdZOQvmGka/R
+l8hZWHTs+SPHZ+ySiJn55/w7gN/LCJs1XX70jPrzu01lDPTqVIrGKBtWBMKFKR7g
+A4r3EThfj85Xq1T45rvD0ozlkyVmdMtSk3z+fKCt5+qEHAu52kq2Ps7xQviAYkIK
+f+yNf1a/Ly79QoqEibRXuKMk/oWoqv7f5vT5HqoWEWZFIYbdbYTBIwkw3mHwZRZx
+CcyiukHw2W/ZwM6p60gXWZwrQxwVkdhxWnAHrAToL6O8M9Fk4aVWUkFNjqVUjTWS
+HLCxv8mCPujXIneqXyiJOpAPKu2kjmoFwfisjevNUmO5EqUHUba98Ne7rdiWweP3
+nwcBBKIQ2MVZ/lPqfPtqFOHqBzCbqozVw1HzE2/ImnYsK8SGqwBnSJyTt+WjM/8S
+4ulkjVDIwWFwUkOWjM2yorp3u2tFJF2sMv+3AR3mp6aDjF7sCzYpLaZag6oDmwOF
+nR+VwEbTC8gnl21swWSjtUC8I0EidfxzCpc=
 -----END CERTIFICATE-----

rust/pv/tests/assets/cert/host_invalid_signing_key.crt

@@ -1,30 +1,29 @@
 -----BEGIN CERTIFICATE-----
-MIIFHzCCAwegAwIBAgIUBphLhhHJL2K96bK/cfgBk0d+7gkwDQYJKoZIhvcNAQEN
+MIIFAzCCAuugAwIBAgIUELm+ubD3lNPrFxtCj86wMh7lYEcwDQYJKoZIhvcNAQEN
 BQAwgckxCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
 ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
 IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
 azEVMBMGA1UEBwwMUG91Z2hrZWVwc2llMSQwIgYDVQQLDBtLZXkgU2lnbmluZyBT
-ZXJ2aWNlIEludmFsaWQwIBcNMjMwMzI5MDkwNDQ4WhgPMjM4NzEyMzEwOTA0NDha
+ZXJ2aWNlIEludmFsaWQwIBcNMjQwMzIxMTQ1MjM5WhgPMjM4ODEyMjMxNDUyMzla
 MIG2MQswCQYDVQQGEwJVUzE0MDIGA1UECgwrSW50ZXJuYXRpb25hbCBCdXNpbmVz
 cyBNYWNoaW5lcyBDb3Jwb3JhdGlvbjE0MDIGA1UEAwwrSW50ZXJuYXRpb25hbCBC
 dXNpbmVzcyBNYWNoaW5lcyBDb3Jwb3JhdGlvbjERMA8GA1UECAwITmV3IFlvcmsx
 DzANBgNVBAcMBkFybW9uazEXMBUGA1UECwwOSUJNIFogSG9zdCBLZXkwgZswEAYH
-KoZIzj0CAQYFK4EEACMDgYYABAF709fZwb3pGZWfHLcCG2fLNcvNh6IqPHwfjRYp
-brM5BEE8XoXxcCAXwxo4EAGOcuZBRKP6Ofahek7ppizV8bkPMQDCIgNq2N8mwPFO
-99CbyrZs4ZMeAWWWPJiHXUHbWQq4ko8w4UUT7nUIgdHQwWM6TdZml8ke+LE9Jxtx
-h9KkfCPi/aOBlTCBkjBABgNVHR8EOTA3MDWgM6Axhi9odHRwOi8vMTI3LjAuMC4x
-OjEyMzQvY3JsL2libV93cm9uZ19zdWJqZWN0LmNybDAOBgNVHQ8BAf8EBAMCAwgw
-HwYDVR0jBBgwFoAU+jIyiVonTYe6GuSPiAkxA65qou0wHQYDVR0OBBYEFJdEECIf
-7UdEf08saThHZDzSfxjhMA0GCSqGSIb3DQEBDQUAA4ICAQBgvREPqqKvAZM3q9pG
-5S6wtUspz1Y1sBD4duPEnMZ7Vf9a1HRPrR4vc5ncFIcyS/U/UusvWgFMYoa6WIZR
-l4OqRplKF1pwCaQ2F/8OdGMV37iUqZuN6V/GggbFXgMFK1dH29T6h4VtoKC9yScQ
-ToHQLuz4ymkd2BwxYix19M6QwdrqomjJb2/zrc7pvMZ0k8KKYi/wt6tlz7FDvsxF
-VSDf29gm98kfDJfzPfAC5D93YruAohsP8SakVdA2/YbTkDfImT8ggSnsE83upSD6
-ssjKPPNRunLeCKLb55/Ikcok1iyGhfdmkJvdIHSEvyNp0p7mrohz6l748xdKkKNt
-9hOzsfNjThq3zp97ND7M+knqNuzsZIkcV/OUdxNBootIrJXvfeqpaw++5SfWvf+6
-1dHJQpDU3cXKAQ0/RvvqLC+aPvklk2efuvBKIKP9X4WqcP+l2P19GMaM1SZtr5S5
-OWMxqT6sW5lSX5Smm4rMB3UmLDS0SXxHIIvFEQSABiWb6Y0ibDj8a+YrWVyQNH1K
-fCSNvsW1r03D06q6gp9fxL1hFBLUw9ooi7ewPfNmm3doe2R0TQpE0pWkiRhhjDjJ
-RcIPp+gfYDtt0LcoYVpNdKtLoRPVtO2K3zeU0ezW4PL9Q0tjxh2K/+1+8UEv7nJD
-sFg4nQMeygdSK4w0ZlT8xqXVJw==
+KoZIzj0CAQYFK4EEACMDgYYABAB/2mDXj/QP7fcpxLTNfFfuh/X1Y/RS8XK+Y4v+
+0nisTQhe3MK8BZ7D0bcB872s8EJCYZ1OYr5O2epQgv2hbk4T1wCGKe+Pjf2QHTts
+wXMpPf87R3etF+zWR+CYH+5N5uQhjW9Ueeq7wve3A61e+Atz7IzTKVlM29kT0XvI
+sYtazn6usqN6MHgwJgYDVR0fBB8wHTAboBmgF4YVaWJtX3dyb25nX3N1YmplY3Qu
+Y3JsMA4GA1UdDwEB/wQEAwIDCDAfBgNVHSMEGDAWgBTXVfLQH2D0KccIHhK6M5MR
+TITvtDAdBgNVHQ4EFgQUWdGEEpvjFJ4SNUillC09iBfcTEUwDQYJKoZIhvcNAQEN
+BQADggIBACfZ7+KtT0Hl4Y/JBwCtUqCRRt4kCM5rXqORswkJ6RNmx1OtBHPlkUEI
+E5HrE0dZlaECfqMkOBxhbBqOSpoL/xjz1gDHILWXEbWchuFnU4EAgYvJS7nLAHHO
+swJCEP8VDM3y5lUWni8sXs6ro/H5tAkm260+xbn0BFF99l+M124ZUawB+tDg7E9b
+MNG0eWtfeiZzWBBhoxhQoD03gFADWxTU1EK4JgCl7frsj4PjK7TMKTV/Gd/Bd5l0
+KreFW5orupd3YBqDeUYI6p1l9+uThottwrA4z/POygxvhqgoqNA/+evMWX3wxNza
+ComAmWffB5EJQFEKcpdASwEhyjBMap15GdJVBFGYzXAlksQz7k1fr4h0ebuYtcpb
+dvcDyeIxjsg5XiP32494wogLUjHioi5mwIrGn8/9V6JLRGfKBHnmejHBR/cbMpuv
+rpl0ZZks3bicmBVTKFyj1ORRGX1cXsbtCbPBJEmBeR5IOFYBeaQHrqTcaEBz4lWe
+K2OT6ebcqtsCzDSmjsoeAX/CWRVaIzLzMc9SqE8lZ68ajXjbt/59I7EBeOenttO5
+mg9mokwDqoeM0bXyT3qdT4s9fhy0BPgnBqJHKIc9afzV79Iz1uJ/E+TZJ+tzhbAU
+n4fFxIHOdbyaOLCLT0+O74FZCQq8FUUnL9QVY5dXTH2458IUiD20
 -----END CERTIFICATE-----

rust/pv/tests/assets/cert/host_invalid_signing_key.key

@@ -0,0 +1,8 @@
+-----BEGIN PRIVATE KEY-----
+MIHuAgEAMBAGByqGSM49AgEGBSuBBAAjBIHWMIHTAgEBBEIB48Wl8pvlD/o6F7YG
+sFfCXNQRbKbppIrywEBkfNG0VzfXazBOLD41bcdPEBh1111kSYgn46uUVxjabyLp
+BgQthf2hgYkDgYYABAB/2mDXj/QP7fcpxLTNfFfuh/X1Y/RS8XK+Y4v+0nisTQhe
+3MK8BZ7D0bcB872s8EJCYZ1OYr5O2epQgv2hbk4T1wCGKe+Pjf2QHTtswXMpPf87
+R3etF+zWR+CYH+5N5uQhjW9Ueeq7wve3A61e+Atz7IzTKVlM29kT0XvIsYtazn6u
+sg==
+-----END PRIVATE KEY-----

rust/pv/tests/assets/cert/host_rev.crt

@@ -1,30 +1,29 @@
 -----BEGIN CERTIFICATE-----
-MIIFFDCCAvygAwIBAgIUGuqbEx5X1pFQfF4T6kIfdcrUwbMwDQYJKoZIhvcNAQEN
+MIIE+DCCAuCgAwIBAgIUMi8utJhRyr5bbvABnCn/Q9/vJ0kwDQYJKoZIhvcNAQEN
 BQAwgcwxCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
 ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
 IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
 azEVMBMGA1UEBwwMUG91Z2hrZWVwc2llMScwJQYDVQQLDB5JQk0gWiBIb3N0IEtl
-eSBTaWduaW5nIFNlcnZpY2UwIBcNMjMwMzI5MDkwNDQ4WhgPMjM4NzEyMzEwOTA0
-NDhaMIG2MQswCQYDVQQGEwJVUzE0MDIGA1UECgwrSW50ZXJuYXRpb25hbCBCdXNp
+eSBTaWduaW5nIFNlcnZpY2UwIBcNMjQwMzIxMTQ1MjM5WhgPMjM4ODEyMjMxNDUy
+MzlaMIG2MQswCQYDVQQGEwJVUzE0MDIGA1UECgwrSW50ZXJuYXRpb25hbCBCdXNp
 bmVzcyBNYWNoaW5lcyBDb3Jwb3JhdGlvbjE0MDIGA1UEAwwrSW50ZXJuYXRpb25h
 bCBCdXNpbmVzcyBNYWNoaW5lcyBDb3Jwb3JhdGlvbjERMA8GA1UECAwITmV3IFlv
 cmsxDzANBgNVBAcMBkFybW9uazEXMBUGA1UECwwOSUJNIFogSG9zdCBLZXkwgZsw
-EAYHKoZIzj0CAQYFK4EEACMDgYYABABphgYAOqZ4uJPUtVIqaU7UsJgz9+xMmGDq
-V7nFimGmkbmqPLT96jIyN4CWdLzfbxP0xvIklkEoOm1xV07YR2LHHQATNEPISTDH
-7fySZ47QVc5tyECpZVW7JvSvWKA/KiApAbB1ixErfDrqW1nG5IUtEbDYJgtGwPI/
-+I7e9cU2wkA5mKOBhzCBhDAyBgNVHR8EKzApMCegJaAjhiFodHRwOi8vMTI3LjAu
-MC4xOjEyMzQvY3JsL2libS5jcmwwDgYDVR0PAQH/BAQDAgMIMB8GA1UdIwQYMBaA
-FN6M1/Do0NgBB3F9b9loWSA+sGd8MB0GA1UdDgQWBBTECeFXnyfTnFazbR0K9cYk
-lS3O0jANBgkqhkiG9w0BAQ0FAAOCAgEAOjEE4/KdvcJZbloSGLue27FSrhExvUJ3
-tYS3rs2xg3Ua2daCioI00VrwIN2Fjisqvi10Nv6+NWz5w1220AJyjlmPxvWFcPco
-sXLAOWDhi217JaoJ+RzavpOwzhTffEpvPwR6RU4A36vvonc4jm3mWs6F1i5T6YPi
-ZaYuk3CRme6WX012rBhIc+heTGh5ZDwwPmGDMLXdpsu+2+3sCPxUW6eQcOWoXkhJ
-jn+n6mU18JdN5+wU6Lig5uxXnoP1VN8Xog/mmKV4ThVAS8k9iS5wFK4jl27n6XZy
-wfd65WWlm4MMEvKNruj025aSPJp/bcnchBNfnXXPuI5GnYS2cC3TXHd4XT3r3pYn
-qgLoNi+AkxnTnxEv5lg+oE+yTMNxDh4iiYkX96ljamGbUPBvbD7bi3Oc/7EOVra1
-BmCGmcjToEnm0e0it9yyuYwKQ6nTz906W3XzaFB+awnXZcGEMgwwdvdal8+eki/r
-ofT0nO6cuXbbPYc0rSs/2f3WxjDVmQtiVoJ1dPYIrTX/4lbrsYWVS016Y0UcZ/D/
-/qWWWZIyYpzPasTEgGqtwb5WhBvz3RAFTePefFlTzBHhSPk0Tsu4+W7zHpapfZ0M
-0LXT1lGR5WBmur002vbTm4yt7tzdypMbL2i70WGEp4mpRohmBG1m9hYGcelip3iL
-Im6vFBNWpVE=
+EAYHKoZIzj0CAQYFK4EEACMDgYYABAHkrwf4hZ7M5ahoYHT0u1Xgl28qxURcdNmW
+kYDA5u1Y2mGXQq85BakAOyfxl/FF/cBrLm0eLVFpePumqgPna3El1gAs9p2SFwN7
+4MmcLhbwPmGnWmzVrOh9cNS988XYf01E74966r4MKpAGxSNPKDwu4doXFVAYRH/w
+tcgbjlk+Qi3c96NsMGowGAYDVR0fBBEwDzANoAugCYYHaWJtLmNybDAOBgNVHQ8B
+Af8EBAMCAwgwHwYDVR0jBBgwFoAUw4weXbTWAZisD86gZSugZ6V1FNkwHQYDVR0O
+BBYEFG+41urs6GhYzOrJD/MJDWMSrUlvMA0GCSqGSIb3DQEBDQUAA4ICAQAnowYb
+R1qgnpH5FLgkj3LndAAfFmJMlTrNcmtafjaLZHUmxxO1tFjb7vvGgu9LggwwSRoN
+y0Qsu0mywXd/ntEuWDyD735aGtUE9xnmluoj4ILBnln195VuvUoWYjCy0XsGZg6G
+UL8bOaZgbvXQWDcdXfpYnM9C5Uj4mB3LFDdasd7nDv2F9vZlHNkd0uGmZvBco3SX
+GNFETOaY5HjU3jLlCmD74p7G9e//+153R2aXEww3SVVJyRowO7SpwH88DNjl2a6A
+OLWoA3oRrX4rDQI66LYv0RZMDCTvzY+HxOQHXeswosA8D96GhpClb1X0wLZUp6gR
+pLzVzaE8RFnSg52jzjI3ehFIoSK0x9R1KPzKbYDh7Q8Sc5sOSe6r9Q01BdpBOUjp
+iTKhgbUEbcIwcaKLIGeSBe0+Yh1uQpqBtOPectUp9bz+hEUDzG6QMS5VFxAGuZWY
+2iA97jxHsUBEgMBZha7z/hQ68Pst+KaIV/24By8lKm0rWpLSKOXVAW1lWZrlpIcx
+Le8+dmy9/JFJXmmN/pmAEVVsK5dYtVXt6ikVi+LPr/7fCfvt2zk88wiUp8iz5jgQ
+pNYT8MPOMf+yzzoqPXjGmrT5znuHnCg0OSh0u8NILWQPQl8M6KNiI8lzcVBy6Djq
+fmnQlaxP1Ey+wrznWmBu5zesU8uMyRTxIfnEzg==
 -----END CERTIFICATE-----

rust/pv/tests/assets/cert/host_rev.key

@@ -0,0 +1,8 @@
+-----BEGIN PRIVATE KEY-----
+MIHuAgEAMBAGByqGSM49AgEGBSuBBAAjBIHWMIHTAgEBBEIBLz0ExeBJrxd5gA7C
+YFJLVuNd4CPNc/jsOLIMnIbLHSegdOtQn9tief97k5rZdz/MQzWp7rCmsLUYw/fM
+ktUQjJKhgYkDgYYABAHkrwf4hZ7M5ahoYHT0u1Xgl28qxURcdNmWkYDA5u1Y2mGX
+Qq85BakAOyfxl/FF/cBrLm0eLVFpePumqgPna3El1gAs9p2SFwN74MmcLhbwPmGn
+WmzVrOh9cNS988XYf01E74966r4MKpAGxSNPKDwu4doXFVAYRH/wtcgbjlk+Qi3c
+9w==
+-----END PRIVATE KEY-----

rust/pv/tests/assets/cert/host_uri_na.crt

@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIE/TCCAuWgAwIBAgIUPRltRSFZSbucmw20u9TN7WHxG8UwDQYJKoZIhvcNAQEN
+BQAwgcwxCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
+ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
+IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
+azEVMBMGA1UEBwwMUG91Z2hrZWVwc2llMScwJQYDVQQLDB5JQk0gWiBIb3N0IEtl
+eSBTaWduaW5nIFNlcnZpY2UwIBcNMjQwMzIxMTQ1MjM5WhgPMjM4ODEyMjMxNDUy
+MzlaMIG2MQswCQYDVQQGEwJVUzE0MDIGA1UECgwrSW50ZXJuYXRpb25hbCBCdXNp
+bmVzcyBNYWNoaW5lcyBDb3Jwb3JhdGlvbjE0MDIGA1UEAwwrSW50ZXJuYXRpb25h
+bCBCdXNpbmVzcyBNYWNoaW5lcyBDb3Jwb3JhdGlvbjERMA8GA1UECAwITmV3IFlv
+cmsxDzANBgNVBAcMBkFybW9uazEXMBUGA1UECwwOSUJNIFogSG9zdCBLZXkwgZsw
+EAYHKoZIzj0CAQYFK4EEACMDgYYABAHGO0MnpQa6Q2IxgqV7AGwd3OwBnYOJjYJF
+hzrwY+wQacmJjWeNyHahBCxu4bM8vDr70SF5vZFrWpcWpc9JTY5AagFCFDqIfSvL
+J6lKJuCog5RfMsWJpG2j/MnK7MxG+Ph0R+ItmLFbWFxCV5YOT43olhwYZr/pd9qH
+PAD96UEDM8JanKNxMG8wHQYDVR0fBBYwFDASoBCgDoYMbm90YXZhaWxhYmxlMA4G
+A1UdDwEB/wQEAwIDCDAfBgNVHSMEGDAWgBTDjB5dtNYBmKwPzqBlK6BnpXUU2TAd
+BgNVHQ4EFgQUviblTFVtR0SX3KDiyOJYo78QDHIwDQYJKoZIhvcNAQENBQADggIB
+AGlM/E6RfiQV8si38/IieHw2TsZDNKluXA/edGN4d9i5ztIB+G57IgvAR9GBeRTB
+AxANycBGOWy+VXsUij3UgpoK3NiZJ+XvgFYqx0ZVUX3uPmU6R0Ko5cHGmSEVV6KS
+5ToGLqSZdftybGt9NYKg+LGxzIhT15tgUENkOrFVRSlKVn1zAP+sa2vOEtH5aX6S
+ins3hHQBuhGKSR/z2I5IzEVhnx0FJxpFO32QBdmXUdgjlHcpiIy1BaQRTca/U4iJ
+Q+fnzn5UP5v29ftr/PRh0W9rPVeS8ge+vuPC1eriRL4WWnkMFm0QljERqhg48NWk
+zT8mnVn0E3vQ2Y71FKg85ov0Sza8/OpBgAgnoyCDUIp8YD7BrU1viLEoqLtlvsoH
+l/+mU/CnCe5749C6OBppKhdrIRSG8bh6mIeco1ALDNIaqGoUtdhib0f+YKeCc0zC
+MFjvoSranndvwO+z/qdL7Feay8uAjgq1GPNuj/xaEbzrZz0yF2viMXfK62kgwq+W
+ebg2D1FHVuKXQ2q3IXmwcyLOEUScUcEYDsM5eDenoScgIE2FfHvoGOdJVLsQ9U+8
+2HTb7ntvbc6ANCTcnt51s5/PfD7UaHeJiSxRpU6rjxnqKZ2mEjbF/Ha8AjImQrrd
+jpjNgH6H5p7ZQqc/4DGa/Q2B/rfvmn5bAgOhicEKMzm1
+-----END CERTIFICATE-----

rust/pv/tests/assets/cert/ibm.chained.crt

@@ -0,0 +1,59 @@
+-----BEGIN X509 CRL-----
+MIIDfDCCAWQCAQEwDQYJKoZIhvcNAQENBQAwgcwxCzAJBgNVBAYTAlVTMTQwMgYD
+VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
+MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
+cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEVMBMGA1UEBwwMUG91Z2hrZWVwc2ll
+MScwJQYDVQQLDB5JQk0gWiBIb3N0IEtleSBTaWduaW5nIFNlcnZpY2UXDTI0MDMx
+MTE1NTIzOVoYDzIzODgxMjIzMTU1MjM5WjA8MBMCAgIrFw0yNDAzMjAxNTUyMzla
+MCUCFDIvLrSYUcq+W27wAZwp/0Pf7ydJFw0yNDAzMjAxNTUyMzlaoCMwITAfBgNV
+HSMEGDAWgBTDjB5dtNYBmKwPzqBlK6BnpXUU2TANBgkqhkiG9w0BAQ0FAAOCAgEA
+hMmvyXLOtDG7faP93ZqMh061Qms/at5uYz/eAA9CGfS4E+hq2uQaic6gEMWf5NkH
+9xRWB1UM9sLR5Ai/Fn+MqsbeXK+1ommOfYx0KL6J8JihHAlQpGYJXu683dxIB3LL
+ijZ+od5pes5ZIRKtMNaO4+meDG6e5guXDeFNyJaNYqFXOJcy8OIL4O3T840qY1aY
+YcHZs/sNwC/hSAloTeUQ6S+ga/EplzSDumz5VrRsEhVd3wScM1FNeqwMvA4VPUIa
+NOtZJNLJBLhfmetTeO/wb/y3Ekp8sXAf8UJqABczJODSaGc2RwULmxJd2Q5lESpX
+RkfvObqTWgpzpyV/1OhZYDUlXJqiADYnyAsQL8WV2uFQ5fRG7baVDiNYn4uE92Of
+FN7jXmT+7UcHSO5L0VqHS6Ia6j2NammKlbhsAw7dU3uxEgCJvBYlWSY+z9Fs+O1B
+hNU42fL5W7JnoGfqG+LqfDdbG0MG+GMo1rDDcvrEK73F41w7mLmZhfYAZY26xU6Q
+XyLcrG4YfR6FCyOs53zwrKKG9x3ETqY3S0DSSOKTnuvIGZBCSOxGpqdb7pQax6IJ
+PqsM+IzFC1C0Ol0eX1ee734rCHfNP6XEM7ucjBweNUJRrU0Q5CrGGJzEQz0ym/JN
+81f/kQJJosSSc1+j8iDiaKkUgcQ1DWWZLYZgvCkwZcY=
+-----END X509 CRL-----
+-----BEGIN CERTIFICATE-----
+MIIGsTCCBJmgAwIBAgIUMwTHYM3peBjwVRi6iICr6FVn0cMwDQYJKoZIhvcNAQEL
+BQAwgb0xCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
+ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
+IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
+azEPMA0GA1UEBwwGQXJtb25rMR4wHAYDVQQLDBVJQk0gWiBJbnRlcm1lZGlhdGUg
+Q0EwIBcNMjQwMzIxMTQ1MjM4WhgPMjM4ODEyMjMxNDUyMzhaMIHMMQswCQYDVQQG
+EwJVUzE0MDIGA1UECgwrSW50ZXJuYXRpb25hbCBCdXNpbmVzcyBNYWNoaW5lcyBD
+b3Jwb3JhdGlvbjE0MDIGA1UEAwwrSW50ZXJuYXRpb25hbCBCdXNpbmVzcyBNYWNo
+aW5lcyBDb3Jwb3JhdGlvbjERMA8GA1UECAwITmV3IFlvcmsxFTATBgNVBAcMDFBv
+dWdoa2VlcHNpZTEnMCUGA1UECwweSUJNIFogSG9zdCBLZXkgU2lnbmluZyBTZXJ2
+aWNlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAxNqcFB9GSj+nC1PV
+OTIAvzTuo3X7bTbohEPrIDDsEcGyVzQtfagI9vkxhhGLhXxIXrkwEI4u75DeLBdq
+ZR3KFJ3QD+jHW12EWNpmSYu272CEAJeb/SBJaFbh40WbY1BsTP+3zI5QMwVTmCH5
+QqODD+GU0fDSo9Gti0yX4rxOY+54jDC77AhSlU55rYruBoIXVe4CcPUpqzZLgqB2
+cTJ5g7lokGqc6w9pveCznVYGPfcdDt+ePGssOvrfBOJnn6N44tTRAG623BrpctXi
+t3IAhG60y6CqF29BjV0RKOv09nOBiph2a3lAiKYrpAt92BETFB7KSQManUrrvWOD
+mYEcoVkzvrVrB3WnCcHs6lsjQg1FcNrGcDzV9SmX0BIhM+fasxZyHWc08pr3NrRn
+Eks7lRqY+TS8DAeZYJt/2M0Jr32d6Bh+WdyGFFUj6sBPtCaC2VnSkxOgKXeWf/c5
+EUXIQT2YXEkNK9CP8Kqs8IerEIpfceelQReA5QcvNruaJNktWLKJgYTrdLdfOP0u
+s+9JJHWcFH3tv5906CA+Tlm53Dk6SaRc/DB7lu94yTkcSOpxXZnximZi0GcPZYmZ
+TaswE7d8HCPLhks/RkZSV2764Kl08xle65APiWZ4dM24uSyu75Izb4hrwgIA4qyM
+dDVQnI3cu6utmKUPyHoJtH26dr0CAwEAAaOBlTCBkjAdBgNVHR8EFjAUMBKgEKAO
+hgxpbnRlcl9jYS5jcmwwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwEwYD
+VR0lBAwwCgYIKwYBBQUHAwMwHwYDVR0jBBgwFoAU+f7h8O2ttBHtwI4OZnpD9wU0
+9GYwHQYDVR0OBBYEFMOMHl201gGYrA/OoGUroGeldRTZMA0GCSqGSIb3DQEBCwUA
+A4ICAQBfBZZ7ZPkRjRgk+0/7CGam2AAv/GSuma8lOnJ6IpBEUL0D01reRe9NO1Y5
+iXasGZ80e95oC7WtePt1LS2I5rOOb3No0iHcUTm5lZV2M/ObAOwraQLXePCRVgU/
+OQzNhtRoCpqgL80/1Ne+MTHj1yZp2GRKXOdMd39KZoG92JU/h556GQ6reN6WKNs+
+wbFG+JKiRnfvPsul6J5lG4QuObCAZXa0fhcQNUHyWjCGIhMa8AuhkDDlIEOBV1Vx
+T/ixdoFhDIoz0xExFidR5uqYXKZlgzcMZ4JT7x0Vs/YsOIg9z5PNkyjt8Kjrxvqs
+NZ1eYuNNxdXxdJZ2x04y8AzLkLRYntOCks5nEamQtzv0ice1Jg52qNJnMm0Y0U9o
+7BjlWy/pp8dBfIA+FyxsIs62hAE6Z/vuJa1VuWJblrT1MFM48Bh64p1m5uDXAZ9w
+Oy7n6YDpzWKWqn6XNV6FoDSkkwaOwB6bPaqAP1ZvP3BmVhednyYRYY21M2aOmxos
+7rpaW1FHgYV96Dm60rL7XRtOEYZNPSIPDO/Ro1oWs3EFwjLLAWtlK1HdMswlnVDX
+6M+LNCRZA3foNi6xvf7CvPkshtQe3FOfiw/OiPBsYsYREC+90Ml/oeTIsyCaOF6n
+5+dpjCBeOUaxzfeQI4WCrLG6+iQZNXWgBkW/PHaPZTldRWzvdQ==
+-----END CERTIFICATE-----

