mirror of
https://github.com/drwetter/testssl.sh.git
synced 2026-10-25 10:35:12 +01:00
Dirk Wetter
06f364f25b
The test compared the regenerated etc/ca_hashes.txt byte-for-byte
against the committed file, but two aspects are not stable across
platforms:
- The name column comes from 'openssl x509 -subject', which formats
differently between LibreSSL (macOS) and OpenSSL (Linux).
- The line order comes from 'sort', whose collation differs between
BSD libc and glibc even under an identically-named locale.
Only the SPKI hash (field 1) is deterministic, and it is the sole
column testssl.sh consumes. So:
- The test now compares the set of SPKI hashes (field 1) between the
committed and regenerated files, order-independently, using
'LC_ALL=C sort -u' for a stable, platform-independent collation.
- create_ca_hashes.sh pins the name format ('-nameopt compat') and
sort collation ('LC_ALL=C') so the generated file is stable.
Verified on macOS (LibreSSL) and Ubuntu 24.04 (OpenSSL).
42 lines
1.7 KiB
Perl
Executable File
42 lines
1.7 KiB
Perl
Executable File
#!/usr/bin/env perl
|
|
|
|
use strict;
|
|
use warnings;
|
|
use Test::More;
|
|
|
|
# Verify that etc/ca_hashes.txt is in sync with the CA bundles (etc/*.pem).
|
|
# Regenerates the hashes and compares content, rather than relying on
|
|
# file modification times (which git does not preserve).
|
|
|
|
# Regenerate ca_hashes.txt from the .pem bundles
|
|
my $rc = system('./utils/create_ca_hashes.sh');
|
|
is($rc, 0, "create_ca_hashes.sh exited successfully");
|
|
|
|
# Compare the set of SPKI hashes (field 1) between the committed file and
|
|
# the freshly regenerated one, order-independently. We do NOT compare the
|
|
# whole file byte-for-byte: the name column (field 2) and the line order
|
|
# are cosmetic and are not stable across platforms. The name comes from
|
|
# `openssl x509 -subject`, which formats differently between LibreSSL
|
|
# (macOS) and OpenSSL (Linux); the order comes from `sort`, whose collation
|
|
# differs between BSD libc and glibc even under an identically-named locale.
|
|
# Only the SPKI hash is deterministic, and it is the sole column testssl.sh
|
|
# consumes (grep -h "$hpkp_spki"), so that is what "up to date" means here.
|
|
# LC_ALL=C pins the collation so the set comparison is byte-order and
|
|
# platform-independent.
|
|
my $committed = `git show HEAD:etc/ca_hashes.txt 2>/dev/null | cut -d' ' -f1 | LC_ALL=C sort -u`;
|
|
my $regenerated = `cut -d' ' -f1 etc/ca_hashes.txt 2>/dev/null | LC_ALL=C sort -u`;
|
|
my $has_diff = ($committed eq $regenerated) ? "0" : "1";
|
|
|
|
# Restore the original file and remove the .bak the script creates
|
|
system('git checkout -- etc/ca_hashes.txt 2>/dev/null');
|
|
unlink 'etc/ca_hashes.txt.bak';
|
|
|
|
is($has_diff, "0",
|
|
"ca_hashes.txt is up to date with the .pem bundles (run ./utils/create_ca_hashes.sh if not)");
|
|
|
|
done_testing;
|
|
|
|
|
|
# vim:ts=5:sw=5:expandtab
|
|
|