JankariTechUG/GitTrustedTimestamps
2
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity

Only download CRL once #16

Merged
artur merged 2 commits from onlyDownloadOnce into main 2026-10-05 10:14:54 +00:00
Conversation 2 Commits 2 Files Changed 8
+687 -2312
artur commented 2026-10-05 09:13:39 +00:00
Owner
Copy link
Copy source

Whenever the last commit in a branch is not a signing commit, the script walks up the chain to the top and downloads revocation lists (CRLs) from the signing authorities, to store them in the new commit (see https://git.jankaritech.eu/JankariTechUG/GitTrustedTimestamps#ltv---long-term-validation).

The problem was that it would download the CRLs again and again for every signing commit, even if it's the same URL as the commits before.
This PR changes the behaviour, so that already downloaded CRLs are cached in a file called crl_tmp.<hash of URL>.clr. So if we come across the same URL again, it will not be downloaded again.

Further optimizations could be made (in separate PRs)

  1. check if we really have to go up and check the CRLs for EVERY commit, or would it be enough to check only the latest
  2. do not do regenerate $OUTPUT_FILE if it already exists for the same data
Whenever the last commit in a branch is not a signing commit, the script walks up the chain to the top and downloads revocation lists (CRLs) from the signing authorities, to store them in the new commit (see https://git.jankaritech.eu/JankariTechUG/GitTrustedTimestamps#ltv---long-term-validation). The problem was that it would download the CRLs again and again for every signing commit, even if it's the same URL as the commits before. This PR changes the behaviour, so that already downloaded CRLs are cached in a file called `crl_tmp.<hash of URL>.clr`. So if we come across the same URL again, it will not be downloaded again. Further optimizations could be made (in separate PRs) 1. check if we really have to go up and check the CRLs for EVERY commit, or would it be enough to check only the latest 2. do not do regenerate $OUTPUT_FILE if it already exists for the same data
artur added 2 commits 2026-10-05 09:13:39 +00:00
only dowload CRL once 57f0bbaf9c
-----TIMESTAMP COMMIT-----
Validate Trusted Timestamps Actions Demo / Validate (push) Failing after 2m3s
Details
5f23cdf799 
Version: 1

Algorithm: sha1

Preimage: version:1,parent:57f0bbaf9cc7a23e3ab5d90c0ef07023b04fec01,tree:2b5a78ee16c9971858b50fa9c1980547b6e12e1c

Digest: 1a61e4c004239cc24021c21fd8819ede7a99af42

Timestamp: https://freetsa.org/tsr
 Info: Timestamp generated with GitTrustedTimestamps by Mabulous GmbH

 Version: 1
 Policy OID: tsa_policy1
 Hash Algorithm: sha1
 Message data:
     0000 - 1a 61 e4 c0 04 23 9c c2-40 21 c2 1f d8 81 9e de   .a...#..@!......
     0010 - 7a 99 af 42                                       z..B
 Serial number: 0x08E5B7C9
 Time stamp: Oct  5 08:37:23 2026 GMT
 Accuracy: unspecified
 Ordering: yes
 Nonce: 0x0E315C2FE4EA80F9
 TSA: DirName:/O=Free TSA/OU=TSA/description=This certificate digitally signs documents and time stamp requests made using the freetsa.org online services/CN=www.freetsa.org/emailAddress=busilezas@mailbox.org/L=Wuerzburg/C=DE/ST=Bayern
 Extensions:

