certificate-transparency/ctool
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fold tiledump into ctfetch. Add +sct, +issuer and +ctlog flags to print additional info

Browse Source
This commit is contained in:
Pim van Pelt
2026-04-05 21:49:10 +02:00
parent 66835aab9d
commit a36e913e27
4 changed files with 471 additions and 161 deletions
Download Patch File Download Diff File Expand all files Collapse all files

64
README.md
View File

@@ -6,17 +6,18 @@ Tools for working with Certificate Transparency log tiles.
```bash
go install ./cmd/ctfetch
go install ./cmd/tiledump
```
## Commands
## Usage
### ctfetch
`ctfetch` operates in two modes depending on the arguments given.
Fetch and dump leaf entries from CT logs.
### Leaf-index mode
Fetch a specific entry (or all entries in its tile) by leaf index:
```bash
ctfetch [--dumpall] <log-url> <leaf-index>
ctfetch [flags] <log-url> <leaf-index> [+sct] [+issuer] [+ctlog]
```
**Examples:**
@@ -26,35 +27,58 @@ Dump a specific entry:
ctfetch https://halloumi2026h1.mon.ct.ipng.ch 629794635
```
Dump all entries in the tile:
Dump with SCTs, issuer chain, and CT log details:
```bash
ctfetch --dumpall https://halloumi2026h1.mon.ct.ipng.ch 629794635
ctfetch https://halloumi2026h1.mon.ct.ipng.ch 629794635 +sct +issuer +ctlog
```
**Options:**
- `--dumpall`: Dump all entries in the tile instead of just the specified leaf
### Tile-dump mode
### tiledump
Read a CT log tile file or URL and dump contents. Automatically detects and handles both data tiles (log entries) and hash tiles (Merkle tree hashes).
Fetch all entries from a tile URL or a local file. Automatically detects data tiles (log entries) and hash tiles (Merkle tree hashes).
```bash
tiledump <tile-file-or-url>
ctfetch [flags] <tile-url-or-file> [+sct] [+issuer] [+ctlog]
```
**Examples:**
Data tile from a file:
```bash
tiledump tile.data
```
Data tile from a URL:
```bash
tiledump https://halloumi2026h1.mon.ct.ipng.ch/tile/data/x002/x460/135
ctfetch https://halloumi2026h1.mon.ct.ipng.ch/tile/data/x002/x460/135
```
Data tile with SCTs and CT log details:
```bash
ctfetch https://halloumi2026h1.mon.ct.ipng.ch/tile/data/x002/x460/135 +sct +ctlog
```
Hash tile from a URL:
```bash
tiledump https://halloumi2026h1.mon.ct.ipng.ch/tile/0/x100/999
ctfetch https://halloumi2026h1.mon.ct.ipng.ch/tile/0/x100/999
```
Data tile from a local file (with issuer resolution):
```bash
ctfetch --monitoring-url https://halloumi2026h1.mon.ct.ipng.ch tile.bin +issuer
```
## Output modifiers
| Modifier | Description |
|---|---|
| `+sct` | Parse and include embedded Signed Certificate Timestamps from final (non-precert) certificates |
| `+issuer` | Fetch and include issuer certificate details from the log's `/issuer/<fp>` endpoint |
| `+ctlog` | Look up each SCT's log ID in the CT log list and include operator/state details |
## Flags
| Flag | Default | Description |
|---|---|---|
| `--logs-list-url` | `https://www.gstatic.com/ct/log_list/v3/all_logs_list.json` | URL of the CT log list JSON used for `+ctlog` lookups |
| `--monitoring-url` | _(none)_ | Log root URL for issuer lookups when input is a local file |
## Notes
- In tile-dump mode with a tile URL, `+issuer` automatically derives the log root by stripping the `/tile/...` path. With a local file, `--monitoring-url` must be provided.
- Partial tiles (`.p/N` suffix) are tried first; on 404 the full tile is fetched automatically.
- The CT log list and issuer certificates are cached in memory, so each unique resource is fetched only once per invocation.