rust/pv/tests/assets/cert/ibm.crl

@@ -1,20 +1,21 @@
 -----BEGIN X509 CRL-----
-MIIDVzCCAT8CAQEwDQYJKoZIhvcNAQELBQAwgcwxCzAJBgNVBAYTAlVTMTQwMgYD
+MIIDfDCCAWQCAQEwDQYJKoZIhvcNAQENBQAwgcwxCzAJBgNVBAYTAlVTMTQwMgYD
 VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
 MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
 cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEVMBMGA1UEBwwMUG91Z2hrZWVwc2ll
-MScwJQYDVQQLDB5JQk0gWiBIb3N0IEtleSBTaWduaW5nIFNlcnZpY2UXDTIzMDMx
-OTExMDQ0OFoYDzIzODcxMjMxMTEwNDQ4WjA8MBMCAgIrFw0yMzAzMjgxMTA0NDha
-MCUCFBrqmxMeV9aRUHxeE+pCH3XK1MGzFw0yMzAzMjgxMTA0NDhaMA0GCSqGSIb3
-DQEBCwUAA4ICAQCGdm0ls5MXM6MUI0wR7qOitKh3TIfRnCvhSibVPskjlBZaBT01
-F6xaQGyWVR19IzQNn9GxOGMqvRy/oSihznBeA0+e9497IOPXKop/JsypZR101539
-ntVt691ncmctxKnb2nT4dw7AuiLTxMVzdJ/ouXovnPcgSv/r8lwBo1fXxOgQlQLE
-Pi126WFkkgBK7EANnAXiXVWvdM6p67jl/AQGOVHp8MeXowejDdVqKzoU6yyMRDeE
-uEU4QibvH/J8VPLC/A2oh4XTZbJ5rB6u3rz2fFGI03XqSrJJHbNenGVQ2ar5qJeI
-6kHNDIuuwXN+7JPFf8JXdk8L0G88rQsnjrcm0GzQPW/nZ5bN3FA1V139rdOhSBLR
-QgaKzju8Le/Zem317ykOJbC6nDBORmpBVzXYdXA9RMg4PIs3kRVqp/RMiiClz42z
-w8c1khmcH6FO2Q5Z40vq8tmSLhbu6PgGIPIya/OQacgDjDiDGcWGvqzVCWv/6AoL
-em7b5Piu4yznVkEUA2h3LvoigYTJCgHFrQnoIcuM8vx8QkDjXxSHeuy3wTd2l67S
-pZp+jSJPdqWe2PWALJrYuq736E2rZ013eLybHKYOkoJP6ZLewh4gsomO0bpxTL1U
-TjPsJncaAP/gLqHi0QD4+irMlo6Q9YpEIkbp9ScEoVMHRL9A/vBQfUJfZw==
+MScwJQYDVQQLDB5JQk0gWiBIb3N0IEtleSBTaWduaW5nIFNlcnZpY2UXDTI0MDMx
+MTE1NTIzOVoYDzIzODgxMjIzMTU1MjM5WjA8MBMCAgIrFw0yNDAzMjAxNTUyMzla
+MCUCFDIvLrSYUcq+W27wAZwp/0Pf7ydJFw0yNDAzMjAxNTUyMzlaoCMwITAfBgNV
+HSMEGDAWgBTDjB5dtNYBmKwPzqBlK6BnpXUU2TANBgkqhkiG9w0BAQ0FAAOCAgEA
+hMmvyXLOtDG7faP93ZqMh061Qms/at5uYz/eAA9CGfS4E+hq2uQaic6gEMWf5NkH
+9xRWB1UM9sLR5Ai/Fn+MqsbeXK+1ommOfYx0KL6J8JihHAlQpGYJXu683dxIB3LL
+ijZ+od5pes5ZIRKtMNaO4+meDG6e5guXDeFNyJaNYqFXOJcy8OIL4O3T840qY1aY
+YcHZs/sNwC/hSAloTeUQ6S+ga/EplzSDumz5VrRsEhVd3wScM1FNeqwMvA4VPUIa
+NOtZJNLJBLhfmetTeO/wb/y3Ekp8sXAf8UJqABczJODSaGc2RwULmxJd2Q5lESpX
+RkfvObqTWgpzpyV/1OhZYDUlXJqiADYnyAsQL8WV2uFQ5fRG7baVDiNYn4uE92Of
+FN7jXmT+7UcHSO5L0VqHS6Ia6j2NammKlbhsAw7dU3uxEgCJvBYlWSY+z9Fs+O1B
+hNU42fL5W7JnoGfqG+LqfDdbG0MG+GMo1rDDcvrEK73F41w7mLmZhfYAZY26xU6Q
+XyLcrG4YfR6FCyOs53zwrKKG9x3ETqY3S0DSSOKTnuvIGZBCSOxGpqdb7pQax6IJ
+PqsM+IzFC1C0Ol0eX1ee734rCHfNP6XEM7ucjBweNUJRrU0Q5CrGGJzEQz0ym/JN
+81f/kQJJosSSc1+j8iDiaKkUgcQ1DWWZLYZgvCkwZcY=
 -----END X509 CRL-----

rust/pv/tests/assets/cert/ibm.crt

@@ -1,39 +1,38 @@
 -----BEGIN CERTIFICATE-----
-MIIGyzCCBLOgAwIBAgIUeGuWhNwpt9CPzFJ5UJAKfkIlLDcwDQYJKoZIhvcNAQEL
+MIIGsTCCBJmgAwIBAgIUMwTHYM3peBjwVRi6iICr6FVn0cMwDQYJKoZIhvcNAQEL
 BQAwgb0xCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
 ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
 IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
 azEPMA0GA1UEBwwGQXJtb25rMR4wHAYDVQQLDBVJQk0gWiBJbnRlcm1lZGlhdGUg
-Q0EwIBcNMjMwMzI5MDkwNDQ3WhgPMjM4NzEyMzEwOTA0NDdaMIHMMQswCQYDVQQG
+Q0EwIBcNMjQwMzIxMTQ1MjM4WhgPMjM4ODEyMjMxNDUyMzhaMIHMMQswCQYDVQQG
 EwJVUzE0MDIGA1UECgwrSW50ZXJuYXRpb25hbCBCdXNpbmVzcyBNYWNoaW5lcyBD
 b3Jwb3JhdGlvbjE0MDIGA1UEAwwrSW50ZXJuYXRpb25hbCBCdXNpbmVzcyBNYWNo
 aW5lcyBDb3Jwb3JhdGlvbjERMA8GA1UECAwITmV3IFlvcmsxFTATBgNVBAcMDFBv
 dWdoa2VlcHNpZTEnMCUGA1UECwweSUJNIFogSG9zdCBLZXkgU2lnbmluZyBTZXJ2
-aWNlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAsXm4EgSxVmuNsKgo
-sfJNxNQFkdbpCxxyMOuyBFyGKxSwiGl20VWB6itsG+b9NOmAI6D6FPvLPuB/gSq0
-HR5FuSIkmp9AUx6Xi6lVA2L7qdINo1OA4nJKe5hLSHfjWn36DZFrDyoODlDzLJrS
-O4h4QSP1nDSFhk1ilsR1czlvKreXkJw5FsUHRhZGG6idLoK2Ibrne6WsVhPG6WNA
-abuvQFv40cQWcyRoePktG8ImnNF5GDewXwtpzARSQj9jTL/gE77DH78a77J8+H+h
-d5guiBbPZK8gNkPe0CjD0B7tUx/+sByoaSeQffFG4Cnu5JJDqFq9LXPjtlG2nXSB
-Qh6Sc2gzP3jKV+ZcSwQw9AxEQ0ZB/VIPsR8KZKReDDztEpcKxwxlh7bEix/0Y1sv
-zT7/I+m5kufdDG6j3hHHzniKXL4b/WyedSfdnVqIJw82FgPFgyIY6F/0ccLdkhAm
-fLtQJBHc3UyK13l0qVJxhAFdz1Q0zfScBS6qM/Gnbcdc6MY9/bZdIK7E+4op5iAM
-kvQHap7qnArhI8VQ1bcXYlQ6asPj4e10lmzroiBHM4N/Yuxv38tmtUCudSB+EcXi
-EgJIOLmLq2ZACRzug9KPyMXOD/Yxz2wPgs6I3gvrB22w/MfC77wMfEMuQQk4cZel
-TFKosHgLjvcLG+zx5yh5ZVFcNV0CAwEAAaOBrzCBrDA3BgNVHR8EMDAuMCygKqAo
-hiZodHRwOi8vMTI3LjAuMC4xOjEyMzQvY3JsL2ludGVyX2NhLmNybDAMBgNVHRMB
-Af8EAjAAMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNV
-HSMEGDAWgBQRqYdWstn6ntusRZ8LjyPFEicL5TAdBgNVHQ4EFgQU3ozX8OjQ2AEH
-cX1v2WhZID6wZ3wwDQYJKoZIhvcNAQELBQADggIBAEqkZawT89MngrmMTREjYGKZ
-+qrm7uQf9wFiM7H7Xs11OEJ5PkNh4jNnnIsXZxc8rr76x+zLr4F6aI08AQn5QOy9
-JXGIbrMHLebtn198aIOYbxZisbXnBlVO3Xz+k8JLdzsu5zxjjaDY3/a63X2ccStJ
-U53pSqvgJi6/AvMPA1CPazSjxu6na8rYz6d7c/god7OF0qwQ/ePqd4uJOaImm7HH
-CCkwMPYO7UyOWU5CSPMcJ86SGYhvYkoM7wZeJoukK6HlKDI1SRubiTFAx+Hbyk1R
-dyVY9vmIOeUlsGEMgsW836g++dg8efRIbIYbSBLQhUL64lLA6wZJ6/oCtC29aX+o
-UfxcGUROrpZ5Xi4b4sn0vW4rYq65BzlU17x45XsZMh11hX9aPNE4B62Jl2XLjX3P
-Sedu7b/QB6jWpwTAdH96LeLxVepAWiVcFBApBqpu7wxRhCs6M1t3Gh9nvlPE5NRz
-zsmx+HVZIgWoP3CgHmiHqajphL0xp6R9qJOyzAVChsmbQYvr+rfaXMv24KBvJYgc
-xq5iCP7IccgC6WlhpWyAoTSuhiStTZJtlCKPZqc+HRcuf2fLWXip8YKNHgEtTxNz
-7citBXZNoRDFULWwiYDnwhGcZ53p5zPLABYKZdfNHdI+tV92AbzYyQaV0ZwcxL9K
-ObAAlDzZKE8vJwT94E3O
+aWNlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAxNqcFB9GSj+nC1PV
+OTIAvzTuo3X7bTbohEPrIDDsEcGyVzQtfagI9vkxhhGLhXxIXrkwEI4u75DeLBdq
+ZR3KFJ3QD+jHW12EWNpmSYu272CEAJeb/SBJaFbh40WbY1BsTP+3zI5QMwVTmCH5
+QqODD+GU0fDSo9Gti0yX4rxOY+54jDC77AhSlU55rYruBoIXVe4CcPUpqzZLgqB2
+cTJ5g7lokGqc6w9pveCznVYGPfcdDt+ePGssOvrfBOJnn6N44tTRAG623BrpctXi
+t3IAhG60y6CqF29BjV0RKOv09nOBiph2a3lAiKYrpAt92BETFB7KSQManUrrvWOD
+mYEcoVkzvrVrB3WnCcHs6lsjQg1FcNrGcDzV9SmX0BIhM+fasxZyHWc08pr3NrRn
+Eks7lRqY+TS8DAeZYJt/2M0Jr32d6Bh+WdyGFFUj6sBPtCaC2VnSkxOgKXeWf/c5
+EUXIQT2YXEkNK9CP8Kqs8IerEIpfceelQReA5QcvNruaJNktWLKJgYTrdLdfOP0u
+s+9JJHWcFH3tv5906CA+Tlm53Dk6SaRc/DB7lu94yTkcSOpxXZnximZi0GcPZYmZ
+TaswE7d8HCPLhks/RkZSV2764Kl08xle65APiWZ4dM24uSyu75Izb4hrwgIA4qyM
+dDVQnI3cu6utmKUPyHoJtH26dr0CAwEAAaOBlTCBkjAdBgNVHR8EFjAUMBKgEKAO
+hgxpbnRlcl9jYS5jcmwwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwEwYD
+VR0lBAwwCgYIKwYBBQUHAwMwHwYDVR0jBBgwFoAU+f7h8O2ttBHtwI4OZnpD9wU0
+9GYwHQYDVR0OBBYEFMOMHl201gGYrA/OoGUroGeldRTZMA0GCSqGSIb3DQEBCwUA
+A4ICAQBfBZZ7ZPkRjRgk+0/7CGam2AAv/GSuma8lOnJ6IpBEUL0D01reRe9NO1Y5
+iXasGZ80e95oC7WtePt1LS2I5rOOb3No0iHcUTm5lZV2M/ObAOwraQLXePCRVgU/
+OQzNhtRoCpqgL80/1Ne+MTHj1yZp2GRKXOdMd39KZoG92JU/h556GQ6reN6WKNs+
+wbFG+JKiRnfvPsul6J5lG4QuObCAZXa0fhcQNUHyWjCGIhMa8AuhkDDlIEOBV1Vx
+T/ixdoFhDIoz0xExFidR5uqYXKZlgzcMZ4JT7x0Vs/YsOIg9z5PNkyjt8Kjrxvqs
+NZ1eYuNNxdXxdJZ2x04y8AzLkLRYntOCks5nEamQtzv0ice1Jg52qNJnMm0Y0U9o
+7BjlWy/pp8dBfIA+FyxsIs62hAE6Z/vuJa1VuWJblrT1MFM48Bh64p1m5uDXAZ9w
+Oy7n6YDpzWKWqn6XNV6FoDSkkwaOwB6bPaqAP1ZvP3BmVhednyYRYY21M2aOmxos
+7rpaW1FHgYV96Dm60rL7XRtOEYZNPSIPDO/Ro1oWs3EFwjLLAWtlK1HdMswlnVDX
+6M+LNCRZA3foNi6xvf7CvPkshtQe3FOfiw/OiPBsYsYREC+90Ml/oeTIsyCaOF6n
+5+dpjCBeOUaxzfeQI4WCrLG6+iQZNXWgBkW/PHaPZTldRWzvdQ==
 -----END CERTIFICATE-----

rust/pv/tests/assets/cert/ibm.key

@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQDE2pwUH0ZKP6cL
+U9U5MgC/NO6jdfttNuiEQ+sgMOwRwbJXNC19qAj2+TGGEYuFfEheuTAQji7vkN4s
+F2plHcoUndAP6MdbXYRY2mZJi7bvYIQAl5v9IEloVuHjRZtjUGxM/7fMjlAzBVOY
+IflCo4MP4ZTR8NKj0a2LTJfivE5j7niMMLvsCFKVTnmtiu4GghdV7gJw9SmrNkuC
+oHZxMnmDuWiQapzrD2m94LOdVgY99x0O3548ayw6+t8E4mefo3ji1NEAbrbcGuly
+1eK3cgCEbrTLoKoXb0GNXREo6/T2c4GKmHZreUCIpiukC33YERMUHspJAxqdSuu9
+Y4OZgRyhWTO+tWsHdacJwezqWyNCDUVw2sZwPNX1KZfQEiEz59qzFnIdZzTymvc2
+tGcSSzuVGpj5NLwMB5lgm3/YzQmvfZ3oGH5Z3IYUVSPqwE+0JoLZWdKTE6Apd5Z/
+9zkRRchBPZhcSQ0r0I/wqqzwh6sQil9x56VBF4DlBy82u5ok2S1YsomBhOt0t184
+/S6z70kkdZwUfe2/n3ToID5OWbncOTpJpFz8MHuW73jJORxI6nFdmfGKZmLQZw9l
+iZlNqzATt3wcI8uGSz9GRlJXbvrgqXTzGV7rkA+JZnh0zbi5LK7vkjNviGvCAgDi
+rIx0NVCcjdy7q62YpQ/Iegm0fbp2vQIDAQABAoICACjHosq2WeDaw9egY80H80ip
+BgC92bqbw9pWmZhfGiBpkHDpQb1EuKq1H9HGw7EA+JsK4Q6k7cs6JxRaO3O8Epdn
+w+jvz5C5VEf14ne85kY7p8zZm3p6HErtqLjkvBZ8XBstZF2PY8TWByW+b/0ik22Q
+TTyal4BRWRLA6LwTR2gDSFy+Yce5R6ZfjexqGfomLABkoIPW/e1Wf5kNdcvoaWzk
+1WkJdP1rAXxQ1tSys/NVRGNG5uhcSVrkipvf7RiQjGPtM2jUBrSdLJxZ+7AGAV5t
+8q02WNYm+Zz32SyxiNsfPYhBIlMMWNaWGfdPXCANFXc3E6/BYVuRYDmpKmN78DqN
+XrSCsJOahg7A9f2JIVKmreC/WmHi0+eL0fCcMHK95CN415mYLagg1bLhOwu0cdjq
+peSx3+xlEWENDm0B4mYQaPDylHht++Giswg9VpZeIPstgvNARoiCgRCOiR3mXVBg
+ZX+BpH45RSZ0hqdhkssiwP3iOQH0xYe1kEvzcaCeNrGc8cZy4dOcZjYso1XNZEQY
+vnUzAfo0TasiMES/RiNuy7Zf0oTP1UV7QootsqPQrZCFf3eixC91pq4Lh2URUseo
+4yOOI1URBWU5U2RuykzYWsqs/xB+CfJy6dhn6jCjm5lZFt1/wEKj5+7JZbZWkH8A
+G2HHxKIQWz5d2KjbQBkxAoIBAQDwUtb6mrJ/JBvMubdR2Tkyog9lT7qeR848ZZqS
+ybGEuT1Ohhd7vtjiIQzMLX7s6XIUoSE3AWFJJzqFrr0f1HkwShBNlvF77We3jski
+p7u4bsJ91mjHBWl/bAKW9s3YA6PRakk8k215mwORf+trhFkcOJ63DHIPxBnPDQEI
+VBBMvp5ogHHIh5wTql+c4OpdEb5s0PuesKFzjdzKtvPashaP3ebt2nM8Nai86UKQ
+WTcZxMLk36XSLFcW2vZlmlkQ7q8gMM3BIliR2ofmB0AlPBwOY/gUHG+tIBbuQWoX
+tw4DJPY3Y9uWRqAcWOkSbQpAEOUVzyK5nrwXwnH7vOA9HOiZAoIBAQDRsd7x3NGL
+Gp8oY8XULwIrZfyQmsk+nozBNuo2Q40qoXBoReIUF212UMMYc2iX8bMo1jBCzmnl
+3m2BA6aVbpxwlp14Ybe78F8ucQN6Dx5wmT7QyDYxdKyMAYOnOHWdW1ic1y2HjKY3
+vinswhuI93C4Dkf4mxFtP+aWT3RpQxS7DsztBTKux7fACoU+OKQxrmZTkPSVhuEE
+DXIov09q3awEvB/R+dDzGj6NXwxQ+Kr3yLl137RvVWcvrObyysKLfnVx+Of0Kol/
+6VD82BBWDcgveu62JPSZ8ckY4eQbi3yl5mOAbL3vre+AQYuDiuOo2NiPOsAimGaz
+kv9gXZQ1leHFAoIBAQDsGHYavN+fCFpHRixSvJT0qUF2xl0QInr52teAXaWIPnN8
+MT/g0h1ACjgIXqnTFYR9v85hu3lX5LIZoxEptBNa3Wgm0aNrnE/IhP4UjbRd/HIW
+Lg3BeA+snu/sX4raLLlDgqdwW2WxkhhvWLxvZBYnI3jJW/CyjHTOdHgPNobM3nfB
+Mm6WEqPCrh5AgLW9uTDatnR78gqq+zNt806eC1ce/2FfSrzq6cxbys0aAoufRS4y
+q4S8ddMZIQPvzTKy78ocVdXNZ3Cb2ZSo53adHfByMsQE/eq4qk3cw2b25V9et3Er
++W5AtCGXt8FB2N25Et/8DQKQWOFwdhaEuYmSgFQBAoIBAEgmEBRdqsdWyI4oDggc
+iH2QIJ9McpOWD83m7Bzxjx+s3jUyXkAVc3czAH1oMAOfiMozL/W8eZk6t6idLfLa
+VP80A0hJLuN+J/GdttmHXCzXvVIuoN7RSxD88GRXu7gBlvKX4rVxwjsJtfkdLEYr
+BOB/IWo7SHqzcs4i1mXlS7u0svOWR0L1upZbyE6JRI1HeTOle1H7T26Khc3ZTSTy
+0l3qsHQZpTgPvpf7rQwrEwAgUxdoefeYheFUdz3wX5GJWDV3s69B939IMrJcUPqa
+0Vbs0DdhbbuOAmgKSOblTmTyaSflwlA2I2KYqrz+y6frvE9DopoEn8mHeVCZwgXR
+5RUCggEBAMv2kXszsi3rgnlpFObRRnjyE5g5U3As1ii6FzUHm/aurUYqAZyMMnE+
+RdKX1zBUfTUXqijSpl7avZrf7DVTWR42kiCJM7PM0lrcFUcYFCIs0x7Qk2j3YIpm
+17vOFMpkZyYdWIniw3ihmWQTM3s3qTfdAbZPztnSInnjp+aXzU/tbfsmOmROcLY7
+V0xYNWeMs+P1axoEC7zGmhCAaN/A+zDY34VLHGDrR4dVKCnFUQFoRwqfE6PtICFL
+4fvdbbhwmU3sxY48y8ws/JyMfWachcFg/zbHVRR/K4j0sGfJB2NKu49jCcwPFaFT
+jLfytXEfbNWBGcgHySC4HUwnpUVxN44=
+-----END PRIVATE KEY-----

rust/pv/tests/assets/cert/ibm_armonk.crl

@@ -0,0 +1,21 @@
+-----BEGIN X509 CRL-----
+MIIDdjCCAV4CAQEwDQYJKoZIhvcNAQENBQAwgcYxCzAJBgNVBAYTAlVTMTQwMgYD
+VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
+MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
+cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEPMA0GA1UEBwwGQXJtb25rMScwJQYD
+VQQLDB5JQk0gWiBIb3N0IEtleSBTaWduaW5nIFNlcnZpY2UXDTI0MDMxMTE1NTIz
+OVoYDzIzODgxMjIzMTU1MjM5WjA8MBMCAgIrFw0yNDAzMjAxNTUyMzlaMCUCFDIv
+LrSYUcq+W27wAZwp/0Pf7ydJFw0yNDAzMjAxNTUyMzlaoCMwITAfBgNVHSMEGDAW
+gBTDjB5dtNYBmKwPzqBlK6BnpXUU2TANBgkqhkiG9w0BAQ0FAAOCAgEAgvfpzZbh
+/utz4zq6/KQdFW25wK9tqPkwFut9vdsOAGMkRRcX699Rk3Km1TpgBVGRKAlsQKfS
+IMq1FtNwbKMv+ycZHXDewk/i7dd2A0eUNzbDxD/WJ7mBdUHJtzkvIKwBmU7SkwdM
+yBRA20H8xKioveDrms+MM3a4oLNRzkZI/FWkSqjCDh9lI6igZNt3J29vkcdIlu+P
+Maa7Cpwh1ELrQbwE3NVgbr172D9qzQ+/NiRlM/Hla/lqGELcUgwVgkNMBFEMo7iK
+XsWy9WQ+/0RExo7n09jk9D4tCyAizGae72Xai8IJQD4tSVNpv6ZtNHZBBKQhkjGy
+PXGM8tHC91Tr8E9CSVVOrtxVit5htxjnTkJLg/9XnoAkxGNbUFbvCm+zIOzkmlJ4
+Drvvt9W4tVfkcfILHKmy4PG/0JU/tAygpr2Hk39e/Lcym64O9gz2g0pU4On/qD6e
+91Q4822RIYLDK/IO3H30CbO25nBChZ4z6KBMWXHG8mTJ5m1IbwZTPxBlL8t47P9v
+2ce2XDkcPzYpk/wqJ4xxQYhuhV9RaJreEnnqCZ9ER7L+heoJcCZcnr56wT4mNd/a
+Kfdm0Oxm8CFCMj1djVJQ7+ghsOY3RAehQ75m2Od5BRM+Vv3gYtkzPWTkWjDUn3us
+2KwZvR+lNaIVXPlQqBlIWJvehWZexLzTkA0=
+-----END X509 CRL-----

rust/pv/tests/assets/cert/ibm_armonk.crt

@@ -0,0 +1,38 @@
+-----BEGIN CERTIFICATE-----
+MIIGqzCCBJOgAwIBAgIUWYLchAxfdv8uD28Im9DK+Lo8pokwDQYJKoZIhvcNAQEL
+BQAwgb0xCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
+ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
+IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
+azEPMA0GA1UEBwwGQXJtb25rMR4wHAYDVQQLDBVJQk0gWiBJbnRlcm1lZGlhdGUg
+Q0EwIBcNMjQwMzIxMTQ1MjM4WhgPMjM4ODEyMjMxNDUyMzhaMIHGMQswCQYDVQQG
+EwJVUzE0MDIGA1UECgwrSW50ZXJuYXRpb25hbCBCdXNpbmVzcyBNYWNoaW5lcyBD
+b3Jwb3JhdGlvbjE0MDIGA1UEAwwrSW50ZXJuYXRpb25hbCBCdXNpbmVzcyBNYWNo
+aW5lcyBDb3Jwb3JhdGlvbjERMA8GA1UECAwITmV3IFlvcmsxDzANBgNVBAcMBkFy
+bW9uazEnMCUGA1UECwweSUJNIFogSG9zdCBLZXkgU2lnbmluZyBTZXJ2aWNlMIIC
+IjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAxNqcFB9GSj+nC1PVOTIAvzTu
+o3X7bTbohEPrIDDsEcGyVzQtfagI9vkxhhGLhXxIXrkwEI4u75DeLBdqZR3KFJ3Q
+D+jHW12EWNpmSYu272CEAJeb/SBJaFbh40WbY1BsTP+3zI5QMwVTmCH5QqODD+GU
+0fDSo9Gti0yX4rxOY+54jDC77AhSlU55rYruBoIXVe4CcPUpqzZLgqB2cTJ5g7lo
+kGqc6w9pveCznVYGPfcdDt+ePGssOvrfBOJnn6N44tTRAG623BrpctXit3IAhG60
+y6CqF29BjV0RKOv09nOBiph2a3lAiKYrpAt92BETFB7KSQManUrrvWODmYEcoVkz
+vrVrB3WnCcHs6lsjQg1FcNrGcDzV9SmX0BIhM+fasxZyHWc08pr3NrRnEks7lRqY
++TS8DAeZYJt/2M0Jr32d6Bh+WdyGFFUj6sBPtCaC2VnSkxOgKXeWf/c5EUXIQT2Y
+XEkNK9CP8Kqs8IerEIpfceelQReA5QcvNruaJNktWLKJgYTrdLdfOP0us+9JJHWc
+FH3tv5906CA+Tlm53Dk6SaRc/DB7lu94yTkcSOpxXZnximZi0GcPZYmZTaswE7d8
+HCPLhks/RkZSV2764Kl08xle65APiWZ4dM24uSyu75Izb4hrwgIA4qyMdDVQnI3c
+u6utmKUPyHoJtH26dr0CAwEAAaOBlTCBkjAdBgNVHR8EFjAUMBKgEKAOhgxpbnRl
+cl9jYS5jcmwwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAww
+CgYIKwYBBQUHAwMwHwYDVR0jBBgwFoAU+f7h8O2ttBHtwI4OZnpD9wU09GYwHQYD
+VR0OBBYEFMOMHl201gGYrA/OoGUroGeldRTZMA0GCSqGSIb3DQEBCwUAA4ICAQC5
+dH5QKZHynK7vGHOtol3brWgAWKkUVj+uqok/AUyGF5hkcXI2AVmu5nWV16Z6/c0b
+rD37YMPCCnZorQQg5g3c3H9In3NzTYWj1q2YT13yQ5PaD56vkwfPQKlmY2kMb/v8
+Y5Ho2LFjhKKOpzP77CsYMs9ZdXs6VKGZ5dSmOAOvJ4AcGaRPs3jXVz3EZFgc+ytK
+705mWrAgTYI3xcemxBTwILWAVCoqqirWrDNd3jicQo4Ks/H07RtLuVNY8kXUJEN9
+UMG7Ggzc/rTlvV/PUsJaQl8lunPDdbUBLsXE1iWaaAxmRTTQaDX8Ygq8NFZgGSrk
+E/dnJXcnJyV/5GH22Ho4JVVtADkP1wh3TKcojiDfM2WlzatSOMPdeISsUQ/D+VSm
+GuSOxPkS0wj5XUpoJz2bKvXNMH1Mdp9sMfOlkMe47iTmU5gK4PJMoj2NZ7zW9u6p
+pYXQz9LhdwoTJZBJXVYSA1q+sIIy8u3vFXEeN88FuoY8yS8t8qjwGEcKP1oojFxV
+ibj9cv87Vcd+tgXAqwkjxGQVbDZPBlL6OWCYoEluqWGnbUD1mUp2y8K99ZlzoT44
+i2ipEFyZmVPrmwgKRlz1UYDIsQvtvVw91Oi+DRNP1u+9D++Mnz2itGixHh1Hob25
+nQl1/SS4PfgMlYscbHYOfLAzOnW02FvrJZgQAQUpgg==
+-----END CERTIFICATE-----

