zero-lab removes XMLDSig from ti-pki; app-vzd-cli gains add-base --from-cert

app-vzd-cli

New branch: origin/feature/add-base-from-cert (15 commits)

• New feature add-base --from-cert: Entries are created directly from ENC certificates. The related commits: deriving the base entry from the ENC certificate subject, assembling the add_Directory_Entry request from ENC certificates, documentation.
• Loading and checking certificates:
  • Certificates are loaded from DER, PEM and PKCS#12.
  • cert-info accepts PKCS#12 and --passin.
  • professionOID is mapped to entryType, and the certificate type is shown in CertificateInfo.
  • Certificate type and entryType are checked locally before the add-cert upload.
• Validation and mapping:
  • Base entries are validated against the rules from gemILF_Pflege_VZD before upload.
  • ILF sector mapping by TelematikID with mandatory attributes.
  • Pharmacy specialization codes are resolved via PharmacyTypeLDAPCS; the Region code system is loaded.
• Other changes:
  • The setter for base entry attributes was moved to the directory-lib.
  • Known VZD server errors are explained with the permitted values.
  • Review adjustments: discarded certificates are reported, entryType is retained in the pers extract, the prompt loop and cert-info were adjusted.
  • New regression tests with KV practice test card certificates.

gematik.github.io

Branch origin/master: 1 new commit ("created new html pages"), 2 files changed (+24/−24).

zero-lab

Branch origin/main: 59 new commits, 408 files changed (+18,826/−7,843). Pull requests #77 (feat/ti-cli-help-and-search) and #78 (feat/ti-xmldsig-removal) were merged.

• TSL with detached signature (ti-pki, ti, ti-report, ti-wasm):
  • The TSL is loaded with a detached signature and signer status (TSLDET-010, 020, 021).
  • The published .ocsp serves as the signer status of the TSL.
  • parse_verified_detached shares parts B to G with the enveloped path.
  • New: pki tsl verify --signature and --signer-status.
  • The detached path reaches the CLI; the hash gate fails closed.
  • The TSL view in ti-report and ti-wasm is based on the detached signature.
  • New release notes and guides, plus fuzz targets for detached signature, TSL XML and OCSP responses.
  • Fixed: A GeneralizedTime containing multibyte characters no longer causes the OCSP parser to panic.
  • XMLDSig was removed from ti-pki (PR #78): the TSL is now verified only via the detached signature.
• ti-cli:
  • -h is equivalent to --help; the short help appears only without a subcommand. The short help shows the command, --help shows the shared options (TASK-150).
  • New: connector config show, test, new, edit, set and pin (TASK-136.1, 136.2). config test allows http outside the production environment, and new asks for the invocation context again after a failed test. Otherwise only https applies.
  • --card takes its connector via -c/--connector-config, like the connector commands.
  • The trust tree shows a CA that expired after issuing an SMC-B/HBA certificate as a warning (TASK-153). Also added: the compromise model for nonQES certificates of HBA and SMC-B in ti-pki.
  • The AUT identity of an HBA is handled like that of an SMC-B in help, guide and tests (TASK-151).
  • New: owner token of a card identity for the Search API in ti directory login search (TASK-149).
  • New: rules for agents, each error type with exit code, and the .kon format (TASK-148).
  • No SOCKS proxies; proxy variables do not reach the connector (TASK-55, TASK-163).
• Security:
  • ti-connector-client: A call goes only to the origin of the .kon URL, not to targets from the service directory (TASK-160). Fuzz targets for the service directory and connector responses; a rewrite leaves no endpoint outside the .kon origin (TASK-47).
  • ti-pkcs12: Only PBES2 with pbkdf2, aes and cbc; pkcs5, scrypt and salsa20 are dropped (TASK-56). New fuzz target for decode, seeded from spec/pkcs12 (TASK-46).
  • ti-xmldsig: Attributes are limited before the parser (TASK-161).
  • Rust: No unsafe in the dependencies of the cores outside an approved list, checked by unsafe-audit (TASK-156). Also added: the initial exceptions.
• Dependencies:
  • crypto-bigint 0.7.10 and ctutils 0.4.6 (after the yanked 0.7.6, TASK-155).
  • arc-swap replaced by a std lock, jiff remains, two XML parsers with documented rationale (TASK-57, TASK-58).
  • ti-pki: The unused reqwest and tokio features were removed (TASK-122).
• Backlog:
  • HITL tests with a real connector, HBA, RU and GEM.SMCB-CA9 certificate marked as done for TASK-119, 136.1, 136.2, 149, 151, 153, 160.
  • TASK-136 done; migrate moves to TASK-157 (parked). TASK-136.3 is parked until secret management (TASK-104, decision-7).
  • TASK-152 withdrawn.
  • ti-cli 0.6.0 takes over TASK-46, 156 and 122; TASK-39 and 7 move out.

At a glance

• app-vzd-cli: New branch feature/add-base-from-cert with 15 commits for add-base --from-cert.
• zero-lab: 59 commits on main (408 files, +18,826/−7,843); XMLDSig removed from ti-pki, TSL verification now only via the detached signature (PR #78).
• zero-lab: New connector config commands in ti-cli (PR #77 among others) and several security changes (origin binding of the .kon URL, PBES2-only in ti-pkcs12, unsafe-audit).
• gematik.github.io: 1 commit (2 files).