20260324 完成和routinator对齐snapshot delta replay correctness一致

src/validation/cert_path.rs

@@ -193,6 +193,59 @@ pub fn validate_ee_cert_path_with_prevalidated_issuer(
     validation_time: time::OffsetDateTime,
 ) -> Result<ResourceCertificate, CertPathError> {
     let ee = ResourceCertificate::decode_der(ee_cert_der)?;
+    validate_ee_cert_path_components(
+        &ee,
+        ee_cert_der,
+        issuer_ca,
+        issuer_spki,
+        issuer_crl,
+        issuer_crl_revoked_serials,
+        issuer_ca_rsync_uri,
+        issuer_crl_rsync_uri,
+        validation_time,
+    )?;
+    Ok(ee)
+}
+
+/// Validate the EE certificate path using a pre-decoded EE certificate and a pre-validated issuer.
+///
+/// This avoids re-decoding the embedded EE certificate when the caller already parsed it while
+/// decoding a signed object (e.g. ROA / ASPA).
+pub fn validate_ee_cert_path_with_predecoded_ee(
+    ee: &ResourceCertificate,
+    ee_cert_der: &[u8],
+    issuer_ca: &ResourceCertificate,
+    issuer_spki: &SubjectPublicKeyInfo<'_>,
+    issuer_crl: &RpkixCrl,
+    issuer_crl_revoked_serials: &HashSet<Vec<u8>>,
+    issuer_ca_rsync_uri: Option<&str>,
+    issuer_crl_rsync_uri: Option<&str>,
+    validation_time: time::OffsetDateTime,
+) -> Result<(), CertPathError> {
+    validate_ee_cert_path_components(
+        ee,
+        ee_cert_der,
+        issuer_ca,
+        issuer_spki,
+        issuer_crl,
+        issuer_crl_revoked_serials,
+        issuer_ca_rsync_uri,
+        issuer_crl_rsync_uri,
+        validation_time,
+    )
+}
+
+fn validate_ee_cert_path_components(
+    ee: &ResourceCertificate,
+    ee_cert_der: &[u8],
+    issuer_ca: &ResourceCertificate,
+    issuer_spki: &SubjectPublicKeyInfo<'_>,
+    issuer_crl: &RpkixCrl,
+    issuer_crl_revoked_serials: &HashSet<Vec<u8>>,
+    issuer_ca_rsync_uri: Option<&str>,
+    issuer_crl_rsync_uri: Option<&str>,
+    validation_time: time::OffsetDateTime,
+) -> Result<(), CertPathError> {
     if ee.kind != ResourceCertKind::Ee {
         return Err(CertPathError::EeNotEe);
     }
@@ -207,12 +260,12 @@ pub fn validate_ee_cert_path_with_prevalidated_issuer(
         });
     }
 
-    validate_ee_aki_matches_issuer_ski(&ee, issuer_ca)?;
+    validate_ee_aki_matches_issuer_ski(ee, issuer_ca)?;
     if let Some(expected_issuer_uri) = issuer_ca_rsync_uri {
-        validate_ee_aia_points_to_issuer_uri(&ee, expected_issuer_uri)?;
+        validate_ee_aia_points_to_issuer_uri(ee, expected_issuer_uri)?;
     }
     if let Some(expected_crl_uri) = issuer_crl_rsync_uri {
-        validate_ee_crldp_contains_issuer_crl_uri(&ee, expected_crl_uri)?;
+        validate_ee_crldp_contains_issuer_crl_uri(ee, expected_crl_uri)?;
     }
 
     if !time_within_validity(
@@ -240,7 +293,7 @@ pub fn validate_ee_cert_path_with_prevalidated_issuer(
         return Err(CertPathError::EeRevoked);
     }
 
-    Ok(ee)
+    Ok(())
 }
 
 fn parse_subject_pki_from_der(der: &[u8]) -> Result<SubjectPublicKeyInfo<'_>, CertPathError> {