bucketeer/third_party/certspotter/BUCKETEER_PATCH.md

Bucketeer patch to upstream CertSpotter

This directory is a copy of upstream CertSpotter (https://github.com/SSLMate/certspotter), pulled in as a local module and wired up with a replace directive in the root go.mod.

It is intentionally a copy (not a git submodule) so the patched tree lives in this repository and is compiled by the Docker build with no network access to a separate fork. To rebase on a newer upstream release:

1. Replace this directory with the new upstream tree.
2. Re-apply the two hunks below.

Changes (only two hunks)

monitor/config.go

Adds an exported IdentifierSink interface and a Config.IdentifierSink field:

type IdentifierSink interface {
	HandleIdentifiers(ctx context.Context, identifiers *certspotter.Identifiers)
}

monitor/process.go

In processCertificate, immediately after certInfo.ParseIdentifiers(), hand the parsed identifiers to the sink and return, bypassing the watchlist, certificate-chain retrieval and notification paths:

if config.IdentifierSink != nil {
	config.IdentifierSink.HandleIdentifiers(ctx, identifiers)
	return nil
}

Why

The sink gives Bucketeer parsed DNS identifiers via a direct in-process Go call:

CT log entry -> CertSpotter parse -> IdentifierSink.HandleIdentifiers -> classifier

No stdout, no JSON, no files, no hooks, no subprocess. Setting the sink also skips issuer-chain fetching and the watchlist machinery, which is exactly the I/O and serialization overhead the design forbids.

Upstream is otherwise unmodified. License and notices are preserved in LICENSE.