Block what could not be checked when screening fails closed

* Block versions published under a minimum age

* Trim comments and tidy the age filter

core/Cargo.toml

@@ -44,6 +44,10 @@ path = "tests/denylist.rs"
 name = "osv"
 path = "tests/osv.rs"
 
+[[test]]
+name = "age"
+path = "tests/age.rs"
+
 [[test]]
 name = "mitm"
 path = "tests/mitm.rs"
@@ -63,7 +67,7 @@ regex = "1.13.1"
 semver = "1.0.28"
 serde = { version = "1.0.229", features = ["derive"] }
 serde_json = "1.0.151"
-time = { version = "0.3.47", features = ["formatting"] }
+time = { version = "0.3.47", features = ["formatting", "parsing"] }
 tokio = { version = "1.53.1", features = ["io-util", "rt", "sync", "time"] }
 tracing = "0.1.44"
 tracing-subscriber = { version = "0.3.23", features = ["env-filter"] }

core/src/config/mod.rs

@@ -1,6 +1,7 @@
 use crate::policies::registries::{Registry, BUILT_IN};
 use directories::ProjectDirs;
 use serde::Deserialize;
+use std::collections::HashMap;
 use std::io::{Error, ErrorKind};
 use std::path::PathBuf;
 
@@ -13,13 +14,25 @@ pub struct FirewallConfig {
     pub port: u16,
     /// Allow a package when a filter could not check it.
     pub fail_open: bool,
+    /// 0 turns the age check off.
+    pub min_age_hours: u64,
     pub denylist: DenylistSource,
+    /// Packages never screened, by ecosystem: `{"npm": [{"name": "left-pad"}]}`.
+    pub allow: HashMap<String, Vec<AllowedPackage>>,
     pub telemetry: bool,
     /// Not describable in the file yet, so this is always the built-in table.
     #[serde(skip)]
     pub registries: Vec<&'static Registry>,
 }
 
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct AllowedPackage {
+    pub name: String,
+    /// Every version when absent.
+    pub version: Option<String>,
+}
+
 #[derive(Debug, Clone, Deserialize)]
 #[serde(default, deny_unknown_fields)]
 pub struct DenylistSource {
@@ -43,7 +56,9 @@ impl Default for FirewallConfig {
         FirewallConfig {
             port: DEFAULT_PORT,
             fail_open: true,
+            min_age_hours: 0,
             denylist: DenylistSource::default(),
+            allow: HashMap::new(),
             telemetry: true,
             registries: BUILT_IN.to_vec(),
         }
@@ -80,6 +95,18 @@ impl FirewallConfig {
     pub fn local_url(&self, path: &str) -> String {
         crate::local_url(self.port, path)
     }
+
+    /// Without building a `Firewall`, which needs a runtime.
+    pub fn hosts(&self) -> Vec<&'static str> {
+        let mut hosts: Vec<&'static str> = Vec::new();
+        for registry in &self.registries {
+            let host = registry.host();
+            if !hosts.contains(&host) {
+                hosts.push(host);
+            }
+        }
+        hosts
+    }
 }
 
 pub fn path() -> Option<PathBuf> {

core/src/firewall.rs

@@ -1,4 +1,5 @@
 use crate::config::FirewallConfig;
+use crate::policies::filters::age::Age;
 use crate::policies::filters::denylist::Denylist;
 use crate::policies::filters::osv::Osv;
 use crate::policies::filters::Filter;
@@ -27,7 +28,10 @@ impl Firewall {
         }
         let ecosystems = config.registries.iter().map(|r| r.osv_name);
         let denylist = Denylist::new(config.denylist.clone(), config.denylist.token(), ecosystems);
-        let filters: Vec<Box<dyn Filter>> = vec![Box::new(denylist), Box::new(Osv)];
+        let mut filters: Vec<Box<dyn Filter>> = vec![Box::new(denylist), Box::new(Osv)];
+        if config.min_age_hours > 0 {
+            filters.push(Box::new(Age::new(config.min_age_hours)));
+        }
         Firewall { config, patterns, filters }
     }
 
