README.md

@@ -46,7 +46,7 @@ Cert Spotter requires Go version 1.19 or higher.
 
 4. Configure your system to run `certspotter` as a daemon.  You may want to specify
    the `-start_at_end` command line option to tell certspotter to start monitoring
-   new logs at the end instead of the beginning.  This saves significant bandwidth, but
+   logs at the end instead of the beginning.  This saves significant bandwidth, but
    you won't be notified about certificates which were logged before you started
    using certspotter.
 

cmd/certspotter/main.go

@@ -16,6 +16,7 @@ import (
 	"flag"
 	"fmt"
 	"io/fs"
+	insecurerand "math/rand"
 	"os"
 	"os/signal"
 	"path/filepath"
@@ -151,6 +152,8 @@ func appendFunc(slice *[]string) func(string) error {
 }
 
 func main() {
+	insecurerand.Seed(time.Now().UnixNano()) // TODO: remove after upgrading to Go 1.20
+
 	loglist.UserAgent = fmt.Sprintf("certspotter/%s (%s; %s; %s)", certspotterVersion(), runtime.Version(), runtime.GOOS, runtime.GOARCH)
 
 	var flags struct {
@@ -173,7 +176,7 @@ func main() {
 	flag.StringVar(&flags.logs, "logs", defaultLogList, "File path or URL of JSON list of logs to monitor")
 	flag.BoolVar(&flags.noSave, "no_save", false, "Do not save a copy of matching certificates in state directory")
 	flag.StringVar(&flags.script, "script", "", "Program to execute when a matching certificate is discovered")
-	flag.BoolVar(&flags.startAtEnd, "start_at_end", false, "Start monitoring new logs from the end rather than the beginning (saves considerable bandwidth)")
+	flag.BoolVar(&flags.startAtEnd, "start_at_end", false, "Start monitoring logs from the end rather than the beginning (saves considerable bandwidth)")
 	flag.StringVar(&flags.stateDir, "state_dir", defaultStateDir(), "Directory for storing log position and discovered certificates")
 	flag.BoolVar(&flags.stdout, "stdout", false, "Write matching certificates to stdout")
 	flag.BoolVar(&flags.verbose, "verbose", false, "Be verbose")
@@ -190,36 +193,33 @@ func main() {
 		os.Exit(2)
 	}
 
-	fsstate := &monitor.FilesystemState{
-		StateDir:  flags.stateDir,
-		SaveCerts: !flags.noSave,
-		Script:    flags.script,
-		ScriptDir: defaultScriptDir(),
-		Email:     flags.email,
-		Stdout:    flags.stdout,
-	}
 	config := &monitor.Config{
 		LogListSource:       flags.logs,
-		State:               fsstate,
+		StateDir:            flags.stateDir,
+		SaveCerts:           !flags.noSave,
 		StartAtEnd:          flags.startAtEnd,
 		Verbose:             flags.verbose,
+		Script:              flags.script,
+		ScriptDir:           defaultScriptDir(),
+		Email:               flags.email,
+		Stdout:              flags.stdout,
 		HealthCheckInterval: flags.healthcheck,
 	}
 
 	emailFileExists := false
 	if emailRecipients, err := readEmailFile(defaultEmailFile()); err == nil {
 		emailFileExists = true
-		fsstate.Email = append(fsstate.Email, emailRecipients...)
+		config.Email = append(config.Email, emailRecipients...)
 	} else if !errors.Is(err, fs.ErrNotExist) {
 		fmt.Fprintf(os.Stderr, "%s: error reading email recipients file %q: %s\n", programName, defaultEmailFile(), err)
 		os.Exit(1)
 	}
 
-	if len(fsstate.Email) == 0 && !emailFileExists && fsstate.Script == "" && !fileExists(fsstate.ScriptDir) && fsstate.Stdout == false {
+	if len(config.Email) == 0 && !emailFileExists && config.Script == "" && !fileExists(config.ScriptDir) && config.Stdout == false {
 		fmt.Fprintf(os.Stderr, "%s: no notification methods were specified\n", programName)
 		fmt.Fprintf(os.Stderr, "Please specify at least one of the following notification methods:\n")
 		fmt.Fprintf(os.Stderr, " - Place one or more email addresses in %s (one address per line)\n", defaultEmailFile())
-		fmt.Fprintf(os.Stderr, " - Place one or more executable scripts in the %s directory\n", fsstate.ScriptDir)
+		fmt.Fprintf(os.Stderr, " - Place one or more executable scripts in the %s directory\n", config.ScriptDir)
 		fmt.Fprintf(os.Stderr, " - Specify an email address using the -email flag\n")
 		fmt.Fprintf(os.Stderr, " - Specify the path to an executable script using the -script flag\n")
 		fmt.Fprintf(os.Stderr, " - Specify the -stdout flag\n")

cmd/submitct/main.go

@@ -158,19 +158,18 @@ func main() {
 
 	var logs []Log
 	for _, ctlog := range list.AllLogs() {
-		submissionURL := ctlog.GetSubmissionURL()
 		pubkey, err := x509.ParsePKIXPublicKey(ctlog.Key)
 		if err != nil {
-			log.Fatalf("%s: Failed to parse log public key: %s", submissionURL, err)
+			log.Fatalf("%s: Failed to parse log public key: %s", ctlog.URL, err)
 		}
 		verifier, err := ct.NewSignatureVerifier(pubkey)
 		if err != nil {
-			log.Fatalf("%s: Failed to create signature verifier for log: %s", submissionURL, err)
+			log.Fatalf("%s: Failed to create signature verifier for log: %s", ctlog.URL, err)
 		}
 		logs = append(logs, Log{
 			Log: ctlog,
 			SignatureVerifier: verifier,
-			LogClient: client.New(strings.TrimRight(submissionURL, "/")),
+			LogClient: client.New(strings.TrimRight(ctlog.URL, "/")),
 		})
 	}
 
@@ -213,11 +212,11 @@ func main() {
 			go func(fingerprint [32]byte, ctlog Log) {
 				sct, err := ctlog.SubmitChain(chain)
 				if err != nil {
-					log.Printf("%x (%s): %s: Submission Error: %s", fingerprint, cn, ctlog.GetSubmissionURL(), err)
+					log.Printf("%x (%s): %s: Submission Error: %s", fingerprint, cn, ctlog.URL, err)
 					atomic.AddUint32(&submitErrors, 1)
 				} else if *verbose {
 					timestamp := time.Unix(int64(sct.Timestamp)/1000, int64(sct.Timestamp%1000)*1000000)
-					log.Printf("%x (%s): %s: Submitted at %s", fingerprint, cn, ctlog.GetSubmissionURL(), timestamp)
+					log.Printf("%x (%s): %s: Submitted at %s", fingerprint, cn, ctlog.URL, timestamp)
 				}
 				wg.Done()
 			}(fingerprint, ctlog)

loglist/helpers.go

@@ -13,16 +13,12 @@ import (
 	"time"
 )
 
-// Return all tiled and non-tiled logs from all operators
 func (list *List) AllLogs() []*Log {
 	logs := []*Log{}
 	for operator := range list.Operators {
 		for log := range list.Operators[operator].Logs {
 			logs = append(logs, &list.Operators[operator].Logs[log])
 		}
-		for log := range list.Operators[operator].TiledLogs {
-			logs = append(logs, &list.Operators[operator].TiledLogs[log])
-		}
 	}
 	return logs
 }

loglist/schema.go

@@ -22,19 +22,16 @@ type List struct {
 }
 
 type Operator struct {
-	Name      string   `json:"name"`
-	Email     []string `json:"email"`
-	Logs      []Log    `json:"logs"`
-	TiledLogs []Log    `json:"tiled_logs"`
+	Name  string   `json:"name"`
+	Email []string `json:"email"`
+	Logs  []Log    `json:"logs"`
 }
 
 type Log struct {
 	Key              []byte        `json:"key"`
 	LogID            ct.SHA256Hash `json:"log_id"`
 	MMD              int           `json:"mmd"`
-	URL              string        `json:"url,omitempty"`            // only for rfc6962 logs
-	SubmissionURL    string        `json:"submission_url,omitempty"` // only for static-ct-api logs
-	MonitoringURL    string        `json:"monitoring_url,omitempty"` // only for static-ct-api logs
+	URL              string        `json:"url"`
 	Description      string        `json:"description"`
 	State            State         `json:"state"`
 	DNS              string        `json:"dns"`
@@ -47,29 +44,6 @@ type Log struct {
 	// TODO: add previous_operators
 }
 
-func (log *Log) IsRFC6962() bool     { return log.URL != "" }
-func (log *Log) IsStaticCTAPI() bool { return log.SubmissionURL != "" && log.MonitoringURL != "" }
-
-// Return URL prefix for submission using the RFC6962 protocol
-func (log *Log) GetSubmissionURL() string {
-	if log.SubmissionURL != "" {
-		return log.SubmissionURL
-	} else {
-		return log.URL
-	}
-}
-
-// Return URL prefix for monitoring.
-// Since the protocol understood by the URL might be either RFC6962 or static-ct-api, this URL is
-// only useful for informational purposes.
-func (log *Log) GetMonitoringURL() string {
-	if log.MonitoringURL != "" {
-		return log.MonitoringURL
-	} else {
-		return log.URL
-	}
-}
-
 type State struct {
 	Pending *struct {
 		Timestamp time.Time `json:"timestamp"`

loglist/validate.go

@@ -26,12 +26,7 @@ func (list *List) Validate() error {
 func (operator *Operator) Validate() error {
 	for i := range operator.Logs {
 		if err := operator.Logs[i].Validate(); err != nil {
-			return fmt.Errorf("problem with %dth non-tiled log (%s): %w", i, operator.Logs[i].LogIDString(), err)
-		}
-	}
-	for i := range operator.TiledLogs {
-		if err := operator.TiledLogs[i].Validate(); err != nil {
-			return fmt.Errorf("problem with %dth tiled log (%s): %w", i, operator.TiledLogs[i].LogIDString(), err)
+			return fmt.Errorf("problem with %dth log (%s): %w", i, operator.Logs[i].LogIDString(), err)
 		}
 	}
 	return nil
@@ -42,12 +37,5 @@ func (log *Log) Validate() error {
 	if log.LogID != realLogID {
 		return fmt.Errorf("log ID does not match log key")
 	}
-
-	if !log.IsRFC6962() && !log.IsStaticCTAPI() {
-		return fmt.Errorf("URL(s) not provided")
-	} else if log.IsRFC6962() && log.IsStaticCTAPI() {
-		return fmt.Errorf("inconsistent URLs provided")
-	}
-
 	return nil
 }

man/certspotter.md

@@ -63,9 +63,7 @@ You can use Cert Spotter to detect:
 
 -no\_save
 
-:   Do not save a copy of matching certificates. Note that enabling this option
-    will cause you to receive duplicate notifications, since certspotter will
-    have no way of knowing if you've been previously notified about a certificate.
+:   Do not save a copy of matching certificates.
 