rust/pv/tests/assets/cert/ibm_expired.crt

@@ -0,0 +1,38 @@
+-----BEGIN CERTIFICATE-----
+MIIGrzCCBJegAwIBAgIUU5pxAXMrXmWzioXpyoQoipFwsH4wDQYJKoZIhvcNAQEL
+BQAwgb0xCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
+ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
+IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
+azEPMA0GA1UEBwwGQXJtb25rMR4wHAYDVQQLDBVJQk0gWiBJbnRlcm1lZGlhdGUg
+Q0EwHhcNMjIwMzIyMTU1MjM4WhcNMjMwMzIyMTU1MjM4WjCBzDELMAkGA1UEBhMC
+VVMxNDAyBgNVBAoMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29y
+cG9yYXRpb24xNDAyBgNVBAMMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGlu
+ZXMgQ29ycG9yYXRpb24xETAPBgNVBAgMCE5ldyBZb3JrMRUwEwYDVQQHDAxQb3Vn
+aGtlZXBzaWUxJzAlBgNVBAsMHklCTSBaIEhvc3QgS2V5IFNpZ25pbmcgU2Vydmlj
+ZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMTanBQfRko/pwtT1Tky
+AL807qN1+2026IRD6yAw7BHBslc0LX2oCPb5MYYRi4V8SF65MBCOLu+Q3iwXamUd
+yhSd0A/ox1tdhFjaZkmLtu9ghACXm/0gSWhW4eNFm2NQbEz/t8yOUDMFU5gh+UKj
+gw/hlNHw0qPRrYtMl+K8TmPueIwwu+wIUpVOea2K7gaCF1XuAnD1Kas2S4KgdnEy
+eYO5aJBqnOsPab3gs51WBj33HQ7fnjxrLDr63wTiZ5+jeOLU0QButtwa6XLV4rdy
+AIRutMugqhdvQY1dESjr9PZzgYqYdmt5QIimK6QLfdgRExQeykkDGp1K671jg5mB
+HKFZM761awd1pwnB7OpbI0INRXDaxnA81fUpl9ASITPn2rMWch1nNPKa9za0ZxJL
+O5UamPk0vAwHmWCbf9jNCa99negYflnchhRVI+rAT7QmgtlZ0pMToCl3ln/3ORFF
+yEE9mFxJDSvQj/CqrPCHqxCKX3HnpUEXgOUHLza7miTZLViyiYGE63S3Xzj9LrPv
+SSR1nBR97b+fdOggPk5Zudw5OkmkXPwwe5bveMk5HEjqcV2Z8YpmYtBnD2WJmU2r
+MBO3fBwjy4ZLP0ZGUldu+uCpdPMZXuuQD4lmeHTNuLksru+SM2+Ia8ICAOKsjHQ1
+UJyN3LurrZilD8h6CbR9una9AgMBAAGjgZUwgZIwHQYDVR0fBBYwFDASoBCgDoYM
+aW50ZXJfY2EuY3JsMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1Ud
+JQQMMAoGCCsGAQUFBwMDMB8GA1UdIwQYMBaAFPn+4fDtrbQR7cCODmZ6Q/cFNPRm
+MB0GA1UdDgQWBBTDjB5dtNYBmKwPzqBlK6BnpXUU2TANBgkqhkiG9w0BAQsFAAOC
+AgEAo+WGpxIz8s0UY8gOlCYeGr6SRYbgH7bcFVaV2fJf2eacv/YSaryc4PNwFnO4
++e/LvE8908xq57Kl0xpCzp4bO941/aJkJuyr59TOe1nhcH0z0Yik9Dt1zRxxy0XO
+uVUSYuYEmKlWNgsWAGCmcHAz+wQxn2qjpD8k/GAe8Rr7O7r/EnSt6HvVKt3dl+zx
+rv88gKKJKWrbn7zn4/c/E3XG9RxunCsYGtOfUfk8tGeWtemoGNmXlCLCmKR4JKjk
+mEEM16veHHdD5k9MPj6YQH/jh1pDOD11o8GlOd/rEQCpFWeg23Z0uEq5j+qr1FI7
+Fjk4HvTtwGU7QXn+QV9bSjhE6svdWVbmADwb3Z/UU//UzgEAZDPb/n4cC95vk/Lt
+Wwq5MzHBIyeHladxzLE7LuVA9dmkv7dnST7L5ZAqQYcT5c7vxkrTHD53ZTojPMD2
+Lmd3ZIcRIdFbPChY/+ajuBaNpi+gBwQaQ0J4b70fKW7oUxOpgSjh12ACNOYmVRWb
+sCzSiIaxkD0pvIYLgNXcY2CekuWxO+4DLGNGPPAHeovue0yRgNKTC14AHsLWh04c
+aWdomQToTHFxJcoVk2LiE5nwg5Xu8BoNuMag1jl/ZQVsl4LrL4bItwplWdH/bSyi
+9VFeSwPGTiNverBtv/aF4q7O6JWB7/zUh2GqYQcILcaIy4E=
+-----END CERTIFICATE-----

rust/pv/tests/assets/cert/ibm_invalid_hash.crl

@@ -0,0 +1,20 @@
+-----BEGIN X509 CRL-----
+MIIDVzCCAT8CAQEwDQYJKoZIhvcNAQENBQAwgcwxCzAJBgNVBAYTAlVTMTQwMgYD
+VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
+MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
+cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEVMBMGA1UEBwwMUG91Z2hrZWVwc2ll
+MScwJQYDVQQLDB5JQk0gWiBIb3N0IEtleSBTaWduaW5nIFNlcnZpY2UXDTI0MDMx
+MTE1NTIzOVoYDzIzODgxMjIzMTU1MjM5WjA8MBMCAgIrFw0yNDAzMjAxNTUyMzla
+MCUCFAUi4bhk78T24IBu9CEi9kegwxmXFw0yNDAzMjAxNTUyMzlaMA0GCSqGSIb3
+DQEBDQUAA4ICAQCH2paQrJTqVzDjBOixREnhV0Ned2SHHwuIxZPeA1LrA1MR8KeY
+RCNiBxaOg2fkIe7WbPbiFVmosRq1kMjOJrgajvI6CG4is5F37KhW+Q/8siNcc8y3
+oiu+b8O5wp7vfUq9f4bxh78ytS+cHJpxHLoYzlp1f6aha2x2kUqDQzEf3ghIXEAN
+y0Jlmn2OqeZ/cCnWG+QF8Yb9OMlnR6rTpwk4ml0TvMa1/LhBUMj7vva0BmXuTunW
+eEr/wxmTMyJsRKNXgqRDLil+hnNzIP7HOmofyad9dyHv73gOkmu1GizwSB/AEVoB
+J5N/LUeCh4cG3YJYYpw7HaAHUnka2SDiuL3MD7VD5ONXiwcZIplT7I9vJHaBimoz
+kUTr3BkzFHas+KiPuGLm25Pxc0G8mVZl0jzoIJe0JS4bi+NCqeQ3C5s4WOZ476Bs
+5PSWbkJ8GwUxtXciOxHVKvgnBkc55bng2VEJlRLDfERdcTa1yobvJBRNZ8J/gDu5
+aWvRJs+cQ+1Bj4oq3ejV+Be5UFEVEFfQd4wFixvZcr781aDhYg744Ig0n3oZE0pg
+ye9V55q5yra6K1eertb63y1WvIrpfvNBM5p7mFbYBc5vnoH44mAhwbsCL5Mkjcxp
+0XjPSUsE9OyORtN92YLrZztEXIZmjw7otzQCQmcj/0ri3X+M1RLUTh+BVQ==
+-----END X509 CRL-----

rust/pv/tests/assets/cert/ibm_outdated_early.crl

@@ -1,19 +1,20 @@
 -----BEGIN X509 CRL-----
-MIIDGzCCAQMCAQEwDQYJKoZIhvcNAQELBQAwgcwxCzAJBgNVBAYTAlVTMTQwMgYD
+MIIDQDCCASgCAQEwDQYJKoZIhvcNAQENBQAwgcwxCzAJBgNVBAYTAlVTMTQwMgYD
 VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
 MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
 cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEVMBMGA1UEBwwMUG91Z2hrZWVwc2ll
-MScwJQYDVQQLDB5JQk0gWiBIb3N0IEtleSBTaWduaW5nIFNlcnZpY2UYDzMwMjIw
-NzMwMTEwNDQ4WhgPMzAyMzA3MzAxMTA0NDhaMA0GCSqGSIb3DQEBCwUAA4ICAQAa
-bg7llgCL+OdmZQEeBKey5Dm/NxJGJljoT/sxFbQ+86lwACh1mbdxVkaPyUC/oE9T
-4ppC/eHoaRcdmvN4FlIYrUhqnrTGD4s8VSoYvJ7+f5ZFGjUyflnMwyaal21hDaG4
-2SZjPVOQ0ksEA3mrHE1MTRVFqFl4ZFxGhh7NYMoOEkffM1UooChWHTTBMz67nmbh
-Ih0MDHhS5J7677K2N05402Z3v3S+Y8QEjIQjDsTC1S9V607eEfG9YEND2KicQKPH
-r+CK9/fVaiTz9wgUEyybps4MFoWBuUqqRebQoargFZW8w329LuS6VokbM6BSduOT
-qaYFtzp3DGZbvKwUGjiGVgB/PzzB1rv+2+i/EI3D4RJt+k8xvlBIIONxwK/hcjI3
-/i6hJueQpeCuasfX8ck/uKzSf0PhCmyLwWxQux66FJq4sXqWoqwf5P/U+tbB8zna
-0cX5/f8+rS7ansbxjeiCHUkbdUEoY7k7KMSNUrtqbgQ4VyjTziysTbSEG7jkb4ri
-Jaa9mDfWCkdwfB3TqDofWRkOdNpPTkj9TVZJ5FdV1h39D9O7B+VvedIiVod/KhB1
-DyOa44YpkEcS51PuNAC/exUd6nOv9Mz+WOUP+RrxHqndRYE0RGaFP9vENyks0Kga
-4CLB/IbT2rmpLivK2i6i3NOqzcykHOab3LtwOLDDmg==
+MScwJQYDVQQLDB5JQk0gWiBIb3N0IEtleSBTaWduaW5nIFNlcnZpY2UYDzMwMjMw
+NzIzMTU1MjM5WhgPMzAyNDA3MjIxNTUyMzlaoCMwITAfBgNVHSMEGDAWgBTDjB5d
+tNYBmKwPzqBlK6BnpXUU2TANBgkqhkiG9w0BAQ0FAAOCAgEATxMm63G11oaOvRm9
+nb20MXyXaqejudryJLcKSAUNNcvVpfj4zO4iG7Eiipq5svrEHmb8aNELKb7eHVY0
+uT5V1hd3xELkQqVS8rxcD2rQfoE8B3kkeuKtgI0yxC4rkrt8recajh8au/FSoknq
+Ts1CKsc0ghFo01gIv4fgWC7eWFrfw51T/bZW4AN1QsAT0wEqcYjuDTZpwXU+8JsB
+czQ1wWoKJPCAbh6ZOd8R/DEywffWSVjS+8hrmIc6TAwfu7SOBSvDLh7kKZeEgZ6Y
+lwp1R9EcRBYLlyclg4E7w/WL2DY426Lo+0aSIWcFwGbU3kWwFNXCKIpYvVQZ4QPT
+2lZfuRVMe1ZgRdPRz5wkiEYYIGFoe3cOC16jHGi+Vs9JQX/EgoRiy/YYxZdckuxA
+961S5h4bbYyB9aNH1vNn9Kp2r8oDGD6xucXM9cTXDsXvLLSFUxcFqoOdixYqFzX+
+EsZM5A33pMq5zKLkRD8JI2lP7nT0wdyaDjuH4ION7y90tJiq1Q1GPfmJ6+mp/3/I
+QF1Mh8axL59Rgz/KrzszP4+kn3NuhvKQOjL3QDo5TSXEmsdjERFHsmOuTwB9E4iH
+EIBu7bz9GfVMDUL8LSOK8Tq9Gj9Zzy8kYe2BuwNOTTDzQAUnPZK/m6p1wm/K3vjL
+2pjdFJmfRBtPNSRXL2hY2MYdZDk=
 -----END X509 CRL-----

rust/pv/tests/assets/cert/ibm_outdated_late.crl

@@ -1,19 +1,20 @@
 -----BEGIN X509 CRL-----
-MIIDFjCB/wIBATANBgkqhkiG9w0BAQsFADCBzDELMAkGA1UEBhMCVVMxNDAyBgNV
-BAoMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29ycG9yYXRpb24x
-NDAyBgNVBAMMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29ycG9y
-YXRpb24xETAPBgNVBAgMCE5ldyBZb3JrMRUwEwYDVQQHDAxQb3VnaGtlZXBzaWUx
-JzAlBgNVBAsMHklCTSBaIEhvc3QgS2V5IFNpZ25pbmcgU2VydmljZRcNMjEwMzI5
-MTEwNDQ4WhcNMjIwMzI5MTEwNDQ4WjANBgkqhkiG9w0BAQsFAAOCAgEAh+81L4ws
-rvOC1j7nwxthaIE4m8alnuaq9h9uxYfDZooimvGwhCjfcoWmfSSA8lt3vbMJ2vRe
-ZwnXXCyGWmetZ6ObnT0jwL0QuOYEuIdA8QHleBxLYBeFr4k0O9i8i3VUG0YcgZuN
-H+lcpGdoIx2WV0cZ4rbzZ1cNx3bieaivqNoLQAy7g9jTizmTfY5ZvlvuG3iqSG+P
-08APxmtt1qFEm1LVu4SyUSyoGB1NaxeoziMITQdfFqHoPRsu7Wdyuqi9f5irIPwM
-VQNKs/Y+3Q3S8YkTW3yqxhj4HdSKJE4qVBLMYm7muirDFWo25u2sDX1LJHBsQLvV
-fi7cGY0YnOJL2Y7A3XKDuqtZ34zpXg3Hhqpa9RF55K2u5dYUaPq8MEQUHK67II1r
-YZAwfarhijQQ6t03E0vrzPVYpK8VjNUunYKQdOBS3OkKgXCwEMuqQDrps98BgDQ4
-qfbVfxwm9XEHJZaX/qFR0sp8OQd/SD5dnS3DBl0Pp5w+w2xIaSA7QmBpDqWY66Hb
-cJq4CLOKTasHTddHKz7O7zIu8QhwJGLabtnx18iaHTNNHaTF6k/51pwvA3HkJgds
-HVcUNljsDNSPE258JwR2XoQAUu6VuFwRzgD7lGwdI70CpIBeAP1TRSius5RsZB+u
-cw+872CILlIdNJ72lzMPWQNH+IB1RU8U/eA=
+MIIDPDCCASQCAQEwDQYJKoZIhvcNAQENBQAwgcwxCzAJBgNVBAYTAlVTMTQwMgYD
+VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
+MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
+cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEVMBMGA1UEBwwMUG91Z2hrZWVwc2ll
+MScwJQYDVQQLDB5JQk0gWiBIb3N0IEtleSBTaWduaW5nIFNlcnZpY2UXDTIyMDMy
+MjE1NTIzOVoXDTIzMDMyMjE1NTIzOVqgIzAhMB8GA1UdIwQYMBaAFMOMHl201gGY
+rA/OoGUroGeldRTZMA0GCSqGSIb3DQEBDQUAA4ICAQAGD8ryV/GUC+s4qfqchMZA
+QYYOBcV7lS9i8zFrdB7UJuhCL/gXzrmldFsi6hW95PBNBtADT75UQ4JzNNVKYXWe
+wTbEOG54N7Ff4LdbbCRNjqpyOkqQgRWZOgiTeHSeiNLU+P98HZVKFIfiOS6Rs6zB
+5UNdYwCGz9kkeiR7xSpp0z86jI8WSxHR6e7CH78Ax/9dpGAyKYYj8LY0l7igxlIL
+yRgu0S81VsprcHKuGp5wcnabOWO7lEUCTFbYa7Cgc1+avUl1vaCmMqUsvydurCU+
+BCN8Zhc7noOXm0AE+58r9yy30aW9n+NUmP7uX6Eibb5NXtVZRVe83Ltk2Rbi9HRM
+hkcO0X37mXu+jcqw714i/r0mUsfGtC54IRMCgyIgWJ3TDdJ9ORo0rkrYRXVzKHdb
+0nqXEsrYecaCNcnx8iygC2YEwAN9WH8cvvLTJQcL+j57xcJVqOSbhXTEE5LfiHpa
+DO+dc9A+THZNO+o8GEZ3teTxylOVctiO9CkUkICmVZ9VDA73qOzHI8DJxpCAwT0I
+whm1QfCROAXYFW9enTuCGDZGPoyTf+tVrAGLmCWLewBV6W3z+7OBfNomktuI4Z0+
+opvwIJwYX3emeZ/5gDuYmwnvNYkC0GRQ/994430b/4Rssv32SCjToJ+Ko5pz4x18
+YUtbQcKxpJzRDSkccck83A==
 -----END X509 CRL-----

rust/pv/tests/assets/cert/ibm_rev.crt

@@ -1,39 +1,38 @@
 -----BEGIN CERTIFICATE-----
-MIIGyzCCBLOgAwIBAgIUTPiBWJn8k37onZ/aYgLxudbD3kgwDQYJKoZIhvcNAQEL
+MIIGsTCCBJmgAwIBAgIUXvZ6XWXXrTAFn66B61xZNya2iYMwDQYJKoZIhvcNAQEL
 BQAwgb0xCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
 ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
 IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
 azEPMA0GA1UEBwwGQXJtb25rMR4wHAYDVQQLDBVJQk0gWiBJbnRlcm1lZGlhdGUg
-Q0EwIBcNMjMwMzI5MDkwNDQ3WhgPMjM4NzEyMzEwOTA0NDdaMIHMMQswCQYDVQQG
+Q0EwIBcNMjQwMzIxMTQ1MjM4WhgPMjM4ODEyMjMxNDUyMzhaMIHMMQswCQYDVQQG
 EwJVUzE0MDIGA1UECgwrSW50ZXJuYXRpb25hbCBCdXNpbmVzcyBNYWNoaW5lcyBD
 b3Jwb3JhdGlvbjE0MDIGA1UEAwwrSW50ZXJuYXRpb25hbCBCdXNpbmVzcyBNYWNo
 aW5lcyBDb3Jwb3JhdGlvbjERMA8GA1UECAwITmV3IFlvcmsxFTATBgNVBAcMDFBv
 dWdoa2VlcHNpZTEnMCUGA1UECwweSUJNIFogSG9zdCBLZXkgU2lnbmluZyBTZXJ2
-aWNlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAsXm4EgSxVmuNsKgo
-sfJNxNQFkdbpCxxyMOuyBFyGKxSwiGl20VWB6itsG+b9NOmAI6D6FPvLPuB/gSq0
-HR5FuSIkmp9AUx6Xi6lVA2L7qdINo1OA4nJKe5hLSHfjWn36DZFrDyoODlDzLJrS
-O4h4QSP1nDSFhk1ilsR1czlvKreXkJw5FsUHRhZGG6idLoK2Ibrne6WsVhPG6WNA
-abuvQFv40cQWcyRoePktG8ImnNF5GDewXwtpzARSQj9jTL/gE77DH78a77J8+H+h
-d5guiBbPZK8gNkPe0CjD0B7tUx/+sByoaSeQffFG4Cnu5JJDqFq9LXPjtlG2nXSB
-Qh6Sc2gzP3jKV+ZcSwQw9AxEQ0ZB/VIPsR8KZKReDDztEpcKxwxlh7bEix/0Y1sv
-zT7/I+m5kufdDG6j3hHHzniKXL4b/WyedSfdnVqIJw82FgPFgyIY6F/0ccLdkhAm
-fLtQJBHc3UyK13l0qVJxhAFdz1Q0zfScBS6qM/Gnbcdc6MY9/bZdIK7E+4op5iAM
-kvQHap7qnArhI8VQ1bcXYlQ6asPj4e10lmzroiBHM4N/Yuxv38tmtUCudSB+EcXi
-EgJIOLmLq2ZACRzug9KPyMXOD/Yxz2wPgs6I3gvrB22w/MfC77wMfEMuQQk4cZel
-TFKosHgLjvcLG+zx5yh5ZVFcNV0CAwEAAaOBrzCBrDA3BgNVHR8EMDAuMCygKqAo
-hiZodHRwOi8vMTI3LjAuMC4xOjEyMzQvY3JsL2ludGVyX2NhLmNybDAMBgNVHRMB
-Af8EAjAAMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNV
-HSMEGDAWgBQRqYdWstn6ntusRZ8LjyPFEicL5TAdBgNVHQ4EFgQU3ozX8OjQ2AEH
-cX1v2WhZID6wZ3wwDQYJKoZIhvcNAQELBQADggIBAA1ipq2MIRdRIiUZ6M6AjY91
-L5iUpgKGrmhna/gg2b6AlugDOtVDsfeFm389aSplwY+zcJZ2AbUXhXe8RVHOEUwf
-O7iEDWsMZ/wxit5ZotJ5kzr49n9RTtomgbQSqxWadLq6Q9hYOWg/cr1FvXwL5tyO
-rHyuRXhkUMmuk4aQ1sfybfPp0PJKbzWu001Q4rxbJTlaib9b+CcsyLWHs06JXVKi
-755Lg9/ND1bQjW2CMJbZ2rm8V7oh4J0tJuF3DntOjyOk+yosckTF3bFffGPR67WC
-RkZebIKx2Rh6OXMrQTLz9ldqWo0cW0O353gSmrMxExWKhgoDrZKc4UeOanweDTqO
-4lU0RP/4naDuQl6/FE0rUzUkfAJmsKIuI4G1lQNZhaqUH/BdN1du094RON0T5agK
-etoBcPpNpxOn4N86TJaYoDjRSDpKwxXVKZs9lk5GRLxRhqtY3iQYVZrz2gY36Ri4
-lnuKZCeFmfjHvvktmb08EmrvGiQAhXzI8yfeVhlwP8lhtumIO877VW++tedK0z0D
-6aBz1LsVI3IbinDZPRsWl0EEi+JFmpIktmMTdSn+0vTs7XJjbBZ+VKaPPWOG/Afg
-Qav6+1AnnMtieGfrj3tyyfKo0vPSZKbdGzEr79Ukl+cxLdG5O5qZTy4ASm3EOw36
-p70HafhN8Vioa+uhQObP
+aWNlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAxNqcFB9GSj+nC1PV
+OTIAvzTuo3X7bTbohEPrIDDsEcGyVzQtfagI9vkxhhGLhXxIXrkwEI4u75DeLBdq
+ZR3KFJ3QD+jHW12EWNpmSYu272CEAJeb/SBJaFbh40WbY1BsTP+3zI5QMwVTmCH5
+QqODD+GU0fDSo9Gti0yX4rxOY+54jDC77AhSlU55rYruBoIXVe4CcPUpqzZLgqB2
+cTJ5g7lokGqc6w9pveCznVYGPfcdDt+ePGssOvrfBOJnn6N44tTRAG623BrpctXi
+t3IAhG60y6CqF29BjV0RKOv09nOBiph2a3lAiKYrpAt92BETFB7KSQManUrrvWOD
+mYEcoVkzvrVrB3WnCcHs6lsjQg1FcNrGcDzV9SmX0BIhM+fasxZyHWc08pr3NrRn
+Eks7lRqY+TS8DAeZYJt/2M0Jr32d6Bh+WdyGFFUj6sBPtCaC2VnSkxOgKXeWf/c5
+EUXIQT2YXEkNK9CP8Kqs8IerEIpfceelQReA5QcvNruaJNktWLKJgYTrdLdfOP0u
+s+9JJHWcFH3tv5906CA+Tlm53Dk6SaRc/DB7lu94yTkcSOpxXZnximZi0GcPZYmZ
+TaswE7d8HCPLhks/RkZSV2764Kl08xle65APiWZ4dM24uSyu75Izb4hrwgIA4qyM
+dDVQnI3cu6utmKUPyHoJtH26dr0CAwEAAaOBlTCBkjAdBgNVHR8EFjAUMBKgEKAO
+hgxpbnRlcl9jYS5jcmwwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwEwYD
+VR0lBAwwCgYIKwYBBQUHAwMwHwYDVR0jBBgwFoAU+f7h8O2ttBHtwI4OZnpD9wU0
+9GYwHQYDVR0OBBYEFMOMHl201gGYrA/OoGUroGeldRTZMA0GCSqGSIb3DQEBCwUA
+A4ICAQBlx15n00tEAP8moDUehCtLLJx7CCG/V7gcldTZACXpOYkcuRcKW9GlXqQv
+N30rTZpIZv3XIQEhhWhMJ3dqJRC0l2CbNlrIcM9t5p7GrYS/I/HGamKIU09jfud2
+1/FimjvBOQKr583vTLL0kr3Aosd3S8jHGA7Clal/85SntQN0kDxnceo01aCUhnxg
+Lkrd2+N0wPYGW5DZR6jk4Y/GiOO+q/ANO+tm4szT8RNwC5sNectpaI+ZRNlUHCdM
+DtZO5HkBADQ7PdZ2x51gliS5l9w7obFY62TG6LgtKFJgqEhqsHMIp+/OwmKbpP/p
+urUDJFCZGWD+lBkaxyy+VsPlvddU7gnXSm0wXoCxpXerRwWFb9/Kc5Q+kQB4nCkv
+bHm/zAkhjoRSjWYPcLL3F/9P858W9QlkhNdcoq73EIuc3FHUMdQUm+rjxGxfO76h
+fXoR2uBGlESO+gKL2iC9E7KKB+o07hdmafEnE8mGTRcGmVPp8e5SS7LfN8lfHez+
+3gBo2/lW1+2wBmBNIeBkkBpUI69DmNZvMliGNl/3LAIR/slQ6ZYXR/2dLeyhqwRt
+QSj5e6Jw2fg3ekG11R98OGoP3ZC/N1dTTh82O571ZBGxIWA6zPDrWj7tX0oW+JK0
+Of23BiH+4sex36HshqiyZ/faq4AtO62uII5mRQzlAwE2QdXI1g==
 -----END CERTIFICATE-----

