Roland Shoemaker
5fe8145aca
This makes the automated update workflow simpler. Also switch the ordering from human readable subject (which is not necessarily unique), to the raw SPKI (which should always be unique). This makes it somewhat harder to read to a human (since it'll appear a little jumbled) but results in a stable sort. Note this results in adding two new roots, which were added since we last generated the bundle. Change-Id: Id4d34bf9e98164e7b2fc4f06f9b46b63c0013d23 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/504597 Run-TryBot: Roland Shoemaker <roland@golang.org> Reviewed-by: Heschi Kreinick <heschi@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
125 lines
3.0 KiB
Go
125 lines
3.0 KiB
Go
// Copyright 2023 The Go Authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style
|
|
// license that can be found in the LICENSE file.
|
|
|
|
//go:build generate
|
|
// +build generate
|
|
|
|
//go:generate go run gen_fallback_bundle.go
|
|
|
|
package main
|
|
|
|
import (
|
|
"bytes"
|
|
"crypto/sha256"
|
|
"encoding/pem"
|
|
"flag"
|
|
"fmt"
|
|
"go/format"
|
|
"io"
|
|
"log"
|
|
"net/http"
|
|
"os"
|
|
"sort"
|
|
|
|
"golang.org/x/crypto/x509roots/nss"
|
|
)
|
|
|
|
const tmpl = `// Code generated by gen_fallback_bundle.go; DO NOT EDIT.
|
|
|
|
package fallback
|
|
|
|
import "crypto/x509"
|
|
import "encoding/pem"
|
|
|
|
func mustParse(b []byte) []*x509.Certificate {
|
|
var roots []*x509.Certificate
|
|
for len(b) > 0 {
|
|
var block *pem.Block
|
|
block, b = pem.Decode(b)
|
|
if block == nil {
|
|
break
|
|
}
|
|
if block.Type != "CERTIFICATE" {
|
|
panic("unexpected PEM block type: "+block.Type)
|
|
}
|
|
cert, err := x509.ParseCertificate(block.Bytes)
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
roots = append(roots, cert)
|
|
}
|
|
return roots
|
|
}
|
|
|
|
var bundle = mustParse([]byte(pemRoots))
|
|
|
|
// Format of the PEM list is:
|
|
// * Subject common name
|
|
// * SHA256 hash
|
|
// * PEM block
|
|
|
|
`
|
|
|
|
var (
|
|
certDataURL = flag.String("certdata-url", "https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt", "URL to the raw certdata.txt file to parse (certdata-path overrides this, if provided)")
|
|
certDataPath = flag.String("certdata-path", "", "Path to the NSS certdata.txt file to parse (this overrides certdata-url, if provided)")
|
|
output = flag.String("output", "fallback/bundle.go", "Path to file to write output to")
|
|
)
|
|
|
|
func main() {
|
|
flag.Parse()
|
|
|
|
var certdata io.Reader
|
|
|
|
if *certDataPath != "" {
|
|
f, err := os.Open(*certDataPath)
|
|
if err != nil {
|
|
log.Fatalf("unable to open %q: %s", *certDataPath, err)
|
|
}
|
|
defer f.Close()
|
|
certdata = f
|
|
} else {
|
|
resp, err := http.Get(*certDataURL)
|
|
if err != nil {
|
|
log.Fatalf("failed to request %q: %s", *certDataURL, err)
|
|
}
|
|
defer resp.Body.Close()
|
|
certdata = resp.Body
|
|
}
|
|
|
|
certs, err := nss.Parse(certdata)
|
|
if err != nil {
|
|
log.Fatalf("failed to parse %q: %s", *certDataPath, err)
|
|
}
|
|
|
|
sort.Slice(certs, func(i, j int) bool {
|
|
return string(certs[i].X509.RawSubjectPublicKeyInfo) < string(certs[j].X509.RawSubjectPublicKeyInfo)
|
|
})
|
|
|
|
b := bytes.NewBuffer(nil)
|
|
b.Write([]byte(tmpl))
|
|
b.Write([]byte("const pemRoots = `\n"))
|
|
for _, c := range certs {
|
|
if len(c.Constraints) > 0 {
|
|
// Until the constrained roots API lands, skip anything that has any
|
|
// additional constraints. Once that API is available, we can add
|
|
// build constraints that support both the current version and the
|
|
// new version.
|
|
continue
|
|
}
|
|
b.Write([]byte(fmt.Sprintf("# %s\n# %x\n", c.X509.Subject.String(), sha256.Sum256(c.X509.Raw))))
|
|
pem.Encode(b, &pem.Block{Type: "CERTIFICATE", Bytes: c.X509.Raw})
|
|
}
|
|
b.Write([]byte("`\n"))
|
|
|
|
formatted, err := format.Source(b.Bytes())
|
|
if err != nil {
|
|
log.Fatalf("failed to format source: %s", err)
|
|
}
|
|
|
|
if err := os.WriteFile(*output, formatted, 0644); err != nil {
|
|
log.Fatalf("failed to write to %q: %s", *output, err)
|
|
}
|
|
}
|