 -script *COMMAND*
 
@@ -215,11 +213,6 @@ and non-zero when a serious error occurs.
 :   Directory from which any configuration, such as the watch list, is read.
     Defaults to `~/.certspotter`.
 
-`EMAIL`
-
-:   Email address from which to send emails. If not set, certspotter lets sendmail pick
-    the address.
-
 `HTTPS_PROXY`
 
 :   URL of proxy server for making HTTPS requests.  `http://`, `https://`, and

merkletree/collapsed_tree.go

@@ -16,76 +16,46 @@ import (
 	"slices"
 )
 
-// CollapsedTree is an efficient representation of a Merkle (sub)tree that permits appending
-// nodes and calculating the root hash.
 type CollapsedTree struct {
-	offset uint64
-	nodes  []Hash
-	size   uint64
+	nodes []Hash
+	size  uint64
 }
 
 func calculateNumNodes(size uint64) int {
 	return bits.OnesCount64(size)
 }
 
-// TODO: phase out this function
 func EmptyCollapsedTree() *CollapsedTree {
 	return &CollapsedTree{nodes: []Hash{}, size: 0}
 }
 
-// TODO: phase out this function
 func NewCollapsedTree(nodes []Hash, size uint64) (*CollapsedTree, error) {
-	tree := new(CollapsedTree)
-	if err := tree.Init(nodes, size); err != nil {
-		return nil, err
+	if len(nodes) != calculateNumNodes(size) {
+		return nil, fmt.Errorf("nodes has wrong length (should be %d, not %d)", calculateNumNodes(size), len(nodes))
 	}
-	return tree, nil
+	return &CollapsedTree{nodes: nodes, size: size}, nil
+}
+
+func CloneCollapsedTree(source *CollapsedTree) *CollapsedTree {
+	nodes := make([]Hash, len(source.nodes))
+	copy(nodes, source.nodes)
+	return &CollapsedTree{nodes: nodes, size: source.size}
 }
 
 func (tree CollapsedTree) Equal(other CollapsedTree) bool {
-	return tree.offset == other.offset && tree.size == other.size && slices.Equal(tree.nodes, other.nodes)
+	return tree.size == other.size && slices.Equal(tree.nodes, other.nodes)
 }
 
-func (tree CollapsedTree) Clone() CollapsedTree {
-	return CollapsedTree{
-		offset: tree.offset,
-		nodes:  slices.Clone(tree.nodes),
-		size:   tree.size,
-	}
-}
-
-// Add a new leaf hash to the end of the tree.
-// Returns an error if and only if the new tree would be too large for the subtree offset.
-// Always returns a nil error if tree.Offset() == 0.
-func (tree *CollapsedTree) Add(hash Hash) error {
-	if tree.offset > 0 {
-		maxSize := uint64(1) << bits.TrailingZeros64(tree.offset)
-		if tree.size+1 > maxSize {
-			return fmt.Errorf("subtree at offset %d is already at maximum size %d", tree.offset, maxSize)
-		}
-	}
+func (tree *CollapsedTree) Add(hash Hash) {
 	tree.nodes = append(tree.nodes, hash)
 	tree.size++
 	tree.collapse()
-	return nil
 }
 
-func (tree *CollapsedTree) Append(other CollapsedTree) error {
-	if tree.offset+tree.size != other.offset {
-		return fmt.Errorf("subtree at offset %d cannot be appended to subtree ending at offset %d", other.offset, tree.offset+tree.size)
-	}
-	if tree.offset > 0 {
-		newSize := tree.size + other.size
-		maxSize := uint64(1) << bits.TrailingZeros64(tree.offset)
-		if newSize > maxSize {
-			return fmt.Errorf("size of new subtree (%d) would exceed maximum size %d for a subtree at offset %d", newSize, maxSize, tree.offset)
-		}
-	}
-	if tree.size > 0 {
-		maxSize := uint64(1) << bits.TrailingZeros64(tree.size)
-		if other.size > maxSize {
-			return fmt.Errorf("tree of size %d is too large to append to a tree of size %d (maximum size is %d)", other.size, tree.size, maxSize)
-		}
+func (tree *CollapsedTree) Append(other *CollapsedTree) error {
+	maxSize := uint64(1) << bits.TrailingZeros64(tree.size)
+	if other.size > maxSize {
+		return fmt.Errorf("tree of size %d is too large to append to a tree of size %d (maximum size is %d)", other.size, tree.size, maxSize)
 	}
 
 	tree.nodes = append(tree.nodes, other.nodes...)
@@ -103,7 +73,7 @@ func (tree *CollapsedTree) collapse() {
 	}
 }
 
-func (tree CollapsedTree) CalculateRoot() Hash {
+func (tree *CollapsedTree) CalculateRoot() Hash {
 	if len(tree.nodes) == 0 {
 		return HashNothing()
 	}
@@ -116,67 +86,29 @@ func (tree CollapsedTree) CalculateRoot() Hash {
 	return hash
 }
 
-// Return the subtree offset (0 if this represents an entire tree)
-func (tree CollapsedTree) Offset() uint64 {
-	return tree.offset
-}
-
-// Return a non-nil slice containing the nodes.  The slice
-// must not be modified.
-func (tree CollapsedTree) Nodes() []Hash {
-	if tree.nodes == nil {
-		return []Hash{}
-	} else {
-		return tree.nodes
-	}
-}
-
-// Return the number of leaf nodes in the tree.
-func (tree CollapsedTree) Size() uint64 {
+func (tree *CollapsedTree) Size() uint64 {
 	return tree.size
 }
 
-type collapsedTreeMessage struct {
-	Offset uint64 `json:"offset,omitempty"`
-	Nodes  []Hash `json:"nodes"` // never nil
-	Size   uint64 `json:"size"`
-}
-
 func (tree CollapsedTree) MarshalJSON() ([]byte, error) {
-	return json.Marshal(collapsedTreeMessage{
-		Offset: tree.offset,
-		Nodes:  tree.Nodes(),
-		Size:   tree.size,
+	return json.Marshal(map[string]interface{}{
+		"nodes": tree.nodes,
+		"size":  tree.size,
 	})
 }
 
 func (tree *CollapsedTree) UnmarshalJSON(b []byte) error {
-	var rawTree collapsedTreeMessage
+	var rawTree struct {
+		Nodes []Hash `json:"nodes"`
+		Size  uint64 `json:"size"`
+	}
 	if err := json.Unmarshal(b, &rawTree); err != nil {
 		return fmt.Errorf("error unmarshalling Collapsed Merkle Tree: %w", err)
 	}
-	if err := tree.InitSubtree(rawTree.Offset, rawTree.Nodes, rawTree.Size); err != nil {
-		return fmt.Errorf("error unmarshalling Collapsed Merkle Tree: %w", err)
+	if len(rawTree.Nodes) != calculateNumNodes(rawTree.Size) {
+		return fmt.Errorf("error unmarshalling Collapsed Merkle Tree: nodes has wrong length (should be %d, not %d)", calculateNumNodes(rawTree.Size), len(rawTree.Nodes))
 	}
+	tree.size = rawTree.Size
+	tree.nodes = rawTree.Nodes
 	return nil
 }
-
-func (tree *CollapsedTree) Init(nodes []Hash, size uint64) error {
-	if len(nodes) != calculateNumNodes(size) {
-		return fmt.Errorf("nodes has wrong length (should be %d, not %d)", calculateNumNodes(size), len(nodes))
-	}
-	tree.size = size
-	tree.nodes = nodes
-	return nil
-}
-
-func (tree *CollapsedTree) InitSubtree(offset uint64, nodes []Hash, size uint64) error {
-	if offset > 0 {
-		maxSize := uint64(1) << bits.TrailingZeros64(offset)
-		if size > maxSize {
-			return fmt.Errorf("subtree size (%d) is too large for offset %d (maximum size is %d)", size, offset, maxSize)
-		}
-	}
-	tree.offset = offset
-	return tree.Init(nodes, size)
-}