rust/pv/tests/assets/cert/ibm_wrong_issuer.crl

@@ -0,0 +1,19 @@
+-----BEGIN X509 CRL-----
+MIIDCTCB8gIBATANBgkqhkiG9w0BAQ0FADCBvTELMAkGA1UEBhMCVVMxNDAyBgNV
+BAoMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29ycG9yYXRpb24x
+NDAyBgNVBAMMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29ycG9y
+YXRpb24xETAPBgNVBAgMCE5ldyBZb3JrMQ8wDQYDVQQHDAZBcm1vbmsxHjAcBgNV
+BAsMFUlCTSBaIEludGVybWVkaWF0ZSBDQRcNMjQwMzExMTU1MjM5WhgPMjM4ODEy
+MjMxNTUyMzlaMA0GCSqGSIb3DQEBDQUAA4ICAQC1oMFXyJ2mAz0el6drt4KtH38d
+FfDvsjc6hTgiPbmQW4NmLuSKnNLOyOulsRaV7Kl7hxQpd+Gyimqbtb1ObeqLvnyb
+W5kX90k94l8M/laZT1mZm39AGR8xW8HDtuJgwliI7RujX6iWuyrJCxM4qpAHe0Jw
+GGQd7ZlzEZ/4xMsZV0lPSsA9CPUn4HyZ2FWj3DJjfXloEOu+krcpmvmL3EROUi/h
+F6bsViKRmoQoe5GJFLdG4eVSgc9+ejaM23n8C0tmAhz7FKOYOqU7pS9+hvCyJ2Ul
+c8S3V7hzTlz1G4AJAeSJtCnV/hkpt+yj0eQa0Q92I0NZY3UWT8dOMZUxpHO91Th5
+4nfaF6FVSO/AQcpr4FPElYObp+RigqWf44v3vrriHTYi9QntKaNZq5XLgx8EkgBx
+1dTM7mDJ9W21ZWGEbRtLRaKt71RVsVKVLh5CPQrFEzENOTuy66QD26LNC2BfE3TJ
+tsMgjm14Fm1mC91roj7sOsO3MUl4YKh6cdKFtfryWr5Du+7x9/6vjabuay/BopC9
+BF/q8ITHh5Shs0h9OpOeunGFbcTnYOSgOpDLwC4++hur8p0BzClJkt2Z4yZGuKe+
+lh66PA/UkHtC3E8NDxVRkd+NsejSJUzRR0+1ruEoDEGP4jZKL83UpOFjIWGlIBsM
+2gwwqV/LJsywfW1kFg==
+-----END X509 CRL-----

rust/pv/tests/assets/cert/ibm_wrong_subject.crl

@@ -0,0 +1,20 @@
+-----BEGIN X509 CRL-----
+MIIDUjCCAToCAQEwDQYJKoZIhvcNAQENBQAwgckxCzAJBgNVBAYTAlVTMTQwMgYD
+VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
+MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
+cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEVMBMGA1UEBwwMUG91Z2hrZWVwc2ll
+MSQwIgYDVQQLDBtLZXkgU2lnbmluZyBTZXJ2aWNlIEludmFsaWQXDTI0MDMxMTE1
+NTIzOVoYDzIzODgxMjIzMTU1MjM5WjAVMBMCAgIrFw0yNDAzMjAxNTUyMzlaoCMw
+ITAfBgNVHSMEGDAWgBTXVfLQH2D0KccIHhK6M5MRTITvtDANBgkqhkiG9w0BAQ0F
+AAOCAgEAkHC9VxzSFGrY4NWoMLkunjaRQ5qmc4+3PFDiZLaGQua5QMJixMo+QIp4
+RfCLAkvI4VzMdoJXhl4+sV0mocn1HWDBxFUwfsvV4h84o8bEUK+bizrFsEoN58R0
+J3yfbikgj4P7WFQdU7p7bbAkmoKejt5+gu5etV2royIh2mjckCN7WnYzvhfRUBYz
+v+93R1usMMQIVId6l6k4DuBqaFyip8AKXVoXj4KbmwXZ8n+ILd5gWV3WKYo/ffCh
+h2g+jaS8JS8CYqtVGEb7F0zQwdPe1tHA/SBFBCNVqzHos+yET1m0Cn1zoYPvkEu9
+U2OVK5tqffEyrkN8hRm7LT2NIYji/z4VOIY/sGA1SPO7HNzoheAyHR7u9ortGMYv
+2Q69SEqtA7N6kMX3y/dL95sI/E3EJp5Z27jMMP7+aJ53F/5xmIqkZarA0ETuBic/
+KlNjG0WJilUMH7D7emTxksTdZOC8OKjg6gPY5GhVmlQ/LRvJQtoXqC84UQV2ul8R
+chvU55EUB67247g/WAusCjutISXnKQ4RGPaH9eOu1yN7StiXtJyiZ8R14ZihhC82
+ZzxjfDDk6ATR87bkAeDYJvubLJkVtUyUK0vgklNsyA+hwbdr5E5Q7IaRW2Bk/tnt
+K9ANhMjaerwcR20aOmA7pVuMGXU2MhFIleQzl+Yfv8N1CDECw3Y=
+-----END X509 CRL-----

rust/pv/tests/assets/cert/ibm_wrong_subject.crt

@@ -1,39 +1,38 @@
 -----BEGIN CERTIFICATE-----
-MIIGyDCCBLCgAwIBAgIUOgU+VHYEK4Q4dZokfM01Ok2XBtUwDQYJKoZIhvcNAQEL
+MIIGrjCCBJagAwIBAgIUOJ2eXoc9SJ1pRCC4x452LX35eNowDQYJKoZIhvcNAQEL
 BQAwgb0xCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
 ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
 IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
 azEPMA0GA1UEBwwGQXJtb25rMR4wHAYDVQQLDBVJQk0gWiBJbnRlcm1lZGlhdGUg
-Q0EwIBcNMjMwMzI5MDkwNDQ4WhgPMjM4NzEyMzEwOTA0NDhaMIHJMQswCQYDVQQG
+Q0EwIBcNMjQwMzIxMTQ1MjM5WhgPMjM4ODEyMjMxNDUyMzlaMIHJMQswCQYDVQQG
 EwJVUzE0MDIGA1UECgwrSW50ZXJuYXRpb25hbCBCdXNpbmVzcyBNYWNoaW5lcyBD
 b3Jwb3JhdGlvbjE0MDIGA1UEAwwrSW50ZXJuYXRpb25hbCBCdXNpbmVzcyBNYWNo
 aW5lcyBDb3Jwb3JhdGlvbjERMA8GA1UECAwITmV3IFlvcmsxFTATBgNVBAcMDFBv
 dWdoa2VlcHNpZTEkMCIGA1UECwwbS2V5IFNpZ25pbmcgU2VydmljZSBJbnZhbGlk
-MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA61P3Lfow3E6wGpMJmUWp
-wsfFZwcuKSf64JXDn1pVJLUcjTwhApshnGaSBb+knlpwvsO1evrR7re9ZRh51730
-IintOP5IA3CSGd7fqmTpchx3kdFOndrXS7BwAWuB/eZ1qzKeOYpyAS3VSE4FphYi
-LSxGfwSUl89pwYyWyqGl21hv/sBL6cc+Lm55vXbeRwWKW9K/w7BkhtK1zx1xm4i9
-4x1aXJ6DGWQpIk1sVDNPtzQVZYvmR1Y10/r75sNgA/WMiZx3/2VyCREnV+UXfvsX
-fyMLcbwMWWt6psdhtoGFZ2sLJka5ZNvttQKfbde4TA3I6fpsrMi+oTT9YO3it5zG
-ORCUC+j5B+zrzbSv+RgL+SnnAPkHqufb1a/4mFs/uTbjUYHN2/rhObnkLK4Xtfly
-FBlivxx5haT9o49YkCv7l57+We4nafBPMw96ac5AGzA0gVwdMTeRZ3joT2Pc/zSf
-H5E9wg3MZfg3TN2THB4S//r1/XOaA5F4BGjorbpPhp1/YaeF0rRMlAbZVKXHZJBR
-n5qN8hD/V2tXviEkrZRL+iW6ltkslsjIkzrYSS+6goymUjWrkGjmcsTo0SStHE0p
-7pOChLwpUtpaElemp1NDzVJqvrglWPkM1ZIIjxpk23zxKj7V2FazqP6PVuyeWdkj
-VYN86ULDRG5j1hfn/n0HEC0CAwEAAaOBrzCBrDA3BgNVHR8EMDAuMCygKqAohiZo
-dHRwOi8vMTI3LjAuMC4xOjEyMzQvY3JsL2ludGVyX2NhLmNybDAMBgNVHRMBAf8E
-AjAAMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSME
-GDAWgBQRqYdWstn6ntusRZ8LjyPFEicL5TAdBgNVHQ4EFgQU+jIyiVonTYe6GuSP
-iAkxA65qou0wDQYJKoZIhvcNAQELBQADggIBABcvU42Z/T7hT8ke5viG2x7FJmwA
-gkrphOYiooB77sxY+cjxaYsct4yvFXvwuNAcstnlBK0jJRaWzLwswR1t2bXbRwQF
-kjDO3br4ALRMHkDPa8iNioogyap8X6r40p7rvfnudKX0+MruLHXN3ZM2ltucYAYU
-oR/Wa04KxDuZQHeKrDosAsJCv5MwgF69H3oPbhspFQsP2V5fFsxupnWFzVlwPfcQ
-0lgHVC3nZ2Rj7ZariT/px3nfZ6Eg3pRyK32r2SQWVN/oVBEd5cCTONvD7Hr2SrtB
-9D58f+vDyVNWM5OED7NqlNDaQw2x9BMjdEVYTGGRW4IXPbXWH08NUcEkT1Tx/vUE
-EPlTgwt88Fca03yvAn/8Daw7ezsJNAFwDpPDcQhPi3vg2l32nuRkuQ5641hJiTGw
-TEtpJc3dg3FJymG999rOCLLIheNLMehEDMPZHqG7XeEg/42F0580MdkOenMpjhwg
-ZhrommB85sZcGBOwc63VMb5PPInYDQi5PXz9Tpann/VliVd4Dpnyn0XVy73VccXu
-WWgDt8gJKWUpRiJ6MZzEKkBrXYjPLmrKB64usEJNQ1e2NIKV3bwvH5K3PmibyVBu
-9fT5t0VXQpNxxlwngCjvjtt0D/frMCJQXpXpnz25aQDog9bnD1yl02SzxdZaVK05
-LZP4wR2beOGlz828
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAw7LcEUPdhr0FKp+muH7w
+Bj5Mbktl4e4kpIMqc2OaTxtwM4RDUDpLwy9X4PuEpGYEgOwOQYyd6udfInpjVVTy
+JBnwxdfpgHfsdqamkrZDqjGWHeSw4332D8gGMNFLmbCuHEzVmr1XLYQFVYMTuWex
+VFvL9ctA4gv5xO9f6oL7fVE7X420qb7IzntrxJHKsQA/IheJkZHYvPpBLs9Xlwje
+tb5OwyhdbTIsfR4V3vHdQ3shwD9TFbc+6MTDryWZThlDDUA8f+iO+euAe6QjLDnL
+JgLwnXd4EmGyePDhBM8oSex5o3/vzJVmJkpb40pvloOG11qlXGaqJxOLH2jjsNKx
+iC4l7oAHP0tXIw5f8hn+pk5vQNIcIHguXIT65ZR0IFRE9tjciLOtxndEn976jmqN
+Qu6Ajx5DiImwzp4wHjJOoVWmKCM9BklFRhwJvZ2xTmBGvC20jX0OgEaCeWV+E7UK
+2pzfGwwkWdXC7ihIszhGNP/lLlE3IflS0MHSxtie5fUrwuoZ+bVkKYClkLYeKrBT
+MLfszTuWg+rJfGmCwvYWGG9gcIRc1T3EuOiNpN4YJ5HZyD4rSI82fSzbrAtAPWPk
+6iVdmo9Ban0pQhMzyH2Gu07OnvBpmH2ADLzFpugjWafW157//GCNVgjrKVN/JbuC
+0nne/OTbQgCO1mFOy6RI1RcCAwEAAaOBlTCBkjAdBgNVHR8EFjAUMBKgEKAOhgxp
+bnRlcl9jYS5jcmwwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0l
+BAwwCgYIKwYBBQUHAwMwHwYDVR0jBBgwFoAU+f7h8O2ttBHtwI4OZnpD9wU09GYw
+HQYDVR0OBBYEFNdV8tAfYPQpxwgeErozkxFMhO+0MA0GCSqGSIb3DQEBCwUAA4IC
+AQATY32D+AMy1/x1WLGbQcvEkcT5+UEGp82FEVamXy4eM+zctzemEufjSszEpRod
+N5UgiNGDjuD5ttZSc37XHwtOwqZv2V0tu2jclxQQCswPjLhkecpIwSFJW9Y7IQPo
++4FKry6q+vyo0sLA+pIhTT+OHK8ijy9PQEx9YOHgr0HTTTG8UZ/6oqx70lvx9KcA
+x9PhFb5TWaOhOds+v7NEPxslwrMRQ4jOz92bGeBjSXBzxwohoKKWcLWIy5ktJsFS
+PhVztHa+on4AXdDJVifU4lYIPTRZBX491EnIpEaZtyEED319SNlj691+5SgDNHRw
+Ysk+xcVYy8RmL84qfTNce+t2eEr0vjnkUqVNt6ps3UvkK2jvlehBlfPW/Dy/r/Er
+q1KNvc1Uiza3ryf2dAMDWL2VBIKMZb+d88cEuLHIgmCXrxtcyxCBTWCK6t4cnKsQ
+J82B4XQ9IRCCJDTjGEQLxsjYt9jwHeUIK0l/sseBeohxMfDptfRQ8hWt7c5SvvNy
+xRGJ1adli7LiJ3+gnPcyO+D+3DPtKtgY4y8Aed5P3oDOQGNdUznSP2qexUpT9GO0
+fJaRI8Bc3Kj1zLkS+mtYHeOBu5eyLhR0fSBpKr3/3RoKj2/NI3SvlBbJ6dD5jQBs
+4qEi8T70wjhDqITPyqZV4auy/0/h89JXDB/qAg162p8EJA==
 -----END CERTIFICATE-----

rust/pv/tests/assets/cert/ibm_wrong_subject.key

@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQDDstwRQ92GvQUq
+n6a4fvAGPkxuS2Xh7iSkgypzY5pPG3AzhENQOkvDL1fg+4SkZgSA7A5BjJ3q518i
+emNVVPIkGfDF1+mAd+x2pqaStkOqMZYd5LDjffYPyAYw0UuZsK4cTNWavVcthAVV
+gxO5Z7FUW8v1y0DiC/nE71/qgvt9UTtfjbSpvsjOe2vEkcqxAD8iF4mRkdi8+kEu
+z1eXCN61vk7DKF1tMix9HhXe8d1DeyHAP1MVtz7oxMOvJZlOGUMNQDx/6I7564B7
+pCMsOcsmAvCdd3gSYbJ48OEEzyhJ7Hmjf+/MlWYmSlvjSm+Wg4bXWqVcZqonE4sf
+aOOw0rGILiXugAc/S1cjDl/yGf6mTm9A0hwgeC5chPrllHQgVET22NyIs63Gd0Sf
+3vqOao1C7oCPHkOIibDOnjAeMk6hVaYoIz0GSUVGHAm9nbFOYEa8LbSNfQ6ARoJ5
+ZX4TtQranN8bDCRZ1cLuKEizOEY0/+UuUTch+VLQwdLG2J7l9SvC6hn5tWQpgKWQ
+th4qsFMwt+zNO5aD6sl8aYLC9hYYb2BwhFzVPcS46I2k3hgnkdnIPitIjzZ9LNus
+C0A9Y+TqJV2aj0FqfSlCEzPIfYa7Ts6e8GmYfYAMvMWm6CNZp9bXnv/8YI1WCOsp
+U38lu4LSed785NtCAI7WYU7LpEjVFwIDAQABAoICAAqhxnv3pGrkDQpORygB2Xd1
+XgCl/wCByCLZ7236bNE8a+GYn3GV4TTW9x7Fe2TVGAyLBpFAGvo+nLgKTyg9J7SX
+ZjHRc6Gjokil8CnLVizCaeXw3T1WxA4Cb3eqf0F3zFXERNyVyc0yvXlyWBl8DTHI
+lPGjG8DMJsMwwBTFDfW2epPL5pNMRquVH/s7cnggS83F2pb6hfxqWi05XYhaloLo
+Nm463KyIi8s2XbjRihRW9bP0nMZywKuzuO/kioooLDDlmwPV9iKUzVOqTLDj6OoF
+Qd5ENdVF0oTojUkOGiG+A7PCyRvjx/tvkcNs8VgLiEFd7trwxvC9ipLnx2r9X2Cu
+zi8iQJ901lz6cj5tR5VBttM2MaLFtELTa4HDmVMf6cNuMNZO8eULNmV2EX5K/L5b
+JD9Y1fhctQr2+pEvhgela+hi4XC/jZ/HBxDg2gg1lzt7MNjODi/fISz/zGexGQW0
+R9KElISntcpsyG8bqH2LQFQ7XzgAF1qrUC8Z9KFONGRGGZViH/K/aeH00PqCEwG/
+kv5MH+JgS+Rb2AM6HT6SK4rchAkpINPDIsD//dh4vdEfPQ/ysICf3yqACSYgu0cl
+kaTyNQE/Oga1tDOAbC8YlxPRmFHCybz8gXG4iyfFaXLGaZB+UXwZCMKOBsWbid4v
+l+1wRY/EcEuxgU6itVv9AoIBAQDo38kPbhvcT7I56++EKVuEfCzwAnXV/kttXRQk
+QQP9b7C6ZVsEgHz9/sNWzwrp0+28JXMZIggAt0kE783hitDlh7mRIUqjYoU6FcKs
+J3qaHR/Dn5TeDFlMeXmbDOsXPLRDTFdvX9+We6gbAUY1NjbK/CS+fOIigzw/jplS
+DIPxpsPLQ79/lUvr842Fn9HAIoPWq6bhMW4qibh8clJInMO9VTz4TF0FnmkPgl3Y
+R63h5zngQiOAtWCIleN/9F4G7VvrDqYHAHX54vL5Vz+dgtsynJIcpQlIJ5Z6w4hU
+q04aHuxDBkNPNRfTUIo/Jb1ghxK0m8JEZb9FE5TmZ2PDH0l9AoIBAQDXIfwjSYez
+fahZtDCis9skiaRBz2Vw+EUruXyEShER2mPaW2Of/cxAjE+cRPC4aGuseHs+4TWR
+CMnLU8lsrrw80HhdRjd11Gvr/o5qlqgxnw3zNSWQzwld+QcyxpzOgIxIR4kFV+1z
+VoG5PO+vARhcZH2tXrrWdjnCTchaMV74Sffb8bHD0p0PfcAg3CdSzMhynnMGp3wN
+PBZXqk0T+C9isaXKxL8HcDJxgcJHEyEZp9ygQtzQo1BPluVTWPJRQQvP6VLNyNl2
+NISvmYJSwRQ3yuqEvWE4eSge9kaNp2eUrUz5O3t1NyOa4qioVPnlCH7Glaj6nyNS
+Ler2dszcqz0jAoIBAQCnY9SeZsNYBWFTCSjNkvzZqniSvPH+tB97qSBFPwajMZmT
+Ii/eeI1f9bRrvb9WfKOyTikBs9iUyyqNheIzcRjfJERa8dc4wiSJsAKSxH34MV8X
+uqnDQpUdx2OF9C84MMZSaZmf0QZioNghMTVKIoIYPk4bLqFNtY+lD9ddhumA1iJ/
+BV+tUZ+VJyhfGJYoyaaCtDfsPx+1K/GUYoiK8UQx4AdHY3yqAUf7gfX69OskKpUL
+gf8LEVUmWLeCziCYUh10RL9K4SXsTRnh6Lkte1Ycdzb/qBGX7/zWmZ5xXgFx/TBO
+rT3MvZk2p/n3kiUiMXVcpWlqyMhH2t95DnBDXUXxAoIBABcS0Q0j1MceghDk75Zz
+vdxEWvan/NRJ/Hk9EqrJmt0UVENWK/A78000/1DeYAcXQ/0iiu1qkCk3DRWererX
+Lt9C6LXwUwBzQQP1sGakM/PmgEOGfrnySqnmjKwYezb2uJUD/yEwlgoZzB4G+BoH
+/wnhyUzv7RAVbAp39zYdN3dfz5KqcIt1Kl0/+nxLwHfz+Me6UNH04qw0tpy+ajfr
+FYH7VbHSuj5c/TwJU8H1vkYXJ+WUZkSGT5XJtFzlHFA0rsSk3LmvggtYhKaky0J+
+7OEzBUYpXaUF8ZSoi1akDsr2b1wH0iz3Nf1ls/sh6g9zgs1fvdjreolU3W+DvGMq
+hosCggEAWvrHup9KFfS7QznGOLjOdil+HT8TqbVjFa51S7gd5A2B3XpC2mDk9XPO
+uxvUjXxuH18hRlLHP2uERlIsOl37iPJ2jY4C1SUQb9xNmSarfUKwsgDhJKBfPNIC
+LXmXQgs/gcL+Sm/l6Az4slsV/9xg1Sp4EG/3bBM8i4VRRcpKZqwttZ/pArzYNrYp
+LbZeRCm34iPDAelganc4cX/wzlXa36j0Eh0PHd1SvQhKb9lcxtbV4EFhxD9qC1VF
+URy6m7FJrA0r5Hrh4SuSagOpbPCJTeXP0Ysvx/tsl7DR1kIpGkMGhYHMScbKjGwe
+ZAbU3ynucdvh2dgqN4agS//dmuRo0A==
+-----END PRIVATE KEY-----

rust/pv/tests/assets/cert/inter_ca.chained.crt

@@ -0,0 +1,58 @@
+-----BEGIN CERTIFICATE-----
+MIIGhjCCBG6gAwIBAgIUOkSdvHg4/HXtknNMhIFkuPv/ghMwDQYJKoZIhvcNAQEL
+BQAwgbUxCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
+ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
+IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
+azEPMA0GA1UEBwwGQXJtb25rMRYwFAYDVQQLDA1JQk0gWiBSb290IENBMCAXDTI0
+MDMyMTE0NTIzOFoYDzIzODgxMjIzMTQ1MjM4WjCBvTELMAkGA1UEBhMCVVMxNDAy
+BgNVBAoMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29ycG9yYXRp
+b24xNDAyBgNVBAMMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29y
+cG9yYXRpb24xETAPBgNVBAgMCE5ldyBZb3JrMQ8wDQYDVQQHDAZBcm1vbmsxHjAc
+BgNVBAsMFUlCTSBaIEludGVybWVkaWF0ZSBDQTCCAiIwDQYJKoZIhvcNAQEBBQAD
+ggIPADCCAgoCggIBAMheyYWl/STLJ0iwlrqNRyURatdeC8oDpKFdpglYHAs/jo3s
+fWNySCnaw6NCe0vxFLpqcK8VMNFRGu/XhR/kZ1YR3V4mLwF1Wa5v7a7J9swq50Fk
+CsLtaU5vq/h6rIpy0NLnmN5KgqChrMh9IwZ+Mc8sqc/0BFFJsuCCGu0TNlGVOhmN
+AbdS3s7wEUwT023CKn47G3pVqeaErEB9honz1I71g5/jNKGe5CLCV35ExzsrzU43
+atyJ0jgh15PYCXDTdsRccSmEs2S6Xh2o4ZhlqioWB+tKxGsdxq8Ri4soy6yyooOz
+T/3X5CHpKxiI2P9z38Pr9egPcNPPVMGDhzwHz7p3iBPg0RcWd5VP2nimLJsdGWK0
+bkU7zlQ3R2NelSIW9Hr8MVASihmELvX+AcC6KhTpHHhf3CTPgcAfV2fE9U84Xl2i
+shmoEsUQTUx97qKUOKRfY6o+WMBnVkzlqWj+s52ndiT+0KNLTDtvlejEFf1VSF43
+IkS9UJK+XxxEnvIBzNKI5EbWlG5Z38/nKv6pjTXFi3aZR4cdmI/0XfAjLTkrTBaW
+lkguEjt+/cxPYJOqt50ldI9kle8XTu/HibmcbU2wYIF21CBjE/hLk/KY3FQlnTFL
+y7x3bM0CuTfJ8Noy59f3l56fwPOpaQWqhqO+UoFkbFlbROAiVxfb8KlyZPdNAgMB
+AAGjgYEwfzAcBgNVHR8EFTATMBGgD6ANhgtyb290X2NhLmNybDAPBgNVHRMBAf8E
+BTADAQH/MA4GA1UdDwEB/wQEAwIBBjAfBgNVHSMEGDAWgBTWntryJpCwZqZJ1H3n
+znJYhbfoKjAdBgNVHQ4EFgQU+f7h8O2ttBHtwI4OZnpD9wU09GYwDQYJKoZIhvcN
+AQELBQADggIBAE8gulfly5+EC8DX3K02qEYPoQwVbVhD0wGrlAhgJiakDvPlX6/K
+vSe/1nNRG87jXvXdDiuJ6F4iKZpeJndzvx/8ZEmllyyxDwb3UOmylwW/o3/Uh6fY
+kiVBfW6uNNB0BfDKcXDDZgKjTg3kLT5z8m4u8rPoIPFkLFl9AuAq82Ll6NQ+xZFP
+lZ3K6HN+ntVnIGP4XkOgEYPxjJO3yTGle8VBqLfo/JKwbZtKfNXxSAMRXiP02SQg
+D9yshxkonQYWog2hHz8oDuQQNbzaAFlxnY914av/XwxP8TwEfGNchNtAtrlGRlx8
+PjMfp3Mnbz71yp+L2We2/A7njIPbEcn0FIBedpNyyBON5Cd6Xqx18otmMTtUILZ3
+SUKeYmLp8soVMEmmnWz6y1a4bCKwo6hA8oSoq5ydIeWy/jI9v7DF0S/qZTz3c2Q1
+a3aniuug2FRAxuU/8fSlMrE4672d3505SbHUblhy9XzQ4+sWjkDtYnY89kyY4BTu
+W5n6JlVoewZGOjlJ9/6mV6BVLQ74IeiytWtdH5uOQ1wroi5Kq+EroGgFmPSQCIvN
+XNDvBCNFN/O1+/eVZd6JNx6NMO7DrWql3GFMtJE8u/SWXA9vit3pfmeDrosZ4SDg
+ZPt7+JfzITUh2UMaPsQsPF8G8/tYmxDbELE5LjFcQ24ps362rG+q2rfA
+-----END CERTIFICATE-----
+-----BEGIN X509 CRL-----
+MIIDbTCCAVUCAQEwDQYJKoZIhvcNAQENBQAwgb0xCzAJBgNVBAYTAlVTMTQwMgYD
+VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
+MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
+cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEPMA0GA1UEBwwGQXJtb25rMR4wHAYD
+VQQLDBVJQk0gWiBJbnRlcm1lZGlhdGUgQ0EXDTI0MDMxMTE1NTIzOFoYDzIzODgx
+MjIzMTU1MjM4WjA8MBMCAgG8Fw0yNDAzMjAxNTUyMzhaMCUCFF72el1l160wBZ+u
+getcWTcmtomDFw0yNDAzMjAxNTUyMzhaoCMwITAfBgNVHSMEGDAWgBT5/uHw7a20
+Ee3Ajg5mekP3BTT0ZjANBgkqhkiG9w0BAQ0FAAOCAgEAbGRxfJj3wsZ9iUsYTO3W
+7+hNbZ+nRaokZT1UgprzDTMmQKWp5HRyvAsTtzxeJZ4NDEqP2mg8imvmSUSnLSmR
+pdq7vUdk7lKvdV++fZo4XIRF/pqv7+8Nz8iZvxINGhFaJDUUPPQSFcLm00JIUMzn
+9nh5JkCkKFuk34DgHDR3Zn+nM6R+gAuaDsBgv3xnU6PKVW796JPbz3yrN9fma9Pw
+P27ICXVyOH2oH7p/E7oNB/J0YxKcD5bjaFkzVHsMExCzeyGTA56qtdN2O1Oxiw2z
+L1Yitj1c+2/P29vhCw0IuxKjduL15Qu5Px5BT+B6V3cVUPbn9fYlDjSFAHxyrGno
+X3QnVzCChVoHuS+Og/QwEx6AcTSEbl4E47XQK0gr1cG7ayOZoDO3rqGQ+eO6kREM
+LpX2lHPofzMBk9lGPfAZX41pXUlshT0irrwFbIt3OTGfvU5x2wAjCap1InzvFS9J
+4vEFHcLeHAi5ztlnYNIkB9/kja3ogpSCbcO6WoveJeHCTsXk5K4qIOSvoLYEdRE1
+Pn2EJStyULZW9Sv1JH2puyZ2d2Y7cl6DqCZ5D4tFsyFFsMUNlBJQSxKoPDYnGsi8
+DOTxrwhdxG/mSwn/NoYjZdC0Y+NJyBs1RvLvBZLdgzWS8I+uvyuwTfn27tP7GT6Z
+8hmLPBMvUOyczXdMD6b1mfQ=
+-----END X509 CRL-----

