refactor!: update revocation

revocation/ocsp/ocsp.go

@@ -36,24 +36,18 @@ import (
 	"golang.org/x/crypto/ocsp"
 )
 
-// Purpose is an enum for purpose of the certificate chain whose OCSP status
-// is checked
-type Purpose int
-
-const (
-	// PurposeCodeSigning means the certificate chain is a code signing chain
-	PurposeCodeSigning Purpose = iota
-
-	// PurposeTimestamping means the certificate chain is a timestamping chain
-	PurposeTimestamping
-)
-
 // Options specifies values that are needed to check OCSP revocation
 type Options struct {
-	CertChain        []*x509.Certificate
-	CertChainPurpose Purpose // default value is `PurposeCodeSigning`
-	SigningTime      time.Time
-	HTTPClient       *http.Client
+	CertChain []*x509.Certificate
+
+	// CertChainPurpose is the purpose of the certificate chain. Supported
+	// values are x509.ExtKeyUsageCodeSigning and x509.ExtKeyUsageTimeStamping.
+	// When not provided, the default value x509.ExtKeyUsageAny is also taken as
+	// a code signing certificate chain.
+	CertChainPurpose x509.ExtKeyUsage
+
+	SigningTime time.Time
+	HTTPClient  *http.Client
 }
 
 const (
@@ -73,21 +67,21 @@ func CheckStatus(opts Options) ([]*result.CertRevocationResult, error) {
 		return nil, result.InvalidChainError{Err: errors.New("chain does not contain any certificates")}
 	}
 
-	// Validate cert chain structure
-	// Since this is using authentic signing time, signing time may be zero.
-	// Thus, it is better to pass nil here than fail for a cert's NotBefore
-	// being after zero time
 	switch opts.CertChainPurpose {
-	case PurposeCodeSigning:
+	case x509.ExtKeyUsageAny, x509.ExtKeyUsageCodeSigning:
+		// Since ValidateCodeSigningCertChain is using authentic signing time,
+		// signing time may be zero.
+		// Thus, it is better to pass nil here than fail for a cert's NotBefore
+		// being after zero time
 		if err := coreX509.ValidateCodeSigningCertChain(opts.CertChain, nil); err != nil {
 			return nil, result.InvalidChainError{Err: err}
 		}
-	case PurposeTimestamping:
+	case x509.ExtKeyUsageTimeStamping:
 		if err := coreX509.ValidateTimestampingCertChain(opts.CertChain); err != nil {
 			return nil, result.InvalidChainError{Err: err}
 		}
 	default:
-		return nil, result.InvalidChainError{Err: fmt.Errorf("unknown certificate chain purpose %v", opts.CertChainPurpose)}
+		return nil, result.InvalidChainError{Err: fmt.Errorf("unsupported certificate chain purpose %v", opts.CertChainPurpose)}
 	}
 
 	certResults := make([]*result.CertRevocationResult, len(opts.CertChain))