merkletree/fragment.go

@@ -1,121 +0,0 @@
-// Copyright (C) 2024 Opsmate, Inc.
-//
-// This Source Code Form is subject to the terms of the Mozilla
-// Public License, v. 2.0. If a copy of the MPL was not distributed
-// with this file, You can obtain one at http://mozilla.org/MPL/2.0/.
-//
-// This software is distributed WITHOUT A WARRANTY OF ANY KIND.
-// See the Mozilla Public License for details.
-
-package merkletree
-
-import (
-	"encoding/json"
-	"fmt"
-	"slices"
-)
-
-// FragmentedCollapsedTree represents a sequence of non-overlapping subtrees
-type FragmentedCollapsedTree struct {
-	subtrees []CollapsedTree // sorted by offset
-}
-
-func (tree *FragmentedCollapsedTree) AddHash(position uint64, hash Hash) error {
-	return tree.Add(CollapsedTree{
-		offset: position,
-		nodes:  []Hash{hash},
-		size:   1,
-	})
-}
-
-func (tree *FragmentedCollapsedTree) Add(subtree CollapsedTree) error {
-	if subtree.size == 0 {
-		return nil
-	}
-	i := len(tree.subtrees)
-	for i > 0 && tree.subtrees[i-1].offset > subtree.offset {
-		i--
-	}
-	if i > 0 && tree.subtrees[i-1].offset+tree.subtrees[i-1].size > subtree.offset {
-		return fmt.Errorf("overlaps with subtree ending at %d", tree.subtrees[i-1].offset+tree.subtrees[i-1].size)
-	}
-	if i < len(tree.subtrees) && subtree.offset+subtree.size > tree.subtrees[i].offset {
-		return fmt.Errorf("overlaps with subtree starting at %d", tree.subtrees[i].offset)
-	}
-	if i == 0 || tree.subtrees[i-1].Append(subtree) != nil {
-		tree.subtrees = slices.Insert(tree.subtrees, i, subtree)
-		i++
-	}
-	for i < len(tree.subtrees) && tree.subtrees[i-1].Append(tree.subtrees[i]) == nil {
-		tree.subtrees = slices.Delete(tree.subtrees, i, i+1)
-	}
-	return nil
-}
-
-func (tree *FragmentedCollapsedTree) Merge(other FragmentedCollapsedTree) error {
-	for _, subtree := range other.subtrees {
-		if err := tree.Add(subtree); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func (tree FragmentedCollapsedTree) Gaps(yield func(uint64, uint64) bool) {
-	var prevEnd uint64
-	for i := range tree.subtrees {
-		if prevEnd != tree.subtrees[i].offset {
-			if !yield(prevEnd, tree.subtrees[i].offset) {
-				return
-			}
-		}
-		prevEnd = tree.subtrees[i].offset + tree.subtrees[i].size
-	}
-	yield(prevEnd, 0)
-}
-
-func (tree FragmentedCollapsedTree) NumSubtrees() int {
-	return len(tree.subtrees)
-}
-
-func (tree FragmentedCollapsedTree) Subtree(i int) CollapsedTree {
-	return tree.subtrees[i]
-}
-
-func (tree FragmentedCollapsedTree) Subtrees() []CollapsedTree {
-	if tree.subtrees == nil {
-		return []CollapsedTree{}
-	} else {
-		return tree.subtrees
-	}
-}
-
-// Return true iff the tree contains at least the first n nodes (without any gaps)
-func (tree FragmentedCollapsedTree) ContainsFirstN(n uint64) bool {
-	return len(tree.subtrees) >= 1 && tree.subtrees[0].offset == 0 && tree.subtrees[0].size >= n
-}
-
-func (tree *FragmentedCollapsedTree) Init(subtrees []CollapsedTree) error {
-	for i := 1; i < len(subtrees); i++ {
-		if subtrees[i-1].offset+subtrees[i-1].size > subtrees[i].offset {
-			return fmt.Errorf("subtrees %d and %d overlap", i-1, i)
-		}
-	}
-	tree.subtrees = subtrees
-	return nil
-}
-
-func (tree FragmentedCollapsedTree) MarshalJSON() ([]byte, error) {
-	return json.Marshal(tree.Subtrees())
-}
-
-func (tree *FragmentedCollapsedTree) UnmarshalJSON(b []byte) error {
-	var subtrees []CollapsedTree
-	if err := json.Unmarshal(b, &subtrees); err != nil {
-		return fmt.Errorf("error unmarshaling Fragmented Collapsed Merkle Tree: %w", err)
-	}
-	if err := tree.Init(subtrees); err != nil {
-		return fmt.Errorf("error unmarshaling Fragmented Collapsed Merkle Tree: %w", err)
-	}
-	return nil
-}

monitor/config.go

@@ -15,9 +15,14 @@ import (
 
 type Config struct {
 	LogListSource       string
-	State               StateProvider
+	StateDir            string
 	StartAtEnd          bool
 	WatchList           WatchList
 	Verbose             bool
+	SaveCerts           bool
+	Script              string
+	ScriptDir           string
+	Email               []string
+	Stdout              bool
 	HealthCheckInterval time.Duration
 }

monitor/daemon.go

@@ -16,6 +16,7 @@ import (
 	"golang.org/x/sync/errgroup"
 	"log"
 	insecurerand "math/rand"
+	"path/filepath"
 	"software.sslmate.com/src/certspotter/loglist"
 	"time"
 )
@@ -50,13 +51,18 @@ type daemon struct {
 
 func (daemon *daemon) healthCheck(ctx context.Context) error {
 	if time.Since(daemon.logsLoadedAt) >= daemon.config.HealthCheckInterval {
-		info := &StaleLogListInfo{
+		textPath := filepath.Join(daemon.config.StateDir, "healthchecks", healthCheckFilename())
+		event := &staleLogListEvent{
 			Source:        daemon.config.LogListSource,
 			LastSuccess:   daemon.logsLoadedAt,
 			LastError:     daemon.logListError,
 			LastErrorTime: daemon.logListErrorAt,
+			TextPath:      textPath,
 		}
-		if err := daemon.config.State.NotifyHealthCheckFailure(ctx, nil, info); err != nil {
+		if err := event.save(); err != nil {
+			return fmt.Errorf("error saving stale log list event: %w", err)
+		}
+		if err := notify(ctx, daemon.config, event); err != nil {
 			return fmt.Errorf("error notifying about stale log list: %w", err)
 		}
 	}
@@ -123,8 +129,8 @@ func (daemon *daemon) loadLogList(ctx context.Context) error {
 }
 
 func (daemon *daemon) run(ctx context.Context) error {
-	if err := daemon.config.State.Prepare(ctx); err != nil {
-		return fmt.Errorf("error preparing state: %w", err)
+	if err := prepareStateDir(daemon.config.StateDir); err != nil {
+		return fmt.Errorf("error preparing state directory: %w", err)
 	}
 
 	if err := daemon.loadLogList(ctx); err != nil {
@@ -144,7 +150,7 @@ func (daemon *daemon) run(ctx context.Context) error {
 			if err := daemon.loadLogList(ctx); err != nil {
 				daemon.logListError = err.Error()
 				daemon.logListErrorAt = time.Now()
-				recordError(ctx, daemon.config, nil, fmt.Errorf("error reloading log list (will try again later): %w", err))
+				recordError(fmt.Errorf("error reloading log list (will try again later): %w", err))
 			}
 			reloadLogListTicker.Reset(reloadLogListInterval())
 		case <-healthCheckTicker.C:

monitor/discoveredcert.go

@@ -21,24 +21,21 @@ import (
 	"software.sslmate.com/src/certspotter/ct"
 )
 
-type DiscoveredCert struct {
+type discoveredCert struct {
 	WatchItem    WatchItem
-	LogEntry     *LogEntry
+	LogEntry     *logEntry
 	Info         *certspotter.CertInfo
 	Chain        []ct.ASN1Cert // first entry is the leaf certificate or precertificate
 	TBSSHA256    [32]byte      // computed over Info.TBS.Raw
 	SHA256       [32]byte      // computed over Chain[0]
 	PubkeySHA256 [32]byte      // computed over Info.TBS.PublicKey.FullBytes
 	Identifiers  *certspotter.Identifiers
+	CertPath     string // empty if not saved on the filesystem
+	JSONPath     string // empty if not saved on the filesystem
+	TextPath     string // empty if not saved on the filesystem
 }
 
-type certPaths struct {
-	certPath string
-	jsonPath string
-	textPath string
-}
-
-func (cert *DiscoveredCert) pemChain() []byte {
+func (cert *discoveredCert) pemChain() []byte {
 	var buffer bytes.Buffer
 	for _, certBytes := range cert.Chain {
 		if err := pem.Encode(&buffer, &pem.Block{
@@ -51,7 +48,7 @@ func (cert *DiscoveredCert) pemChain() []byte {
 	return buffer.Bytes()
 }
 
-func (cert *DiscoveredCert) json() any {
+func (cert *discoveredCert) json() any {
 	object := map[string]any{
 		"tbs_sha256":    hex.EncodeToString(cert.TBSSHA256[:]),
 		"pubkey_sha256": hex.EncodeToString(cert.PubkeySHA256[:]),
@@ -70,23 +67,23 @@ func (cert *DiscoveredCert) json() any {
 	return object
 }
 
-func writeCertFiles(cert *DiscoveredCert, paths *certPaths) error {
-	if err := writeFile(paths.certPath, cert.pemChain(), 0666); err != nil {
+func (cert *discoveredCert) save() error {
+	if err := writeFile(cert.CertPath, cert.pemChain(), 0666); err != nil {
 		return err
 	}
-	if err := writeJSONFile(paths.jsonPath, cert.json(), 0666); err != nil {
+	if err := writeJSONFile(cert.JSONPath, cert.json(), 0666); err != nil {
 		return err
 	}
-	if err := writeTextFile(paths.textPath, certNotificationText(cert, paths), 0666); err != nil {
+	if err := writeTextFile(cert.TextPath, cert.Text(), 0666); err != nil {
 		return err
 	}
 	return nil
 }
 