rust/pv/tests/assets/cert/inter_ca.crl

@@ -1,20 +1,21 @@
 -----BEGIN X509 CRL-----
-MIIDSDCCATACAQEwDQYJKoZIhvcNAQELBQAwgb0xCzAJBgNVBAYTAlVTMTQwMgYD
+MIIDbTCCAVUCAQEwDQYJKoZIhvcNAQENBQAwgb0xCzAJBgNVBAYTAlVTMTQwMgYD
 VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
 MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
 cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEPMA0GA1UEBwwGQXJtb25rMR4wHAYD
-VQQLDBVJQk0gWiBJbnRlcm1lZGlhdGUgQ0EXDTIzMDMxOTExMDQ0N1oYDzIzODcx
-MjMxMTEwNDQ3WjA8MBMCAgG8Fw0yMzAzMjgxMTA0NDdaMCUCFEz4gViZ/JN+6J2f
-2mIC8bnWw95IFw0yMzAzMjgxMTA0NDdaMA0GCSqGSIb3DQEBCwUAA4ICAQA0FKRq
-yESt1SYxVW+BlFjeDWCf1GL471q+603JiRek5iEVt+bZXrII9y9lXsYhZ1d7BxCt
-Wyo/497tPMwRKSiPJwrXPODQn3DTl6EM6VB+w9Kipmm3Fq97TSRBuiDkYaS/nUHh
-nDfj40qb1tc18SgBXVLSSiu97U0JMAq8AHIfMzlnhIe4fJ7TJU2TFSrkFAOUVqZs
-p0/J3aDccYJBnUnEeGD44i80wd3xmuOoBDqRgKcasYsv8QmSFhbD4BTvicxKueDD
-kiWTFbgNTDQU9Prp8gYmuSOaQoK6S+8DlO80IRTDwpDq1nQaf5MvwfOqfwQVgAjt
-RgrC9BI1RvQu0OyihvcqOh9EEj5O9D/nrgTdsWYJGF/otb8lL6JdXDOAjqWSkZVA
-gKDq4NPUskgKzoccD6HY5wgIvSZTV8bXjz2ST2oddfg0/7akNBEmq4TQV9NHb/G0
-AihNJgd3HtESn5Fhm51aJZPyuwqzmkmNHTuHZ5qeDB1dN/UVSqfnLXKeKirOtJCq
-VdWGZTFEKJSDPgmLOMy0GhrOeM/y5N5MJZBrwBxPJ3No3TOGr13Ir8E1cxCnchZX
-PgpyXNU183gMX4k5NVEWYpCzoTxzY7PNvaMft61IkC9DIdnRxRbEqfdLiVy/k4jP
-MUjX4ThGwtUVzqVOiH5uRRE1J7Msk/W3EYzIWg==
+VQQLDBVJQk0gWiBJbnRlcm1lZGlhdGUgQ0EXDTI0MDMxMTE1NTIzOFoYDzIzODgx
+MjIzMTU1MjM4WjA8MBMCAgG8Fw0yNDAzMjAxNTUyMzhaMCUCFF72el1l160wBZ+u
+getcWTcmtomDFw0yNDAzMjAxNTUyMzhaoCMwITAfBgNVHSMEGDAWgBT5/uHw7a20
+Ee3Ajg5mekP3BTT0ZjANBgkqhkiG9w0BAQ0FAAOCAgEAbGRxfJj3wsZ9iUsYTO3W
+7+hNbZ+nRaokZT1UgprzDTMmQKWp5HRyvAsTtzxeJZ4NDEqP2mg8imvmSUSnLSmR
+pdq7vUdk7lKvdV++fZo4XIRF/pqv7+8Nz8iZvxINGhFaJDUUPPQSFcLm00JIUMzn
+9nh5JkCkKFuk34DgHDR3Zn+nM6R+gAuaDsBgv3xnU6PKVW796JPbz3yrN9fma9Pw
+P27ICXVyOH2oH7p/E7oNB/J0YxKcD5bjaFkzVHsMExCzeyGTA56qtdN2O1Oxiw2z
+L1Yitj1c+2/P29vhCw0IuxKjduL15Qu5Px5BT+B6V3cVUPbn9fYlDjSFAHxyrGno
+X3QnVzCChVoHuS+Og/QwEx6AcTSEbl4E47XQK0gr1cG7ayOZoDO3rqGQ+eO6kREM
+LpX2lHPofzMBk9lGPfAZX41pXUlshT0irrwFbIt3OTGfvU5x2wAjCap1InzvFS9J
+4vEFHcLeHAi5ztlnYNIkB9/kja3ogpSCbcO6WoveJeHCTsXk5K4qIOSvoLYEdRE1
+Pn2EJStyULZW9Sv1JH2puyZ2d2Y7cl6DqCZ5D4tFsyFFsMUNlBJQSxKoPDYnGsi8
+DOTxrwhdxG/mSwn/NoYjZdC0Y+NJyBs1RvLvBZLdgzWS8I+uvyuwTfn27tP7GT6Z
+8hmLPBMvUOyczXdMD6b1mfQ=
 -----END X509 CRL-----

rust/pv/tests/assets/cert/inter_ca.crt

@@ -1,38 +1,37 @@
 -----BEGIN CERTIFICATE-----
-MIIGoTCCBImgAwIBAgIUXCG9Tf1Ea3mKUicsQMd1lldTtIgwDQYJKoZIhvcNAQEL
+MIIGhjCCBG6gAwIBAgIUOkSdvHg4/HXtknNMhIFkuPv/ghMwDQYJKoZIhvcNAQEL
 BQAwgbUxCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
 ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
 IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
-azEPMA0GA1UEBwwGQXJtb25rMRYwFAYDVQQLDA1JQk0gWiBSb290IENBMCAXDTIz
-MDMyOTA5MDQ0NloYDzIzODcxMjMxMDkwNDQ2WjCBvTELMAkGA1UEBhMCVVMxNDAy
+azEPMA0GA1UEBwwGQXJtb25rMRYwFAYDVQQLDA1JQk0gWiBSb290IENBMCAXDTI0
+MDMyMTE0NTIzOFoYDzIzODgxMjIzMTQ1MjM4WjCBvTELMAkGA1UEBhMCVVMxNDAy
 BgNVBAoMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29ycG9yYXRp
 b24xNDAyBgNVBAMMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29y
 cG9yYXRpb24xETAPBgNVBAgMCE5ldyBZb3JrMQ8wDQYDVQQHDAZBcm1vbmsxHjAc
 BgNVBAsMFUlCTSBaIEludGVybWVkaWF0ZSBDQTCCAiIwDQYJKoZIhvcNAQEBBQAD
-ggIPADCCAgoCggIBAJYQSR4xUs7bFbMY4r4v8l/9cuRxOxnZ8/cFpIDKzCA4c7/U
-omjJCaPOFJrldYthRnyjN6MdqKyIED0XjW/MIlbqjMJ4E4AvWKZC1+r3+YoFCYmg
-pLq7kfBkw8Kd8BFhfRsGg60VeAzZ79Y6BvJZSyXXQeH1RYiH/bW4o6PdFaO/tchx
-KFlYgOW5MoGTemx+muifZ9iKav4/feFZsh73+OFf+KyruSkGnM18YNqnoMiNL3M9
-H5T86OBjcPYHhhwCp/v5cjfD4Yaa1WAM0Bsy+o6b/VwSNhrk8U8JF2rjuK3wZm3L
-hyMa3QOn/kgoonl7sVCKes6GpwOmiS/+qKf14JBK+bjTpDk/CsRYpnonBJKNGOzy
-tr6CTqLWcJtoUz3kr1ZZnGXUmBjqYc9vYI2EnlzHnBAf+gplJVqtbEZckLx7rKBD
-QXyXp5pqDZmnnxQ9qlk1ZMeqw/mjLackdi1CRg8SfA0GlRcQYmcWxc2U5iCcs+ym
-q+V0ciK4YFg/z2wEMFEsarGclW8YrZ1RtY+IcmtCXf3rRa0CEbHCiclHoVtuX20c
-LZuYsQ5y6TdeWkDTcAwm3ZCYa54LeySuYny8F8A7by42KRg+Z/JjaOlA6hBPGwvC
-p1frJqQod5uGd0Zg0DrNKjjWIVc4Z38dRy48b1Ija081WBtKwyJiX8jto6yfAgMB
-AAGjgZwwgZkwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovLzEyNy4wLjAuMToxMjM0
-L2NybC9yb290X2NhLmNybDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIB
-BjAfBgNVHSMEGDAWgBRJTc+PTs7kYFuicyYmOttP7ItAazAdBgNVHQ4EFgQUEamH
-VrLZ+p7brEWfC48jxRInC+UwDQYJKoZIhvcNAQELBQADggIBAD3ZOiRT6ESzxFIK
-76FY7qNM1PWcNrgTmMDy8iHfBWEBmkAUQbHvY/U5fPnPj3vPLiHXkLDbUliXyEnL
-4myo966j8dettrvB7pxibCy7J2FxwoKwMUOY+4IgGBuxVVoWVBwzu5me35RnDZ6i
-9+dRJXiZnO2cEVvfFmEfq0w5SQLsqmR6EeIhoUOepmEJDpjE3cSz6QnQ6KWdw2wf
-e+dviPlDwS0sNg006lqSy3rVzsnlqLAsoDkeOEZyZmPbc6sAx4RJS9nBH4WERWb5
-XxVOYIn0QmlJKwlULB3x8dhxUv+a7alBjDt6v2MW1zXH8v1ZcMcJnFy8i6m0VzkV
-edrO/ONmqfi/EUr/FothDLQnCoykWjcfL1JGLADjzyRE86Wg4L/DRil8k5wH8Fir
-ZZE/kLeOkQN5FhvQK+m3YzGtxkehO7Io3YWmzbv05ZI2d6zroyP6DXS/zJY9wuNd
-I/6zp6eUYb/mtT3NF3h1C3SjQpELT2IDoXXYQsbvcVk7pgMB2mP9sYnoDlQsXZvC
-oEzD/ollmkHsgD3Zr3p6ANSiNpW6iRYBiWsRoXmVJw+nTSYvWLiMI/vuABXYPPn1
-Tc6yypXgtezMNtUI4fxJ5pU5aHMKL4+XGtCcACyazoVZaUam1DulWUcDhuH/4Om9
-FhcPOT6WqhWjn/zZLW6Rr5OvXwoF
+ggIPADCCAgoCggIBAMheyYWl/STLJ0iwlrqNRyURatdeC8oDpKFdpglYHAs/jo3s
+fWNySCnaw6NCe0vxFLpqcK8VMNFRGu/XhR/kZ1YR3V4mLwF1Wa5v7a7J9swq50Fk
+CsLtaU5vq/h6rIpy0NLnmN5KgqChrMh9IwZ+Mc8sqc/0BFFJsuCCGu0TNlGVOhmN
+AbdS3s7wEUwT023CKn47G3pVqeaErEB9honz1I71g5/jNKGe5CLCV35ExzsrzU43
+atyJ0jgh15PYCXDTdsRccSmEs2S6Xh2o4ZhlqioWB+tKxGsdxq8Ri4soy6yyooOz
+T/3X5CHpKxiI2P9z38Pr9egPcNPPVMGDhzwHz7p3iBPg0RcWd5VP2nimLJsdGWK0
+bkU7zlQ3R2NelSIW9Hr8MVASihmELvX+AcC6KhTpHHhf3CTPgcAfV2fE9U84Xl2i
+shmoEsUQTUx97qKUOKRfY6o+WMBnVkzlqWj+s52ndiT+0KNLTDtvlejEFf1VSF43
+IkS9UJK+XxxEnvIBzNKI5EbWlG5Z38/nKv6pjTXFi3aZR4cdmI/0XfAjLTkrTBaW
+lkguEjt+/cxPYJOqt50ldI9kle8XTu/HibmcbU2wYIF21CBjE/hLk/KY3FQlnTFL
+y7x3bM0CuTfJ8Noy59f3l56fwPOpaQWqhqO+UoFkbFlbROAiVxfb8KlyZPdNAgMB
+AAGjgYEwfzAcBgNVHR8EFTATMBGgD6ANhgtyb290X2NhLmNybDAPBgNVHRMBAf8E
+BTADAQH/MA4GA1UdDwEB/wQEAwIBBjAfBgNVHSMEGDAWgBTWntryJpCwZqZJ1H3n
+znJYhbfoKjAdBgNVHQ4EFgQU+f7h8O2ttBHtwI4OZnpD9wU09GYwDQYJKoZIhvcN
+AQELBQADggIBAE8gulfly5+EC8DX3K02qEYPoQwVbVhD0wGrlAhgJiakDvPlX6/K
+vSe/1nNRG87jXvXdDiuJ6F4iKZpeJndzvx/8ZEmllyyxDwb3UOmylwW/o3/Uh6fY
+kiVBfW6uNNB0BfDKcXDDZgKjTg3kLT5z8m4u8rPoIPFkLFl9AuAq82Ll6NQ+xZFP
+lZ3K6HN+ntVnIGP4XkOgEYPxjJO3yTGle8VBqLfo/JKwbZtKfNXxSAMRXiP02SQg
+D9yshxkonQYWog2hHz8oDuQQNbzaAFlxnY914av/XwxP8TwEfGNchNtAtrlGRlx8
+PjMfp3Mnbz71yp+L2We2/A7njIPbEcn0FIBedpNyyBON5Cd6Xqx18otmMTtUILZ3
+SUKeYmLp8soVMEmmnWz6y1a4bCKwo6hA8oSoq5ydIeWy/jI9v7DF0S/qZTz3c2Q1
+a3aniuug2FRAxuU/8fSlMrE4672d3505SbHUblhy9XzQ4+sWjkDtYnY89kyY4BTu
+W5n6JlVoewZGOjlJ9/6mV6BVLQ74IeiytWtdH5uOQ1wroi5Kq+EroGgFmPSQCIvN
+XNDvBCNFN/O1+/eVZd6JNx6NMO7DrWql3GFMtJE8u/SWXA9vit3pfmeDrosZ4SDg
+ZPt7+JfzITUh2UMaPsQsPF8G8/tYmxDbELE5LjFcQ24ps362rG+q2rfA
 -----END CERTIFICATE-----

rust/pv/tests/assets/cert/inter_ca.invalid_date.crl

@@ -0,0 +1,20 @@
+-----BEGIN X509 CRL-----
+MIIDRDCCASwCAQEwDQYJKoZIhvcNAQENBQAwgb0xCzAJBgNVBAYTAlVTMTQwMgYD
+VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
+MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
+cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEPMA0GA1UEBwwGQXJtb25rMR4wHAYD
+VQQLDBVJQk0gWiBJbnRlcm1lZGlhdGUgQ0EXDTI0MDMxOTE1NTIzOFoXDTI0MDMy
+MDE1NTIzOFowFTATAgIBvBcNMjQwMzIwMTU1MjM4WqAjMCEwHwYDVR0jBBgwFoAU
++f7h8O2ttBHtwI4OZnpD9wU09GYwDQYJKoZIhvcNAQENBQADggIBACgakUDSN7qq
+ATkeMC0PpwymGBu6i3Jd641BKDhwe0yG9rDa1ppm1W9z/z64LrzKSSeXJ8Hc07wP
+E94ODXqouo0WlGK4HnxGJ2QwHPJG69bYfcJREQw0Df/dTjlatyIc95QSsmChKixu
+3goFe1laa421bUDIFr111Zv+4DV/LDoPZSQvRe0xHvouZNAQ0rQ8T4gVJkU6w/dW
+636DvyXpW6/LyBTH4Nf4PHWjP6PTgzOW8+yX0RwCpHegwAA0ehEJZ8HAvW7VQWA3
+uDdfB8j9uxyKQeeIkYLkK/Ds5P0nN8Kd/6OKGlF+9mRCpEQ0n3tgQa1q7tn9blVL
+9yu3mmTbRB3YTRUCy/B7Wc8AwYE+k56wZoYpa7GI7mRYe7Vwhs6PeFmJLcZ3ByOl
+1eeR6yIRzSbS50rVNOeaez4o0hjGEj82OJpK1THtB8pnCCIE5eZ8NI37WZGcPvMU
+KbNC+JjX+rlcnK7NTdS7eQZjcKOYVuDZ0lW5n+TaXKTLL24tuA+oV1SbRZOZN7QE
+5/31A/1dCg2NDLKLNsSlq3A2DAJE5SOMSNCq4V+WGp36LAlKlNvYfHrcRxBEM6bp
+Qa4xCrcUINJ9x51wd0h5+5DilGdpoukSNwnSbMTBG7degdh2DGT4MqJ2Y1+puL9n
+7EmMLPMyTYK/tB4ZsbgV/z05Dyngi3Ut
+-----END X509 CRL-----

rust/pv/tests/assets/cert/inter_ca.invalid_signer.crl

@@ -0,0 +1,20 @@
+-----BEGIN X509 CRL-----
+MIIDRjCCAS4CAQEwDQYJKoZIhvcNAQENBQAwgb0xCzAJBgNVBAYTAlVTMTQwMgYD
+VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
+MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
+cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEPMA0GA1UEBwwGQXJtb25rMR4wHAYD
+VQQLDBVJQk0gWiBJbnRlcm1lZGlhdGUgQ0EXDTI0MDMxMTE1NTIzOFoYDzIzODgx
+MjIzMTU1MjM4WjAVMBMCAgG8Fw0yNDAzMjAxNTUyMzhaoCMwITAfBgNVHSMEGDAW
+gBTWntryJpCwZqZJ1H3nznJYhbfoKjANBgkqhkiG9w0BAQ0FAAOCAgEAFSRriQnY
+3LIc9AHCGYZM+BFfaDnQCiwUx2PuYownMGOyDOu8xjBBIgNgLsNsqVLBQqP/tOdz
+9WpIQd2VXbj8o2UaHZullRbJNJoNHzuC0KsdYuvZVooJ46nJONCo6RwsapiLlXnf
+Y/c//Ynqmk8xBZZpB4pAZKKq0D3eoeNFPJGWSwRa5AfQx5qpbikntK6khIBb8c+4
+NfK6VMpEsHZQUG25fdLIpDOV2nnhRd2Xbcu/THFeCV2VnI8yoormOeiJznRJq1bv
+C4+jmW4NUAvFUFbcBRDpuq8LTIQUYuQYs018aCOqTTpMTTV5Q1iWuTZtAbO91UJp
+APEtEJH+/Wd/xB5ABk19bMiyxbCQeoLci7US0YEzASeGLH3Z59swwMvkGUhc2UvE
+Jtpx0unupgdA3lCpa/nDYwuFYCqmZ1kKHYtELC7WUldzd8K/J8XkNF4UIreTTD/0
+kLC3UZEKuoIj3Lv4GrnWKcIdQ51jUMdbTUeIdWFzjqdxFq4i6oqgWA5Hjcr3yDcM
+ATjxVDLxeLC+fJf6/SQu+7dOWKPKzIS8BcufmZpkRoxrt5qmgoJHuceps5pdfa0B
+dy8xEb9FnGNSuLec1rcUPPFgCioSgDFoQiU0aoToW/kDVTA6/PHFh6TD6Qynmc4K
+PtMu/kCMWULgMi68svcnA7NxpoKAsCnQH6c=
+-----END X509 CRL-----

rust/pv/tests/assets/cert/inter_ca.key

@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQDIXsmFpf0kyydI
+sJa6jUclEWrXXgvKA6ShXaYJWBwLP46N7H1jckgp2sOjQntL8RS6anCvFTDRURrv
+14Uf5GdWEd1eJi8BdVmub+2uyfbMKudBZArC7WlOb6v4eqyKctDS55jeSoKgoazI
+fSMGfjHPLKnP9ARRSbLgghrtEzZRlToZjQG3Ut7O8BFME9Ntwip+Oxt6VanmhKxA
+fYaJ89SO9YOf4zShnuQiwld+RMc7K81ON2rcidI4IdeT2Alw03bEXHEphLNkul4d
+qOGYZaoqFgfrSsRrHcavEYuLKMussqKDs0/91+Qh6SsYiNj/c9/D6/XoD3DTz1TB
+g4c8B8+6d4gT4NEXFneVT9p4piybHRlitG5FO85UN0djXpUiFvR6/DFQEooZhC71
+/gHAuioU6Rx4X9wkz4HAH1dnxPVPOF5dorIZqBLFEE1Mfe6ilDikX2OqPljAZ1ZM
+5alo/rOdp3Yk/tCjS0w7b5XoxBX9VUheNyJEvVCSvl8cRJ7yAczSiORG1pRuWd/P
+5yr+qY01xYt2mUeHHZiP9F3wIy05K0wWlpZILhI7fv3MT2CTqredJXSPZJXvF07v
+x4m5nG1NsGCBdtQgYxP4S5PymNxUJZ0xS8u8d2zNArk3yfDaMufX95een8DzqWkF
+qoajvlKBZGxZW0TgIlcX2/CpcmT3TQIDAQABAoICAB9LwM2tbLHdwkvF+zD1ppZZ
+V1b+szgxI/ppSmj8uFqgaXds5/PLso5JA1QhaukkZVCtld6e4HJdKOgrwTkHP4Wv
+wiP1slNXvTNz+4uYs4HVtKufwNeL5e4Qnqtvm7n/L3M1pciYmjkVL4vcEceul8CM
+cRSQQEljCburzqFXZh1NgdbiUZGM8cygLg90LEqhMGppeIP908zzzYTAJm6vJTTU
+D6Q+RGb3DpqIQMqx2u14zLcqDDiYlTtbu9R1gpn7CXqnlqw9tBhoTJF04pGfVXn/
+2WpMkgvKCZGoG6PXciKN/zizXevf19vdE7RgEYaq1lk/ZngBy2Vl5Y7ZKJr9fFoU
+hdZq+w8UroAAzRIiLrbnGCt0+tK3rBC/DvtffNjvwjvphGaxKiz1pZdegZ4TsO+y
+zd+Aa6Gb/XCf5TIakFaYXPTpKj0UMi/TVKshblC9JWr3cuL3EoGJe4XtqxS0cGiT
+llLDTbiS4eSAM6S6Mek55jsD8KCGBrROp+A0Wc7nUinWfKXThJYvzOm4E0gSlvbN
+Fg9LqlbK47vbtSyAmfNcdl+C5oHVwE5p5AkZV8hNQOVusfs0aLufvWC+NCGLyJ/d
+wuMmFmx2XkrkhD+BsuhP1grkSjJLpKfufCzP9NBKXRzDMReiOI40AjL5Rm9ZVOc4
+99B1CuyCiWG4BPUVlj3ZAoIBAQDs0nMc6lOY2VVkAYe6B5SmF94nMUzmegcIC4Hi
+oP0+4X8M2GfAiOKAb9QaMgrNnjOOeomYMUtfUhueRkXhvt5ssmalYCTLAuskApJ0
+UM34UfpY3P3V3i69hOSdpPje6bsorTMOWheNiMz5XKTWaVnk27Ou2fAuChHuLbmC
+ApeMEYd/VgbwgdtOpLaJGPt0cQ1FhbSsoac4tHMLwN9GpVegts/WZZb0bzjXDLEY
+RcfxcYCO0FJvfaIyfr/JEnw0CsLrkDdIVcsG+QiebygxV0CiDzCeHUgd0uLNq+X6
+fXqqQh8KUMHVHuFwGpEljpxvHqXQFq5SaEYqq7m9tGTcrHS5AoIBAQDYmKgHWG9a
+lz+usrwoxuHkzPJ+lpqslEVNs60nPf3aI6+bYjsOI7MNT7QkGQXdQ/aErWqzAali
+566f3sUsDz2z/jaMGZYElqgF5sQdIAFTihPS5fkX7mcF5Nqst2tQz1rogEwWgJ14
+XSQFCogASkxTEjD+/1kmuaSsc0NuOSkh4Wcxohla/7GQaiWnTBLnZ9axobLmmT76
+vf4mGqAWmNNenHRkUY+ZoYF1xLpR/60OKzQTdUrL5NZB3bL4n3+ViOI0JE3VZYRQ
+PP3/tTr/NwwhTbkxpw/pNhbFIItPM1fzmfieGfgZlqmj5EXgwtGG2qlFPgR+9tWw
+uJwf4bHUerU1AoIBAQDDXRj5UZWFEkUPKvP80yQdoLLzQgheWWxThqqven9v0DYv
+MpbkjgfMTHR856th1JBTiWLY2lGDYQjHmNEtWXfD06g55QZ1MwMnwbdvnPlNUNNl
+W2lLdO66CVdPdTiZK9fpxnfH7ype5+uwCm0xM9ekpFmmdMNeN5BzG+VdCyZZtlxA
+/4baAUYZqmeq0aEefeSk5ZgWkYSRkssVdxa6AMw5GJZ8F3JgUyBgx2eQzoAS/b9A
+ETrwHoQfg9BS35z2kaobCe2RDrVeGzKxAKH3kjMPfdhtl1pWwBG5+YTPD5SRv9o7
+eENuvPrcsA3tHaiPQoknEI7eDIdVzDR9+sL6CIqBAoIBAQCcY90vMJN2fa7lnPhv
+GOsSIUkWTffwlD5WFF3577DTSOEK+KpbUzt9aQdQ6SBq2x+sPOrFxXVgjJhxppAH
+eBm9VNhd4DuJpJ49ZJpFzU4n25LkvFhXBzQr9UpPW0CJYK7rIXfO557LwbS4TxpT
+21GwyXnHJOhiJbjZK4CMnYkthWrVU42rPuQeugXl/e/IVhmWuIJMLmpi8bwIF0Fw
+D3jO33jK1nkxHIQ1XI6LlmiFynwXcKFJBzoM5N7M1Z1xgxyROYVZh6s5pFBhyaGH
+lV+UzGHjkBTU9tEKFK2Byji/E3WH8ohJMZfbVn9+Aiz3ifqenGDyq5cvupxACN41
+5UPhAoIBAC51vwgPKuFNXU/pipkRMr7S+Ew7N5rVij3dJhcaq0RMNm24zneKZoC2
+7b7zKd92zYV4RgviUZEiSmiGXbEvVkNrSZ0BESRt8C7dfqDZx8E3+LMH2Fz2Q3CJ
+EJjEGiQuDQuyx2ICs5ETvIFzxy0A+uRbsrjJHbikizvPbX6qY1F9q4m3GAxU1mlv
+Nj548F/eL13gCUVPfmcbkDXKXDjeMydogPqcH20/d+88Cl5puFV1KwBptmJ/2WVP
+fcVKpeLL1DvWsd9UikzYuLXP3tGs47aPPKqX20lQoZWW+su6uWXi62WuOSPckHF0
+/y+kPmf1RQh8JbiNv7ddFdj4eUReLOo=
+-----END PRIVATE KEY-----