@@ -40,14 +44,7 @@ impl Firewall {
     }
 
     pub fn hosts(&self) -> Vec<&'static str> {
-        let mut hosts: Vec<&'static str> = Vec::new();
-        for registry in &self.config.registries {
-            let host = registry.host();
-            if !hosts.contains(&host) {
-                hosts.push(host);
-            }
-        }
-        hosts
+        self.config.hosts()
     }
 
     pub fn is_index_url(&self, url: &str) -> bool {

core/src/mitm/ca.rs

@@ -1,10 +1,12 @@
 use rama::error::BoxError;
 use rama::tls::boring::core::x509::X509;
 use rcgen::{
-    BasicConstraints, CertificateParams, DistinguishedName, DnType, GeneralSubtree, IsCa,
-    KeyUsagePurpose, NameConstraints, SigningKey,
+    BasicConstraints, CertificateParams, CertificateRevocationListParams, DistinguishedName,
+    DnType, GeneralSubtree, IsCa, Issuer, KeyIdMethod, KeyUsagePurpose, NameConstraints,
+    SerialNumber, SigningKey,
 };
 use std::sync::Arc;
+use time::{Duration, OffsetDateTime};
 
 /// Held in the Secure Enclave on macOS, in memory elsewhere.
 pub type CaSigner = Arc<dyn SigningKey + Send + Sync>;
@@ -42,6 +44,22 @@ impl CertificateAuthority {
     }
 }
 
+/// Empty, for verifiers that fail closed without one, such as schannel under cargo.
+/// Signed fresh for each fetch; a week's validity outlasts any verifier's cache.
+pub fn crl(hosts: &[&str], signer: &dyn SigningKey) -> Result<Vec<u8>, BoxError> {
+    let now = OffsetDateTime::now_utc();
+    let list = CertificateRevocationListParams {
+        this_update: now - Duration::hours(1),
+        next_update: now + Duration::days(7),
+        crl_number: SerialNumber::from(now.unix_timestamp() as u64),
+        issuing_distribution_point: None,
+        revoked_certs: Vec::new(),
+        key_identifier_method: KeyIdMethod::Sha256,
+    };
+    let ca = params(hosts);
+    Ok(list.signed_by(&Issuer::from_params(&ca, signer))?.der().to_vec())
+}
+
 /// Also used by the issuer, whose issuer name must match the CA's subject.
 pub fn params(hosts: &[&str]) -> CertificateParams {
     let mut name = DistinguishedName::new();
@@ -51,7 +69,8 @@ pub fn params(hosts: &[&str]) -> CertificateParams {
     let mut params = CertificateParams::default();
     params.distinguished_name = name;
     params.is_ca = IsCa::Ca(BasicConstraints::Constrained(0));
-    params.key_usages = vec![KeyUsagePurpose::KeyCertSign];
+    // rcgen signs a CRL only for a CA that may.
+    params.key_usages = vec![KeyUsagePurpose::KeyCertSign, KeyUsagePurpose::CrlSign];
     params.name_constraints = Some(NameConstraints {
         permitted_subtrees: hosts
             .iter()

core/src/mitm/issuer.rs

@@ -4,7 +4,7 @@ use rama::tls::boring::core::pkey::PKey;
 use rama::tls::boring::core::x509::X509;
 use rama::tls::boring::proxy::cert_issuer::{BoringMitmCertIssuer, MitmIssuedCert};
 use rama::utils::collections::non_empty_vec;
-use rcgen::{CertificateParams, DistinguishedName, DnType, Issuer, KeyPair};
+use rcgen::{CertificateParams, CrlDistributionPoint, DistinguishedName, DnType, Issuer, KeyPair};
 use std::sync::Arc;
 
 /// Leaves name only screened hosts; any other name falls outside the CA's constraint.
@@ -14,12 +14,18 @@ pub struct ConstrainedCertIssuer {
     ca_params: Arc<CertificateParams>,
     signer: CaSigner,
     hosts: Vec<&'static str>,
+    crl: Option<String>,
 }
 
 impl ConstrainedCertIssuer {
-    pub(super) fn new(ca_crt: X509, signer: CaSigner, hosts: Vec<&'static str>) -> Self {
+    pub(super) fn new(
+        ca_crt: X509,
+        signer: CaSigner,
+        hosts: Vec<&'static str>,
+        crl: Option<String>,
+    ) -> Self {
         let ca_params = Arc::new(params(&hosts));
-        Self { ca_crt, ca_params, signer, hosts }
+        Self { ca_crt, ca_params, signer, hosts, crl }
     }
 }
 