-func certNotificationEnviron(cert *DiscoveredCert, paths *certPaths) []string {
+func (cert *discoveredCert) Environ() []string {
 	env := []string{
 		"EVENT=discovered_cert",
-		"SUMMARY=" + certNotificationSummary(cert),
+		"SUMMARY=" + cert.Summary(),
 		"CERT_PARSEABLE=yes", // backwards compat with pre-0.15.0; not documented
 		"LOG_URI=" + cert.LogEntry.Log.URL,
 		"ENTRY_INDEX=" + fmt.Sprint(cert.LogEntry.Index),
@@ -96,12 +93,9 @@ func certNotificationEnviron(cert *DiscoveredCert, paths *certPaths) []string {
 		"FINGERPRINT=" + hex.EncodeToString(cert.SHA256[:]), // backwards compat with pre-0.15.0; not documented
 		"PUBKEY_SHA256=" + hex.EncodeToString(cert.PubkeySHA256[:]),
 		"PUBKEY_HASH=" + hex.EncodeToString(cert.PubkeySHA256[:]), // backwards compat with pre-0.15.0; not documented
-	}
-
-	if paths != nil {
-		env = append(env, "CERT_FILENAME="+paths.certPath)
-		env = append(env, "JSON_FILENAME="+paths.jsonPath)
-		env = append(env, "TEXT_FILENAME="+paths.textPath)
+		"CERT_FILENAME=" + cert.CertPath,
+		"JSON_FILENAME=" + cert.JSONPath,
+		"TEXT_FILENAME=" + cert.TextPath,
 	}
 
 	if cert.Info.ValidityParseError == nil {
@@ -136,7 +130,7 @@ func certNotificationEnviron(cert *DiscoveredCert, paths *certPaths) []string {
 	return env
 }
 
-func certNotificationText(cert *DiscoveredCert, paths *certPaths) string {
+func (cert *discoveredCert) Text() string {
 	// TODO-4: improve the output: include WatchItem, indicate hash algorithm used for fingerprints, ... (look at SSLMate email for inspiration)
 
 	text := new(strings.Builder)
@@ -164,13 +158,13 @@ func certNotificationText(cert *DiscoveredCert, paths *certPaths) string {
 	}
 	writeField("Log Entry", fmt.Sprintf("%d @ %s", cert.LogEntry.Index, cert.LogEntry.Log.URL))
 	writeField("crt.sh", "https://crt.sh/?sha256="+hex.EncodeToString(cert.SHA256[:]))
-	if paths != nil {
-		writeField("Filename", paths.certPath)
+	if cert.CertPath != "" {
+		writeField("Filename", cert.CertPath)
 	}
 
 	return text.String()
 }
 
-func certNotificationSummary(cert *DiscoveredCert) string {
+func (cert *discoveredCert) Summary() string {
 	return fmt.Sprintf("Certificate Discovered for %s", cert.WatchItem)
 }

monitor/errors.go

@@ -10,19 +10,9 @@
 package monitor
 
 import (
-	"context"
 	"log"
-
-	"software.sslmate.com/src/certspotter/loglist"
 )
 
-func recordError(ctx context.Context, config *Config, ctlog *loglist.Log, errToRecord error) {
-	if err := config.State.NotifyError(ctx, ctlog, errToRecord); err != nil {
-		log.Print("unable to notify about error: ", err)
-		if ctlog == nil {
-			log.Print(errToRecord)
-		} else {
-			log.Print(ctlog.URL, ": ", errToRecord)
-		}
-	}
+func recordError(err error) {
+	log.Print(err)
 }

monitor/fsstate.go

@@ -1,239 +0,0 @@
-// Copyright (C) 2024 Opsmate, Inc.
-//
-// This Source Code Form is subject to the terms of the Mozilla
-// Public License, v. 2.0. If a copy of the MPL was not distributed
-// with this file, You can obtain one at http://mozilla.org/MPL/2.0/.
-//
-// This software is distributed WITHOUT A WARRANTY OF ANY KIND.
-// See the Mozilla Public License for details.
-
-package monitor
-
-import (
-	"context"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io/fs"
-	"log"
-	"os"
-	"path/filepath"
-	"strings"
-
-	"software.sslmate.com/src/certspotter/ct"
-	"software.sslmate.com/src/certspotter/loglist"
-)
-
-type FilesystemState struct {
-	StateDir  string
-	SaveCerts bool
-	Script    string
-	ScriptDir string
-	Email     []string
-	Stdout    bool
-}
-
-func (s *FilesystemState) logStateDir(logID LogID) string {
-	return filepath.Join(s.StateDir, "logs", logID.Base64URLString())
-}
-
-func (s *FilesystemState) Prepare(ctx context.Context) error {
-	return prepareStateDir(s.StateDir)
-}
-
-func (s *FilesystemState) PrepareLog(ctx context.Context, logID LogID) error {
-	var (
-		stateDirPath        = s.logStateDir(logID)
-		sthsDirPath         = filepath.Join(stateDirPath, "unverified_sths")
-		malformedDirPath    = filepath.Join(stateDirPath, "malformed_entries")
-		healthchecksDirPath = filepath.Join(stateDirPath, "healthchecks")
-	)
-	for _, dirPath := range []string{stateDirPath, sthsDirPath, malformedDirPath, healthchecksDirPath} {
-		if err := os.Mkdir(dirPath, 0777); err != nil && !errors.Is(err, fs.ErrExist) {
-			return err
-		}
-	}
-	return nil
-}
-
-func (s *FilesystemState) LoadLogState(ctx context.Context, logID LogID) (*LogState, error) {
-	filePath := filepath.Join(s.logStateDir(logID), "state.json")
-	fileBytes, err := os.ReadFile(filePath)
-	if errors.Is(err, fs.ErrNotExist) {
-		return nil, nil
-	} else if err != nil {
-		return nil, err
-	}
-	state := new(LogState)
-	if err := json.Unmarshal(fileBytes, state); err != nil {
-		return nil, fmt.Errorf("error parsing %s: %w", filePath, err)
-	}
-	return state, nil
-}
-
-func (s *FilesystemState) StoreLogState(ctx context.Context, logID LogID, state *LogState) error {
-	filePath := filepath.Join(s.logStateDir(logID), "state.json")
-	return writeJSONFile(filePath, state, 0666)
-}
-
-func (s *FilesystemState) StoreSTH(ctx context.Context, logID LogID, sth *ct.SignedTreeHead) error {
-	sthsDirPath := filepath.Join(s.logStateDir(logID), "unverified_sths")
-	return storeSTHInDir(sthsDirPath, sth)
-}
-
-func (s *FilesystemState) LoadSTHs(ctx context.Context, logID LogID) ([]*ct.SignedTreeHead, error) {
-	sthsDirPath := filepath.Join(s.logStateDir(logID), "unverified_sths")
-	return loadSTHsFromDir(sthsDirPath)
-}
-
-func (s *FilesystemState) RemoveSTH(ctx context.Context, logID LogID, sth *ct.SignedTreeHead) error {
-	sthsDirPath := filepath.Join(s.logStateDir(logID), "unverified_sths")
-	return removeSTHFromDir(sthsDirPath, sth)
-}
-
-func (s *FilesystemState) NotifyCert(ctx context.Context, cert *DiscoveredCert) error {
-	var notifiedPath string
-	var paths *certPaths
-	if s.SaveCerts {
-		hexFingerprint := hex.EncodeToString(cert.SHA256[:])
-		prefixPath := filepath.Join(s.StateDir, "certs", hexFingerprint[0:2])
-		var (
-			notifiedFilename      = "." + hexFingerprint + ".notified"
-			certFilename          = hexFingerprint + ".pem"
-			jsonFilename          = hexFingerprint + ".v1.json"
-			textFilename          = hexFingerprint + ".txt"
-			legacyCertFilename    = hexFingerprint + ".cert.pem"
-			legacyPrecertFilename = hexFingerprint + ".precert.pem"
-		)
-
-		for _, filename := range []string{notifiedFilename, legacyCertFilename, legacyPrecertFilename} {
-			if fileExists(filepath.Join(prefixPath, filename)) {
-				return nil
-			}
-		}
-
-		if err := os.Mkdir(prefixPath, 0777); err != nil && !errors.Is(err, fs.ErrExist) {
-			return fmt.Errorf("error creating directory in which to save certificate %x: %w", cert.SHA256, err)
-		}
-
-		notifiedPath = filepath.Join(prefixPath, notifiedFilename)
-		paths = &certPaths{
-			certPath: filepath.Join(prefixPath, certFilename),
-			jsonPath: filepath.Join(prefixPath, jsonFilename),
-			textPath: filepath.Join(prefixPath, textFilename),
-		}
-		if err := writeCertFiles(cert, paths); err != nil {
-			return fmt.Errorf("error saving certificate %x: %w", cert.SHA256, err)
-		}
-	} else {
-		// TODO-4: save cert to temporary files, and defer their unlinking
-	}
-
-	if err := s.notify(ctx, &notification{
-		summary: certNotificationSummary(cert),
-		environ: certNotificationEnviron(cert, paths),
-		text:    certNotificationText(cert, paths),
-	}); err != nil {
-		return fmt.Errorf("error notifying about discovered certificate for %s (%x): %w", cert.WatchItem, cert.SHA256, err)
-	}
-
-	if notifiedPath != "" {
-		if err := os.WriteFile(notifiedPath, nil, 0666); err != nil {
-			return fmt.Errorf("error saving certificate %x: %w", cert.SHA256, err)
-		}
-	}
-
-	return nil
-}
-
-func (s *FilesystemState) NotifyMalformedEntry(ctx context.Context, entry *LogEntry, parseError error) error {
-	var (
-		dirPath   = filepath.Join(s.logStateDir(entry.Log.LogID), "malformed_entries")
-		entryPath = filepath.Join(dirPath, fmt.Sprintf("%d.json", entry.Index))
-		textPath  = filepath.Join(dirPath, fmt.Sprintf("%d.txt", entry.Index))
-	)
-
-	summary := fmt.Sprintf("Unable to Parse Entry %d in %s", entry.Index, entry.Log.URL)
-
-	entryJSON := struct {
-		LeafInput []byte `json:"leaf_input"`
-		ExtraData []byte `json:"extra_data"`
-	}{
-		LeafInput: entry.LeafInput,
-		ExtraData: entry.ExtraData,
-	}
-
-	text := new(strings.Builder)
-	writeField := func(name string, value any) { fmt.Fprintf(text, "\t%13s = %s\n", name, value) }
-	fmt.Fprintf(text, "Unable to determine if log entry matches your watchlist. Please file a bug report at https://github.com/SSLMate/certspotter/issues/new with the following details:\n")
-	writeField("Log Entry", fmt.Sprintf("%d @ %s", entry.Index, entry.Log.URL))
-	writeField("Leaf Hash", entry.LeafHash.Base64String())
-	writeField("Error", parseError.Error())
-
-	if err := writeJSONFile(entryPath, entryJSON, 0666); err != nil {
-		return fmt.Errorf("error saving JSON file: %w", err)
-	}
-	if err := writeTextFile(textPath, text.String(), 0666); err != nil {
-		return fmt.Errorf("error saving texT file: %w", err)
-	}
-
-	environ := []string{
-		"EVENT=malformed_cert",
-		"SUMMARY=" + summary,
-		"LOG_URI=" + entry.Log.URL,
-		"ENTRY_INDEX=" + fmt.Sprint(entry.Index),
-		"LEAF_HASH=" + entry.LeafHash.Base64String(),
-		"PARSE_ERROR=" + parseError.Error(),
-		"ENTRY_FILENAME=" + entryPath,
-		"TEXT_FILENAME=" + textPath,
-		"CERT_PARSEABLE=no", // backwards compat with pre-0.15.0; not documented
-	}
-
-	if err := s.notify(ctx, &notification{
-		environ: environ,
-		summary: summary,
-		text:    text.String(),
-	}); err != nil {
-		return err
-	}
-	return nil
-}
-
-func (s *FilesystemState) healthCheckDir(ctlog *loglist.Log) string {
-	if ctlog == nil {
-		return filepath.Join(s.StateDir, "healthchecks")
-	} else {
-		return filepath.Join(s.logStateDir(ctlog.LogID), "healthchecks")
-	}
-}
-
-func (s *FilesystemState) NotifyHealthCheckFailure(ctx context.Context, ctlog *loglist.Log, info HealthCheckFailure) error {
-	textPath := filepath.Join(s.healthCheckDir(ctlog), healthCheckFilename())
-	environ := []string{
-		"EVENT=error",
-		"SUMMARY=" + info.Summary(),
-		"TEXT_FILENAME=" + textPath,
-	}
-	text := info.Text()
-	if err := writeTextFile(textPath, text, 0666); err != nil {
-		return fmt.Errorf("error saving text file: %w", err)
-	}
-	if err := s.notify(ctx, &notification{
-		environ: environ,
-		summary: info.Summary(),
-		text:    text,
-	}); err != nil {
-		return err
-	}
-	return nil
-}
-
-func (s *FilesystemState) NotifyError(ctx context.Context, ctlog *loglist.Log, err error) error {
-	if ctlog == nil {
-		log.Print(err)
-	} else {
-		log.Print(ctlog.URL, ":", err)
-	}
-	return nil
-}

