Add multi-manifest X.509 certificate chain extraction and OCSP status verification

[sherifhanna-google]

Summary

This pull request adds Authority Information Access (AIA) X.509 certificate chain extraction and live RFC 6960 OCSP revocation verification for multi-manifest C2PA assets.

Features

1. WASM Multi-Manifest Certificate Extraction:
   • Added extract_manifest_certificates and extract_sidecar_manifest_certificates in wasm/src/lib.rs using c2pa-rs reader.manifests().
2. RFC 6960 OCSP Engine:
   • Parses AIA extensions for id-ad-ocsp and id-ad-caIssuers using @peculiar/x509.
   • Encodes binary OCSPRequest DER payloads and decodes BasicOCSPResponse DER payloads using @peculiar/asn1-ocsp (extracting good, revoked with date/reason, unknown).
   • Caches responses by certificate SHA-256 thumbprints.
   • Generates copyable curl commands for offline inspection.
3. CORS & HTTP Proxying:
   • Added Netlify serverless function netlify/functions/ocsp-proxy.ts to proxy HTTP OCSP responder queries securely with CORS headers in deployed environments.
   • Added Vite dev/preview middleware (/api/ocsp-proxy) for local testing.
4. UI Affordances:
   • Integrated CertificateSection.svelte into the Report tab.
   • Added a master [⚡ Check All OCSP] button with progress indicators and batch summary statistics.
   • Added individual [Check OCSP] buttons, live status badges, copyable curl commands, and collapsible certificate PEM viewers on each certificate card across all manifests.
   • Added top-right 🔴 "Revoked" badges on affected nodes in the provenance tree (TreeNode.svelte).

Testing

• All 165 vitest unit & component tests pass cleanly (npm test).
• Production build succeeds (npm run build).

[netlify]

✅ Deploy Preview for c2pa-conformulator ready!

Name	Link
🔨 Latest commit	0fb788e
🔍 Latest deploy log	https://app.netlify.com/projects/c2pa-conformulator/deploys/6a95c0bd7ad3ae0008d30e39
😎 Deploy Preview	https://deploy-preview-51--c2pa-conformulator.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[andyparsons]

duplicates some of #25, reviewers should consider both although this appears top be more complete!

[sherifhanna-google]

duplicates some of #25, reviewers should consider both although this appears top be more complete!

Thanks for taking a look and for the pointer to #25 Andy. I had missed it.

I did a detailed comparison with #25 to see where they overlap and how best to proceed:

1. Subsumes & Extends OCSP Functionality:

   • Multi-Manifest Support: Whereas feat: server-side OCSP revocation checking #25 targets only the active manifest's leaf signer, Add multi-manifest X.509 certificate chain extraction and OCSP status verification #51 checks all certificate chains across root and ingredient manifests (including TSA certs) directly via the Rust c2pa-rs WASM bindings (reader.manifests()), avoiding fragile custom binary JUMBF scraping in JavaScript.
   • Standard ASN.1 / RFC 6960: Rather than hand-rolling DER bit-shifting and tag parsing in Node, Add multi-manifest X.509 certificate chain extraction and OCSP status verification #51 uses @peculiar/asn1-ocsp and @peculiar/x509 (supporting SHA-256 and SHA-1, full BasicOCSPResponse parsing including revocation reason and timestamps).
   • Dual-Mode Proxy (Vite + Netlify): The proxy in Add multi-manifest X.509 certificate chain extraction and OCSP status verification #51 is a lightweight raw byte bridge implemented for both Netlify Functions v2 (/api/ocsp-proxy) and Vite dev server middleware (vite.config.ts). OCSP checking works seamlessly during local development (npm run dev) without needing netlify dev.
   • Active Trust Gating & UI: OCSP checks run automatically on upload with an animated progress indicator. If any certificate anywhere in the manifest store is revoked, the top verdict changes to Signature Not Trusted — Certificate Revoked ✕, and revoked nodes in the provenance tree display visual warning badges. A dedicated "Signatures & Certificate Validation" panel provides full certificate cards, PEM viewers, and copyable curl reproduction commands.
   • Unit Tests: Added a full test suite in src/lib/ocsp/ocsp.test.ts covering AIA extraction, DER encoding, and response decoding against real Google PKI revoked samples.

2. Incorporated feat: server-side OCSP revocation checking #25's Windows HEIC/HEIF Fix:

   • I cherry-picked your EXTENSION_MIME_MAP fix (heic, heif, avci, avcs) from feat: server-side OCSP revocation checking #25 into src/lib/c2pa.ts so Windows Chrome users without the Microsoft Store HEIF codec pack continue to work seamlessly.

Since #51 is a clean, passing superset of #25 that resolves its open merge conflicts and adds multi-manifest/testing capabilities, merging #51 will completely satisfy the objectives of #25 while providing a more complete experience.