Skip to content

Commit ee9fe66

Browse files
svedisvedi
committed
Update mk-ca-bundle.pl
1 parent 80a8212 commit ee9fe66

File tree

1 file changed

+79
-19
lines changed

1 file changed

+79
-19
lines changed

‎util/mk-ca-bundle.pl

+79-19
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,16 @@
1-
#!/usr/bin/perl -w
1+
#!/usr/bin/env perl
22
# ***************************************************************************
33
# * _ _ ____ _
44
# * Project ___| | | | _ \| |
55
# * / __| | | | |_) | |
66
# * | (__| |_| | _ <| |___
77
# * \___|\___/|_| \_\_____|
88
# *
9-
# * Copyright (C) 1998 - 2016, Daniel Stenberg, <[email protected]>, et al.
9+
# * Copyright (C) 1998 - 2021, Daniel Stenberg, <[email protected]>, et al.
1010
# *
1111
# * This software is licensed as described in the file COPYING, which
1212
# * you should have received as part of this distribution. The terms
13-
# * are also available at https://curl.haxx.se/docs/copyright.html.
13+
# * are also available at https://curl.se/docs/copyright.html.
1414
# *
1515
# * You may opt to use, copy, modify, merge, publish, distribute and/or sell
1616
# * copies of the Software, and permit persons to whom the Software is
@@ -34,9 +34,11 @@
3434
use Getopt::Std;
3535
use MIME::Base64;
3636
use strict;
37+
use warnings;
3738
use vars qw($opt_b $opt_d $opt_f $opt_h $opt_i $opt_k $opt_l $opt_m $opt_n $opt_p $opt_q $opt_s $opt_t $opt_u $opt_v $opt_w);
3839
use List::Util;
3940
use Text::Wrap;
41+
use Time::Local;
4042
my $MOD_SHA = "Digest::SHA";
4143
eval "require $MOD_SHA";
4244
if ($@) {
@@ -47,11 +49,9 @@
4749

4850
my %urls = (
4951
'nss' =>
50-
'https://hg.mozilla.org/projects/nss/raw-file/tip/lib/ckfw/builtins/certdata.txt',
52+
'https://hg.mozilla.org/projects/nss/raw-file/default/lib/ckfw/builtins/certdata.txt',
5153
'central' =>
5254
'https://hg.mozilla.org/mozilla-central/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt',
53-
'aurora' =>
54-
'https://hg.mozilla.org/releases/mozilla-aurora/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt',
5555
'beta' =>
5656
'https://hg.mozilla.org/releases/mozilla-beta/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt',
5757
'release' =>
@@ -63,7 +63,7 @@
6363
# If the OpenSSL commandline is not in search path you can configure it here!
6464
my $openssl = 'openssl';
6565

66-
my $version = '1.27';
66+
my $version = '1.28';
6767

6868
$opt_w = 76; # default base64 encoded lines length
6969

@@ -137,6 +137,7 @@
137137
print "Perl Version : $]\n";
138138
print "Operating System Name : $^O\n";
139139
print "Getopt::Std.pm Version : ${Getopt::Std::VERSION}\n";
140+
print "Encode::Encoding.pm Version : ${Encode::Encoding::VERSION}\n";
140141
print "MIME::Base64.pm Version : ${MIME::Base64::VERSION}\n";
141142
print "LWP::UserAgent.pm Version : ${LWP::UserAgent::VERSION}\n" if($LWP::UserAgent::VERSION);
142143
print "LWP.pm Version : ${LWP::VERSION}\n" if($LWP::VERSION);
@@ -377,6 +378,9 @@ (%)
377378

378379
if(!$opt_f && $oldhash eq $newhash) {
379380
report "Downloaded file identical to previous run\'s source file. Exiting";
381+
if($opt_u && -e $txt && !unlink($txt)) {
382+
report "Failed to remove $txt: $!\n";
383+
}
380384
exit;
381385
}
382386

