mirror of
https://github.com/storytold/pdfcraft.git
synced 2026-10-28 03:58:45 -06:00
A malformed EKU left extended_key_usage at None, which reads as "no restriction", so an issuer-signed certificate with a broken EKU could reach a Valid verdict; EKU being on the processed-critical list let a critical one through as well. Like keyUsage, a present EKU now restricts the key even when it doesn't parse: it must be a SEQUENCE whose members are all OIDs, otherwise it allows no purpose. Claude-Session: https://claude.ai/code/session_01RUNQSPVXx3dDBabRZHAnjz Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>