rust/pv/tests/assets/cert/root_ca.chained.crt

@@ -1,56 +1,57 @@
 -----BEGIN CERTIFICATE-----
-MIIGXzCCBEegAwIBAgIUWAen+5+bRZaL8kVlq51CXPQUdZUwDQYJKoZIhvcNAQEL
+MIIGXzCCBEegAwIBAgIUd6BiIEGe+cX502NGGPVuMHrV0ucwDQYJKoZIhvcNAQEL
 BQAwgbUxCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
 ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
 IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
-azEPMA0GA1UEBwwGQXJtb25rMRYwFAYDVQQLDA1JQk0gWiBSb290IENBMCAXDTIz
-MDMyOTA5MDQ0NFoYDzIzODcxMjMxMDkwNDQ0WjCBtTELMAkGA1UEBhMCVVMxNDAy
+azEPMA0GA1UEBwwGQXJtb25rMRYwFAYDVQQLDA1JQk0gWiBSb290IENBMCAXDTI0
+MDMyMTE0NTIzN1oYDzIzODgxMjIzMTQ1MjM3WjCBtTELMAkGA1UEBhMCVVMxNDAy
 BgNVBAoMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29ycG9yYXRp
 b24xNDAyBgNVBAMMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29y
 cG9yYXRpb24xETAPBgNVBAgMCE5ldyBZb3JrMQ8wDQYDVQQHDAZBcm1vbmsxFjAU
 BgNVBAsMDUlCTSBaIFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK
-AoICAQD0gnTWPpI/FahyE+PizunOHzNBi88KObopjL6+6p9J10RB82pDxaLoMxPo
-6xkm0ZKiFea6ll6sAfcKPzCei+3691sCOiGN/JYdSZR+SynRGeD1o8KJWAwfmZ4w
-DNHWHRqUE6u3oqAPDQUqaOnzyGdh2vGLP3HU5F5rIDhYzilm7WuXykYdiF/P6Rjs
-xzzQZOxHTnvV8byEDN0Sw0ONsQSFee0uM22e20Kme34A4p+p7QBiRFSJAQyLtp/o
-YBY8zeIgekr+BppRbCItEFAgHBS8DLk04jhNfGlU5RteaOJe7D6tg7z9CC8X0dAI
-/p1vJkz5zYMPGuoKKaowDAJ+ncwN+UDYhbd4g0ATKC7M5DFmn4Wy60G+3op2BNp4
-PadcsOcXwzKsOSQix0+n4Tfw1QQ07+ilBHBe8fCRpk2Nf/byYuEaBjPBTXUcpTsp
-Ydv0s5HjSyRfhEWKMQBOIn6mSORayTJ1/xQECrOfuIopLiZyMCjhixT4PImiGucM
-ruCmsHZvfA/8VQxyEcPK5K+XqFaSr5r423C4CzcafHhvUFOYj2WmJyZzWc2X2fjo
-l+ZspNpQTlvYgVi2cTeBnbNqCNMcTiGoyie5roHGa4CnigHuBIVSuUVGq/rqFKnT
-KgKboI8C3XpQID6rFcYY444wOpfea8LodHTXFF6o8A5m+6QlGwIDAQABo2MwYTAP
-BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAfBgNVHSMEGDAWgBRJTc+P
-Ts7kYFuicyYmOttP7ItAazAdBgNVHQ4EFgQUSU3Pj07O5GBbonMmJjrbT+yLQGsw
-DQYJKoZIhvcNAQELBQADggIBAFCGlLEdAsicVPPuekhdfOyoK/P6r5JHnPIpC894
-9TVUp/7LBvDOwcNAvs+34dsbfRtMmwXUCGofrS4S0+zugnpgx6D1ScWC+FNdBJf9
-C6XKBiU4Mxn/mKWTDUMBCxI+RRbpOvOox5h6pQcfo0IYz5okazol1nT40IdvNkZ7
-WDAz6Xqmw8k/+8Y+l1fDSfUqcgPnTBfgX3kkna8VHBx74nSqeFgOVvtd8BJq/xIG
-6rAkGsv/PzmQqKpyoD70N/nGALomLlVScX5qIbNrXWW0DWxY+kDwhRlskPdYS7RJ
-Qol3NX0t7GZ+l+0W2Kpp7k04n5xrJ7pzTDyltJJEeaLfqrMlF5MCK/UyJqxa3LQr
-IkP2wTxM4HR1gsIvr8ei3QFSBtxEGiQl2VWfBs8bwy+KkL1ao1UIcB+1dj4SLy8x
-RqNFNfogkyLL9cELiKxViRQgNYowv3OsSw30i4eSHMor8m0qfVf38t7gi+m0Ba+T
-+RIV5MlZcjG6C3jS8AMpUwXO4hOxGEueuXmZuCDmyypqRpMJc0hu2JA1Q9fztvfn
-hnOAv6K++5hB4mIyqUp8/QJjO9X2kKa4+MmbuNTnRuC13s2f7pzHjZR3cFf6QN5b
-duxTQZ18xvqXIR6EV4PVwShjCMS6NHmkmumIxMzaDK1mGwL7l7B0ZS+r3i7qwGPw
-2iYv
+AoICAQDMw/UE5XNiZpjuCRtyq4A9PDBuJJgyUl14xvN8lcsLHGK9b/WkQdDxUXsN
+QbvS2HVkg2X6AGHwixk/3U0mzgzImZhmh3i0IbFn7L2eqpuvgP82BJpveq58Sjsk
+OHYuG2JqSv63reKtK8pLXtKZnSV9vFUAwxWSuqA68FLwDgjGMK/Iy3Hh+cwnpffn
+IMqJ70Nlxc7z4KKO4nrO/+rIQSqe0UpjEEaK4Eb3YXWWontaah3/sw+uAbVncJMV
++AacHQzi130sJJeLe4p+8DD9EYX112DEj6WFrHpyEqhsGXvLO7uJRzMqJ1WVz47x
+j8wK+GPm66KCeOM+wm65u49vNHDotlQzoclIzLDiegQo/3ob5YRTFNDJzbNN6AAE
+zF8K7f8t2TNYeWgPOmXLEVmFalOSNTZ5sLrJipsYs7uT7CT1orW3PvM16v+knigJ
+NuryIdr/+hFgRh7Sr4U/6H6fDuZGJXgZeUSNM7S1UI0iFTZyKAP/3EQrhRWlIROs
+ql9rFnH0LWaPcmk66Yyhq6Va0dmLBSjGPWAHLguKyHkMvhJfMd/1miGfz9Rz9LbE
+6CqOK8sf6EQNWTgmpTdXgjmR9dvMk3ki2aar0u+IamzfIx3y0OPSlpaO8mFMucZe
+3iaeG/l84sUR93NgVI2dCdtEinCQviudV+QwRdLzZQQNM5zLzwIDAQABo2MwYTAP
+BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAfBgNVHSMEGDAWgBTWntry
+JpCwZqZJ1H3nznJYhbfoKjAdBgNVHQ4EFgQU1p7a8iaQsGamSdR9585yWIW36Cow
+DQYJKoZIhvcNAQELBQADggIBAHw/+RKyDRBsvWksX4ji95W+4uo292psPzpeusjw
+Ztl25D4jssgjNbEiNwyYgV9e9BCse9hOkFwAE6ogwBAel7POX8XjizaJcwSs/GaC
+2ORQ/KYRpMsypENZ4HZQbc8j9ROqTDD45B+9/5nAA6le/7wd0yS8hbum/b78vAN1
+98Ja8wfQIq1PE0heFELSRR2hAmcGkxIo1tBqP/CnAzOpBZ2ovPJ75oeGlnpk/ATY
+rUJPTY0UPGp9ZSq/l+t88onDewjCblMMMBeJSEklP2CFlE1jGx3QJtnThiJ9WQKG
+TMakgaAERrcvXs6Lx2GFuk7kCOJsWJtvT6CJVCUtEBHNGY3GqyQwNrE3OEVQ6CFb
+CNNarrRKlArBISExLY3xn0CcuWr8GewsIvwzmJBX+u2Xs0s7RYFc4S4s/SbRLqi4
+Gn77E7dG711nKHXwDxYOuDAL0MNBT4aDephQK+rF7GlHMLTUPWKYCwmjh2vzmRWJ
+fZkojybvX6g8+7fKmwTUn5LXlcnmjv9KYN8LgfHSQhvRaGtGph0X8mVH3eCs4MGG
+OUU6p9wdPS3MDBHRzn0MXEhq25r+xT829lcHdoxkMVorVDTDD7hOm3HBsF/LOh6c
+/sA1LZnnfy+YZt+Gn5cE5CSK3ddmzRbrB+ZHWbJahegJktWq2rrnw9ipfRln7DJF
+fsHf
 -----END CERTIFICATE-----
 -----BEGIN X509 CRL-----
-MIIDGTCCAQECAQEwDQYJKoZIhvcNAQELBQAwgbUxCzAJBgNVBAYTAlVTMTQwMgYD
+MIIDPjCCASYCAQEwDQYJKoZIhvcNAQENBQAwgbUxCzAJBgNVBAYTAlVTMTQwMgYD
 VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
 MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
 cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEPMA0GA1UEBwwGQXJtb25rMRYwFAYD
-VQQLDA1JQk0gWiBSb290IENBFw0yMzAzMTkxMTA0NDRaGA8yMzg3MTIzMTExMDQ0
-NFowFTATAgIBTRcNMjMwMzI4MTEwNDQ0WjANBgkqhkiG9w0BAQsFAAOCAgEAzXCT
-KYc+J3XC49cCzdJBRzXdVk8AqylNFCBC/Z4a9AaPnFgUHIZqLcucvVTBMlYkzQST
-7lu47hksCrlePGeY58goa8rOUuTjH0Gk/809oMNMxyJ3UjuEq/Q45gDeKys8UZqu
-qrgHZ1dnBB5ARdPEhkMLzBgizrknhPXcAyg0f4dy8wFPCNJ0T+DiNdqKoQCZNsxD
-3p1N3vTMIO20oWbX9cDZoY2Xb0rT9Cbt7ES3JY1DB4Z92zPB5ZxFuCIsxT3Jtszd
-fM6YktxJbUvds/mqwmYCbQNZ4veS5YcrFPVVSADjnwP88GMbIQddAvXLOhjrUj4B
-QEMndtREs0MvkDZdc/YkTEI/c1QF1xNT+UrMOxC0sEHSvcOQXNtw579QJ0gucA2J
-HWWr6p2wTDrIefhppBQS0GSY2n7L1loKAZZNWt56TQoXRFWI4CtLJJTsPKIHWTQz
-KLBgv5UlOdbcuh1+foY/XS8prlZvMS22oiDMLIknBR7ywYuYEq9YPKzDXWAL4mHk
-DInbBQEYC2ar7wiLLBOM/2c2BmkzDdygChj7/1xvNYMGXEnak0Y/V75uAuWQ1h0T
-3e52xW2RzwjYsoM04WBsSJFNd7VYSuSX7SneJywrSBneB+XvB7tcVaycsA1f3BMT
-ptsIMqT9/N3++8MGCb/SRWoWFlLjITR9l5y3BUU=
+VQQLDA1JQk0gWiBSb290IENBFw0yNDAzMTExNTUyMzdaGA8yMzg4MTIyMzE1NTIz
+N1owFTATAgIBTRcNMjQwMzIwMTU1MjM3WqAjMCEwHwYDVR0jBBgwFoAU1p7a8iaQ
+sGamSdR9585yWIW36CowDQYJKoZIhvcNAQENBQADggIBAIs4Y7Qsk2TAJQqdNQeM
+3Gjx2fYFHbliDRVQPU5OP19ppeUzFGRL/SRplCH4rvEj4bBwQZcsNdmzxYyFbWcz
+lU38l5/mgkLkPdHzRnbPmVraWqKzuvNrTQ3Lj5VcgOJ95UAOwOIg2jWZlkIAUgO/
+cayWJK7l0gOIDCKSyuI6haM5D6wNAwfyKZ4WkBgYulCeqRmsMePvsj/WYL1tcR6Y
+1WSN6FtvLn9u2vqrJ879BEH5RDQSkCXsxBqKFnOpLf/gpRYhRp+3JpSACXOzy1wr
+8KxlvZ/14UOhz4x8VZ9GJTzLydzLPIhNTwcl1PJyD3pOhASxfdSXuR8f3jJvAGv5
+kaj9uO23sKU4PzLfr/DPFkhKsp+vShoSGtnZjj7ewYW9Y/PY0D9TX8CWIcwKuJ8U
+XTWRj9s/FLTlqfrbJXvSaRd0rihGQI+mSwar5cnBuxULgw4V35YmTiY8wCf3+k9c
+tGRRUj5A2fVs9NWWTReBatoou8Rnuraz6ctqwFsxJQSGS1JpfECznGq2wKqLstKn
+WCMEAKehcGqLlSco7Hg2qRNgDw5AAC058drRf9L70geV4Tf00iXjK19aHSJ1wH+p
+7hUcTCiQ7413ztC7HawqsRW3Yzszucj+6vqF8ZYMh+9oEzzWJEt/piKakIwbxwKk
+cf5JE3KE7X+LQS3p4+sw/wP4
 -----END X509 CRL-----

rust/pv/tests/assets/cert/root_ca.crl

@@ -0,0 +1,20 @@
+-----BEGIN X509 CRL-----
+MIIDPjCCASYCAQEwDQYJKoZIhvcNAQENBQAwgbUxCzAJBgNVBAYTAlVTMTQwMgYD
+VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
+MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
+cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEPMA0GA1UEBwwGQXJtb25rMRYwFAYD
+VQQLDA1JQk0gWiBSb290IENBFw0yNDAzMTExNTUyMzdaGA8yMzg4MTIyMzE1NTIz
+N1owFTATAgIBTRcNMjQwMzIwMTU1MjM3WqAjMCEwHwYDVR0jBBgwFoAU1p7a8iaQ
+sGamSdR9585yWIW36CowDQYJKoZIhvcNAQENBQADggIBAIs4Y7Qsk2TAJQqdNQeM
+3Gjx2fYFHbliDRVQPU5OP19ppeUzFGRL/SRplCH4rvEj4bBwQZcsNdmzxYyFbWcz
+lU38l5/mgkLkPdHzRnbPmVraWqKzuvNrTQ3Lj5VcgOJ95UAOwOIg2jWZlkIAUgO/
+cayWJK7l0gOIDCKSyuI6haM5D6wNAwfyKZ4WkBgYulCeqRmsMePvsj/WYL1tcR6Y
+1WSN6FtvLn9u2vqrJ879BEH5RDQSkCXsxBqKFnOpLf/gpRYhRp+3JpSACXOzy1wr
+8KxlvZ/14UOhz4x8VZ9GJTzLydzLPIhNTwcl1PJyD3pOhASxfdSXuR8f3jJvAGv5
+kaj9uO23sKU4PzLfr/DPFkhKsp+vShoSGtnZjj7ewYW9Y/PY0D9TX8CWIcwKuJ8U
+XTWRj9s/FLTlqfrbJXvSaRd0rihGQI+mSwar5cnBuxULgw4V35YmTiY8wCf3+k9c
+tGRRUj5A2fVs9NWWTReBatoou8Rnuraz6ctqwFsxJQSGS1JpfECznGq2wKqLstKn
+WCMEAKehcGqLlSco7Hg2qRNgDw5AAC058drRf9L70geV4Tf00iXjK19aHSJ1wH+p
+7hUcTCiQ7413ztC7HawqsRW3Yzszucj+6vqF8ZYMh+9oEzzWJEt/piKakIwbxwKk
+cf5JE3KE7X+LQS3p4+sw/wP4
+-----END X509 CRL-----

rust/pv/tests/assets/cert/root_ca.crt

@@ -1,37 +1,37 @@
 -----BEGIN CERTIFICATE-----
-MIIGXzCCBEegAwIBAgIUWAen+5+bRZaL8kVlq51CXPQUdZUwDQYJKoZIhvcNAQEL
+MIIGXzCCBEegAwIBAgIUd6BiIEGe+cX502NGGPVuMHrV0ucwDQYJKoZIhvcNAQEL
 BQAwgbUxCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
 ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
 IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
-azEPMA0GA1UEBwwGQXJtb25rMRYwFAYDVQQLDA1JQk0gWiBSb290IENBMCAXDTIz
-MDMyOTA5MDQ0NFoYDzIzODcxMjMxMDkwNDQ0WjCBtTELMAkGA1UEBhMCVVMxNDAy
+azEPMA0GA1UEBwwGQXJtb25rMRYwFAYDVQQLDA1JQk0gWiBSb290IENBMCAXDTI0
+MDMyMTE0NTIzN1oYDzIzODgxMjIzMTQ1MjM3WjCBtTELMAkGA1UEBhMCVVMxNDAy
 BgNVBAoMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29ycG9yYXRp
 b24xNDAyBgNVBAMMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29y
 cG9yYXRpb24xETAPBgNVBAgMCE5ldyBZb3JrMQ8wDQYDVQQHDAZBcm1vbmsxFjAU
 BgNVBAsMDUlCTSBaIFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK
-AoICAQD0gnTWPpI/FahyE+PizunOHzNBi88KObopjL6+6p9J10RB82pDxaLoMxPo
-6xkm0ZKiFea6ll6sAfcKPzCei+3691sCOiGN/JYdSZR+SynRGeD1o8KJWAwfmZ4w
-DNHWHRqUE6u3oqAPDQUqaOnzyGdh2vGLP3HU5F5rIDhYzilm7WuXykYdiF/P6Rjs
-xzzQZOxHTnvV8byEDN0Sw0ONsQSFee0uM22e20Kme34A4p+p7QBiRFSJAQyLtp/o
-YBY8zeIgekr+BppRbCItEFAgHBS8DLk04jhNfGlU5RteaOJe7D6tg7z9CC8X0dAI
-/p1vJkz5zYMPGuoKKaowDAJ+ncwN+UDYhbd4g0ATKC7M5DFmn4Wy60G+3op2BNp4
-PadcsOcXwzKsOSQix0+n4Tfw1QQ07+ilBHBe8fCRpk2Nf/byYuEaBjPBTXUcpTsp
-Ydv0s5HjSyRfhEWKMQBOIn6mSORayTJ1/xQECrOfuIopLiZyMCjhixT4PImiGucM
-ruCmsHZvfA/8VQxyEcPK5K+XqFaSr5r423C4CzcafHhvUFOYj2WmJyZzWc2X2fjo
-l+ZspNpQTlvYgVi2cTeBnbNqCNMcTiGoyie5roHGa4CnigHuBIVSuUVGq/rqFKnT
-KgKboI8C3XpQID6rFcYY444wOpfea8LodHTXFF6o8A5m+6QlGwIDAQABo2MwYTAP
-BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAfBgNVHSMEGDAWgBRJTc+P
-Ts7kYFuicyYmOttP7ItAazAdBgNVHQ4EFgQUSU3Pj07O5GBbonMmJjrbT+yLQGsw
-DQYJKoZIhvcNAQELBQADggIBAFCGlLEdAsicVPPuekhdfOyoK/P6r5JHnPIpC894
-9TVUp/7LBvDOwcNAvs+34dsbfRtMmwXUCGofrS4S0+zugnpgx6D1ScWC+FNdBJf9
-C6XKBiU4Mxn/mKWTDUMBCxI+RRbpOvOox5h6pQcfo0IYz5okazol1nT40IdvNkZ7
-WDAz6Xqmw8k/+8Y+l1fDSfUqcgPnTBfgX3kkna8VHBx74nSqeFgOVvtd8BJq/xIG
-6rAkGsv/PzmQqKpyoD70N/nGALomLlVScX5qIbNrXWW0DWxY+kDwhRlskPdYS7RJ
-Qol3NX0t7GZ+l+0W2Kpp7k04n5xrJ7pzTDyltJJEeaLfqrMlF5MCK/UyJqxa3LQr
-IkP2wTxM4HR1gsIvr8ei3QFSBtxEGiQl2VWfBs8bwy+KkL1ao1UIcB+1dj4SLy8x
-RqNFNfogkyLL9cELiKxViRQgNYowv3OsSw30i4eSHMor8m0qfVf38t7gi+m0Ba+T
-+RIV5MlZcjG6C3jS8AMpUwXO4hOxGEueuXmZuCDmyypqRpMJc0hu2JA1Q9fztvfn
-hnOAv6K++5hB4mIyqUp8/QJjO9X2kKa4+MmbuNTnRuC13s2f7pzHjZR3cFf6QN5b
-duxTQZ18xvqXIR6EV4PVwShjCMS6NHmkmumIxMzaDK1mGwL7l7B0ZS+r3i7qwGPw
-2iYv
+AoICAQDMw/UE5XNiZpjuCRtyq4A9PDBuJJgyUl14xvN8lcsLHGK9b/WkQdDxUXsN
+QbvS2HVkg2X6AGHwixk/3U0mzgzImZhmh3i0IbFn7L2eqpuvgP82BJpveq58Sjsk
+OHYuG2JqSv63reKtK8pLXtKZnSV9vFUAwxWSuqA68FLwDgjGMK/Iy3Hh+cwnpffn
+IMqJ70Nlxc7z4KKO4nrO/+rIQSqe0UpjEEaK4Eb3YXWWontaah3/sw+uAbVncJMV
++AacHQzi130sJJeLe4p+8DD9EYX112DEj6WFrHpyEqhsGXvLO7uJRzMqJ1WVz47x
+j8wK+GPm66KCeOM+wm65u49vNHDotlQzoclIzLDiegQo/3ob5YRTFNDJzbNN6AAE
+zF8K7f8t2TNYeWgPOmXLEVmFalOSNTZ5sLrJipsYs7uT7CT1orW3PvM16v+knigJ
+NuryIdr/+hFgRh7Sr4U/6H6fDuZGJXgZeUSNM7S1UI0iFTZyKAP/3EQrhRWlIROs
+ql9rFnH0LWaPcmk66Yyhq6Va0dmLBSjGPWAHLguKyHkMvhJfMd/1miGfz9Rz9LbE
+6CqOK8sf6EQNWTgmpTdXgjmR9dvMk3ki2aar0u+IamzfIx3y0OPSlpaO8mFMucZe
+3iaeG/l84sUR93NgVI2dCdtEinCQviudV+QwRdLzZQQNM5zLzwIDAQABo2MwYTAP
+BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAfBgNVHSMEGDAWgBTWntry
+JpCwZqZJ1H3nznJYhbfoKjAdBgNVHQ4EFgQU1p7a8iaQsGamSdR9585yWIW36Cow
+DQYJKoZIhvcNAQELBQADggIBAHw/+RKyDRBsvWksX4ji95W+4uo292psPzpeusjw
+Ztl25D4jssgjNbEiNwyYgV9e9BCse9hOkFwAE6ogwBAel7POX8XjizaJcwSs/GaC
+2ORQ/KYRpMsypENZ4HZQbc8j9ROqTDD45B+9/5nAA6le/7wd0yS8hbum/b78vAN1
+98Ja8wfQIq1PE0heFELSRR2hAmcGkxIo1tBqP/CnAzOpBZ2ovPJ75oeGlnpk/ATY
+rUJPTY0UPGp9ZSq/l+t88onDewjCblMMMBeJSEklP2CFlE1jGx3QJtnThiJ9WQKG
+TMakgaAERrcvXs6Lx2GFuk7kCOJsWJtvT6CJVCUtEBHNGY3GqyQwNrE3OEVQ6CFb
+CNNarrRKlArBISExLY3xn0CcuWr8GewsIvwzmJBX+u2Xs0s7RYFc4S4s/SbRLqi4
+Gn77E7dG711nKHXwDxYOuDAL0MNBT4aDephQK+rF7GlHMLTUPWKYCwmjh2vzmRWJ
+fZkojybvX6g8+7fKmwTUn5LXlcnmjv9KYN8LgfHSQhvRaGtGph0X8mVH3eCs4MGG
+OUU6p9wdPS3MDBHRzn0MXEhq25r+xT829lcHdoxkMVorVDTDD7hOm3HBsF/LOh6c
+/sA1LZnnfy+YZt+Gn5cE5CSK3ddmzRbrB+ZHWbJahegJktWq2rrnw9ipfRln7DJF
+fsHf
 -----END CERTIFICATE-----

rust/pv/tests/assets/cert/root_ca.key

@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQDMw/UE5XNiZpju
+CRtyq4A9PDBuJJgyUl14xvN8lcsLHGK9b/WkQdDxUXsNQbvS2HVkg2X6AGHwixk/
+3U0mzgzImZhmh3i0IbFn7L2eqpuvgP82BJpveq58SjskOHYuG2JqSv63reKtK8pL
+XtKZnSV9vFUAwxWSuqA68FLwDgjGMK/Iy3Hh+cwnpffnIMqJ70Nlxc7z4KKO4nrO
+/+rIQSqe0UpjEEaK4Eb3YXWWontaah3/sw+uAbVncJMV+AacHQzi130sJJeLe4p+
+8DD9EYX112DEj6WFrHpyEqhsGXvLO7uJRzMqJ1WVz47xj8wK+GPm66KCeOM+wm65
+u49vNHDotlQzoclIzLDiegQo/3ob5YRTFNDJzbNN6AAEzF8K7f8t2TNYeWgPOmXL
+EVmFalOSNTZ5sLrJipsYs7uT7CT1orW3PvM16v+knigJNuryIdr/+hFgRh7Sr4U/
+6H6fDuZGJXgZeUSNM7S1UI0iFTZyKAP/3EQrhRWlIROsql9rFnH0LWaPcmk66Yyh
+q6Va0dmLBSjGPWAHLguKyHkMvhJfMd/1miGfz9Rz9LbE6CqOK8sf6EQNWTgmpTdX
+gjmR9dvMk3ki2aar0u+IamzfIx3y0OPSlpaO8mFMucZe3iaeG/l84sUR93NgVI2d
+CdtEinCQviudV+QwRdLzZQQNM5zLzwIDAQABAoICAADiwh8UzQR6dCPndy5uTn41
+UfJQBzaEg7H/jlMWJMw2AblXECV3QWuh0hnzFFhrpkpahSjpMoNDXscXcnt9/bEq
+dO3QnTWORcGw1PsoOscuFCyMJYzg53tTKOFVuzEk3i6eh26M+oOMQnJEBT4z31Ml
+auq3bVL2qrXGj11JekE9Oa1xL9tt5LOxNJrT2fxxxAVfLy9/48Qhd62Ijt/x5DjO
+p/c4vU1hff0Y91TA/C6eceXGxQUYLcw2QPSh34lyWLlsfDaiK+OnE6jL6jJWDpHL
+Ljh7dJhY8CipKwBYtd/hsMR9wdtnUyf0P2aNHDFZ9LitgUT2N+lwFuGHza2J+QkO
+sJndo0bNZCRbcfyaATpqQK50fLHpSOkIaA0uNf8IPsgRHnC9oHimIM70/VB4xN5K
+8UJb02rVvAWsV2ZJEzhBXt3ivMwH6d+HKVerkjdhuKxUSO0x4ZfArZI0md6M2Etf
+b2UbMOyyTknWiJcYD65151rThGeyKRSW1GalvrwWwcAAWyabf61a681brpY0t/u4
+aZXBdg41DiZ8bnheK706+l7hpCt/Zg3d+HPVtG8xWreFZzWMPNAmuVcdqtEOqdhe
+aW6xDR/7ekdVjtzFboTVuq12JvMgucfXoYjqNA1TxvXIdl1eSWZzEnfXhDxDezpI
+ZUXfR1jdmyEucFXAlkjVAoIBAQD094bU92/iTkV3ySqDqd1a9gdfMw9ewi18TzWM
+fCtE+dWgvXE1RmzRmHaeKjElJaeAAc/ggXen1ecJmCRsD1wjItyP1/j/IzY/7yzK
+KtLV3w3oArENFwZKa3HeaHsapwladJBVC0CpaRnfO52VKDa/1gvDQsojOkDhngCH
+MKfRd5x4c4+WOuvTpfyQASLXJcurlIhabCa/MGIvhMRXcspGkkttZqxhLGoioAmS
+VcKhje8UuDLnBxCFrmIOVl5Hf8wT4TfOYWq6J5F/v/32dq8Rdf/W8KRIq0N5JDnC
+xFKGkm8QEFxNuSzzfykMcEhKGYXAYFKGIBRhM+nNGuFyqMB7AoIBAQDV/Oguqp74
+4inMMQTP8i3aYlASfU/l2OkNQE7JbxIClf52TzOCPy8v86FjIyx2iYPv2osI3RGi
+yVdDIYPXOBEQZQV7eHS3kuO5/lFw6psQVjMf0qdE9hGuZx3MnXQgol7mUEDS7Rjc
+e1YSkYPpdSd2y1Gsb84iZcbBgBPZsdjy81ZBrfP8bo3BVBtqQIngWCXvM3gWmBH/
+duNxtpvNBFruX2ZwaKcRJjfZ7V6iy2fzEYH84FPyiwj/COCtSfDgkFjCmEa2jepQ
++5r1VXFjeWwonfYeiwZ/WlIGDKhHNZG4XCni05CA2ZejDLmI3IKaMjukWNI49hhS
+ypLJj5n9a8O9AoIBAHrPfbFXO6hhRUKAf+fySR9JKPj5SENhZhxkOZxsw+SYvBkR
+4Kes3vFVVmKFFI5jCk6KmgUb4zkpa+LLe7cRHEghOiKDTDndFV2IMxRH09uVMAuZ
+DdpaKLU2mKfACbea9n164sFAGvLT1jysTpxwxMH4NX13BpASrGRwKiOcqQXCyZc5
+mErgz0oUdUJcz3K9aBZlKNbsUaCYSSE5lpWg3vfycA4w40r0UWF6ilHq3ODRn4Lr
+tdlNGWNrwY0ej7WYxF9TEf9Np4wcOj2pq1Dcv3gpiFHh4vrrobAiETMr6ZO95iBP
+k3cD1x1cKuApipRbp0qC/9xuSMlSlWxWhaBOKfECggEAb0NdBka4+fe+e+lQ8z6d
+ENvlfnehv4UVSEqTrLEP0EBlWua7hZGM24X1+DIlwEyoSWJ8wFMSBG5j7QfUIWeJ
+l9ivDRAIwBqkReUyO2AA2HG5i2Zgir7XWrNLD0UfSIikh2RbEFEviBSpIGaBDDZa
+Gq6E/P/1UnVQ7vPFXn/WqhxUUTo9jpd9JXSx/IEqL3gl4UYFvtm7IfWTNWEZiXQm
+Q6NfBDumAoi4qZt+hW710bDcwbtyar5YIyNejzvO/zSOsj+zJOCNYSYx4DZZCrvr
+vQLFIgRvkHBKDdMu/DeiWRWywbn3fMemzKSlI8BkOAC+eimkxPFQnFuwDxWXn+kU
+kQKCAQEA0EkmMxpI8eC47YeHXKBiACMsRiyiItXal7TAwy/ZQMg/nxrDB85f5L8B
+Zucw2UsA40/5EN/L6n10iaWBQzz7q3TcI15MmIzoBA7Bh9IJI9Oz1+oeOn01b9u0
+7cb+5Shh9Tmu2G4Z/9LE7wB8q9sU/BtJns6owFbGHL9q6ndtl7YVQ7uVzUQjNQph
+qp2DvA8qZYBkNRNZwYAMOJaAO8uhDBSR2wm9XiZ3Q9kar0Tx6sR9WK2pjZTE3okJ
+RUqzQS0EXQ2XLepP3rhYtjAjtlnx9K3jniIHciyFV2rW0SaGH4VvE/nRvCM12q/8
+p+5MT0G3vVdRQM0Poco3B8DElAoMTQ==
+-----END PRIVATE KEY-----

rust/pv_core/Cargo.toml

@@ -17,5 +17,3 @@ byteorder = "1.3"
 
