# Description
TrustList validates an uploaded TrustList before CloseAndUpdate commits
it:
every certificate is validated against the new TrustList (the uploaded
certificates and CRLs, or the current stores for lists that were not
specified), CRLs must belong to a CA of the result, and
IssuerCertificates
must be CA certificates. The check was private, so an application that
applies a TrustList by other means, for example a GDS push it receives
through its own channel, could not apply the same check first and had to
duplicate it.
The method is now public and documented; its behaviour is unchanged. A
test calls it for an accepted TrustList, for one whose issuer is missing
and for one that lists a leaf certificate as an issuer.
## Related Issues
None.
## Checklist
- [x] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [x] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed.
- [x] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [ ] I have addressed **all** PR feedback received.
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Marc Schier <marcschier@users.noreply.github.com>
Wolfgang Colsman
9746c62b49