From f1e8e0f46d0c8272a47ae0f30f82a3a378fdecca Mon Sep 17 00:00:00 2001
From: Carmen Hanish <cyhanish@google.com>
Date: Thu, 12 Nov 2026 05:26:32 -0800
Subject: [PATCH] Treat SUSPENDED as REVOKED.

SUSPENDED was introduced to allow temporary revocation but has not been used.
Treat it like REVOKED just in case SUSPENDED does ever get used, and if
SUSPENDED is more lenient than revoked this can be loosened at that point.

PiperOrigin-RevId: 1020035780
---
 src/main/kotlin/GoogleRevocationList.kt     |  6 +----
 src/test/kotlin/GoogleRevocationListTest.kt | 30 ++++-----------------
 2 files changed, 6 insertions(+), 30 deletions(-)

diff --git a/src/main/kotlin/GoogleRevocationList.kt b/src/main/kotlin/GoogleRevocationList.kt
index aa2b801..a09981c 100644
--- a/src/main/kotlin/GoogleRevocationList.kt
+++ b/src/main/kotlin/GoogleRevocationList.kt
@@ -80,9 +80,5 @@ internal data class StatusFile(val entries: Map<String, StatusEntry>)
  * @return A set of revoked serial numbers.
  */
 fun parseAttestationStatus(input: InputStream): Set<String> {
-  return Gson()
-    .fromJson(InputStreamReader(input), StatusFile::class.java)
-    .entries
-    .filterValues { it.status == "REVOKED" }
-    .keys
+  return Gson().fromJson(InputStreamReader(input), StatusFile::class.java).entries.keys
 }
diff --git a/src/test/kotlin/GoogleRevocationListTest.kt b/src/test/kotlin/GoogleRevocationListTest.kt
index 1b55f12..4372f49 100644
--- a/src/test/kotlin/GoogleRevocationListTest.kt
+++ b/src/test/kotlin/GoogleRevocationListTest.kt
@@ -36,7 +36,7 @@ class GoogleRevocationListTest {
       {
         "entries": {
           "abc": { "status": "REVOKED" },
-          "def": { "status": "OK" }
+          "def": { "status": "SUSPENDED" }
         }
       }
       """
@@ -47,7 +47,7 @@ class GoogleRevocationListTest {
         FakeHttpURLConnection(uri.toURL(), HttpURLConnection.HTTP_OK, json)
       }
 
-    assertThat(result).containsExactly("abc")
+    assertThat(result).containsExactly("abc", "def")
   }
 
   @Test
@@ -68,7 +68,7 @@ class GoogleRevocationListTest {
   }
 
   @Test
-  fun parseAttestationStatus_revokedAndOkEntries() {
+  fun parseAttestationStatus_revokedAndSuspendedEntries() {
     val json =
       """
       {
@@ -78,7 +78,7 @@ class GoogleRevocationListTest {
             "reason": "KEY_COMPROMISE"
           },
           "def": {
-            "status": "OK"
+            "status": "SUSPENDED"
           },
           "123": {
             "status": "REVOKED",
@@ -89,27 +89,7 @@ class GoogleRevocationListTest {
       """
         .trimIndent()
     val result = parseAttestationStatus(json.byteInputStream())
-    assertThat(result).containsExactly("abc", "123")
-  }
-
-  @Test
-  fun parseAttestationStatus_onlyOkEntries() {
-    val json =
-      """
-      {
-        "entries": {
-          "def": {
-            "status": "OK"
-          },
-          "456": {
-            "status": "OK"
-          }
-        }
-      }
-      """
-        .trimIndent()
-    val result = parseAttestationStatus(json.byteInputStream())
-    assertThat(result).isEmpty()
+    assertThat(result).containsExactly("abc", "def", "123")
   }
 
   @Test