Roland Shoemaker
376eb14006
Adds support for roots with the distrust-after bit set. The constraint function construction is a little funky, but I couldn't think of an obvious better way to do it. Fixes golang/go#70777 Fixes golang/go#70623 Change-Id: I780f866416b626360eaee9368185768da7bc75ef Reviewed-on: https://go-review.googlesource.com/c/crypto/+/652996 Reviewed-by: David Chase <drchase@google.com> Reviewed-by: Daniel McCarney <daniel@binaryparadox.net> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
41 lines
1.2 KiB
Go
41 lines
1.2 KiB
Go
// Copyright 2023 The Go Authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style
|
|
// license that can be found in the LICENSE file.
|
|
|
|
// Package fallback embeds a set of fallback X.509 trusted roots in the
|
|
// application by automatically invoking [x509.SetFallbackRoots]. This allows
|
|
// the application to work correctly even if the operating system does not
|
|
// provide a verifier or system roots pool.
|
|
//
|
|
// To use it, import the package like
|
|
//
|
|
// import _ "golang.org/x/crypto/x509roots/fallback"
|
|
//
|
|
// It's recommended that only binaries, and not libraries, import this package.
|
|
//
|
|
// This package must be kept up to date for security and compatibility reasons.
|
|
// Use govulncheck to be notified of when new versions of the package are
|
|
// available.
|
|
package fallback
|
|
|
|
import "crypto/x509"
|
|
|
|
func init() {
|
|
p := x509.NewCertPool()
|
|
for _, c := range parsedCertificates {
|
|
if len(c.constraints) == 0 {
|
|
p.AddCert(c.cert)
|
|
} else {
|
|
p.AddCertWithConstraint(c.cert, func(chain []*x509.Certificate) error {
|
|
for _, constraint := range c.constraints {
|
|
if err := constraint(chain); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
return nil
|
|
})
|
|
}
|
|
}
|
|
x509.SetFallbackRoots(p)
|
|
}
|