@@ -42,6 +48,9 @@ impl BoringMitmCertIssuer for ConstrainedCertIssuer {
         subject.push(DnType::CommonName, common_name);
         let mut leaf = CertificateParams::new(names)?;
         leaf.distinguished_name = subject;
+        if let Some(crl) = &self.crl {
+            leaf.crl_distribution_points = vec![CrlDistributionPoint { uris: vec![crl.clone()] }];
+        }
 
         // The TLS server needs the leaf key in memory, so it can't be the platform key.
         let leaf_key = KeyPair::generate()?;

core/src/mitm/mod.rs

@@ -3,7 +3,7 @@ mod issuer;
 mod route;
 mod screen;
 
-pub use ca::{CaSigner, CertificateAuthority};
+pub use ca::{crl, CaSigner, CertificateAuthority};
 
 use crate::Firewall;
 use issuer::ConstrainedCertIssuer;
@@ -25,14 +25,16 @@ type RelayService = Arc<HttpMitmRelay<FirewallLayer>>;
 type InterceptService =
     TlsMitmRelayService<CachedBoringMitmCertIssuer<ConstrainedCertIssuer>, RelayService>;
 
+/// `crl` is where leaves say an empty CRL is served, for verifiers that insist on one.
 pub fn mitm_service(
     firewall: Arc<Firewall>,
     ca: &CertificateAuthority,
     signer: CaSigner,
+    crl: Option<String>,
     exec: Executor,
 ) -> MitmService {
     let hosts = firewall.hosts();
-    let issuer = ConstrainedCertIssuer::new(ca.crt.clone(), signer, hosts.clone());
+    let issuer = ConstrainedCertIssuer::new(ca.crt.clone(), signer, hosts.clone(), crl);
 
     let relay = Arc::new(HttpMitmRelay::new(exec).with_http_middleware(FirewallLayer { firewall }));
 

core/src/os/macos/mod.rs

@@ -108,7 +108,7 @@ fn handler(exec: Executor) -> Result<Handler, BoxError> {
     let signer: mitm::CaSigner = Arc::new(key);
     let ca = install::certificate_authority(&hosts, &*signer);
     let ca = Arc::new(ca.inspect_err(|_| telemetry::error("ca"))?);
-    let service = mitm::mitm_service(firewall, &ca, signer, exec);
+    let service = mitm::mitm_service(firewall, &ca, signer, None, exec);
     Ok(Handler { ca, hosts, service })
 }
 

core/src/policies/filters/age.rs

@@ -0,0 +1,72 @@
+use super::{Filter, Verdict, VerdictFuture, AGENT};
+use crate::policies::registries::{Published, Registry};
+use crate::policies::Package;
+use rama::http::client::EasyHttpWebClient;
+use rama::http::header::USER_AGENT;
+use rama::http::service::client::HttpClientExt;
+use rama::http::{BodyExtractExt, StatusCode};
+use serde_json::Value;
+use time::format_description::well_known::Rfc3339;
+use time::{Duration, OffsetDateTime};
+
+pub struct Age {
+    min: Duration,
+}
+
+impl Age {
+    pub fn new(hours: u64) -> Self {
+        Age { min: Duration::hours(hours as i64) }
+    }
+}
+
+impl Filter for Age {
+    fn name(&self) -> &'static str {
+        "age"
+    }
+
+    fn check<'a>(&'a self, registry: &'static Registry, pkg: &'a Package) -> VerdictFuture<'a> {
+        Box::pin(async move {
+            let Some(version) = pkg.version.as_deref() else { return Verdict::Allow };
+            let Some(published) = &registry.published else { return Verdict::Allow };
+            let published_at = match published_at(published, &pkg.name, version).await {
+                Ok(at) => at,
+                Err(e) => return Verdict::Unknown(e),
+            };
+
+            let age = OffsetDateTime::now_utc() - published_at;
+            if age >= self.min {
+                return Verdict::Allow;
+            }
+            let (hours, min) = (age.whole_hours(), self.min.whole_hours());
+            Verdict::Deny(format!("was published {hours} hours ago, under the {min}-hour minimum"))
+        })
+    }
+}
+
+async fn published_at(
+    published: &Published,
+    name: &str,
+    version: &str,
+) -> Result<OffsetDateTime, String> {
+    let name = match published.escape {
+        Some(escape) => escape(name),
+        None => name.to_string(),
+    };
+    let url = published.url.replace("{name}", &name).replace("{version}", version);
+    let pointer = published.pointer.replace("{version}", version);
+
+    let client = EasyHttpWebClient::default();
+    let response = client.get(&url).header(USER_AGENT, AGENT).send().await;
+    let response = response.map_err(|e| e.to_string())?;
+    if response.status() != StatusCode::OK {
+        return Err(format!("{url} replied {}", response.status()));
+    }
+    let text = response.try_into_string().await.map_err(|e| e.to_string())?;
+    let body: Value =
+        serde_json::from_str(&text).map_err(|e| format!("{url} sent unreadable JSON: {e}"))?;
+
+    let Some(stamp) = body.pointer(&pointer).and_then(Value::as_str) else {
+        return Err(format!("{url} gave no publish time"));
+    };
+    OffsetDateTime::parse(stamp, &Rfc3339).map_err(|e| format!("{url} sent a bad time: {e}"))
+}

