code wiki / (root) / nx_cert_monitor.nx

nx_cert_monitor.nx

buildroot/runtime/nx_cert_monitor.nx

5599 B88 linesdepth 5pulls 6 transitivereach 6 importersview sourcekind tooltopic cert
docsdependenciesstructsconstsfunctions

about

nx_cert_monitor.nx -- CERT-EXPIRY MONITOR (closes hosting_research gap #3 "cert-expiry-monitor", 3/0 CONFIRMED: best-in-class hosts auto-renew + monitor SSL expiry; Nishi certs are hardcoded, no expiry alert -- "a silent cert expiry = a self-inflicted outage"). Pure COMPOSITION (rule 15 DRY): reuses the shipped X.509 stack -- x509_parse (nx_x509) captures the validity field; x509_validity_get (nx_x509_validity) returns notBefore/notAfter as Unix epoch seconds via parse_utctime/parse_gentime; sys_now_realtime_sec is `now`. We just compute days-until-expiry and turn it into an actionable verdict. module: nishi-core.supervision.cert_monitor capability: DAEMON_ROBUSTNESS / observability

dependencies 2 imports · 4 importers

nx_x509.nx nx_x509_validity.nx nx_cert_monitor.nx nx_cert_autorenew_lib.nx nx_cert_debug.nx nx_cert_monitor_gate.nx nx_status_page.nx

imports: nx_x509.nxnx_x509_validity.nx

imported by: nx_cert_autorenew_lib.nxnx_cert_debug.nxnx_cert_monitor_gate.nxnx_status_page.nx

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main cm_p cm_check_file cm_status cm_read sys_read x509_parse sys_mmap asn1_cursor_init asn1_expect_tag sys_mmap ↻ asn1_read_tlv_header asn1_read_tag asn1_read_length asn1_read_length ↻ x509_read_tlv sys_mmap ↻ asn1_expect_tag ↻ x509_read_alg_id sys_mmap ↻ asn1_expect_tag ↻ x509_validity_get sys_mmap ↻ x509_read_time_tlv parse_utctime parse_2digit days_from_civil parse_gentime parse_4digit parse_2digit ↻ days_from_civil ↻ sys_now_realtime_sec sys_mmap ↻ sys_clock_gettime_real cm_days_until cm_verdict cm_days_until ↻ cm_p ↻ cm_name cm_n

structs

none

consts

11const CM_MAGIC_86400: i64 = 86400
12const CM_MAGIC_65536: i64 = 65536
13const CM_MAGIC_1024: i64 = 1024
15const CM_OK: i64 = 0 // > warn_days remain
16const CM_WARN: i64 = 1 // 0..warn_days remain -> RENEW NOW (the alert best-in-class fires, Nishi never did)
17const CM_EXPIRED: i64 = 2 // notAfter is in the past -> the site is serving an expired cert (or about to fail TLS)
18const CM_NOCERT: i64 = 3 // could not read/parse the cert
19const CM_WARN_DAYS: i64 = 21 // LE certs live 90d; alert ~3 weeks before expiry (well inside the renew window)

functions

21func cm_days_until(na_epoch: i64, now_epoch: i64) -> i64 { return (na_epoch - now_epoch) / CM_MAGIC_86400 }
called by 3: cm_verdictcm_statusmain
22func cm_verdict(na_epoch: i64, now_epoch: i64, warn_days: i64) -> i64
called by 3: maincm_statusmain calls 1: cm_days_until
28func cm_name(v: i64) -> *u8
called by 2: car_sweep_onecm_check_file
35func cm_p(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
called by 4: dbg_certmaincm_check_filemain
36func cm_n(v: i64) -> i64 { let t: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m; sys_write(1,"-" as *u8,1)} var k: i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} let b: *u8=sys_mmap(28); var i: i64=0; while i<k{b[i]=t[k-1-i];i=i+1} sys_write(1,b,k); return 0 }
called by 2: dbg_certcm_check_file
40func cm_read(path: *u8, buf: *u8, cap: i64) -> i64
called by 2: dbg_certcm_status calls 1: sys_read
50func cm_status(path: *u8, out_days: *i64, out_na: *i64) -> i64
called by 4: car_renew_domaincm_check_filemainmain calls 6: cm_readx509_parsex509_validity_getsys_now_realtime_seccm_days_untilcm_verdict
64func cm_check_file(path: *u8) -> i64
called by 1: main calls 4: cm_statuscm_pcm_namecm_n
73func main() -> i64
calls 2: cm_pcm_check_file