monitor/healthcheck.go

@@ -11,7 +11,10 @@ package monitor
 
 import (
 	"context"
+	"errors"
 	"fmt"
+	"io/fs"
+	"path/filepath"
 	"strings"
 	"time"
 
@@ -24,38 +27,52 @@ func healthCheckFilename() string {
 }
 
 func healthCheckLog(ctx context.Context, config *Config, ctlog *loglist.Log) error {
-	state, err := config.State.LoadLogState(ctx, ctlog.LogID)
-	if err != nil {
-		return fmt.Errorf("error loading log state: %w", err)
-	} else if state == nil {
+	var (
+		stateDirPath  = filepath.Join(config.StateDir, "logs", ctlog.LogID.Base64URLString())
+		stateFilePath = filepath.Join(stateDirPath, "state.json")
+		sthsDirPath   = filepath.Join(stateDirPath, "unverified_sths")
+		textPath      = filepath.Join(stateDirPath, "healthchecks", healthCheckFilename())
+	)
+	state, err := loadStateFile(stateFilePath)
+	if errors.Is(err, fs.ErrNotExist) {
 		return nil
+	} else if err != nil {
+		return fmt.Errorf("error loading state file: %w", err)
 	}
 
 	if time.Since(state.LastSuccess) < config.HealthCheckInterval {
 		return nil
 	}
 
-	sths, err := config.State.LoadSTHs(ctx, ctlog.LogID)
+	sths, err := loadSTHsFromDir(sthsDirPath)
 	if err != nil {
-		return fmt.Errorf("error loading STHs: %w", err)
+		return fmt.Errorf("error loading STHs directory: %w", err)
 	}
 
 	if len(sths) == 0 {
-		info := &StaleSTHInfo{
+		event := &staleSTHEvent{
 			Log:         ctlog,
 			LastSuccess: state.LastSuccess,
 			LatestSTH:   state.VerifiedSTH,
+			TextPath:    textPath,
 		}
-		if err := config.State.NotifyHealthCheckFailure(ctx, ctlog, info); err != nil {
+		if err := event.save(); err != nil {
+			return fmt.Errorf("error saving stale STH event: %w", err)
+		}
+		if err := notify(ctx, config, event); err != nil {
 			return fmt.Errorf("error notifying about stale STH: %w", err)
 		}
 	} else {
-		info := &BacklogInfo{
+		event := &backlogEvent{
 			Log:       ctlog,
 			LatestSTH: sths[len(sths)-1],
 			Position:  state.DownloadPosition.Size(),
+			TextPath:  textPath,
 		}
-		if err := config.State.NotifyHealthCheckFailure(ctx, ctlog, info); err != nil {
+		if err := event.save(); err != nil {
+			return fmt.Errorf("error saving backlog event: %w", err)
+		}
+		if err := notify(ctx, config, event); err != nil {
 			return fmt.Errorf("error notifying about backlog: %w", err)
 		}
 	}
@@ -63,45 +80,63 @@ func healthCheckLog(ctx context.Context, config *Config, ctlog *loglist.Log) err
 	return nil
 }
 
-type HealthCheckFailure interface {
-	Summary() string
-	Text() string
-}
-
-type StaleSTHInfo struct {
+type staleSTHEvent struct {
 	Log         *loglist.Log
 	LastSuccess time.Time
 	LatestSTH   *ct.SignedTreeHead // may be nil
+	TextPath    string
 }
-
-type BacklogInfo struct {
+type backlogEvent struct {
 	Log       *loglist.Log
 	LatestSTH *ct.SignedTreeHead
 	Position  uint64
+	TextPath  string
 }
-
-type StaleLogListInfo struct {
+type staleLogListEvent struct {
 	Source        string
 	LastSuccess   time.Time
 	LastError     string
 	LastErrorTime time.Time
+	TextPath      string
 }
 
-func (e *BacklogInfo) Backlog() uint64 {
+func (e *backlogEvent) Backlog() uint64 {
 	return e.LatestSTH.TreeSize - e.Position
 }
 
-func (e *StaleSTHInfo) Summary() string {
+func (e *staleSTHEvent) Environ() []string {
+	return []string{
+		"EVENT=error",
+		"SUMMARY=" + e.Summary(),
+		"TEXT_FILENAME=" + e.TextPath,
+	}
+}
+func (e *backlogEvent) Environ() []string {
+	return []string{
+		"EVENT=error",
+		"SUMMARY=" + e.Summary(),
+		"TEXT_FILENAME=" + e.TextPath,
+	}
+}
+func (e *staleLogListEvent) Environ() []string {
+	return []string{
+		"EVENT=error",
+		"SUMMARY=" + e.Summary(),
+		"TEXT_FILENAME=" + e.TextPath,
+	}
+}
+
+func (e *staleSTHEvent) Summary() string {
 	return fmt.Sprintf("Unable to contact %s since %s", e.Log.URL, e.LastSuccess)
 }
-func (e *BacklogInfo) Summary() string {
+func (e *backlogEvent) Summary() string {
 	return fmt.Sprintf("Backlog of size %d from %s", e.Backlog(), e.Log.URL)
 }
-func (e *StaleLogListInfo) Summary() string {
+func (e *staleLogListEvent) Summary() string {
 	return fmt.Sprintf("Unable to retrieve log list since %s", e.LastSuccess)
 }
 
-func (e *StaleSTHInfo) Text() string {
+func (e *staleSTHEvent) Text() string {
 	text := new(strings.Builder)
 	fmt.Fprintf(text, "certspotter has been unable to contact %s since %s. Consequentially, certspotter may fail to notify you about certificates in this log.\n", e.Log.URL, e.LastSuccess)
 	fmt.Fprintf(text, "\n")
@@ -114,7 +149,7 @@ func (e *StaleSTHInfo) Text() string {
 	}
 	return text.String()
 }
-func (e *BacklogInfo) Text() string {
+func (e *backlogEvent) Text() string {
 	text := new(strings.Builder)
 	fmt.Fprintf(text, "certspotter has been unable to download entries from %s in a timely manner. Consequentially, certspotter may be slow to notify you about certificates in this log.\n", e.Log.URL)
 	fmt.Fprintf(text, "\n")
@@ -125,7 +160,7 @@ func (e *BacklogInfo) Text() string {
 	fmt.Fprintf(text, "         Backlog = %d\n", e.Backlog())
 	return text.String()
 }
-func (e *StaleLogListInfo) Text() string {
+func (e *staleLogListEvent) Text() string {
 	text := new(strings.Builder)
 	fmt.Fprintf(text, "certspotter has been unable to retrieve the log list from %s since %s.\n", e.Source, e.LastSuccess)
 	fmt.Fprintf(text, "\n")
@@ -135,4 +170,14 @@ func (e *StaleLogListInfo) Text() string {
 	return text.String()
 }
 
