ctcloud: CertSpotter-backed CT cloud-resource monitor

Single stateless Go process that consumes CT logs via embedded (patched)
CertSpotter internals, classifies cloud/database/storage DNS identifiers
in-process with a zero-allocation classifier, enriches via round-robin DNS
resolvers with CNAME following, and batch-writes useful findings to PostgreSQL.

- third_party/certspotter: 2-hunk IdentifierSink patch, no stdout/JSON/files
- internal/classify: AWS/Azure/GCP/Firebase/Cloudflare R2/DigitalOcean/Supabase/OCI
- internal/dns: sharded bounded TTL cache, multi-resolver load balancing + failover
- internal/pipeline: bounded queues, dedup, direct-priority load shedding
- internal/store: pgx batch writer, Postgres CT checkpoints (no cert contents)
- internal/probe: optional non-destructive reachability checks (off by default)
- Docker: distroless non-root, read-only rootfs, no app volume, resource limits
- tests enforce 0 allocs/op on the classifier and sink hot path

third_party/certspotter/man/certspotter-authorize.md

@@ -0,0 +1,105 @@
+# NAME
+
+**certspotter-authorize** - Authorize certificates to suppress certspotter notifications
+
+# SYNOPSIS
+
+**certspotter-authorize** [`-printhash`] *CERTFILE*...
+
+**certspotter-authorize** [`-printhash`] `-`
+
+# DESCRIPTION
+
+**certspotter-authorize** is a utility for preemptively authorizing
+certificates so that **certspotter(8)** will not send notifications when
+those certificates are discovered in Certificate Transparency logs.
+
+This is useful for preventing false alarms when you know in advance that a
+certificate will be issued. For example, you might run **certspotter-authorize**
+immediately after receiving a certificate from your certificate authority, as
+part of your certificate issuance pipeline.
+
+**certspotter-authorize** uses the TBSCertificate hash as defined by RFC
+6962 Section 3.2 to identify certificates. This hash is the same for a
+certificate and its corresponding precertificate. This means authorizing
+the certificate will suppress notifications for the precertificate
+as well. Certificates with different serial numbers, validity periods,
+or other changes to the TBSCertificate will not be covered by the authorization
+and will trigger notifications.
+
+# ARGUMENTS
+
+**certspotter-authorize** takes paths to one or more PEM-encoded certificates
+on the command line. If `-` is specified as the sole path, it reads the certificate
+from stdin.
+
+# OPTIONS
+
+-state\_dir *PATH*
+
+:   Directory where certspotter stores state. Defaults to
+    `$CERTSPOTTER_STATE_DIR` if set, or `~/.certspotter` otherwise.
+    This should be the same directory used by **certspotter(8)**.
+
+-printhash
+
+:   Instead of authorizing the certificate, print its TBS hash (a hex-encoded SHA-256 digest) to stdout.
+
+-version
+
+:   Print version information and exit.
+
+# EXAMPLES
+
+Authorize a certificate from a file:
+
+    $ certspotter-authorize /path/to/cert.pem
+
+Authorize multiple certificates from files:
+
+    $ certspotter-authorize cert-a.pem cert-b.pem
+
+Authorize a certificate from stdin:
+
+    $ cat cert.pem | certspotter-authorize -
+
+Authorize a certificate in a custom state directory:
+
+    $ certspotter-authorize -state_dir /var/lib/certspotter cert.pem
+
+Print the TBS hash without authorizing:
+
+    $ certspotter-authorize -printhash /path/to/cert.pem
+
+# OPERATION
+
+**certspotter-authorize** computes the SHA-256 hash of each
+certificate's TBSCertificate as defined by RFC 6962 Section 3.2 and
+creates a `.notified` marker file in the certspotter
+state directory. When certspotter later discovers a certificate with
+the same TBSCertificate in a CT log, it will skip sending notifications
+because the marker file is present.
+
+# ENVIRONMENT
+
+`CERTSPOTTER_STATE_DIR`
+
+:   Directory for storing state. Overridden by `-state_dir`. Defaults to
+    `~/.certspotter`.  This should be the same directory used by **certspotter(8)**.
+
+# FILES
+
+`$CERTSPOTTER_STATE_DIR/certs/XX/.HASH.notified`
+
+:   Marker files indicating that a certificate with TBS hash `HASH`
+    has been authorized. `XX` is the first two hex digits of the hash.
+    The file is empty; only its existence is checked.
+
+# EXIT STATUS
+
+**certspotter-authorize** exits with status 0 on success, 1 on error, or 2 on
+invalid usage.
+
+# SEE ALSO
+
+certspotter(8), certspotter-script(8)