Merge commit from fork

* Only validate revocation and time in chain certs

* Rearrange x5c parsing

* Tweak API of assertCertIsWithinValidTimeWindow

* Can't check revocation of potential anchors

* Only split leaf + intermediates once

* Hoist verified `chain`

* Replace last cert in chain to simplify later logic

* Tweak tests that check updated error messages

* Accept issuerCert in isCertRevoked

* Check time validity of chain certs

* Begin to check revocation status of chain certs

* Get some testing set up for isCertRevoked()

* Verify CRL signature

* Assert CRL URL is fetched

* Tweak isCertRevoked tests

* Raise SimpleWebAuthnError from cert validation

* Update verifyAttestationWithMetadata

* Only validate chain after all checks pass

* Update X.509 root cert maker to add CRL sign ext

* Fix some dates

* Check all CRL URLs, and cache by key ID + URL

* Add test for multiple CRL distribution points

* Soft-fail on AKI checks for cert and certCRL

* Add note about generating test coverage report

* Add http-server to host test coverage report

* Tweak a bit of the root README

* Tweak error messages for AKI check failures

* Simplify generateCRLDistributionPointsExtension

* Tweak some tests

* Address PR feedback

Author: MasterKale

README.md

@@ -98,20 +98,38 @@ Install the following before proceeding:
 After pulling down the code, set up dependencies:
 
 ```sh
-$> deno install
+deno install
 ```
 
 To run unit tests for all workspace packages, use the `test` series of scripts:
 
 ```sh
-# Run an individual package's tests
-$> cd packages/browser/ && deno task test
-$> cd packages/server/ && deno task test
+cd packages/browser/ && deno task test
+```
+
+```sh
+cd packages/server/ && deno task test
 ```
 
 Tests can be run in watch mode with the `test:watch` series of scripts:
 
 ```sh
-$> cd packages/browser/ && deno task test:watch
-$> cd packages/server/ && deno task test:watch
+cd packages/browser/ && deno task test:watch
+```
+
+```sh
+cd packages/server/ && deno task test:watch
+```
+
+### Test Coverage <!-- omit in toc -->
+
+The following additional dependencies are needed locally to display test coverage reports:
+
+- **genhtml** (run `brew install lcov` on macOS to install this CLI tool)
+
+Then run the following command to run tests and then host a coverage report at
+http://127.0.0.1:8000:
+
+```
+deno run test:coverage
 ```

deno.json

@@ -4,9 +4,9 @@
     "test:browser": "(cd packages/browser; deno task test)",
     "test:server": "(cd packages/server; deno task test)",
     "test:coverage": {
-      "command": "(cd html_cov/ && python -m http.server -b 127.0.0.1)",
+      "command": "http-server ./html_cov -a 127.0.0.1 -p 8000",
       "dependencies": [
-        "test:coverage:html"
+        // "test:coverage:html"
       ]
     },
     "test:coverage:html": {
@@ -62,6 +62,7 @@
     "@std/path": "jsr:@std/path@^1.0.8",
     "@std/semver": "jsr:@std/semver@^1.0.5",
     "@std/testing": "jsr:@std/testing@^1.0.4",
+    "http-server": "npm:http-server@^14.1.1",
     "jsdom": "npm:jsdom@^25.0.1",
     "rollup": "npm:rollup@^4.27.3",
     "rollup-plugin-version-injector": "npm:rollup-plugin-version-injector@^1.3.3",