+func (e *staleSTHEvent) save() error {
+	return writeTextFile(e.TextPath, e.Text(), 0666)
+}
+func (e *backlogEvent) save() error {
+	return writeTextFile(e.TextPath, e.Text(), 0666)
+}
+func (e *staleLogListEvent) save() error {
+	return writeTextFile(e.TextPath, e.Text(), 0666)
+}
+
 // TODO-3: make the errors more actionable

monitor/malformed.go

@@ -0,0 +1,72 @@
+// Copyright (C) 2023 Opsmate, Inc.
+//
+// This Source Code Form is subject to the terms of the Mozilla
+// Public License, v. 2.0. If a copy of the MPL was not distributed
+// with this file, You can obtain one at http://mozilla.org/MPL/2.0/.
+//
+// This software is distributed WITHOUT A WARRANTY OF ANY KIND.
+// See the Mozilla Public License for details.
+
+package monitor
+
+import (
+	"fmt"
+	"strings"
+)
+
+type malformedLogEntry struct {
+	Entry     *logEntry
+	Error     string
+	EntryPath string
+	TextPath  string
+}
+
+func (malformed *malformedLogEntry) entryJSON() any {
+	return struct {
+		LeafInput []byte `json:"leaf_input"`
+		ExtraData []byte `json:"extra_data"`
+	}{
+		LeafInput: malformed.Entry.LeafInput,
+		ExtraData: malformed.Entry.ExtraData,
+	}
+}
+
+func (malformed *malformedLogEntry) save() error {
+	if err := writeJSONFile(malformed.EntryPath, malformed.entryJSON(), 0666); err != nil {
+		return err
+	}
+	if err := writeTextFile(malformed.TextPath, malformed.Text(), 0666); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (malformed *malformedLogEntry) Environ() []string {
+	return []string{
+		"EVENT=malformed_cert",
+		"SUMMARY=" + malformed.Summary(),
+		"LOG_URI=" + malformed.Entry.Log.URL,
+		"ENTRY_INDEX=" + fmt.Sprint(malformed.Entry.Index),
+		"LEAF_HASH=" + malformed.Entry.LeafHash.Base64String(),
+		"PARSE_ERROR=" + malformed.Error,
+		"ENTRY_FILENAME=" + malformed.EntryPath,
+		"TEXT_FILENAME=" + malformed.TextPath,
+		"CERT_PARSEABLE=no", // backwards compat with pre-0.15.0; not documented
+	}
+}
+
+func (malformed *malformedLogEntry) Text() string {
+	text := new(strings.Builder)
+	writeField := func(name string, value any) { fmt.Fprintf(text, "\t%13s = %s\n", name, value) }
+
+	fmt.Fprintf(text, "Unable to determine if log entry matches your watchlist. Please file a bug report at https://github.com/SSLMate/certspotter/issues/new with the following details:\n")
+	writeField("Log Entry", fmt.Sprintf("%d @ %s", malformed.Entry.Index, malformed.Entry.Log.URL))
+	writeField("Leaf Hash", malformed.Entry.LeafHash.Base64String())
+	writeField("Error", malformed.Error)
+
+	return text.String()
+}
+
+func (malformed *malformedLogEntry) Summary() string {
+	return fmt.Sprintf("Unable to Parse Entry %d in %s", malformed.Entry.Index, malformed.Entry.Log.URL)
+}

monitor/monitor.go

@@ -14,7 +14,10 @@ import (
 	"crypto/x509"
 	"errors"
 	"fmt"
+	"io/fs"
 	"log"
+	"os"
+	"path/filepath"
 	"strings"
 	"time"
 
@@ -70,8 +73,17 @@ func monitorLog(ctx context.Context, config *Config, ctlog *loglist.Log, logClie
 	ctx, cancel := context.WithCancel(ctx)
 	defer cancel()
 
-	if err := config.State.PrepareLog(ctx, ctlog.LogID); err != nil {
-		return fmt.Errorf("error preparing state: %w", err)
+	var (
+		stateDirPath        = filepath.Join(config.StateDir, "logs", ctlog.LogID.Base64URLString())
+		stateFilePath       = filepath.Join(stateDirPath, "state.json")
+		sthsDirPath         = filepath.Join(stateDirPath, "unverified_sths")
+		malformedDirPath    = filepath.Join(stateDirPath, "malformed_entries")
+		healthchecksDirPath = filepath.Join(stateDirPath, "healthchecks")
+	)
+	for _, dirPath := range []string{stateDirPath, sthsDirPath, malformedDirPath, healthchecksDirPath} {
+		if err := os.Mkdir(dirPath, 0777); err != nil && !errors.Is(err, fs.ErrExist) {
+			return fmt.Errorf("error creating state directory: %w", err)
+		}
 	}
 
 	startTime := time.Now()
@@ -79,35 +91,32 @@ func monitorLog(ctx context.Context, config *Config, ctlog *loglist.Log, logClie
 	if isFatalLogError(err) {
 		return err
 	} else if err != nil {
-		recordError(ctx, config, ctlog, fmt.Errorf("error fetching latest STH: %w", err))
+		recordError(fmt.Errorf("error fetching latest STH for %s: %w", ctlog.URL, err))
 		return nil
 	}
 	latestSTH.LogID = ctlog.LogID
-	if err := config.State.StoreSTH(ctx, ctlog.LogID, latestSTH); err != nil {
+	if err := storeSTHInDir(sthsDirPath, latestSTH); err != nil {
 		return fmt.Errorf("error storing latest STH: %w", err)
 	}
 
-	state, err := config.State.LoadLogState(ctx, ctlog.LogID)
-	if err != nil {
-		return fmt.Errorf("error loading log state: %w", err)
-	}
-	if state == nil {
+	state, err := loadStateFile(stateFilePath)
+	if errors.Is(err, fs.ErrNotExist) {
 		if config.StartAtEnd {
 			tree, err := reconstructTree(ctx, logClient, latestSTH)
 			if isFatalLogError(err) {
 				return err
 			} else if err != nil {
-				recordError(ctx, config, ctlog, fmt.Errorf("error reconstructing tree of size %d: %w", latestSTH.TreeSize, err))
+				recordError(fmt.Errorf("error reconstructing tree of size %d for %s: %w", latestSTH.TreeSize, ctlog.URL, err))
 				return nil
 			}
-			state = &LogState{
+			state = &stateFile{
 				DownloadPosition: tree,
 				VerifiedPosition: tree,
 				VerifiedSTH:      latestSTH,
 				LastSuccess:      startTime.UTC(),
 			}
 		} else {
-			state = &LogState{
+			state = &stateFile{
 				DownloadPosition: merkletree.EmptyCollapsedTree(),
 				VerifiedPosition: merkletree.EmptyCollapsedTree(),
 				VerifiedSTH:      nil,
@@ -117,19 +126,21 @@ func monitorLog(ctx context.Context, config *Config, ctlog *loglist.Log, logClie
 		if config.Verbose {
 			log.Printf("brand new log %s (starting from %d)", ctlog.URL, state.DownloadPosition.Size())
 		}
-		if err := config.State.StoreLogState(ctx, ctlog.LogID, state); err != nil {
-			return fmt.Errorf("error storing log state: %w", err)
+		if err := state.store(stateFilePath); err != nil {
+			return fmt.Errorf("error storing state file: %w", err)
 		}
+	} else if err != nil {
+		return fmt.Errorf("error loading state file: %w", err)
 	}
 
-	sths, err := config.State.LoadSTHs(ctx, ctlog.LogID)
+	sths, err := loadSTHsFromDir(sthsDirPath)
 	if err != nil {
-		return fmt.Errorf("error loading STHs: %w", err)
+		return fmt.Errorf("error loading STHs directory: %w", err)
 	}
 
 	for len(sths) > 0 && sths[0].TreeSize <= state.DownloadPosition.Size() {
 		// TODO-4: audit sths[0] against state.VerifiedSTH
-		if err := config.State.RemoveSTH(ctx, ctlog.LogID, sths[0]); err != nil {
+		if err := removeSTHFromDir(sthsDirPath, sths[0]); err != nil {
 			return fmt.Errorf("error removing STH: %w", err)
 		}
 		sths = sths[1:]
@@ -139,8 +150,8 @@ func monitorLog(ctx context.Context, config *Config, ctlog *loglist.Log, logClie
 		if config.Verbose {
 			log.Printf("saving state in defer for %s", ctlog.URL)
 		}
-		if err := config.State.StoreLogState(ctx, ctlog.LogID, state); err != nil && returnedErr == nil {
-			returnedErr = fmt.Errorf("error storing log state: %w", err)
+		if err := state.store(stateFilePath); err != nil && returnedErr == nil {
+			returnedErr = fmt.Errorf("error storing state file: %w", err)
 		}
 	}()
 