core/src/policies/filters/denylist.rs

@@ -1,4 +1,4 @@
-use super::{Filter, Verdict, VerdictFuture};
+use super::{Filter, Verdict, VerdictFuture, AGENT};
 use crate::config::DenylistSource;
 use crate::policies::registries::Registry;
 use crate::policies::Package;
@@ -14,9 +14,6 @@ use tokio::sync::OnceCell;
 use tokio::task::JoinHandle;
 use tracing::{info, warn};
 
-/// The GitHub API turns away requests without a user agent.
-const AGENT: &str = "strix-firewall";
-
 #[derive(Debug, PartialEq)]
 pub enum AffectedVersions {
     All,

core/src/policies/filters/mod.rs

@@ -1,3 +1,4 @@
+pub mod age;
 pub mod denylist;
 pub mod osv;
 
@@ -6,6 +7,9 @@ use crate::Firewall;
 use std::future::Future;
 use std::pin::Pin;
 
+/// Some registry APIs turn away requests without a user agent.
+const AGENT: &str = "strix-firewall";
+
 pub type VerdictFuture<'a> = Pin<Box<dyn Future<Output = Verdict> + Send + 'a>>;
 
 /// `Unknown` means the filter could not check the package.
@@ -26,6 +30,9 @@ pub async fn consult(
     registry: &'static Registry,
     pkg: &Package,
 ) -> Option<(&'static str, Verdict)> {
+    if allowed(firewall, registry, pkg) {
+        return None;
+    }
     let mut unsure = None;
     for filter in firewall.filters() {
         match filter.check(registry, pkg).await {
@@ -37,3 +44,18 @@ pub async fn consult(
     }
     unsure
 }
+
+fn allowed(firewall: &Firewall, registry: &Registry, pkg: &Package) -> bool {
+    let Some(entries) = firewall.config.allow.get(registry.eco) else {
+        return false;
+    };
+    entries.iter().any(|entry| {
+        let name_matches = match registry.normalize {
+            Some(normalize) => normalize(&entry.name) == pkg.name,
+            None => entry.name == pkg.name,
+        };
+        // Go writes a leading v that the parsed version drops, and PEP 440 ignores one.
+        let version = entry.version.as_deref().map(|v| v.strip_prefix('v').unwrap_or(v));
+        name_matches && (version.is_none() || version == pkg.version.as_deref())
+    })
+}

core/src/policies/mod.rs

@@ -72,6 +72,9 @@ pub async fn screen(url: &str, firewall: &Firewall) -> Option<String> {
         Some((_, Verdict::Deny(reason))) => {
             Some(format!("{} {reason}", pkg.label()))
         }
+        Some((filter, Verdict::Unknown(e))) if !firewall.config.fail_open => {
+            Some(format!("{} could not be checked by {filter} ({e})", pkg.label()))
+        }
         _ => None,
     }
 }

core/src/policies/registries/cargo.rs

@@ -1,4 +1,4 @@
-use super::{Pattern, Registry};
+use super::{Pattern, Published, Registry};
 
 pub static CARGO_INDEX: Registry = Registry {
     prefix: "/cargo/index/",
@@ -16,6 +16,7 @@ pub static CARGO_INDEX: Registry = Registry {
         // Sparse index paths shard by name: le/ft/left-pad, 3/s/syn, 2/cc.
         Pattern { re: r"(?<name>[^/]+)$", rewrite: None },
     ],
+    published: None,
 };
 
 pub static CARGO_DL: Registry = Registry {
@@ -26,6 +27,11 @@ pub static CARGO_DL: Registry = Registry {
     index: false,
     normalize: None,
     patterns: &[Pattern { re: r"^(?<name>[^/]+)/(?<version>[^/]+)", rewrite: None }],
+    published: Some(Published {
+        url: "https://crates.io/api/v1/crates/{name}/{version}",
+        pointer: "/version/created_at",
+        escape: None,
+    }),
 };
 
