This PR addresses #3182 .

t/05_ca_hashes_up_to_date.t was relying on time stamps but those do
not work in GHA.  This PR now uses git diff which is reliable.

Also it check the wording of the generator utils/create_ca_hashes.sh
also it cleans up the generated crtl files which can cause a problem
when ones run it locally.

The test t/05_ca_hashes_up_to_date.t compared the regenerated etc/ca_hashes.txt
byte-for-byte against the committed file, but two aspects are not stable across
platforms:

- The name column comes from 'openssl x509 -subject', which formats
  differently between LibreSSL (macOS) and OpenSSL (Linux).
- The line order comes from 'sort', whose collation differs between
  BSD libc and glibc even under an identically-named locale.

Only the SPKI hash (field 1) is deterministic, and it is the sole
column testssl.sh consumes. So:

- The test now compares the set of SPKI hashes (field 1) between the
  committed and regenerated files, order-independently, using
  'LC_ALL=C sort -u' for a stable, platform-independent collation.
- create_ca_hashes.sh pins the name format ('-nameopt compat') and
  sort collation ('LC_ALL=C') so the generated file is stable.

Verified on macOS (LibreSSL) and Ubuntu 24.04 (OpenSSL).

t/05_ca_hashes_up_to_date.t

@@ -3,14 +3,36 @@
 use strict;
 use Test::More;
 
-printf "\n%s\n", "Make sure CA certificate stores are older than their SPKI hashes \"~/etc/ca_hashes.txt\" ...";
+# Verify that etc/ca_hashes.txt is in sync with the CA bundles (etc/*.pem).
+# Regenerates the hashes and compares content, rather than relying on
+# file modification times (which git does not preserve).
 
-my $newer_bundles=`find etc/*.pem -newer etc/ca_hashes.txt`;
+# Regenerate ca_hashes.txt from the .pem bundles
+my $rc = system('./utils/create_ca_hashes.sh');
+is($rc, 0, "create_ca_hashes.sh exited successfully");
 
-#1
-is($newer_bundles,"","Checking if there's an output with a *.pem file. If so: run \"~/utils/create_ca_hashes.sh\"");
+# Compare the set of SPKI hashes (field 1) between the committed file and
+# the freshly regenerated one, order-independently. We do NOT compare the
+# whole file byte-for-byte: the name column (field 2) and the line order
+# are cosmetic and are not stable across platforms. The name comes from
+# `openssl x509 -subject`, which formats differently between LibreSSL
+# (macOS) and OpenSSL (Linux); the order comes from `sort`, whose collation
+# differs between BSD libc and glibc even under an identically-named locale.
+# Only the SPKI hash is deterministic, and it is the sole column testssl.sh
+# consumes (grep -h "$hpkp_spki"), so that is what "up to date" means here.
+# LC_ALL=C pins the collation so the set comparison is byte-order and
+# platform-independent.
+my $committed   = `git show HEAD:etc/ca_hashes.txt 2>/dev/null | cut -d' ' -f1 | LC_ALL=C sort -u`;
+my $regenerated = `cut -d' ' -f1 etc/ca_hashes.txt 2>/dev/null | LC_ALL=C sort -u`;
+my $has_diff = ($committed eq $regenerated) ? "0" : "1";
+
+# Restore the original file and remove the .bak the script creates
+system('git checkout -- etc/ca_hashes.txt 2>/dev/null');
+unlink 'etc/ca_hashes.txt.bak';
+
+is($has_diff, "0",
+   "ca_hashes.txt is up to date with the .pem bundles (run ./utils/create_ca_hashes.sh if not)");
 
-printf "\n";
 done_testing;
 
 

utils/create_ca_hashes.sh

@@ -6,7 +6,8 @@
 # This file generates the file etc/ca_hashes.txt from the (root)certificate
 # Bundles in etc (etc/*.pem)
 
-TEMPDIR="/tmp"
+TEMPDIR=$(mktemp -d)
+trap 'rm -rf "$TEMPDIR"' EXIT
 
 # Check if we are in the right directory
 if [[ ! -e etc ]]; then
@@ -14,7 +15,7 @@ if [[ ! -e etc ]]; then
 	exit 99
 fi
 
-echo "Extracting private key hashes from CA bundles"
+echo "Extracting SPKI (public key) hashes from CA bundles"
 echo -n > "$TEMPDIR/cahashes"
 for bundle_fname in etc/*.pem; do
 	if [[ ! -r $bundle_fname ]]; then
@@ -32,7 +33,7 @@ for bundle_fname in etc/*.pem; do
    		echo -n "."
         hpkp_key_ca="$( ( openssl x509 -in "$cert_fname" -pubkey -noout | grep -v PUBLIC | openssl base64 -d |
             openssl dgst -sha256 -binary | openssl enc -base64 ) 2>/dev/null )"
-		hpkp_name=$( openssl x509 -in "$cert_fname" -subject -noout 2>/dev/null | sed "s/^subject= //")
+		hpkp_name=$( openssl x509 -in "$cert_fname" -subject -noout -nameopt compat 2>/dev/null | sed "s/^subject= //")
 		if [[ $(echo $hpkp_name|grep 'CN='|wc -l) -eq 1 ]]; then
 			hpkp_name=$(echo -n $hpkp_name|sed 's/^.*CN=//'|sed 's/\/.*$//')
 		fi
@@ -44,4 +45,4 @@ done
 # Make a backup first
 cp etc/ca_hashes.txt etc/ca_hashes.txt.bak
 
-sort -u "$TEMPDIR/cahashes" > etc/ca_hashes.txt
+LC_ALL=C sort -u "$TEMPDIR/cahashes" > etc/ca_hashes.txt