You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
tailscale/tempfork/x509
Brad Fitzpatrick bfc1261ab6 crypto/x509: keep smaller root cert representation in memory until needed
(from patchset 1, c12c890c64dd6372b3893af1e6f5ab11802c9e81, of
https://go-review.googlesource.com/c/go/+/230025/1, with merges fixes
due to parent commit's differents from its ps1..ps3)

Instead of parsing the PEM files and then storing the *Certificate
values forever, still parse them to see if they're valid and pick out
some fields, but then only store the decoded pem.Block.Bytes until
that cert is first needed.

Saves about 500K of memory on my (Debian stable) machine after doing a
tls.Dial or calling x509.SystemCertPool.

A more aggressive version of this is still possible: we can not keep
the pem.Block.Bytes in memory either, and re-read them from disk when
necessary. But dealing with files disappearing and even large
multi-cert PEM files changing (with offsets sliding around) made this
conservative version attractive. It doesn't change the
slurp-roots-on-startup semantics. It just does so with less memory
retained.

Change-Id: I3aea333f4749ae3b0026042ec3ff7ac015c72204
6 years ago
..
testdata Add fork of Go 1.15-dev's crypto/x509 6 years ago
cert_pool.go crypto/x509: keep smaller root cert representation in memory until needed 6 years ago
example_test.go Add fork of Go 1.15-dev's crypto/x509 6 years ago
name_constraints_test.go crypto/x509: add support for CertPool to load certs lazily 6 years ago
pem_decrypt.go Add fork of Go 1.15-dev's crypto/x509 6 years ago
pem_decrypt_test.go Add fork of Go 1.15-dev's crypto/x509 6 years ago
pkcs1.go Add fork of Go 1.15-dev's crypto/x509 6 years ago
pkcs8.go Add fork of Go 1.15-dev's crypto/x509 6 years ago
pkcs8_test.go Add fork of Go 1.15-dev's crypto/x509 6 years ago
root.go Add fork of Go 1.15-dev's crypto/x509 6 years ago
root_aix.go Add fork of Go 1.15-dev's crypto/x509 6 years ago
root_bsd.go Add fork of Go 1.15-dev's crypto/x509 6 years ago
root_cgo_darwin.go Add fork of Go 1.15-dev's crypto/x509 6 years ago
root_darwin.go Add fork of Go 1.15-dev's crypto/x509 6 years ago
root_darwin_arm64.go Add fork of Go 1.15-dev's crypto/x509 6 years ago
root_darwin_arm_gen.go Add fork of Go 1.15-dev's crypto/x509 6 years ago
root_darwin_test.go Add fork of Go 1.15-dev's crypto/x509 6 years ago
root_js.go Add fork of Go 1.15-dev's crypto/x509 6 years ago
root_linux.go Add fork of Go 1.15-dev's crypto/x509 6 years ago
root_nocgo_darwin.go Add fork of Go 1.15-dev's crypto/x509 6 years ago
root_omit.go Add fork of Go 1.15-dev's crypto/x509 6 years ago
root_omit_test.go Add fork of Go 1.15-dev's crypto/x509 6 years ago
root_plan9.go Add fork of Go 1.15-dev's crypto/x509 6 years ago
root_solaris.go Add fork of Go 1.15-dev's crypto/x509 6 years ago
root_unix.go crypto/x509: add support for CertPool to load certs lazily 6 years ago
root_unix_test.go crypto/x509: add support for CertPool to load certs lazily 6 years ago
root_windows.go Add fork of Go 1.15-dev's crypto/x509 6 years ago
sec1.go Add fork of Go 1.15-dev's crypto/x509 6 years ago
sec1_test.go Add fork of Go 1.15-dev's crypto/x509 6 years ago
test-file.crt Add fork of Go 1.15-dev's crypto/x509 6 years ago
verify.go crypto/x509: add support for CertPool to load certs lazily 6 years ago
verify_test.go Add fork of Go 1.15-dev's crypto/x509 6 years ago
x509.go Add fork of Go 1.15-dev's crypto/x509 6 years ago
x509_test.go crypto/x509: add support for CertPool to load certs lazily 6 years ago
x509_test_import.go Add fork of Go 1.15-dev's crypto/x509 6 years ago