 [dev-dependencies]
 serde_test = "1"
-mockito = {version = "1", default-features = false }
-lazy_static = "1.1"

rust/pv_core/src/uvdevice/info.rs

@@ -48,10 +48,15 @@ impl UvDeviceInfo {
         let mut cmd = uvio_uvdev_info::new_zeroed();
         match uv.send_cmd(&mut cmd) {
             Ok(_) => Ok(cmd.into()),
-            Err(crate::Error::Io(e)) if e.raw_os_error() == Some(libc::ENOTTY) => Ok(Self {
-                supp_uvio_cmds: (UvDevice::ATTESTATION_NR as u64).into(),
-                supp_uv_cmds: None,
-            }),
+            Err(crate::Error::Io(e)) if e.raw_os_error() == Some(libc::ENOTTY) => {
+                let mut supp_uvio_cmds = Lsb0Flags64::default();
+                supp_uvio_cmds.set_bit(UvDevice::ATTESTATION_NR);
+
+                Ok(Self {
+                    supp_uvio_cmds,
+                    supp_uv_cmds: None,
+                })
+            }
             Err(e) => Err(e),
         }
     }

scripts/dbginfo.sh

@@ -15,7 +15,7 @@ export LC_ALL
 ########################################
 # Global used variables
 readonly SCRIPTNAME="${0##*/}" # general name of this script
-readonly STARTDIR="$(pwd)" # save calling directory
+readonly FULLPATHSCRIPT="$(readlink -f "${0}")"
 #
 readonly DATETIME="$(date +%Y-%m-%d-%H-%M-%S 2>/dev/null)"
 readonly DOCKER=$(if type docker >/dev/null 2>&1; then echo "YES"; else echo "NO"; fi)
@@ -1420,9 +1420,8 @@ environment_setup() {
 create_package() {
 	local rc_tar
 	pr_syslog_stdout ${step_num} "Finalizing: Creating archive with collected data"
-	# get a copy of the script used - enabled for relative path calls
-	cd "${STARTDIR}"
-	cp -p "${BASH_SOURCE[0]}" "${WORKPATH}"
+	# get a copy of the script used
+	cp -p "${FULLPATHSCRIPT}" "${WORKPATH}"
 	# create the archive
 	cd "${WORKDIR_BASE}"
 	touch "${WORKARCHIVE}"

scripts/dumpconf

@@ -224,7 +224,7 @@ setup_ccw_device()
 {
 	DEV="$(CheckDeviceString $DEVICE)"
 	if [ "$DEV" != "" ]; then
-		echo $DEV > $1/$2/device
+		echo $DEV > $1/ccw/device
 	else
 		RETVAL=1
 		pr_error "ERROR: Invalid DEVICE '$DEVICE'." $ERRMSG
@@ -232,11 +232,33 @@ setup_ccw_device()
 	fi
 }
 
+setup_eckd_device()
+{
+	DEV="$(CheckDeviceString $DEVICE)"
+	if [ "$DEV" != "" ]; then
+		echo $DEV > $1/eckd/device
+	else
+		RETVAL=1
+		pr_error "ERROR: Invalid DEVICE '$DEVICE'." $ERRMSG
+		return
+	fi
+	echo $BOOTPROG > $1/eckd/bootprog 2>/dev/null || RETVAL=1
+	if [ $RETVAL -eq 1 ]; then
+		pr_error "ERROR: Invalid BOOTPROG '$BOOTPROG'." $ERRMSG
+		return
+	fi
+	echo $BR_CHR > $1/eckd/br_chr 2>/dev/null || RETVAL=1
+	if [ $RETVAL -eq 1 ]; then
+		pr_error "ERROR: Invalid BR_CHR '$BR_CHR'." $ERRMSG
+		return
+	fi
+}
+
 setup_fcp_device()
 {
 	DEV="$(CheckDeviceString $DEVICE)"
 	if [ "$DEV" != "" ]; then
-		echo $DEV > $1/$2/device
+		echo $DEV > $1/fcp/device
 	else
 		RETVAL=1
 		pr_error "ERROR: Invalid DEVICE '$DEVICE'." $ERRMSG
@@ -302,13 +324,13 @@ setup_reipl()
 
 	case "$REIPL_TYPE" in
 		eckd)
-			setup_ccw_device $REIPL_CONFIG_DIR $REIPL_TYPE
+			setup_eckd_device $REIPL_CONFIG_DIR
 			;;
 		ccw)
-			setup_ccw_device $REIPL_CONFIG_DIR $REIPL_TYPE
+			setup_ccw_device $REIPL_CONFIG_DIR
 			;;
 		fcp)
-			setup_fcp_device $REIPL_CONFIG_DIR $REIPL_TYPE
+			setup_fcp_device $REIPL_CONFIG_DIR
 			;;
 		nvme)
 			setup_nvme_device $REIPL_CONFIG_DIR
@@ -336,13 +358,13 @@ setup_dump()
 {
 	case "$DUMP_TYPE" in
 		eckd)
-			setup_ccw_device $DUMP_CONFIG_DIR $DUMP_TYPE
+			setup_eckd_device $DUMP_CONFIG_DIR
 			;;
 		ccw)
-			setup_ccw_device $DUMP_CONFIG_DIR $DUMP_TYPE
+			setup_ccw_device $DUMP_CONFIG_DIR
 			;;
 		fcp)
-			setup_fcp_device $DUMP_CONFIG_DIR $DUMP_TYPE
+			setup_fcp_device $DUMP_CONFIG_DIR
 			;;
 		nvme)
 			setup_nvme_device $DUMP_CONFIG_DIR

zdev/dracut/Makefile

@@ -20,11 +20,12 @@ install:
 	$(INSTALL) -m 755 -d $(DESTDIR)$(DRACUTMODDIR)/$(ZDEVDIR)
 	$(INSTALL) -m 755 $(ZDEVDIR)/module-setup.sh \
 		$(ZDEVDIR)/parse-zdev.sh \
-		$(ZDEVDIR)/zdev-lib.sh \
 		$(ZDEVDIR)/parse-zfcp.sh \
 		$(ZDEVDIR)/parse-dasd.sh \
 		$(ZDEVDIR)/retain-zdev.sh \
 		$(DESTDIR)$(DRACUTMODDIR)/$(ZDEVDIR)/
+	$(INSTALL) -m 644 $(ZDEVDIR)/zdev-lib.sh \
+		$(DESTDIR)$(DRACUTMODDIR)/$(ZDEVDIR)/
 	$(INSTALL) -m 755 -d $(DESTDIR)$(DRACUTMODDIR)/$(ZDEVKDUMPDIR)
 	$(INSTALL) -m 755 $(ZDEVKDUMPDIR)/module-setup.sh \
 		$(DESTDIR)$(DRACUTMODDIR)/$(ZDEVKDUMPDIR)/

zdev/man/chzdev.8

@@ -623,34 +623,6 @@ Apply changes to persistent configuration only.
 
 The persistent configuration is put into effect when the system boots, or
 when a device becomes available, or when a device driver is loaded.
-.PP
-.
-.OD site "s" "SITE-ID"
-Apply the persistent configuration to the specified site only.
-
-This option can be used to configure the device in such a way that, the
-same configuration can be used on multiple different sites with different
-device hardwares, without any modification. With the site information, we
-can add different configurations which are specific to different sites. Where
-each site represents different systems or different hardware devices which
-are even located in different locations.
-For example, having
-the configuration of main-site or failover-site in the same place, but these
-configurations used only on the respective sites. Currently a user can define
-10 different configurations for 10 different sites with
-.I SITE-ID
-0 to 9.
-
-The configuration settings is put into effect only on the system with the
-site number which is mentioned in
-.I SITE-ID.
-
-This parameter is only effective only for persistent configurations and for
-dasd device-types.
-
-.B Example:
-.CL chzdev -ep 0.0.f001 --site 3
-
 .PP
 .
 .OD quiet "q" ""
@@ -686,6 +658,34 @@ values for that list.
 
 .B Note:
 Some attributes are mandatory and cannot be removed.
+.PP
+.
+.OD site "s" "SITE-ID"
+Apply the persistent configuration to the specified site only.
+
+This option can be used to configure the device in such a way that, the
+same configuration can be used on multiple different sites with different
+device hardwares, without any modification. With the site information, we
+can add different configurations which are specific to different sites. Where
+each site represents different systems or different hardware devices which
+are even located in different locations.
+For example, having
+the configuration of main-site or failover-site in the same place, but these
+configurations used only on the respective sites. Currently a user can define
+10 different configurations for 10 different sites with
+.I SITE-ID
+0 to 9.
+
+The configuration settings is put into effect only on the system with the
+site number which is mentioned in
+.I SITE-ID.
+
+This parameter is only effective only for persistent configurations and for
+dasd device-types.
+
+.B Example:
+.CL chzdev -ep 0.0.f001 --site 3
+
 .PP
 .
 .OD type "t" ""

zdev/man/lszdev.8

@@ -439,6 +439,8 @@ variable name by an underscore.
 List information from the persistent configuration only.
 
 Restricts output to information obtained from configuration files.
+.OD quiet "q" ""
+Print only minimal run-time information.
 .PP
 .
 .OD site "s" "SITE-ID"
@@ -460,8 +462,6 @@ for the device is available only for site 'n'.
 
 .PP
 .
-.OD quiet "q" ""
-Print only minimal run-time information.
 .PP
 .
 .OD type "t" ""

zdump/Makefile

@@ -105,7 +105,10 @@ ifneq ("$(HAVE_FUSE)","0")
 OBJECTS += zfuse.o
 endif
 
-libs = $(rootdir)/libutil/libutil.a $(LIBPV)
+libs = $(rootdir)/libutil/libutil.a \
+       $(rootdir)/libvtoc/libvtoc.a \
+       $(rootdir)/libdasd/libdasd.a \
+       $(LIBPV)
 
 all: $(BUILD_TARGETS)
 

zdump/df_s390.c

@@ -153,14 +153,17 @@ void df_s390_dumper_read(struct zg_fh *fh, int blk_size,
 		dumper->version = 0;
 	switch (dumper->version) {
 	case 1:
-		if (strncmp(dumper->magic, DF_S390_DUMPER_MAGIC_EXT, 7) == 0 ||
-		    strncmp(dumper->magic, DF_S390_DUMPER_MAGIC_MV_EXT, 7) == 0)
+		if (strncmp(dumper->magic, DF_S390_DUMPER_MAGIC_EXT,
+			    DF_S390_DUMPER_MAGIC_SIZE) == 0 ||
+		    strncmp(dumper->magic, DF_S390_DUMPER_MAGIC_MV_EXT,
+			    DF_S390_DUMPER_MAGIC_SIZE) == 0)
 			dumper->size = STAGE2_DUMPER_SIZE_V3;
 		else
 			dumper->size = STAGE2_DUMPER_SIZE_V1;
 		break;
 	case 2:
-		if (strncmp(dumper->magic, DF_S390_DUMPER_MAGIC_EXT, 7) == 0)
+		if (strncmp(dumper->magic, DF_S390_DUMPER_MAGIC_EXT,
+			    DF_S390_DUMPER_MAGIC_SIZE) == 0)
 			dumper->size = STAGE2_DUMPER_SIZE_ZLIB;
 		else
 			dumper->size = STAGE2_DUMPER_SIZE_V2;

zdump/df_s390.h

@@ -35,17 +35,6 @@ static inline enum dfi_arch df_s390_to_dfi_arch(enum df_s390_arch df_s390_arch)
 	return df_s390_arch == DF_S390_ARCH_64 ? DFI_ARCH_64 : DFI_ARCH_32;
 }
 
-#define DF_S390_DUMPER_MAGIC32		"ZECKD31"
-#define DF_S390_DUMPER_MAGIC64		"ZECKD64"
-#define DF_S390_DUMPER_MAGIC_EXT	"XECKD64"
-#define DF_S390_DUMPER_MAGIC32_FBA	"ZDFBA31"
-#define DF_S390_DUMPER_MAGIC64_FBA	"ZDFBA64"
-#define DF_S390_DUMPER_MAGIC_FBA_EXT	"XDFBA64"
-#define DF_S390_DUMPER_MAGIC_MV		"ZMULT64"
-#define DF_S390_DUMPER_MAGIC_MV_EXT	"XMULT64"
-#define OLD_DUMPER_HEX_INSTR1 "\x0d\x10\x47\xf0" /* BASR + 1st halfword of BC */
-#define OLD_DUMPER_HEX_INSTR2 "\x0d\xd0" /* BASR 13,0 */
-
 /*
  * Dump tool structure
  */

zdump/dfi_s390mv.c

@@ -73,8 +73,8 @@ static struct {
 	struct df_s390_dumper	dumper;
 	int			dump_incomplete;
 	bool extended;
-	u64 magic_number;	/* Reference value to compare with */
-	char dumper_magic[7];	/* Reference value to compare with */
+	u64 magic_number;				/* Reference value to compare with */
+	char dumper_magic[DF_S390_DUMPER_MAGIC_SIZE];	/* Reference value to compare with */
 } l;
 
 /*
@@ -273,7 +273,7 @@ static void vol_init(struct vol *vol, struct vol_parm *vol_parm, int ssid,
 		l.dump_incomplete = 1;
 	}
 
-	if (strncmp(vol->dumper.magic, l.dumper_magic, 7) != 0) {
+	if (strncmp(vol->dumper.magic, l.dumper_magic, DF_S390_DUMPER_MAGIC_SIZE) != 0) {
 		vol->sign = SIGN_INVALID;
 		l.dump_incomplete = 1;
 	}
@@ -507,7 +507,7 @@ static int mv_dumper_read(void)
 		     ZG_CHECK_NONE) == -1)
 		return -ENODEV;
 	df_s390_dumper_read(g.fh, l.blk_size, &l.dumper);
-	if (strncmp(l.dumper.magic, l.dumper_magic, 7) != 0)
+	if (strncmp(l.dumper.magic, l.dumper_magic, DF_S390_DUMPER_MAGIC_SIZE) != 0)
 		return -ENODEV;
 	table_read(g.fh, l.blk_size, &l.table);
 	return 0;
@@ -567,10 +567,12 @@ static void set_magic_numbers(void)
 {
 	if (l.extended) {
 		l.magic_number = DF_S390_MAGIC_EXT;
-		memcpy(l.dumper_magic, DF_S390_DUMPER_MAGIC_MV_EXT, 7);
+		memcpy(l.dumper_magic, DF_S390_DUMPER_MAGIC_MV_EXT,
+		       DF_S390_DUMPER_MAGIC_SIZE);
 	} else {
 		l.magic_number = DF_S390_MAGIC;
-		memcpy(l.dumper_magic, DF_S390_DUMPER_MAGIC_MV, 7);
+		memcpy(l.dumper_magic, DF_S390_DUMPER_MAGIC_MV,
+		       DF_S390_DUMPER_MAGIC_SIZE);
 	}
 }
 

zdump/dt_ngdump.c

@@ -27,11 +27,9 @@ static int dt_ngdump_init(void)
 	char *part_path = NULL;
 	int rc;
 
-	l.part_num = ngdump_get_dump_part(g.fh);
+	l.part_num = ngdump_get_dump_part(g.fh, &part_path);
 	if (l.part_num <= 0)
 		return -1;
-	if (ngdump_get_disk_part_path(g.fh->path, l.part_num, &part_path) < 0)
-		return -1;
 	rc = ngdump_read_meta_from_device(part_path, &l.meta);
 	free(part_path);
 	if (rc)

zdump/dt_s390sv.c

@@ -34,14 +34,17 @@ static int dumper_read_eckd(int blk_size)
 	df_s390_dumper_read(g.fh, blk_size, &l.dumper);
 
 	if (l.extended) {
-		if (strncmp(l.dumper.magic, DF_S390_DUMPER_MAGIC_EXT, 7) != 0)
+		if (strncmp(l.dumper.magic, DF_S390_DUMPER_MAGIC_EXT,
+			    DF_S390_DUMPER_MAGIC_SIZE) != 0)
 			return -ENODEV;
 		l.dumper_arch = DFI_ARCH_64;
 		return 0;
 	}
-	if (strncmp(l.dumper.magic, DF_S390_DUMPER_MAGIC64, 7) == 0) {
+	if (strncmp(l.dumper.magic, DF_S390_DUMPER_MAGIC64,
+		    DF_S390_DUMPER_MAGIC_SIZE) == 0) {
 		l.dumper_arch = DFI_ARCH_64;
-	} else if (strncmp(l.dumper.magic, DF_S390_DUMPER_MAGIC32, 7) == 0) {
+	} else if (strncmp(l.dumper.magic, DF_S390_DUMPER_MAGIC32,
+			   DF_S390_DUMPER_MAGIC_SIZE) == 0) {
 		l.dumper_arch = DFI_ARCH_32;
 	} else if (memcmp(l.dumper.magic, OLD_DUMPER_HEX_INSTR1, 4) == 0 &&
 		   l.dumper.version == 0) {
@@ -59,15 +62,17 @@ static int dumper_read_eckd(int blk_size)
 static int dumper_check_fba(struct df_s390_dumper *dumper)
 {
 	if (l.extended) {
-		if (strncmp(dumper->magic, DF_S390_DUMPER_MAGIC_FBA_EXT, 7)
-		    != 0)
+		if (strncmp(dumper->magic, DF_S390_DUMPER_MAGIC_FBA_EXT,
+			    DF_S390_DUMPER_MAGIC_SIZE) != 0)
 			return -ENODEV;
 		l.dumper_arch = DFI_ARCH_64;
 		return 0;
 	}
-	if (strncmp(dumper->magic, DF_S390_DUMPER_MAGIC64_FBA, 7) == 0) {
+	if (strncmp(dumper->magic, DF_S390_DUMPER_MAGIC64_FBA,
+		    DF_S390_DUMPER_MAGIC_SIZE) == 0) {
 		l.dumper_arch = DFI_ARCH_64;
-	} else if (strncmp(dumper->magic, DF_S390_DUMPER_MAGIC32_FBA, 7) == 0) {
+	} else if (strncmp(dumper->magic, DF_S390_DUMPER_MAGIC32_FBA,
+			   DF_S390_DUMPER_MAGIC_SIZE) == 0) {
 		l.dumper_arch = DFI_ARCH_32;
 	} else if (memcmp(dumper->magic, OLD_DUMPER_HEX_INSTR1, 4) == 0 &&
 		   memcmp(&dumper->size, OLD_DUMPER_HEX_INSTR2, 2) == 0) {

zdump/ngdump.c

@@ -18,9 +18,11 @@
 #include <unistd.h>
 #include <sys/mount.h>
 
+#include "lib/dasd_base.h"
 #include "lib/util_libc.h"
 #include "lib/util_part.h"
 #include "lib/util_log.h"
+#include "lib/vtoc.h"
 #include "boot/boot_defs.h"
 #include "boot/linux_layout.h"
 
@@ -30,6 +32,11 @@
 #define NGDUMP_META_VERSION	1
 #define NGDUMP_META_FILENAME	"ngdump.meta"
 
+static const char *const ngtype2str[] = {
+	[NG_TYPE_DASD] = "DASD",
+	[NG_TYPE_NVME] = "NVME"
+};
+
 static int read_meta_from_file(const char *filename, struct ngdump_meta *meta)
 {
 	FILE *fp = NULL;
@@ -212,56 +219,71 @@ out:
 }
 
 /*
- * This function parses the bootloader program table stored on the given device
- * and returns the partition index where the dumper's kernel image is stored.
+ * Convert disk blockpointer to the offset in blocks.
+ * Use eckd blockpointer format if hd_geometry is provided, otherwise linear blockpointer.
+ * Return u64(-1) in case the blockpointer contains zeroes.
  */
-int ngdump_get_dump_part(struct zg_fh *zg_fh)
+static uint64_t blockptr2blk(union disk_blockptr *ptr, const struct hd_geometry *geo)
+{
+	uint64_t blk;
+
+	/* For NVMe or SCSI use linear blockpointer format. */
+	/* For DASD use eckd blockpointer format. */
+	if (!geo) {
+		blk = ptr->linear.blockno;
+		if (blk == 0)
+			return U64_MAX;
+	} else {
+		if (ptr->eckd.sec == 0)
+			return U64_MAX;
+		blk = ptr->eckd.cyl * geo->heads + ptr->eckd.head; /* Track number */
+		blk *= geo->sectors;		 /* Track offset in records */
+		blk += ptr->eckd.sec - 1;	 /* Record offset (skipping R0) */
+	}
+	return blk;
+}
+
+/*
+ * Based on the provided program table blockpointer find kernel image Boot Map Section
+ * for dump Boot Map Script. Read the first data blockpointer from the section into
+ * blockptr area.
+ */
+static int get_bootmap_dump_image_blkptr(struct zg_fh *zg_fh, union disk_blockptr *program_table,
+					 struct hd_geometry *geo, int blk_size,
+					 union disk_blockptr *blockptr)
 {
-	int i, blk_size, max_entries, part_ext;
 	struct component_entry comp_entry;
 	struct component_header comp_hdr;
-	struct linear_blockptr blockptr;
-	struct scsi_mbr mbr;
-	uint64_t off;
-
-	if (zg_ioctl(zg_fh, BLKSSZGET, &blk_size, "BLKSSZGET", ZG_CHECK_NONE))
-		return -1;
-
-	util_log_print(UTIL_LOG_TRACE, "%s: Block size %d\n",
-		       __func__, blk_size);
-
-	/* Read Master Boot Record (MBR) and check its magic */
-	zg_read(zg_fh, &mbr, sizeof(mbr), ZG_CHECK);
-	if (memcmp(mbr.magic, ZIPL_MAGIC, ZIPL_MAGIC_SIZE))
-		return -1;
+	int i, max_entries;
+	uint64_t blk;
 
 	/* Read Boot Map Table and check its magic */
-	off = mbr.program_table_pointer.blockno * blk_size;
+	blk = blockptr2blk(program_table, geo);
+	if (blk == U64_MAX)
+		return -1;
 	util_log_print(UTIL_LOG_TRACE,
 		       "%s: Reading program table at offset 0x%016lx\n",
-		       __func__, off);
-	zg_seek(zg_fh, off, ZG_CHECK);
-	zg_read(zg_fh, &blockptr, sizeof(blockptr), ZG_CHECK);
-	if (memcmp((const char*)&blockptr, ZIPL_MAGIC, ZIPL_MAGIC_SIZE))
+		       __func__, blk * blk_size);
+	zg_seek(zg_fh, blk * blk_size, ZG_CHECK);
+	zg_read(zg_fh, blockptr, sizeof(*blockptr), ZG_CHECK);
+	if (memcmp((const char *)blockptr, ZIPL_MAGIC, ZIPL_MAGIC_SIZE))
 		return -1;
-
 	/* Read Boot Map Script Pointer 0 */
-	zg_read(zg_fh, &blockptr, sizeof(blockptr), ZG_CHECK);
-	if (blockptr.blockno == 0)
+	zg_read(zg_fh, blockptr, sizeof(*blockptr), ZG_CHECK);
+	blk = blockptr2blk(blockptr, geo);
+	if (blk == U64_MAX)
 		return -1;
 	/* Read 1st Boot Map Script, check its magic and type */
-	off = blockptr.blockno * blk_size;
 	util_log_print(UTIL_LOG_TRACE,
 		       "%s: Reading component header at offset 0x%016lx\n",
-		       __func__, off);
-	zg_seek(zg_fh, off, ZG_CHECK_ERR);
+		       __func__, blk * blk_size);
+	zg_seek(zg_fh, blk * blk_size, ZG_CHECK_ERR);
 	zg_read(zg_fh, &comp_hdr, sizeof(comp_hdr), ZG_CHECK_ERR);
 	if (memcmp(comp_hdr.magic, ZIPL_MAGIC, ZIPL_MAGIC_SIZE))
 		return -1;
 	/* We want only dump script */
 	if (comp_hdr.type != COMPONENT_HEADER_DUMP)
 		return -1;
-
 	/* Find kernel's Boot Map Section Pointer */
 	max_entries = (blk_size - sizeof(comp_hdr)) / sizeof(comp_entry);
 	for (i = 0; i < max_entries; i++) {
@@ -282,27 +304,178 @@ int ngdump_get_dump_part(struct zg_fh *zg_fh)
 	}
 
 	/* Read 1st Boot Map Data Pointer in kernel's Boot Map Section */
-	off = ((struct linear_blockptr *)comp_entry.data)->blockno * blk_size;
+	blk = blockptr2blk((union disk_blockptr *)comp_entry.data, geo);
+	if (blk == U64_MAX)
+		return -1;
 	util_log_print(UTIL_LOG_TRACE,
 		       "%s: Reading component block pointer at offset 0x%016lx\n",
-		       __func__, off);
-	zg_seek(zg_fh, off, ZG_CHECK_ERR);
-	zg_read(zg_fh, &blockptr, sizeof(blockptr), ZG_CHECK);
-	util_log_print(UTIL_LOG_TRACE,
-		       "%s: Component block address 0x%016lx block count %d\n",
-		       __func__, blockptr.blockno, blockptr.blockct);
+		       __func__, blk * blk_size);
+	zg_seek(zg_fh, blk * blk_size, ZG_CHECK_ERR);
+	zg_read(zg_fh, blockptr, sizeof(*blockptr), ZG_CHECK);
 
-	return util_part_search_fh(zg_fh->fh, blockptr.blockno,
-				   blockptr.blockct, blk_size, &part_ext);
+	return 0;
 }
 
