1// Copyright 2021 The Chromium Authors 2// Use of this source code is governed by a BSD-style license that can be 3// found in the LICENSE file. 4 5// Proto definitions supporting the Chrome Root Store. 6// This file should be manually kept in sync with the corresponding google3 7// file. 8 9syntax = "proto3"; 10 11package chrome_root_store; 12 13// Specifies a set of constraints, all of which that have values must be 14// satisfied for the ConstraintSet to be satisfied. 15message ConstraintSet { 16 // The leaf certificate must have at least one valid SCT timestamp that is 17 // not after the specified value, specified in seconds since the unix epoch. 18 optional int64 sct_not_after_sec = 1; 19 20 // The leaf certificate must have at least one valid SCT timestamp and all 21 // valid SCT timestamps must be after the specified value, specified in 22 // seconds since the unix epoch. 23 optional int64 sct_all_after_sec = 2; 24 25 // The browser version must be equal to or greater than the specified version. 26 // Specified as a dotted version string, for example, "121.0.6167.160". A 27 // partial version is also allowed, for example min_version="121" will match 28 // any M-121 version or later. 29 optional string min_version = 3; 30 31 // The browser version must be less than the specified version. 32 // For example, max_version_exclusive="122" will match any M-121 or earlier 33 // version, and will not match any M-122 version. 34 optional string max_version_exclusive = 4; 35} 36 37message TrustAnchor { 38 // The human-editable textproto version of the root store references roots in 39 // a separate file by SHA-256 hash for convenience. It is converted to the DER 40 // representation as part of the build process. 41 oneof certificate { 42 bytes der = 1; 43 string sha256_hex = 2; 44 } 45 46 // OID should be expressed as dotted-decimal text (e.g. "1.3.159.1.17.1") 47 repeated string ev_policy_oids = 3; 48 49 // If not empty, the anchor is only trusted if at least one of the 50 // ConstraintSets is satisfied. 51 repeated ConstraintSet constraints = 4; 52 53 // Human-readable display name used to identify the certificate. 54 optional string display_name = 5; 55} 56 57// Message storing a complete Chrome Root Store. 58message RootStore { 59 repeated TrustAnchor trust_anchors = 1; 60 61 // Major version # of the Chrome Root Store. It is assumed that if 62 // root_store_1.version_major > root_store_2.version_major, then root_store_1 63 // is newer and should be preferred over root_store_2. 64 int64 version_major = 2; 65} 66