@@ -163,7 +174,7 @@ func monitorLog(ctx context.Context, config *Config, ctlog *loglist.Log, logClie
 		downloadErr = downloadEntries(ctx, logClient, entries, downloadBegin, downloadEnd)
 	}()
 	for rawEntry := range entries {
-		entry := &LogEntry{
+		entry := &logEntry{
 			Log:       ctlog,
 			Index:     state.DownloadPosition.Size(),
 			LeafInput: rawEntry.LeafInput,
@@ -180,11 +191,11 @@ func monitorLog(ctx context.Context, config *Config, ctlog *loglist.Log, logClie
 
 		for len(sths) > 0 && state.DownloadPosition.Size() == sths[0].TreeSize {
 			if merkletree.Hash(sths[0].SHA256RootHash) != rootHash {
-				recordError(ctx, config, ctlog, fmt.Errorf("error verifying at tree size %d: the STH root hash (%x) does not match the entries returned by the log (%x)", sths[0].TreeSize, sths[0].SHA256RootHash, rootHash))
+				recordError(fmt.Errorf("error verifying %s at tree size %d: the STH root hash (%x) does not match the entries returned by the log (%x)", ctlog.URL, sths[0].TreeSize, sths[0].SHA256RootHash, rootHash))
 
 				state.DownloadPosition = state.VerifiedPosition
-				if err := config.State.StoreLogState(ctx, ctlog.LogID, state); err != nil {
-					return fmt.Errorf("error storing log state: %w", err)
+				if err := state.store(stateFilePath); err != nil {
+					return fmt.Errorf("error storing state file: %w", err)
 				}
 				return nil
 			}
@@ -192,7 +203,7 @@ func monitorLog(ctx context.Context, config *Config, ctlog *loglist.Log, logClie
 			state.VerifiedPosition = state.DownloadPosition
 			state.VerifiedSTH = sths[0]
 			shouldSaveState = true
-			if err := config.State.RemoveSTH(ctx, ctlog.LogID, sths[0]); err != nil {
+			if err := removeSTHFromDir(sthsDirPath, sths[0]); err != nil {
 				return fmt.Errorf("error removing verified STH: %w", err)
 			}
 
@@ -200,7 +211,7 @@ func monitorLog(ctx context.Context, config *Config, ctlog *loglist.Log, logClie
 		}
 
 		if shouldSaveState {
-			if err := config.State.StoreLogState(ctx, ctlog.LogID, state); err != nil {
+			if err := state.store(stateFilePath); err != nil {
 				return fmt.Errorf("error storing state file: %w", err)
 			}
 		}
@@ -209,7 +220,7 @@ func monitorLog(ctx context.Context, config *Config, ctlog *loglist.Log, logClie
 	if isFatalLogError(downloadErr) {
 		return downloadErr
 	} else if downloadErr != nil {
-		recordError(ctx, config, ctlog, fmt.Errorf("error downloading entries: %w", downloadErr))
+		recordError(fmt.Errorf("error downloading entries from %s: %w", ctlog.URL, downloadErr))
 		return nil
 	}
 

monitor/notify.go

@@ -25,31 +25,31 @@ import (
 
 var stdoutMu sync.Mutex
 
-type notification struct {
-	environ []string
-	summary string
-	text    string
+type notification interface {
+	Environ() []string
+	Summary() string
+	Text() string
 }
 
-func (s *FilesystemState) notify(ctx context.Context, notif *notification) error {
-	if s.Stdout {
+func notify(ctx context.Context, config *Config, notif notification) error {
+	if config.Stdout {
 		writeToStdout(notif)
 	}
 
-	if len(s.Email) > 0 {
-		if err := sendEmail(ctx, s.Email, notif); err != nil {
+	if len(config.Email) > 0 {
+		if err := sendEmail(ctx, config.Email, notif); err != nil {
 			return err
 		}
 	}
 
-	if s.Script != "" {
-		if err := execScript(ctx, s.Script, notif); err != nil {
+	if config.Script != "" {
+		if err := execScript(ctx, config.Script, notif); err != nil {
 			return err
 		}
 	}
 
-	if s.ScriptDir != "" {
-		if err := execScriptDir(ctx, s.ScriptDir, notif); err != nil {
+	if config.ScriptDir != "" {
+		if err := execScriptDir(ctx, config.ScriptDir, notif); err != nil {
 			return err
 		}
 	}
@@ -57,36 +57,27 @@ func (s *FilesystemState) notify(ctx context.Context, notif *notification) error
 	return nil
 }
 
-func writeToStdout(notif *notification) {
+func writeToStdout(notif notification) {
 	stdoutMu.Lock()
 	defer stdoutMu.Unlock()
-	os.Stdout.WriteString(notif.text + "\n")
+	os.Stdout.WriteString(notif.Text() + "\n")
 }
 
-func sendEmail(ctx context.Context, to []string, notif *notification) error {
+func sendEmail(ctx context.Context, to []string, notif notification) error {
 	stdin := new(bytes.Buffer)
 	stderr := new(bytes.Buffer)
 
-	from := os.Getenv("EMAIL")
-
-	if from != "" {
-		fmt.Fprintf(stdin, "From: %s\n", from)
-	}
 	fmt.Fprintf(stdin, "To: %s\n", strings.Join(to, ", "))
-	fmt.Fprintf(stdin, "Subject: [certspotter] %s\n", notif.summary)
+	fmt.Fprintf(stdin, "Subject: [certspotter] %s\n", notif.Summary())
 	fmt.Fprintf(stdin, "Date: %s\n", time.Now().Format(mailDateFormat))
 	fmt.Fprintf(stdin, "Message-ID: <%s>\n", generateMessageID())
 	fmt.Fprintf(stdin, "Mime-Version: 1.0\n")
 	fmt.Fprintf(stdin, "Content-Type: text/plain; charset=US-ASCII\n")
 	fmt.Fprintf(stdin, "X-Mailer: certspotter\n")
 	fmt.Fprintf(stdin, "\n")
-	fmt.Fprint(stdin, notif.text)
+	fmt.Fprint(stdin, notif.Text())
 
-	args := []string{"-i"}
-	if from != "" {
-		args = append(args, "-f", from)
-	}
-	args = append(args, "--")
+	args := []string{"-i", "--"}
 	args = append(args, to...)
 
 	sendmail := exec.CommandContext(ctx, sendmailPath(), args...)
@@ -104,12 +95,12 @@ func sendEmail(ctx context.Context, to []string, notif *notification) error {
 	}
 }
 
-func execScript(ctx context.Context, scriptName string, notif *notification) error {
+func execScript(ctx context.Context, scriptName string, notif notification) error {
 	stderr := new(bytes.Buffer)
 
 	cmd := exec.CommandContext(ctx, scriptName)
 	cmd.Env = os.Environ()
-	cmd.Env = append(cmd.Env, notif.environ...)
+	cmd.Env = append(cmd.Env, notif.Environ()...)
 	cmd.Stderr = stderr
 
 	if err := cmd.Run(); err == nil {
@@ -125,7 +116,7 @@ func execScript(ctx context.Context, scriptName string, notif *notification) err
 	}
 }
 
-func execScriptDir(ctx context.Context, dirPath string, notif *notification) error {
+func execScriptDir(ctx context.Context, dirPath string, notif notification) error {
 	dirents, err := os.ReadDir(dirPath)
 	if errors.Is(err, fs.ErrNotExist) {
 		return nil

monitor/process.go

@@ -13,14 +13,19 @@ import (
 	"bytes"
 	"context"
 	"crypto/sha256"
+	"encoding/hex"
+	"errors"
 	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
 	"software.sslmate.com/src/certspotter"
 	"software.sslmate.com/src/certspotter/ct"
 	"software.sslmate.com/src/certspotter/loglist"
 	"software.sslmate.com/src/certspotter/merkletree"
 )
 
-type LogEntry struct {
+type logEntry struct {
 	Log       *loglist.Log
 	Index     uint64
 	LeafInput []byte
@@ -28,7 +33,7 @@ type LogEntry struct {
 	LeafHash  merkletree.Hash
 }
 
-func processLogEntry(ctx context.Context, config *Config, entry *LogEntry) error {
+func processLogEntry(ctx context.Context, config *Config, entry *logEntry) error {
 	leaf, err := ct.ReadMerkleTreeLeaf(bytes.NewReader(entry.LeafInput))
 	if err != nil {
 		return processMalformedLogEntry(ctx, config, entry, fmt.Errorf("error parsing Merkle Tree Leaf: %w", err))
@@ -43,7 +48,7 @@ func processLogEntry(ctx context.Context, config *Config, entry *LogEntry) error
 	}
 }
 
-func processX509LogEntry(ctx context.Context, config *Config, entry *LogEntry, cert ct.ASN1Cert) error {
+func processX509LogEntry(ctx context.Context, config *Config, entry *logEntry, cert ct.ASN1Cert) error {
 	certInfo, err := certspotter.MakeCertInfoFromRawCert(cert)
 	if err != nil {
 		return processMalformedLogEntry(ctx, config, entry, fmt.Errorf("error parsing X.509 certificate: %w", err))
@@ -64,7 +69,7 @@ func processX509LogEntry(ctx context.Context, config *Config, entry *LogEntry, c
 	return processCertificate(ctx, config, entry, certInfo, chain)
 }
 
-func processPrecertLogEntry(ctx context.Context, config *Config, entry *LogEntry, precert ct.PreCert) error {
+func processPrecertLogEntry(ctx context.Context, config *Config, entry *logEntry, precert ct.PreCert) error {
 	certInfo, err := certspotter.MakeCertInfoFromRawTBS(precert.TBSCertificate)
 	if err != nil {
 		return processMalformedLogEntry(ctx, config, entry, fmt.Errorf("error parsing precert TBSCertificate: %w", err))
@@ -82,7 +87,7 @@ func processPrecertLogEntry(ctx context.Context, config *Config, entry *LogEntry
 	return processCertificate(ctx, config, entry, certInfo, chain)
 }
 