-int ngdump_get_disk_part_path(const char *disk_path, int part_num,
-			      char **part_path)
+/*
+ * This function parses the bootloader program table stored on the nvme device
+ * and returns the partition index where the dumper's kernel image is stored.
+ */
+static int ngdump_get_nvme_part_num(struct zg_fh *zg_fh)
+{
+	union disk_blockptr dump_image_blkptr;
+	int blk_size, part_num, part_ext;
+	struct linear_blockptr *blockptr;
+	struct scsi_mbr mbr;
+
+	if (zg_ioctl(zg_fh, BLKSSZGET, &blk_size, "BLKSSZGET", ZG_CHECK_NONE))
+		return -1;
+	util_log_print(UTIL_LOG_TRACE, "%s: Block size %d\n",
+		       __func__, blk_size);
+	/* Read Master Boot Record (MBR) and check its magic */
+	zg_read(zg_fh, &mbr, sizeof(mbr), ZG_CHECK);
+	if (memcmp(mbr.magic, ZIPL_MAGIC, ZIPL_MAGIC_SIZE))
+		return -1;
+	blockptr = &mbr.program_table_pointer;
+	/*
+	 * Cast linear_blockptr to disk_blockptr before passing it to the function.
+	 * Since no hd_geometry provided, it will be treated as linear_blockptr later on.
+	 */
+	if (get_bootmap_dump_image_blkptr(zg_fh, (union disk_blockptr *)blockptr,
+					  NULL, blk_size, &dump_image_blkptr))
+		return -1;
+	blockptr = &dump_image_blkptr.linear;
+	util_log_print(UTIL_LOG_TRACE,
+		       "%s: Component block address 0x%016lx block count %d\n",
+		       __func__, blockptr->blockno,
+		       blockptr->blockct);
+	if (blockptr->blockno == 0)
+		return -1;
+	part_num = util_part_search_fh(zg_fh->fh, blockptr->blockno, blockptr->blockct,
+				       blk_size, &part_ext);
+	return part_num;
+}
+
+/*
+ * This function scans a VTOC record of cdl formatted DASD to identify a partition
+ * the specified blockno (0-indexed) belongs to.
+ */
+static int find_vol1_cdl_part_fh(struct zg_fh *zg_fh, uint64_t blockno, int blk_size,
+				 cchhb_t *vtoc, struct hd_geometry *geo)
+{
+	unsigned int part_count, i;
+	struct format1_label f1;
+	uint64_t blk;
+
+	blk = cchhb2blk(vtoc, geo);
+	if (!blk)
+		return -1;
+	/* Get actual offset in blocks (special record zero accounted) */
+	blk--;
+	part_count = 0;
+	for (i = 0; i < MAX_VTOC_ENTRIES; i++) {
+		zg_seek(zg_fh, blk * blk_size, ZG_CHECK);
+		zg_read(zg_fh, &f1, sizeof(f1), ZG_CHECK_ERR);
+		/* Skip FMT4 / FMT5 / FMT7 / FMT9 labels */
+		if (f1.DS1FMTID == 0xf4 ||
+		    f1.DS1FMTID == 0xf5 ||
+		    f1.DS1FMTID == 0xf7 ||
+		    f1.DS1FMTID == 0xf9) {
+			blk++;
+			continue;
+		}
+		/* only FMT1 and FMT8 labels valid at this point */
+		if (f1.DS1FMTID != 0xf1 &&
+		    f1.DS1FMTID != 0xf8)
+			break;
+		/* OK, we got valid partition data. Check for partition boundaries */
+		if (blockno >= cchh2blk(&f1.DS1EXT1.llimit, geo) &&
+		    blockno < cchh2blk(&f1.DS1EXT1.ulimit, geo) + geo->sectors) {
+			return part_count + 1;
+		}
+		part_count++;
+		blk++;
+	}
+	/* No matching partition found */
+	return -1;
+}
+
+/*
+ * This function parses the bootloader program table stored on the eckd device
+ * and returns the partition index where the dumper's kernel image is stored.
+ */
+static int ngdump_get_eckd_part_num(struct zg_fh *zg_fh)
+{
+	union disk_blockptr dump_image_blkptr;
+	struct eckd_blockptr *blockptr;
+	struct eckd_boot_record br;
+	struct vol_label_cdl vl;
+	struct hd_geometry geo;
+	uint64_t blk, off;
+	cchhb_t *vtoc;
+	int blk_size;
+
+	if (zg_ioctl(zg_fh, BLKSSZGET, &blk_size, "BLKSSZGET", ZG_CHECK_NONE))
+		return -1;
+	util_log_print(UTIL_LOG_TRACE, "%s: Block size %d\n",
+		       __func__, blk_size);
+	/* Obtain DASD geometry */
+	if (dasd_get_geo(zg_fh->path, &geo) != 0)
+		return -1;
+	util_log_print(UTIL_LOG_TRACE,
+		       "%s: DASD geometry: cyl=%d, heads=%d, sect=%d\n",
+		       __func__,  geo.cylinders, geo.heads, geo.sectors);
+	/* Read a volume label from CDL-formatted DASD */
+	off = 2 * blk_size;
+	util_log_print(UTIL_LOG_TRACE,
+		       "%s: Reading a volume label at offset 0x%016lx\n",
+		       __func__, off);
+	zg_seek(zg_fh, off, ZG_CHECK_ERR);
+	zg_read(zg_fh, &vl, sizeof(vl), ZG_CHECK);
+	/* Verify that we have a VOL1 label */
+	if (!is_vol1(vl.vollbl))
+		return -1;
+	/* Read Master Boot Record and check its magic */
+	blk = cchhb2blk(&vl.br, &geo);
+	if (blk == 0)
+		return -1;
+	off = (blk - 1) * blk_size;
+	util_log_print(UTIL_LOG_TRACE,
+		       "%s: Reading Master Boot Record at offset 0x%016lx\n",
+		       __func__, off);
+	zg_seek(zg_fh, off, ZG_CHECK_ERR);
+	zg_read(zg_fh, &br, sizeof(br), ZG_CHECK);
+	if (memcmp(br.magic, ZIPL_MAGIC, ZIPL_MAGIC_SIZE))
+		return -1;
+
+	blockptr = (struct eckd_blockptr *)&br.program_table_pointer;
+	/*
+	 * Cast eckd_blockptr to disk_blockptr before passing it to the function.
+	 * With hd_geometry provided, it will be treated as eckd_blockptr later on.
+	 */
+	if (get_bootmap_dump_image_blkptr(zg_fh, (union disk_blockptr *)blockptr,
+					  &geo, blk_size, &dump_image_blkptr))
+		return -1;
+	blk = blockptr2blk(&dump_image_blkptr, &geo);
+	if (blk == U64_MAX)
+		return -1;
+	util_log_print(UTIL_LOG_TRACE,
+		       "%s: Segment0 block number 0x%016lx\n",
+		       __func__, blk);
+	vtoc = &((volume_label_t *)&vl)->vtoc;
+	return find_vol1_cdl_part_fh(zg_fh, blk, blk_size, vtoc, &geo);
+}
+
+/*
+ * This function composes the absolute partition device node name
+ * based on the device name, device type and the partition number.
+ */
+int ngdump_get_part_path(const char *disk_path, int part_num,
+			 enum ngdump_disk_type ng_type, char **part_path)
 {
 	char *real_path;
 
-	util_log_print(UTIL_LOG_TRACE, "%s: Disk path %s\n",
-		       __func__, disk_path);
+	util_log_print(UTIL_LOG_TRACE, "%s: Disk path %s; disk type: %s\n",
+		       __func__, disk_path, ngtype2str[ng_type]);
 
 	real_path = util_malloc(PATH_MAX);
 
@@ -315,7 +488,18 @@ int ngdump_get_disk_part_path(const char *disk_path, int part_num,
 		       __func__, real_path);
 
 	*part_path = NULL;
-	util_asprintf(part_path, "%sp%d", real_path, part_num);
+	switch (ng_type) {
+	case NG_TYPE_DASD:
+		util_asprintf(part_path, "%s%d", real_path, part_num);
+		break;
+	case NG_TYPE_NVME:
+		util_asprintf(part_path, "%sp%d", real_path, part_num);
+		break;
+	default: /* Unknown type, bail out */
+		free(real_path);
+		return -1;
+	}
+
 	free(real_path);
 
 	util_log_print(UTIL_LOG_TRACE, "%s: Disk partition path %s\n",
@@ -323,3 +507,30 @@ int ngdump_get_disk_part_path(const char *disk_path, int part_num,
 
 	return 0;
 }
+
+/*
+ * This function checks for the ngdump device type in order to parse the
+ * bootloader program table and identify the partition where the dumper's
+ * kernel image is stored.
+ * part_path is set to the absolute partition device node name and
+ * the partition number is returned (or -1 when no partition found).
+ */
+int ngdump_get_dump_part(struct zg_fh *zg_fh, char **part_path)
+{
+	dasd_information2_t dasd_info;
+	enum ngdump_disk_type ng_type;
+	int part_num;
+
+	if (dasd_get_info(zg_fh->path, &dasd_info) == 0) {
+		ng_type = NG_TYPE_DASD;
+		part_num = ngdump_get_eckd_part_num(zg_fh);
+	} else {
+		ng_type = NG_TYPE_NVME;
+		part_num = ngdump_get_nvme_part_num(zg_fh);
+	}
+	if (part_num <= 0 ||
+	    ngdump_get_part_path(zg_fh->path, part_num, ng_type, part_path) < 0)
+		return -1;
+
+	return part_num;
+}

zdump/ngdump.h

@@ -20,11 +20,14 @@ struct ngdump_meta {
 	const char *sha256sum;
 };
 
+enum ngdump_disk_type {
+	NG_TYPE_DASD,
+	NG_TYPE_NVME,
+};
+
 int ngdump_read_meta_from_device(const char *device, struct ngdump_meta *meta);
-
-int ngdump_get_dump_part(struct zg_fh *zg_fh);
-
-int ngdump_get_disk_part_path(const char *disk_path, int part_num,
-			      char **part_path);
+int ngdump_get_dump_part(struct zg_fh *zg_fh, char **part_path);
+int ngdump_get_part_path(const char *disk_path, int part_num,
+			 enum ngdump_disk_type ng_type, char **part_path);
 
 #endif /* ZGETDUMP_NGDUMP_H */

zipl/include/install.h

@@ -73,8 +73,9 @@ struct install_set {
 	int fd;
 	char *device;
 	char *filename;
-	char *dump_mount_point;
-	unsigned int dump_tmp_dir_created:1;
+	char *bootmap_dir;
+	unsigned int tmp_filename_created:1;
+	unsigned int bootmap_dir_created:1;
 	unsigned int dump_mounted:1;
 	unsigned int skip_prepare:1;
 	unsigned int print_details:1;
@@ -115,6 +116,7 @@ static inline struct program_component *get_component(struct install_set *bis,
 
 int prepare_bootloader(struct job_data *job, struct install_set *bis);
 int install_bootloader(struct job_data *job, struct install_set *bis);
+int post_install_bootloader(struct job_data *job, struct install_set *bis);
 void free_bootloader(struct install_set *bis);
 int install_tapeloader(const char* device, const char* image,
 		       const char* parmline, const char* ramdisk,

zipl/src/bootmap.c

@@ -1466,6 +1466,7 @@ static int prepare_build_program_table_device(struct job_data *job,
 				   bis->filename);
 			return -1;
 		}
+		bis->tmp_filename_created = 1;
 	}
 	/* Retrieve target device information */
 	if (disk_get_info(bis->filename, &job->target, &bis->info))
@@ -1539,14 +1540,14 @@ static int prepare_bootloader_device(struct job_data *job,
  * Prepare resources to build a program table
  */
 static int prepare_build_program_table_file(struct job_data *job,
-					    char *bootmap_dir,
 					    struct install_set *bis)
 {
 	if (bis->skip_prepare)
 		/* skip the preparation work */
 		return 0;
 	/* Create temporary bootmap file */
-	bis->filename = misc_make_path(bootmap_dir, BOOTMAP_TEMPLATE_FILENAME);
+	bis->filename = misc_make_path(bis->bootmap_dir,
+				       BOOTMAP_TEMPLATE_FILENAME);
 	if (!bis->filename)
 		return -1;
 	bis->fd = mkstemp(bis->filename);
@@ -1555,6 +1556,7 @@ static int prepare_build_program_table_file(struct job_data *job,
 		error_text("Could not create file '%s':", bis->filename);
 		return -1;
 	}
+	bis->tmp_filename_created = 1;
 	/* Retrieve target device information. Note that we have to
 	 * call disk_get_info_from_file() to also get the file system
 	 * block size. */
@@ -1581,7 +1583,7 @@ static int prepare_build_program_table_file(struct job_data *job,
 					 bis->info))
 			return -1;
 	}
-	printf("Building bootmap in '%s'%s\n", bootmap_dir,
+	printf("Building bootmap in '%s'%s\n", bis->bootmap_dir,
 	       job->add_files ? " (files will be added to bootmap file)"
 	       : "");
 	/* Initialize bootmap header */
@@ -1601,11 +1603,11 @@ static int prepare_build_program_table_file(struct job_data *job,
 /**
  * Rename to final bootmap name
  */
-static int finalize_create_file(char *bootmap_dir, struct install_set *bis)
+static int finalize_create_file(struct install_set *bis)
 {
 	char *final_name;
 
-	final_name = misc_make_path(bootmap_dir, BOOTMAP_FILENAME);
+	final_name = misc_make_path(bis->bootmap_dir, BOOTMAP_FILENAME);
 	if (!final_name)
 		return -1;
 	if (rename(bis->filename, final_name)) {
@@ -1615,6 +1617,11 @@ static int finalize_create_file(char *bootmap_dir, struct install_set *bis)
 		free(final_name);
 		return -1;
 	}
+	/*
+	 * The temporary object with @bis->filename has been removed
+	 * from the semantic volume
+	 */
+	bis->tmp_filename_created = 0;
 	free(final_name);
 	return 0;
 }
@@ -1623,9 +1630,9 @@ static int finalize_create_file(char *bootmap_dir, struct install_set *bis)
  * PROGRAM_TABLE_ID: offset of the program table in the array (@bis->tables)
  */
 static int bootmap_create_file(struct job_data *job, struct install_set *bis,
-			       char *bootmap_dir, int program_table_id)
+			       int program_table_id)
 {
-	if (prepare_build_program_table_file(job, bootmap_dir, bis))
+	if (prepare_build_program_table_file(job, bis))
 		return -1;
 	if (build_program_table(job, bis, program_table_id))
 		return -1;
@@ -1638,8 +1645,12 @@ static int bootmap_create_file(struct job_data *job, struct install_set *bis,
 	return 0;
 }
 
-static int
-ngdump_create_meta(const char *path)
+/**
+ * Create a file with the short name "ngdump.meta" in the directory PATH.
+ * This file is required for NGDump stand-alone dumper, it's read/written
+ * by the dumper when it starts.
+ */
+static int ngdump_create_meta(const char *path)
 {
 	char *filename = NULL;
 	FILE *fp;
@@ -1676,7 +1687,6 @@ static int prepare_bootloader_ngdump(struct job_data *job,
 				     struct install_set *bis)
 {
 	struct disk_info *info;
-	char *bootmap_dir;
 
 	/* Retrieve target device information */
 	if (disk_get_info(job->data.dump.device, &job->target, &info))
@@ -1686,27 +1696,27 @@ static int prepare_bootloader_ngdump(struct job_data *job,
 	if (check_dump_device(job, info, bis->device))
 		return -1;
 
-	bis->dump_mount_point = misc_make_path("/tmp",
-					       DUMP_TEMP_MOUNT_POINT_NAME);
-	if (!bis->dump_mount_point) {
+	bis->bootmap_dir = misc_make_path("/tmp",
+					  DUMP_TEMP_MOUNT_POINT_NAME);
+	if (!bis->bootmap_dir) {
 		error_reason(strerror(errno));
 		error_text("Could not make path for '%s'",
 			   DUMP_TEMP_MOUNT_POINT_NAME);
 		return -1;
 	}
 	/* Create a mount point directory */
-	if (mkdtemp(bis->dump_mount_point) == NULL) {
+	if (mkdtemp(bis->bootmap_dir) == NULL) {
 		error_reason(strerror(errno));
 		error_text("Could not create mount point '%s'",
-			   bis->dump_mount_point);
+			   bis->bootmap_dir);
 		return -1;
 	}
-	bis->dump_tmp_dir_created = 1;
+	bis->bootmap_dir_created = 1;
 	/*
 	 * Mount partition where bootmap file and also a dump file will
 	 * be stored.
 	 */
-	if (mount(job->data.dump.device, bis->dump_mount_point,
+	if (mount(job->data.dump.device, bis->bootmap_dir,
 		  NGDUMP_FSTYPE, 0, NULL)) {
 		error_reason(strerror(errno));
 		error_text("Could not mount partition '%s':",
@@ -1714,17 +1724,14 @@ static int prepare_bootloader_ngdump(struct job_data *job,
 		return -1;
 	}
 	bis->dump_mounted = 1;
-	bootmap_dir = bis->dump_mount_point;
 	/*
 	 * Build a single program table for List-Directed IPL
 	 * See comments before install_bootloader() for details
 	 */
 	bis->print_details = 1;
-	if (bootmap_create_file(job, bis, bootmap_dir, BLKPTR_FORMAT_ID))
+	if (bootmap_create_file(job, bis, BLKPTR_FORMAT_ID))
 		return -1;
-	if (!dry_run && finalize_create_file(bootmap_dir, bis))
-		return -1;
-	return ngdump_create_meta(bootmap_dir);
+	return ngdump_create_meta(bis->bootmap_dir);
 }
 
 /**
@@ -1734,27 +1741,28 @@ static int prepare_bootloader_ngdump(struct job_data *job,
  */
 static int prepare_bootloader_ipl(struct job_data *job, struct install_set *bis)
 {
-	char *bootmap_dir = job->target.bootmap_dir;
-
+	bis->bootmap_dir = misc_strdup(job->target.bootmap_dir);
+	if (!bis->bootmap_dir)
+		return -1;
 	/*
 	 * Build a program table for List-Directed IPL from
 	 * SCSI or ECKD DASD
 	 */
 	bis->print_details = 1;
-	if (bootmap_create_file(job, bis, bootmap_dir, BLKPTR_FORMAT_ID))
+	if (bootmap_create_file(job, bis, BLKPTR_FORMAT_ID))
 		return -1;
 	if (bis->info->type == disk_type_scsi)
 		/* only one table to be installed per device */
-		return dry_run ? 0 : finalize_create_file(bootmap_dir, bis);
+		return 0;
 	/*
 	 * Build one more program table for CCW-type IPL from
 	 * ECKD DASD
 	 */
 	bis->skip_prepare = 1;
 	bis->print_details = 0;
-	if (bootmap_create_file(job, bis, bootmap_dir, LEGACY_BLKPTR_FORMAT_ID))
+	if (bootmap_create_file(job, bis, LEGACY_BLKPTR_FORMAT_ID))
 		return -1;
-	return dry_run ? 0 : finalize_create_file(bootmap_dir, bis);
+	return 0;
 }
 
 /**
@@ -1800,7 +1808,22 @@ int prepare_bootloader(struct job_data *job, struct install_set *bis)
 	} else {
 		return prepare_bootloader_ipl(job, bis);
 	}
-	return -1;
+}
+
+/**
+ * Do whatever needed after successful boot records installation
+ * but before releasing all the captured resources
+ */
+int post_install_bootloader(struct job_data *job, struct install_set *bis)
+{
+	if (job->id == job_dump_partition) {
+		if (is_ngdump_enabled(job))
+			return dry_run ? 0 : finalize_create_file(bis);
+		else
+			return 0;
+	} else {
+		return dry_run ? 0 : finalize_create_file(bis);
+	}
 }
 
 /**
@@ -1819,18 +1842,17 @@ void free_bootloader(struct install_set *bis)
 	}
 	if (bis->fd > 0)
 		close(bis->fd);
-	if (dry_run)
+	if (bis->tmp_filename_created)
 		misc_free_temp_file(bis->filename);
 	free(bis->filename);
 	misc_free_temp_dev(bis->device);
 	disk_free_info(bis->info);
-	if (bis->dump_mount_point) {
-		if (bis->dump_mounted && umount(bis->dump_mount_point))
-			warn("Could not umount dump device at %s",
-			     bis->dump_mount_point);
-		if (bis->dump_tmp_dir_created && rmdir(bis->dump_mount_point))
-			warn("Could not remove directory %s",
-			     bis->dump_mount_point);
-		free(bis->dump_mount_point);
-	}
+
+	if (bis->dump_mounted && umount(bis->bootmap_dir))
+		warn("Could not umount dump device at %s",
+		     bis->bootmap_dir);
+	if (bis->bootmap_dir_created && rmdir(bis->bootmap_dir))
+		warn("Could not remove directory %s",
+		     bis->bootmap_dir);
+	free(bis->bootmap_dir);
 }

zipl/src/disk.c

@@ -576,10 +576,10 @@ disk_get_info_from_file(const char* filename, struct job_target_data* target,
 	return rc;
 }
 
-
-void
-disk_free_info(struct disk_info* info)
+void disk_free_info(struct disk_info *info)
 {
+	if (!info)
+		return;
 	if (info->name)
 		free(info->name);
 	if (info->drv_name)
@@ -587,7 +587,6 @@ disk_free_info(struct disk_info* info)
 	free(info);
 }
 
-
 /* Retrieve the physical blocknumber (block on disk) of the specified logical
  * block (block in file). FD provides the file descriptor, LOGICAL is the
  * logical block number. Upon success, return 0 and store the physical

zipl/src/install.c

@@ -346,6 +346,45 @@ int install_bootloader_ipl(struct program_table *tables,
 	return rc;
 }
 
+/*
+ * Check if CCW dump tool is installed on the disk and destroy it by
+ * clearing the first block.
+ */
+static int clear_ccw_dumper(const struct disk_info *info, int fd)
+{
+	char dumper_magic[DF_S390_DUMPER_MAGIC_SIZE];
+	void *buffer;
+	int rc;
+
+	/* Read the CCW dumper magic at the start of block 3 */
+	if (misc_seek(fd, ECKD_CDL_DUMP_REC * info->phy_block_size))
+		return -1;
+	rc = misc_read(fd, dumper_magic, sizeof(dumper_magic));
+	if (rc) {
+		error_text("Could not read CCW dump record");
+		return rc;
+	}
+	/*
+	 * Check if the dump tool is present and clear its first block with zeroes.
+	 */
+	if (strncmp(dumper_magic, DF_S390_DUMPER_MAGIC32, sizeof(dumper_magic)) == 0 ||
+	    strncmp(dumper_magic, DF_S390_DUMPER_MAGIC64, sizeof(dumper_magic)) == 0 ||
+	    strncmp(dumper_magic, DF_S390_DUMPER_MAGIC_EXT, sizeof(dumper_magic)) == 0 ||
+	    strncmp(dumper_magic, DF_S390_DUMPER_MAGIC_MV, sizeof(dumper_magic)) == 0 ||
+	    strncmp(dumper_magic, DF_S390_DUMPER_MAGIC_MV_EXT, sizeof(dumper_magic)) == 0) {
+		if (misc_seek(fd, ECKD_CDL_DUMP_REC * info->phy_block_size))
+			return -1;
+		buffer = misc_calloc(1, info->phy_block_size);
+		if (buffer == NULL)
+			return -1;
+		rc = DRY_RUN_FUNC(misc_write(fd, buffer, info->phy_block_size));
+		free(buffer);
+		if (rc)
+			error_text("Could not clear CCW dumper");
+	}
+	return rc;
+}
+
 /**
  * Install a program table for List-Directed dump
  * See the comment before install_bootloader() for details
@@ -367,6 +406,9 @@ static int install_bootloader_dump(struct program_table *tables,
 		break;
 	case disk_type_eckd_cdl:
 		rc = install_eckd_cdl_ld(fd, pt->stage1b_list, info);
+		/* Clear CCW dumper upon successful List-Directed ECKD dump tool installation */
+		if (rc == 0)
+			rc = clear_ccw_dumper(info, fd);
 		break;
 	default:
 		error_reason("Inappropriarte device type (%d) for List-Directed dump",

zipl/src/zipl.c

@@ -204,9 +204,16 @@ main(int argc, char* argv[])
 	case job_segment:
 	case job_menu:
 		rc = prepare_bootloader(job, &bis);
-		if (rc)
+		if (rc) {
+			free_bootloader(&bis);
 			break;
+		}
 		rc = install_bootloader(job, &bis);
+		if (rc) {
+			free_bootloader(&bis);
+			break;
+		}
+		rc = post_install_bootloader(job, &bis);
 		free_bootloader(&bis);
 		break;
 	case job_ipl_tape:

zkey/keystore.c

@@ -25,6 +25,7 @@
 #include <sys/types.h>
 
 #include "lib/util_base.h"
+#include "lib/util_file.h"
 #include "lib/util_libc.h"
 #include "lib/util_panic.h"
 #include "lib/util_path.h"
@@ -4202,6 +4203,7 @@ struct crypt_info {
 	size_t tries;
 	bool open;
 	bool format;
+	int fips;
 	char **volume_filter;
 	int (*process_func)(struct keystore *keystore,
 			    const char *volume,
@@ -4319,16 +4321,22 @@ static int _keystore_process_cryptsetup(struct keystore *keystore,
 			 * Using the default Argon2i options might cause out-of-memory
 			 * errors when multiple LUKS2 volumes are opened automatically
 			 * via /etc/crypttab
+			 * In case the system runs in FIPS mode, use PBKDF2
+			 * instead, because Argon2i might be disabled by a
+			 * policy when FIPS mode is active.
 			 */
 			util_asprintf(&cmd,
 				      "cryptsetup luksFormat %s%s--type luks2 "
 				      "--master-key-file '%s' --key-size %lu "
-				      "--cipher %s --pbkdf argon2i --pbkdf-memory 32 "
-				      "--pbkdf-force-iterations 4 %s%s%s",
+				      "--cipher %s --pbkdf %s %s%s%s",
 				      info->batch_mode ? "-q " : "",
 				      keystore->verbose ? "-v " : "",
 				      key_file_name, key_file_size * 8,
-				      cipher_spec, common_len > 0 ?
+				      cipher_spec,
+				      info->fips ? "pbkdf2" :
+						"argon2i --pbkdf-memory 32 "
+						"--pbkdf-force-iterations 4",
+				      common_len > 0 ?
 						common_passphrase_options : "",
 				      sector_size > 0 ? temp : "", volume);
 
@@ -4605,6 +4613,8 @@ int keystore_cryptsetup(struct keystore *keystore, const char *volume_filter,
 		return -EINVAL;
 	}
 
+	util_file_read_i(&info.fips, 10, "/proc/sys/crypto/fips_enabled");
+
 	info.execute = execute;
 	info.open = open;
 	info.format = format;

zkey/pkey.c

@@ -922,7 +922,7 @@ int generate_secure_key_random(int pkey_fd, const char *keyfile,
 
 	genseck2.type = key_type_to_pkey_type(key_type);
 	if (genseck2.type == 0) {
-		warnx("Key-type not supported; %s", key_type);
+		warnx("Key-type not supported: %s", key_type);
 		return -ENOTSUP;
 	}
 
@@ -1084,7 +1084,7 @@ int generate_secure_key_clear(int pkey_fd, const char *keyfile,
 
 	clr2seck2.type = key_type_to_pkey_type(key_type);
 	if (clr2seck2.type == 0) {
-		warnx("Key-type not supported; %s", key_type);
+		warnx("Key-type not supported: %s", key_type);
 		return -ENOTSUP;
 	}
 

zkey/zkey.1

@@ -734,10 +734,12 @@ type, this is the default. If specified for the plain volume type, then no
 command is generated.
 .P
 For LUKS2 volumes, the generated \fBcryptsetup luksFormat\fP contains
-options \fB-\-pbkdf argon2i \-\-pbkdf\-memory 32 \-\-pbkdf\-force\-iterations 4
-\fP for low memory and time requirements. Using the default \fBArgon2i\fP
+options \fB-\-pbkdf argon2i \-\-pbkdf\-memory 32 \-\-pbkdf\-force\-iterations
+4\fP for low memory and time requirements. Using the default \fBArgon2i\fP
 options might cause out-of-memory errors when multiple encrypted volumes are
-unlocked automatically at boot through /etc/crypttab. Because PAES uses secure
+unlocked automatically at boot through \fB/etc/crypttab\fP. In case the system
+runs in FIPS mode, \fB-\-pbkdf pbkdf2\fP is used instead, because \fBArgon2i\fP
+might be disabled by a policy when FIPS mode is active. Because PAES uses secure
 AES keys as volume keys, the security of the key derivation function used to encrypt
 the volume key in the LUKS key slots is of less relevance.
 .P