Lada made this comment more than a year ago: It depends on how the constraint is written.
If you have e.g. must "list/non-key-leaf = 42"; then it is sufficient that at least one instance on non-key-leaf exist non-key-leaf exist with that value. In contrast, must "not(list/non-key-leaf != 42)"; requires all instances to have that value. With identityrefs, the outside "not" is possible, but how to negate the "derived-from-or-self" function? PS: in case it helps, the 'must' expression only needs to test for "self" equivalency (i.e., the "derived-from" part is unneeded). K. > On Aug 17, 2022, at 5:08 PM, Kent Watsen <kent+i...@watsen.net> wrote: > > > Given a must-expression like this: > > uses ts:local-or-truststore-public-keys-grouping { > refine "local-or-truststore/truststore/truststore-reference" { > must > 'derived-from-or-self(deref(.)/../ts:public-key/ts:public-key-format, > "ct:ssh-public-key-format")'; > } > } > > Where "ts:public-key" is a list, currently the expression evals true if there > is just one element in the list having > public-key-format="ct:ssh-public-key-format", but it is needed to eval true > only when *all* the elements have that value. > > Any pro-tips? I think I saw this posted before, but can't find it now... > > K. > > > _______________________________________________ > netmod mailing list > netmod@ietf.org > https://www.ietf.org/mailman/listinfo/netmod
_______________________________________________ netmod mailing list netmod@ietf.org https://www.ietf.org/mailman/listinfo/netmod