-func processCertificate(ctx context.Context, config *Config, entry *LogEntry, certInfo *certspotter.CertInfo, chain []ct.ASN1Cert) error {
+func processCertificate(ctx context.Context, config *Config, entry *logEntry, certInfo *certspotter.CertInfo, chain []ct.ASN1Cert) error {
 	identifiers, err := certInfo.ParseIdentifiers()
 	if err != nil {
 		return processMalformedLogEntry(ctx, config, entry, err)
@@ -92,7 +97,7 @@ func processCertificate(ctx context.Context, config *Config, entry *LogEntry, ce
 		return nil
 	}
 
-	cert := &DiscoveredCert{
+	cert := &discoveredCert{
 		WatchItem:    watchItem,
 		LogEntry:     entry,
 		Info:         certInfo,
@@ -103,15 +108,68 @@ func processCertificate(ctx context.Context, config *Config, entry *LogEntry, ce
 		Identifiers:  identifiers,
 	}
 
-	if err := config.State.NotifyCert(ctx, cert); err != nil {
-		return fmt.Errorf("error notifying about certificate %x: %w", cert.SHA256, err)
+	var notifiedPath string
+	if config.SaveCerts {
+		hexFingerprint := hex.EncodeToString(cert.SHA256[:])
+		prefixPath := filepath.Join(config.StateDir, "certs", hexFingerprint[0:2])
+		var (
+			notifiedFilename      = "." + hexFingerprint + ".notified"
+			certFilename          = hexFingerprint + ".pem"
+			jsonFilename          = hexFingerprint + ".v1.json"
+			textFilename          = hexFingerprint + ".txt"
+			legacyCertFilename    = hexFingerprint + ".cert.pem"
+			legacyPrecertFilename = hexFingerprint + ".precert.pem"
+		)
+
+		for _, filename := range []string{notifiedFilename, legacyCertFilename, legacyPrecertFilename} {
+			if fileExists(filepath.Join(prefixPath, filename)) {
+				return nil
+			}
+		}
+
+		if err := os.Mkdir(prefixPath, 0777); err != nil && !errors.Is(err, fs.ErrExist) {
+			return fmt.Errorf("error creating directory in which to save certificate %x: %w", cert.SHA256, err)
+		}
+
+		notifiedPath = filepath.Join(prefixPath, notifiedFilename)
+		cert.CertPath = filepath.Join(prefixPath, certFilename)
+		cert.JSONPath = filepath.Join(prefixPath, jsonFilename)
+		cert.TextPath = filepath.Join(prefixPath, textFilename)
+
+		if err := cert.save(); err != nil {
+			return fmt.Errorf("error saving certificate %x: %w", cert.SHA256, err)
+		}
+	} else {
+		// TODO-4: save cert to temporary files, and defer their unlinking
+	}
+
+	if err := notify(ctx, config, cert); err != nil {
+		return fmt.Errorf("error notifying about discovered certificate for %s (%x): %w", cert.WatchItem, cert.SHA256, err)
+	}
+
+	if notifiedPath != "" {
+		if err := os.WriteFile(notifiedPath, nil, 0666); err != nil {
+			return fmt.Errorf("error saving certificate %x: %w", cert.SHA256, err)
+		}
 	}
 
 	return nil
 }
 
-func processMalformedLogEntry(ctx context.Context, config *Config, entry *LogEntry, parseError error) error {
-	if err := config.State.NotifyMalformedEntry(ctx, entry, parseError); err != nil {
+func processMalformedLogEntry(ctx context.Context, config *Config, entry *logEntry, parseError error) error {
+	dirPath := filepath.Join(config.StateDir, "logs", entry.Log.LogID.Base64URLString(), "malformed_entries")
+	malformed := &malformedLogEntry{
+		Entry:     entry,
+		Error:     parseError.Error(),
+		EntryPath: filepath.Join(dirPath, fmt.Sprintf("%d.json", entry.Index)),
+		TextPath:  filepath.Join(dirPath, fmt.Sprintf("%d.txt", entry.Index)),
+	}
+
+	if err := malformed.save(); err != nil {
+		return fmt.Errorf("error saving malformed log entry %d in %s (%q): %w", entry.Index, entry.Log.URL, parseError, err)
+	}
+
+	if err := notify(ctx, config, malformed); err != nil {
 		return fmt.Errorf("error notifying about malformed log entry %d in %s (%q): %w", entry.Index, entry.Log.URL, parseError, err)
 	}
 	return nil

monitor/state.go

@@ -1,68 +0,0 @@
-// Copyright (C) 2024 Opsmate, Inc.
-//
-// This Source Code Form is subject to the terms of the Mozilla
-// Public License, v. 2.0. If a copy of the MPL was not distributed
-// with this file, You can obtain one at http://mozilla.org/MPL/2.0/.
-//
-// This software is distributed WITHOUT A WARRANTY OF ANY KIND.
-// See the Mozilla Public License for details.
-
-package monitor
-
-import (
-	"context"
-	"software.sslmate.com/src/certspotter/ct"
-	"software.sslmate.com/src/certspotter/loglist"
-	"software.sslmate.com/src/certspotter/merkletree"
-	"time"
-)
-
-type LogState struct {
-	DownloadPosition *merkletree.CollapsedTree `json:"download_position"`
-	VerifiedPosition *merkletree.CollapsedTree `json:"verified_position"`
-	VerifiedSTH      *ct.SignedTreeHead        `json:"verified_sth"`
-	LastSuccess      time.Time                 `json:"last_success"`
-}
-
-type StateProvider interface {
-	// Initialize the state.  Called before any other method in this interface.
-	// Idempotent: returns nil if the state is already initialized.
-	Prepare(context.Context) error
-
-	// Initialize the state for the given log.  Called before any other method
-	// with the log ID.  Idempotent: returns nil if log state already initialized.
-	PrepareLog(context.Context, LogID) error
-
-	// Store log state for retrieval by LoadLogState.
-	StoreLogState(context.Context, LogID, *LogState) error
-
-	// Load log state that was previously stored with StoreLogState.
-	// Returns nil, nil if StoreLogState has not been called yet for this log.
-	LoadLogState(context.Context, LogID) (*LogState, error)
-
-	// Store STH for retrieval by LoadSTHs.  If an STH with the same
-	// timestamp and root hash is already stored, this STH can be ignored.
-	StoreSTH(context.Context, LogID, *ct.SignedTreeHead) error
-
-	// Load all STHs for this log previously stored with StoreSTH.
-	// The returned slice must be sorted by tree size.
-	LoadSTHs(context.Context, LogID) ([]*ct.SignedTreeHead, error)
-
-	// Remove an STH so it is no longer returned by LoadSTHs.
-	RemoveSTH(context.Context, LogID, *ct.SignedTreeHead) error
-
-	// Called when a certificate matching the watch list is discovered.
-	NotifyCert(context.Context, *DiscoveredCert) error
-
-	// Called when certspotter fails to parse a log entry.
-	NotifyMalformedEntry(context.Context, *LogEntry, error) error
-
-	// Called when a health check fails.  The log is nil if the
-	// feailure is not associated with a log.
-	NotifyHealthCheckFailure(context.Context, *loglist.Log, HealthCheckFailure) error
-
-	// Called when a non-fatal error occurs.  The log is nil if the error is
-	// not associated with a log.  Note that most errors are transient, and
-	// certspotter will retry the failed operation later.
-	NotifyError(context.Context, *loglist.Log, error) error
-}

monitor/statedir.go

@@ -76,13 +76,13 @@ func migrateLogStateDirV1(dir string) error {
 		return fmt.Errorf("error unmarshaling %s: %w", treePath, err)
 	}
 
-	stateFile := LogState{
+	stateFile := stateFile{
 		DownloadPosition: &tree,
 		VerifiedPosition: &tree,
 		VerifiedSTH:      &sth,
 		LastSuccess:      time.Now().UTC(),
 	}
-	if err := writeJSONFile(filepath.Join(dir, "state.json"), stateFile, 0666); err != nil {
+	if stateFile.store(filepath.Join(dir, "state.json")); err != nil {
 		return err
 	}
 

monitor/statefile.go

@@ -0,0 +1,42 @@
+// Copyright (C) 2023 Opsmate, Inc.
+//
+// This Source Code Form is subject to the terms of the Mozilla
+// Public License, v. 2.0. If a copy of the MPL was not distributed
+// with this file, You can obtain one at http://mozilla.org/MPL/2.0/.
+//
+// This software is distributed WITHOUT A WARRANTY OF ANY KIND.
+// See the Mozilla Public License for details.
+
+package monitor
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"software.sslmate.com/src/certspotter/ct"
+	"software.sslmate.com/src/certspotter/merkletree"
+	"time"
+)
+
+type stateFile struct {
+	DownloadPosition *merkletree.CollapsedTree `json:"download_position"`
+	VerifiedPosition *merkletree.CollapsedTree `json:"verified_position"`
+	VerifiedSTH      *ct.SignedTreeHead        `json:"verified_sth"`
+	LastSuccess      time.Time                 `json:"last_success"`
+}
+
+func loadStateFile(filePath string) (*stateFile, error) {
+	fileBytes, err := os.ReadFile(filePath)
+	if err != nil {
+		return nil, err
+	}
+	file := new(stateFile)
+	if err := json.Unmarshal(fileBytes, file); err != nil {
+		return nil, fmt.Errorf("error parsing %s: %w", filePath, err)
+	}
+	return file, nil
+}
+
+func (file *stateFile) store(filePath string) error {
+	return writeJSONFile(filePath, file, 0666)
+}

monitor/sthdir.go

@@ -17,10 +17,10 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"slices"
 	"io/fs"
 	"os"
 	"path/filepath"
-	"slices"
 	"software.sslmate.com/src/certspotter/ct"
 	"strconv"
 	"strings"