[WillCybertron]

Day 6 review gate, Account-core part 3 of 3: the lead "attestation chain does not require CA certificates" (attest.ts chainTo).

• Every issuer in an App Attest or Android Key Attestation chain, the pinned root included, must have basicConstraints CA and keyUsage keyCertSign. The extension is read with the module's existing DER reader. Before, a leaf-like certificate could sign the next one.
• Checked on real chains first:
  • A real App Attest chain from an iOS 14.2 device: the leaf is CA:FALSE; "Apple App Attestation CA 1" is CA:TRUE, pathlen:0 with Key Usage Certificate Sign, CRL Sign.
  • Google's EC and RSA, TEE and StrongBox sample chains: every issuer is CA:TRUE with Certificate Sign.
  • The three pinned roots: the same.
• Found doing that: Google's StrongBox leaf names the wrong issuer. It says serialNumber=697bc64b…, which is the next certificate up, but cert1's key signed it. checkIssued, which matches names, refused this real chain before this change. Google's own verifier proves each link by signature only, so chainTo does the same. Signatures at each link, the CA rule and the pinned roots carry the security; the name match added none.
• Tests: attest-chains.test.ts.
  • The real Apple, Google TEE and Google StrongBox chains pass. They are kept as Apache-2.0 fixtures, with their sources named.
  • A forged chain is refused in each case: an issuer without the CA flag, a CA without keyUsage, and a CA without keyCertSign.
  • Removing the CA rule fails the test.
• The test CA builder in helpers.ts now gives stand-in CAs a keyUsage like Apple's and Google's.

Tests: account 180 pass. scripts/verify.sh is green in the pre-push hook.

[chatgpt-codex-connector]

Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	❌ Failed 2026-11-12T09:18:46.243142Z We couldn’t complete this review. Comment @codex review to try again.	ea99e11	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.