func ContainsSCT(cert *x509.Certificate, sct *ct.SignedCertificateTimestamp) (bool, error) {
	if cert == nil || sct == nil {
		return false, nil
	}
	sctBytes, err := tls.Marshal(*sct)
	if err != nil {
		return false, fmt.Errorf("error tls.Marshalling SCT: %s", err)
	}
	for _, s := range cert.SCTList.SCTList {
		if bytes.Equal(sctBytes, s.Val) {
			return true, nil
		}
	}
	return false, nil
}
ContainsSCT checks to see whether the given SCT is embedded within the given
certificate.
package ctutil
import (
	"bytes"
	"crypto"
	"crypto/sha256"
	"encoding/base64"
	"errors"
	"fmt"
	ct "github.com/google/certificate-transparency-go"
	"github.com/google/certificate-transparency-go/tls"
	"github.com/google/certificate-transparency-go/x509"
)
var emptyHash = [sha256.Size]byte{}
func LeafHashB64(chain []*x509.Certificate, sct *ct.SignedCertificateTimestamp, embedded bool) (string, error) {
	hash, err := LeafHash(chain, sct, embedded)
	if err != nil {
		return "", err
	}
	return base64.StdEncoding.EncodeToString(hash[:]), nil
}
func LeafHash(chain []*x509.Certificate, sct *ct.SignedCertificateTimestamp, embedded bool) ([sha256.Size]byte, error) {
	leaf, err := createLeaf(chain, sct, embedded)
	if err != nil {
		return emptyHash, err
	}
	return ct.LeafHashForLeaf(leaf)
}
func VerifySCT(pubKey crypto.PublicKey, chain []*x509.Certificate, sct *ct.SignedCertificateTimestamp, embedded bool) error {
	s, err := ct.NewSignatureVerifier(pubKey)
	if err != nil {
		return fmt.Errorf("error creating signature verifier: %s", err)
	}
	return VerifySCTWithVerifier(s, chain, sct, embedded)
}
func VerifySCTWithVerifier(sv *ct.SignatureVerifier, chain []*x509.Certificate, sct *ct.SignedCertificateTimestamp, embedded bool) error {
	if sv == nil {
		return errors.New("ct.SignatureVerifier is nil")
	}
	leaf, err := createLeaf(chain, sct, embedded)
	if err != nil {
		return err
	}
	return sv.VerifySCTSignature(*sct, ct.LogEntry{Leaf: *leaf})
}
func createLeaf(chain []*x509.Certificate, sct *ct.SignedCertificateTimestamp, embedded bool) (*ct.MerkleTreeLeaf, error) {
	if len(chain) == 0 {
		return nil, errors.New("chain is empty")
	}
	if sct == nil {
		return nil, errors.New("sct is nil")
	}
	if embedded {
		sctPresent, err := ContainsSCT(chain[0], sct)
		if err != nil {
			return nil, fmt.Errorf("error checking for SCT in leaf certificate: %s", err)
		}
		if !sctPresent {
			return nil, errors.New("SCT provided is not embedded within leaf certificate")
		}
	}
	certType := ct.X509LogEntryType
	if chain[0].IsPrecertificate() || embedded {
		certType = ct.PrecertLogEntryType
	}
	var leaf *ct.MerkleTreeLeaf
	var err error
	if embedded {
		leaf, err = ct.MerkleTreeLeafForEmbeddedSCT(chain, sct.Timestamp)
	} else {
		leaf, err = ct.MerkleTreeLeafFromChain(chain, certType, sct.Timestamp)
	}
	if err != nil {
		return nil, fmt.Errorf("error creating MerkleTreeLeaf: %s", err)
	}
	return leaf, nil
}