mirror of
https://github.com/drwetter/testssl.sh.git
synced 2026-10-25 10:35:12 +01:00
Dirk Wetter
0779e0a423
t/05_ca_hashes_up_to_date.t was relying on time stamps but those do
not work in GHA. This PR now uses git diff which is reliable.
Also it check the wording of the generator utils/create_ca_hashes.sh
also it cleans up the generated crtl files which can cause a problem
when ones run it locally.
The test t/05_ca_hashes_up_to_date.t compared the regenerated etc/ca_hashes.txt
byte-for-byte against the committed file, but two aspects are not stable across
platforms:
- The name column comes from 'openssl x509 -subject', which formats
differently between LibreSSL (macOS) and OpenSSL (Linux).
- The line order comes from 'sort', whose collation differs between
BSD libc and glibc even under an identically-named locale.
Only the SPKI hash (field 1) is deterministic, and it is the sole
column testssl.sh consumes. So:
- The test now compares the set of SPKI hashes (field 1) between the
committed and regenerated files, order-independently, using
'LC_ALL=C sort -u' for a stable, platform-independent collation.
- create_ca_hashes.sh pins the name format ('-nameopt compat') and
sort collation ('LC_ALL=C') so the generated file is stable.
Verified on macOS (LibreSSL) and Ubuntu 24.04 (OpenSSL).
49 lines
1.8 KiB
Bash
Executable File
49 lines
1.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# vim:ts=5:sw=5:expandtab
|
|
# we have a spaces softtab, that ensures readability with other editors too
|
|
|
|
# This file generates the file etc/ca_hashes.txt from the (root)certificate
|
|
# Bundles in etc (etc/*.pem)
|
|
|
|
TEMPDIR=$(mktemp -d)
|
|
trap 'rm -rf "$TEMPDIR"' EXIT
|
|
|
|
# Check if we are in the right directory
|
|
if [[ ! -e etc ]]; then
|
|
echo "Please run this script from the base directory of the testssl.sh project"
|
|
exit 99
|
|
fi
|
|
|
|
echo "Extracting SPKI (public key) hashes from CA bundles"
|
|
echo -n > "$TEMPDIR/cahashes"
|
|
for bundle_fname in etc/*.pem; do
|
|
if [[ ! -r $bundle_fname ]]; then
|
|
echo "\"$bundle_fname\" cannot be found / not readable"
|
|
exit 99
|
|
fi
|
|
bundle_name=$(echo -n $bundle_fname|sed s/^etc\\///|sed 's/\.pem$//')
|
|
echo "CA Bundle: $bundle_name"
|
|
# Split up the certificate bundle
|
|
awk -v n=-1 "BEGIN {start=1}
|
|
/-----BEGIN CERTIFICATE-----/{ if (start) {inc=1; n++} }
|
|
inc { print >> (\"$TEMPDIR/$bundle_name.\" n \".$$.crt\") ; close (\"$TEMPDIR/$bundle_name.\" n \".$$.crt\") }
|
|
/---END CERTIFICATE-----/{ inc=0 }" $bundle_fname
|
|
for cert_fname in $TEMPDIR/$bundle_name.*.$$.crt; do
|
|
echo -n "."
|
|
hpkp_key_ca="$( ( openssl x509 -in "$cert_fname" -pubkey -noout | grep -v PUBLIC | openssl base64 -d |
|
|
openssl dgst -sha256 -binary | openssl enc -base64 ) 2>/dev/null )"
|
|
hpkp_name=$( openssl x509 -in "$cert_fname" -subject -noout -nameopt compat 2>/dev/null | sed "s/^subject= //")
|
|
if [[ $(echo $hpkp_name|grep 'CN='|wc -l) -eq 1 ]]; then
|
|
hpkp_name=$(echo -n $hpkp_name|sed 's/^.*CN=//'|sed 's/\/.*$//')
|
|
fi
|
|
echo "$hpkp_key_ca $hpkp_name" >> "$TEMPDIR/cahashes"
|
|
done
|
|
echo
|
|
done
|
|
|
|
# Make a backup first
|
|
cp etc/ca_hashes.txt etc/ca_hashes.txt.bak
|
|
|
|
LC_ALL=C sort -u "$TEMPDIR/cahashes" > etc/ca_hashes.txt
|