 -----BEGIN RFC3161 TOKEN-----
 MIIDnAYJKoZIhvcNAQcCoIIDjTCCA4kCAQMxDzANBglghkgBZQMEAgMFADCCAYAG
 CyqGSIb3DQEJEAEEoIIBbwSCAWswggFnAgEBBgQqAwQBMCEwCQYFKw4DAhoFAAQU
 GmHkwAQjnMJAIcIf2IGe3nqZr0ICBAjlt8kYDzIwMjYxMDA1MDgzNzIzWgEB/wII
 DjFcL+TqgPmgggETpIIBDzCCAQsxETAPBgNVBAoMCEZyZWUgVFNBMQwwCgYDVQQL
 DANUU0ExdjB0BgNVBA0MbVRoaXMgY2VydGlmaWNhdGUgZGlnaXRhbGx5IHNpZ25z
 IGRvY3VtZW50cyBhbmQgdGltZSBzdGFtcCByZXF1ZXN0cyBtYWRlIHVzaW5nIHRo
 ZSBmcmVldHNhLm9yZyBvbmxpbmUgc2VydmljZXMxGDAWBgNVBAMMD3d3dy5mcmVl
 dHNhLm9yZzEkMCIGCSqGSIb3DQEJARYVYnVzaWxlemFzQG1haWxib3gub3JnMRIw
 EAYDVQQHDAlXdWVyemJ1cmcxCzAJBgNVBAYTAkRFMQ8wDQYDVQQIDAZCYXllcm4x
 ggHtMIIB6QIBATCBozCBlTERMA8GA1UEChMIRnJlZSBUU0ExEDAOBgNVBAsTB1Jv
 b3QgQ0ExGDAWBgNVBAMTD3d3dy5mcmVldHNhLm9yZzEiMCAGCSqGSIb3DQEJARYT
 YnVzaWxlemFzQGdtYWlsLmNvbTESMBAGA1UEBxMJV3VlcnpidXJnMQ8wDQYDVQQI
 EwZCYXllcm4xCzAJBgNVBAYTAkRFAgkAwumGFg2o6c0wDQYJYIZIAWUDBAIDBQCg
 gbgwGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0y
 NjEwMDUwODM3MjNaMCsGCyqGSIb3DQEJEAIMMRwwGjAYMBYEFEgf1TxTTThBgMAo
 ZRmgNvmIVEdmME8GCSqGSIb3DQEJBDFCBECf9I+nx4VlcqIy9yo351cgn9aYh9w5
 qwFKtKlX6UqdX3HTNQDvyDbPBp2tRR7SVPmVDsGU5ED8bcO+4cxkipdYMAoGCCqG
 SM49BAMEBGgwZgIxAMLRgNn06QwRYwsFZkVR0zTYSE0xd6gvVRzQGJ3eNcrQxAmM
 X95TrGap0km2Uu9gFQIxAOqKuugEg5vZlaOx1p9C28uenIwXwZRUiz9TAq0L4QgM
 1pXUxv4/6tDVS2gEj7zjDw==
 -----END RFC3161 TOKEN-----

Timestamp: https://tsa.cesnet.cz:3162/tsa
 Info: Timestamp generated with GitTrustedTimestamps by Mabulous GmbH

 Version: 1
 Policy OID: 1.3.6.1.4.1.22408.1.2.3.45
 Hash Algorithm: sha1
 Message data:
     0000 - 1a 61 e4 c0 04 23 9c c2-40 21 c2 1f d8 81 9e de   .a...#..@!......
     0010 - 7a 99 af 42                                       z..B
 Serial number: 0x33D6B37621938998
 Time stamp: Oct  5 08:37:23 2026 GMT
 Accuracy: unspecified seconds, unspecified millis, 0x01 micros
 Ordering: no
 Nonce: 0xBA2582D629B00792
 TSA: DirName:/DC=cz/DC=cesnet-ca/O=CESNET/CN=tsa.cesnet.cz
 Extensions:

 -----BEGIN RFC3161 TOKEN-----
 MIIE4AYJKoZIhvcNAQcCoIIE0TCCBM0CAQMxDTALBglghkgBZQMEAgEwgdMGCyqG
 SIb3DQEJEAEEoIHDBIHAMIG9AgEBBgwrBgEEAYGvCAECAy0wITAJBgUrDgMCGgUA
 BBQaYeTABCOcwkAhwh/YgZ7eepmvQgIIM9azdiGTiZgYDzIwMjYxMDA1MDgzNzIz
 WjADgQEBAgkAuiWC1imwB5KgXKRaMFgxEjAQBgoJkiaJk/IsZAEZFgJjejEZMBcG
 CgmSJomT8ixkARkWCWNlc25ldC1jYTEPMA0GA1UECgwGQ0VTTkVUMRYwFAYDVQQD
 DA10c2EuY2VzbmV0LmN6MYID4TCCA90CAQEwbDBgMRIwEAYKCZImiZPyLGQBGRYC
 Y3oxGTAXBgoJkiaJk/IsZAEZFgljZXNuZXQtY2ExEjAQBgNVBAoMCUNFU05FVCBD
 QTEbMBkGA1UEAwwSUGVyc29uYWwgU2lnbmluZyAyAghMqQaB1E58xzALBglghkgB
 ZQMEAgGgggFIMBoGCSqGSIb3DQEJAzENBgsqhkiG9w0BCRABBDAcBgkqhkiG9w0B
 CQUxDxcNMjYxMDA1MDgzNzIzWjArBgkqhkiG9w0BCTQxHjAcMAsGCWCGSAFlAwQC
 AaENBgkqhkiG9w0BAQsFADAvBgkqhkiG9w0BCQQxIgQgIayddINSKud8vTX/7XOJ
 CTmt+HiaFJoHv190ivahK74wga0GCyqGSIb3DQEJEAIvMYGdMIGaMIGXMIGUBCAc
 O3o3/W7cckkHxBOlTNL/tYnuzpzlsGK9Eedtt96ttTBwMGSkYjBgMRIwEAYKCZIm
 iZPyLGQBGRYCY3oxGTAXBgoJkiaJk/IsZAEZFgljZXNuZXQtY2ExEjAQBgNVBAoM
 CUNFU05FVCBDQTEbMBkGA1UEAwwSUGVyc29uYWwgU2lnbmluZyAyAghMqQaB1E58
 xzANBgkqhkiG9w0BAQsFAASCAgAZIycR0GVwXJoE8w+JEl0FnCQd33IpAnA5FpTn
 SBmbRNvBVfl160uq9RDJULqp6xC2reeZTydjI/5JtuoUV6RJ5LVZj93fUf2FaZP9
 kJpcJxOJVHzreJUY6HJ4Oat/8kxkz4+JjZHlJc/aGBtXINxfwFLxOZSTHplRtVeG
 CbJP3JanrhdJa6TXbp6V1qYSJauNFWxL7HmeDmLzxwCaPdBdJOhpjkHLvy0kiYxj
 GfDlax+/A6hsnr/kxmi+C1KHmtOQU3Tmv/G9ndCegnxHaM4YPoxFMF2NGPFfpS0U
 Y+8MkJ6FV2nmcHQhvt76zQWb1WQYt6/T05YPadKzS/aYx6tHD+ZB1HRQJrHkKC1O
 QYqLZVr27Ry4Ls8oGmz/1cJfXFN/oHrgg7tG2ynveNepWzxy7O5wfIigI+V4UM5C
 3VXwvHq2FDg6LdNkxEF/ZokdsZQt1e/ayALYpWl6p7XfoWik3N18Nrj9uqFqntKB
 iufHfgIV/0A6sAotf17q5jhNgHXikg9QAxSjG40ZoaveuSvBUbCMYdFnSn0S/E7Y
 5AO+NVqxJVq58Dvh3eqdxJxRTYeXZfn++dqAwYj4uf3ejuUXQZQGuDEq9mjodxo8
 A2imEWPYDFDha6VwPirKX3PVnCxIJJjmyzikT57EHBkJiYvfTJIr2wXkOqzYyQwp
 JIPByA==
 -----END RFC3161 TOKEN-----
artur requested review from phil 2026-10-05 09:13:44 +00:00
phil approved these changes 2026-10-05 09:55:58 +00:00
phil left a comment
Owner
Copy link
Copy source

Works for me - JankariTechUG/accounting#160

Works for me - https://git.jankaritech.eu/JankariTechUG/accounting/pulls/160
phil commented 2026-10-05 09:56:41 +00:00
Owner
Copy link
Copy source

Validate Trusted Timestamps Actions - IMO this repo has had various commits that do not have timestamps.

Validate Trusted Timestamps Actions - IMO this repo has had various commits that do not have timestamps.
artur merged commit 2dd8923dc4 into main 2026-10-05 10:14:54 +00:00
artur deleted branch onlyDownloadOnce 2026-10-05 10:14:54 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
phil
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
artur (Artur Neumann) jankaritech phil
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: JankariTechUG/GitTrustedTimestamps#16