Hoist tooling files into root directory

.github/workflows/ci.yml

@@ -8,29 +8,29 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v2
-    - name: Set up Python 3.9
-      uses: actions/setup-python@v2
+    - uses: actions/checkout@v7
+    - name: Set up Python 3.14
+      uses: actions/setup-python@v7
       with:
-        python-version: 3.9
+        python-version: 3.14
 
     - name: Install Linting Tools
       run: |
         python -m pip install --upgrade pip
-        pip install --user pylint==2.6.0
-        pip install --user black~=22.3
-        pip install --user flake8~=4.0
+        pip install --user pylint==4.0.8
+        pip install --user black==26.5.1
+        pip install --user flake8==7.3.0
 
     - name: Analysing the code with pylint
       run: |
-        python -m pylint -E tooling/
+        python -m pylint -E .
 
     - name: Checking format with Black
       run: |
-        python -m black --check tooling/
+        python -m black --check .
 
     - name: Checking format with Flake8
       run: |
-        python -m flake8 tooling/
+        python -m flake8 .
 
 

README.md

@@ -1,42 +1,41 @@
 # Let's Encrypt Certificate Transparency Logs
 
-This repository contains all Root Certificate Authorities from whom [Let's Encrypt's Certificate Transparency Logs](https://letsencrypt.org/docs/ct-logs/) accept leaf certificates.
+This repository contains all root CAs from whom [Let's Encrypt's Certificate Transparency Logs](https://letsencrypt.org/docs/ct-logs/) accept leaf certificates.
 
-Let's Encrypt operates two publicly-accessible [Certificate Transparency](https://www.certificate-transparency.org/what-is-ct) logs:
-* **Oak**
-* **Sapling**
+Certificates are stored in the `roots/` directory:
 
-## Oak
+1. The `roots/common/` directory, which is included in bundles for testing and production logs.
 
-Oak is a production log, containing only certificates which are trusted by the [Mozilla Root Program](https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/).
+2. The `roots/testing/` directory, which is only included in the bundle for testing logs.
 
-## Sapling
-
-Sapling is a preproduction log, intended for certificates which are not publicly trusted, but which are issued by Certificate Authorities who either issue or are expected to issue publicly trusted certificates. In other words, Sapling is used by trusted Certificate Authorities in their testing infrastructures.
+# Submitting a CA root for inclusion
 
-## Testflume
+First, you'll need to install [certigo](https://github.com/square/certigo).
 
-[Testflume no longer exists](https://groups.google.com/a/chromium.org/g/ct-policy/c/CLBlt5rSsAk) and has been replaced by the Sapling test log.
+Next, fork this GitHub repository and add your root certificate(s) to the store:
 
-## ct-test-srv
+```
+./add-roots.sh roots/testing example_new_ca.pem
+```
 
-The [Boulder](https://github.com/letsencrypt/boulder/tree/main/test/ct-test-srv) codebase contains a piece of software named `ct-test-srv` which  implements RFC6962 `add-chain` and `add-pre-chain` endpoints. This software is sufficient for development and other testing environments. It does not persist data.
+Create a [new pull
+request](https://github.com/letsencrypt/ct-log-metadata/compare) and fill out
+the provided template. All communication will be performed via responses to your
+PR.
 
-# Submitting a CA root for inclusion
+Upon approval, Let's Encrypt staff will merge your change, which publishes new
+accepted-roots bundles (see below). Rolling a new bundle out to our running CT
+logs is a separate, SRE-gated process and isn't automatic.
 
-Create a [New Issue](https://github.com/letsencrypt/ct-log-metadata/issues/new/choose) and fill out the provided template. All communication will be performed via responses to your Github Issue. Upon approval, Let's Encrypt staff will create a Pull Request to include your certificates and update our Certificate Transparency logs.
+# Other tooling
 
-# What roots does a log contain?
+To dump all root certificates a log currently accepts:
 
-Calling the `get-roots` endpoint for a [Trillian](https://github.com/google/trillian) backed log will return a JSON structure containing each root as base64 encoded DER.
-
-Example retrieving all the roots from a CT log and viewing certificate content:
 ```
-counter=1
-for root in $(curl -sL https://oak.ct.letsencrypt.org/2023/ct/v1/get-roots | jq -r '.certificates[]'); do
-    echo -n "${root}" | base64 -d > /tmp/${counter}.crt
-    counter=$((counter+1))
-done
-
-openssl x509 -inform DER -in /tmp/${counter}.crt -noout -issuer -serial
+mkdir /tmp/downloaded-roots/
+./pull-roots.sh https://log.twig.ct.letsencrypt.org/2026h2/ /tmp/downloaded-roots/
 ```
+
+The `build_bundle.py` script is used in CI by the release build process. You
+shouldn't need to use it directly for submitting a new root.
+