DNS Persistent DCV validation method

[sciros]

This pull request adds support for a new DNS-based domain control validation (DCV) method, "DNS Persistent," in compliance with the latest CA/Browser Forum Baseline Requirements. The changes include updates to the core validation logic, new parameter and response classes, and enhancements to the test suite. The version is also bumped to reflect these new capabilities.

Support for DNS Persistent DCV (CABF 3.2.2.4.22):

• Added DcvDnsPersistentValidationParameters class to handle parameters for persistent DNS TXT record validation, including issuer domain names and account URI.
• Updated the DCV validation method enum (DcvValidationMethod) to include DNS_PERSISTENT and DNS_ACCOUNT_01, with CABF references and comments for clarity.
• Modified the core checker logic (MpicDcvChecker) to build and evaluate expected DNS record content for persistent validation, including a new evaluate_persistent_dns_response method that parses TXT records according to CABF/RFC 8659 syntax and checks issuer, account URI, and expiration. [1] [2] [3] [4] [5]

API and Model Updates:

• Updated the API specification version to 3.8.0 in pyproject.toml and bumped the package version to 6.3.0. [1] [2]
• Extended union types and response models to support the new validation method, ensuring proper serialization and deserialization of persistent DNS validation parameters and results. [1] [2] [3]

Testing Enhancements:

• Added unit tests for the new persistent DNS validation parameters to ensure correct handling and coverage. [1] [2]

Minor Improvements and Refactoring:

• Improved DNS resolution logic to ensure trailing dots are added for domain names and refactored HTTP validation URL construction for clarity. [1] [2]
• Cleaned up legacy config options and clarified comments in configuration files.

These changes collectively enable persistent DNS validation, align with the latest industry standards, and improve the maintainability and clarity of the codebase.

[Copilot]

Pull request overview

This pull request adds support for the DNS Persistent domain control validation (DCV) method in compliance with CA/Browser Forum Baseline Requirements section 3.2.2.4.22. The implementation includes new validation parameters, core validation logic, and comprehensive test coverage.

Key Changes

• Added DcvDnsPersistentValidationParameters class to handle persistent DNS TXT record validation with issuer domain names and account URI
• Implemented evaluate_persistent_dns_response method to parse and validate DNS TXT records according to RFC 8659 syntax, checking issuer domain, account URI, and optional expiration timestamp
• Updated test suite with comprehensive unit tests for the new validation method, including edge cases for malformed records, case insensitivity, and expiration handling

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
src/open_mpic_core/about.py	Bumped package version to 6.3.0
pyproject.toml	Updated API spec version to 3.8.0 and removed unused pytest config options
src/open_mpic_core/common_domain/enum/dcv_validation_method.py	Added DNS_PERSISTENT and DNS_ACCOUNT_01 enum values with CABF references
src/open_mpic_core/common_domain/check_parameters.py	Added DcvDnsPersistentValidationParameters class and updated union type
src/open_mpic_core/common_domain/check_response_details.py	Extended DNS response details to support DNS_PERSISTENT and DNS_ACCOUNT_01 methods
src/open_mpic_core/mpic_dcv_checker/mpic_dcv_checker.py	Implemented ExpectedDnsRecordContent class and persistent DNS validation logic
src/open_mpic_core/init.py	Exported new DcvDnsPersistentValidationParameters class
tests/unit/test_util/valid_mpic_request_creator.py	Added test factory method for DNS_PERSISTENT validation
tests/unit/test_util/valid_check_creator.py	Added helper methods to create DNS persistent check requests
tests/unit/open_mpic_core/test_check_request_parameters.py	Added validation tests for new parameter class
tests/unit/open_mpic_core/test_mpic_dcv_request.py	Updated tests to use warnings=False in model_dump calls
tests/unit/open_mpic_core/test_mpic_caa_request.py	Updated tests to use warnings=False in model_dump calls
tests/unit/open_mpic_core/test_mpic_dcv_checker.py	Added comprehensive unit tests for persistent DNS validation logic
tests/unit/open_mpic_core/test_mpic_coordinator.py	Added integration test for DNS_PERSISTENT method and fixed typo in test name

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[birgelee]

looks good