 /// `cargo add` resolves versions here, named by config.json's "api" field.
@@ -37,4 +43,5 @@ pub static CRATES_API: Registry = Registry {
     index: false,
     normalize: None,
     patterns: &[],
+    published: None,
 };

core/src/policies/registries/gem.rs

@@ -1,4 +1,4 @@
-use super::{Pattern, Registry};
+use super::{Pattern, Published, Registry};
 
 pub static GEM: Registry = Registry {
     prefix: "/gem/",
@@ -16,4 +16,9 @@ pub static GEM: Registry = Registry {
         // The compact index, which names no version.
         Pattern { re: r"^info/(?<name>[^/]+)$", rewrite: None },
     ],
+    published: Some(Published {
+        url: "https://rubygems.org/api/v2/rubygems/{name}/versions/{version}.json",
+        pointer: "/created_at",
+        escape: None,
+    }),
 };

core/src/policies/registries/go.rs

@@ -1,4 +1,4 @@
-use super::{Pattern, Registry};
+use super::{Pattern, Published, Registry};
 
 pub static GO: Registry = Registry {
     prefix: "/go/",
@@ -13,6 +13,11 @@ pub static GO: Registry = Registry {
         // The version list and the latest lookup, which name no version.
         Pattern { re: r"^(?<name>.+)/@(?:v/list|latest)$", rewrite: None },
     ],
+    published: Some(Published {
+        url: "https://proxy.golang.org/{name}/@v/v{version}.info",
+        pointer: "/Time",
+        escape: Some(escape),
+    }),
 };
 
 /// The proxy protocol writes every capital as !<lowercase>; advisories do not.
@@ -27,3 +32,14 @@ fn unescape(path: &str) -> String {
     }
     out
 }
+
+fn escape(path: &str) -> String {
+    let mut out = String::with_capacity(path.len());
+    for c in path.chars() {
+        if c.is_ascii_uppercase() {
+            out.push('!');
+        }
+        out.push(c.to_ascii_lowercase());
+    }
+    out
+}

core/src/policies/registries/mod.rs

@@ -48,6 +48,15 @@ pub struct Registry {
     /// PyPI escapes a name into a filename and Go escapes its capitals; advisories do neither.
     pub normalize: Option<fn(&str) -> String>,
     pub patterns: &'static [Pattern],
+    pub published: Option<Published>,
+}
+
+/// A URL to fetch and a JSON pointer to the timestamp in its reply.
+#[derive(Debug)]
+pub struct Published {
+    pub url: &'static str,
+    pub pointer: &'static str,
+    pub escape: Option<fn(&str) -> String>,
 }
 
 impl Registry {

core/src/policies/registries/npm.rs

@@ -1,4 +1,4 @@
-use super::{Pattern, Registry};
+use super::{Pattern, Published, Registry};
 
 pub static NPM: Registry = Registry {
     prefix: "/npm/",
@@ -18,4 +18,9 @@ pub static NPM: Registry = Registry {
             rewrite: Some(("https://registry.npmjs.org/", "/npm/")),
         },
     ],
+    published: Some(Published {
+        url: "https://registry.npmjs.org/{name}",
+        pointer: "/time/{version}",
+        escape: None,
+    }),
 };

core/src/policies/registries/pypi.rs

@@ -1,4 +1,4 @@
-use super::{Pattern, Registry};
+use super::{Pattern, Published, Registry};
 
 const FILES: (&str, &str) = ("https://files.pythonhosted.org/", "/pypi-files/");
 
@@ -13,6 +13,7 @@ pub static PYPI: Registry = Registry {
         Pattern { re: r"^simple/(?<name>[^/]+)", rewrite: Some(FILES) },
         Pattern { re: "", rewrite: Some(FILES) },
     ],
+    published: None,
 };
 
