Update OCSPPolicy usage

Author: yim-lee

Sources/PackageSigning/VerifierPolicies.swift

@@ -32,16 +32,16 @@ extension SignatureProviderProtocol {
             policies.append(RFC5280Policy(validationTime: expiryValidationTime ?? now))
             policies
                 .append(_OCSPVerifierPolicy(
+                    failureMode: .hard,
                     httpClient: httpClient,
-                    mode: .strict,
                     validationTime: revocationValidationTime ?? now
                 ))
         case (.enabled(let expiryValidationTime), .allowSoftFail(let revocationValidationTime)):
             policies.append(RFC5280Policy(validationTime: expiryValidationTime ?? now))
             policies
                 .append(_OCSPVerifierPolicy(
+                    failureMode: .soft,
                     httpClient: httpClient,
-                    mode: .allowSoftFail,
                     validationTime: revocationValidationTime ?? now
                 ))
         case (.enabled(let expiryValidationTime), .disabled):
@@ -51,17 +51,17 @@ extension SignatureProviderProtocol {
             policies.append(RFC5280Policy(validationTime: revocationValidationTime ?? now))
             policies
                 .append(_OCSPVerifierPolicy(
+                    failureMode: .hard,
                     httpClient: httpClient,
-                    mode: .strict,
                     validationTime: revocationValidationTime ?? now
                 ))
         case (.disabled, .allowSoftFail(let revocationValidationTime)):
             // Always do expiry check (and before) if revocation check is enabled
             policies.append(RFC5280Policy(validationTime: revocationValidationTime ?? now))
             policies
                 .append(_OCSPVerifierPolicy(
+                    failureMode: .soft,
                     httpClient: httpClient,
-                    mode: .allowSoftFail,
                     validationTime: revocationValidationTime ?? now
                 ))
         case (.disabled, .disabled):
@@ -127,16 +127,15 @@ struct _OCSPVerifierPolicy: VerifierPolicy {
     >()
 
     private var underlying: OCSPVerifierPolicy<_OCSPRequester>
-    private let mode: Mode
 
     let verifyingCriticalExtensions: [ASN1ObjectIdentifier] = []
 
-    init(httpClient: HTTPClient, mode: Mode, validationTime: Date) {
+    init(failureMode: OCSPFailureMode, httpClient: HTTPClient, validationTime: Date) {
         self.underlying = OCSPVerifierPolicy(
+            failureMode: failureMode,
             requester: _OCSPRequester(httpClient: httpClient),
             validationTime: validationTime
         )
-        self.mode = mode
     }
 
     mutating func chainMeetsPolicyRequirements(chain: UnverifiedCertificateChain) async -> PolicyEvaluationResult {
@@ -147,32 +146,10 @@ struct _OCSPVerifierPolicy: VerifierPolicy {
 
         // This makes HTTP requests
         let result = await self.underlying.chainMeetsPolicyRequirements(chain: chain)
-        let actualResult: PolicyEvaluationResult
-        switch result {
-        case .meetsPolicy:
-            actualResult = result
-        case .failsToMeetPolicy(let reason):
-            switch self.mode {
-            case .strict:
-                actualResult = result
-            case .allowSoftFail:
-                // Allow 'unknown' status and failed OCSP request in this mode
-                if reason.lowercased().contains("revoked through ocsp") {
-                    actualResult = result
-                } else {
-                    actualResult = .meetsPolicy
-                }
-            }
-        }
 
         // Save result to cache
-        self.cache[chain] = (result: actualResult, expires: .now() + Self.cacheTTL)
-        return actualResult
-    }
-
-    enum Mode {
-        case strict
-        case allowSoftFail
+        self.cache[chain] = (result: result, expires: .now() + Self.cacheTTL)
+        return result
     }
 }
 

Tests/PackageSigningTests/SigningTests.swift

@@ -486,8 +486,7 @@ final class SigningTests: XCTestCase {
                 issuer: caName,
                 issuerPrivateKey: caPrivateKey,
                 isIntermediate: true,
-                isCodeSigning: false,
-                ocspServer: ocspResponderURI
+                isCodeSigning: false
             ),
         ]