cotl

Go implementation of the Concise Tag List (CoTL) data structure from draft-ietf-rats-corim-11, Section 6, written in the Veraison project style so it can be donated upstream to veraison/corim.

Features

• ConciseTlTag — the concise-tl-tag CBOR structure (tag 508) with deterministic CBOR encoding per RFC 8949
• Spec-conformant wire form: #6.508(bytes .cbor concise-tl-tag)
• Structural validation (Valid) and temporal appraisal (ValidateAt) mirroring the CoTL extraction rules of Section 8.2.3.4
• JSON round-tripping with human-readable keys
• Veraison-style map extensions via RegisterExtensions, including an optional ConstrainConciseTlTag validation hook
• Defensive decoding: malformed input returns errors, never panics or hangs

Usage

tag := cotl.ConciseTlTag{
    TagIdentity: *must(cotl.NewTagIdentityMap("my-list")),
    TagsList: []cotl.TagIdentityMap{
        *must(cotl.NewTagIdentityMap("component-fw")),
    },
    TlValidity: corim.Validity{NotAfter: notAfter},
}

buf, err := tag.ToCBOR()          // #6.508 tagged CBOR
decoded, err := cotl.NewConciseTlTagFromCBOR(buf)
report := decoded.ValidateAt(time.Now()) // errors + warnings

Testing

go test -race ./...

Covers: table-driven construction/validation cases, CBOR and JSON round-trips, determinism, wrong-CBOR-tag rejection, truncation at multiple cut points, validity-window boundary semantics (inclusive bounds), duplicate warnings, extension registration/round-trip/constraint hooks, a panic-free decoder fuzz-lite over thousands of pseudo-random inputs, and regression probes for upstream corim/encoding hangs.

Known upstream issues worked around

• corim/encoding panics on some malformed maps — guarded here.
• corim/encoding can loop indefinitely on malformed map headers — gated by an RFC 8949 well-formedness check before handing off.

License

Apache-2.0 (matches veraison/corim)