 /// The directories are hash shards, but the filename names the distribution.
@@ -35,6 +36,11 @@ pub static PYPI_FILES: Registry = Registry {
             rewrite: None,
         },
     ],
+    published: Some(Published {
+        url: "https://pypi.org/pypi/{name}/{version}/json",
+        pointer: "/urls/0/upload_time_iso_8601",
+        escape: None,
+    }),
 };
 
 /// PEP 503: runs of - _ and . collapse to one -, lowercased, which also un-escapes a wheel.

core/tests/age.rs

@@ -0,0 +1,27 @@
+use firewall::policies::screen;
+use firewall::{Firewall, FirewallConfig};
+use rama::rt::blocking::Runtime;
+
+const OLD_DOWNLOADS: &[&str] = &[
+    "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
+    "https://files.pythonhosted.org/packages/aa/bb/requests-2.31.0-py3-none-any.whl",
+    "https://static.crates.io/crates/serde/1.0.200",
+    "https://rubygems.org/gems/rake-13.0.6.gem",
+    "https://proxy.golang.org/github.com/!burnt!sushi/toml/@v/v1.3.2.zip",
+];
+
+#[test]
+#[ignore = "queries every registry"]
+fn every_registry_reports_when_a_version_was_published() {
+    let runtime = Runtime::try_new().expect("runtime");
+    runtime.block_on(async {
+        let firewall =
+            |hours| Firewall::new(FirewallConfig { min_age_hours: hours, ..Default::default() });
+        let (lenient, strict) = (firewall(24), firewall(24 * 365 * 100));
+        for url in OLD_DOWNLOADS {
+            assert_eq!(screen(url, &lenient).await, None, "{url}");
+            let blocked = screen(url, &strict).await.unwrap_or_default();
+            assert!(blocked.contains("hour minimum"), "{url}: {blocked:?}");
+        }
+    });
+}

core/tests/config.rs

@@ -1,5 +1,7 @@
 use firewall::config::path;
-use firewall::FirewallConfig;
+use firewall::policies::filters::consult;
+use firewall::policies::{screen, Package};
+use firewall::{Firewall, FirewallConfig};
 
 #[test]
 fn a_file_only_has_to_set_what_it_changes() {
@@ -19,3 +21,23 @@ fn the_config_lives_under_the_config_directory() {
     let path = path().expect("a home directory");
     assert!(path.ends_with("config.json"), "{}", path.display());
 }
+
+#[tokio::test]
+async fn an_allowed_version_skips_the_filters() {
+    // An unreachable denylist would otherwise leave the package unchecked.
+    let config = r#"{"allow": {"go": [{"name": "golang.org/x/net", "version": "v0.20.0"}]}, "denylist": {"base": "http://127.0.0.1:1"}}"#;
+    let firewall = Firewall::new(serde_json::from_str(config).expect("parses"));
+    let (registry, _) = firewall.match_on("/go/golang.org/x/net/@v/list", |r| r.prefix).expect("go");
+    let pkg = |version: &str| Package { name: "golang.org/x/net".into(), version: Some(version.into()) };
+    assert!(consult(&firewall, registry, &pkg("0.20.0")).await.is_none());
+    assert!(consult(&firewall, registry, &pkg("0.21.0")).await.is_some());
+}
+
+#[tokio::test]
+async fn failing_closed_blocks_what_could_not_be_checked() {
+    let config = r#"{"fail_open": false, "denylist": {"base": "http://127.0.0.1:1"}}"#;
+    let firewall = Firewall::new(serde_json::from_str(config).expect("parses"));
+    let url = "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz";
+    let blocked = screen(url, &firewall).await.unwrap_or_default();
+    assert!(blocked.contains("could not be checked"), "{blocked:?}");
+}

core/tests/mitm.rs

@@ -43,3 +43,10 @@ fn stored_ca_is_rejected_when_the_signing_key_changed() {
 
     assert!(mitm::CertificateAuthority::from_blob(&blob, &hosts, &signer()).is_none());
 }
+
+/// rcgen signs a CRL only for a CA with cRLSign, and schannel wants one for every leaf.
+#[test]
+fn ca_signs_an_empty_crl() {
+    let crl = mitm::crl(&["registry.npmjs.org", "pypi.org"], &signer()).expect("sign a crl");
+    assert_eq!(crl[0], 0x30, "a DER SEQUENCE");
+}