@@ -407,11 +411,16 @@ (%)
407411
* This file is (mostly) automatically generated.
408412
*
409413
* Conversion done with mk-ca-bundle.pl version $version as available in at
410-
* github.com/SerialKeyManager/SKM-Client-API-CPP
411-
* SHA256: $newhash
414+
* https://github.com/cryptolens/cryptolens-cpp
415+
*
416+
* SHA256 of downloaded file: $newhash
412417
*/
413418
414-
namespace serialkeymanager_com {
419+
namespace cryptolens_io {
420+
421+
namespace v20190401 {
422+
423+
namespace cacerts {
415424
416425
std::vector<std::string> pems {
417426
EOT
@@ -422,6 +431,8 @@ (%)
422431
my $skipnum = 0;
423432
my $start_of_cert = 0;
424433
my @precert;
434+
my $cka_value;
435+
my $valid = 1;
425436

426437
open(TXT,"$txt") or die "Couldn't open $txt: $!\n";
427438
while (<TXT>) {
@@ -436,6 +447,7 @@ (%)
436447
}
437448
elsif(/^# (Issuer|Serial Number|Subject|Not Valid Before|Not Valid After |Fingerprint \(MD5\)|Fingerprint \(SHA1\)):/) {
438449
push @precert, $_;
450+
$valid = 1;
439451
next;
440452
}
441453
elsif(/^#|^\s*$/) {
@@ -444,6 +456,49 @@ (%)
444456
}
445457
chomp;
446458

459+
# Example:
460+
# CKA_NSS_SERVER_DISTRUST_AFTER MULTILINE_OCTAL
461+
# \062\060\060\066\061\067\060\060\060\060\060\060\132
462+
# END
463+
464+
if (/^CKA_NSS_SERVER_DISTRUST_AFTER (CK_BBOOL CK_FALSE|MULTILINE_OCTAL)/) {
465+
if($1 eq "MULTILINE_OCTAL") {
466+
my @timestamp;
467+
while (<TXT>) {
468+
last if (/^END/);
469+
chomp;
470+
my @octets = split(/\\/);
471+
shift @octets;
472+
for (@octets) {
473+
push @timestamp, chr(oct);
474+
}
475+
}
476+
# A trailing Z in the timestamp signifies UTC
477+
if($timestamp[12] ne "Z") {
478+
report "distrust date stamp is not using UTC";
479+
}
480+
# Example date: 200617000000Z
481+
# Means 2020-06-17 00:00:00 UTC
482+
my $distrustat =
483+
timegm($timestamp[10] . $timestamp[11], # second
484+
$timestamp[8] . $timestamp[9], # minute
485+
$timestamp[6] . $timestamp[7], # hour
486+
$timestamp[4] . $timestamp[5], # day
487+
($timestamp[2] . $timestamp[3]) - 1, # month
488+
"20" . $timestamp[0] . $timestamp[1]); # year
489+
if(time >= $distrustat) {
490+
# not trusted anymore
491+
$skipnum++;
492+
report "Skipping: $caname is not trusted anymore" if ($opt_v);
493+
$valid = 0;
494+
}
495+
else {
496+
# still trusted
497+
}
498+
}
499+
next;
500+
}
501+
447502
# this is a match for the start of a certificate
448503
if (/^CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE/) {
449504
$start_of_cert = 1
@@ -453,21 +508,18 @@ (%)
453508
}
454509
my %trust_purposes_by_level;
455510
if ($start_of_cert && /^CKA_VALUE MULTILINE_OCTAL/) {
456-
my $data;
511+
$cka_value="";
457512
while (<TXT>) {
458513
last if (/^END/);
459514
chomp;
460515
my @octets = split(/\\/);
461516
shift @octets;
462517
for (@octets) {
463-
$data .= chr(oct);
518+
$cka_value .= chr(oct);
464519
}
465520
}
466-
# scan forwards until the trust part
467-
while (<TXT>) {
468-
last if (/^CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST/);
469-
chomp;
470-
}
521+
}
522+
if(/^CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST/ && $valid) {
471523
# now scan the trust part to determine how we should trust this cert
472524
while (<TXT>) {
473525
last if (/^#/);
@@ -484,7 +536,15 @@ (%)
484536

485537
if ( !should_output_cert(%trust_purposes_by_level) ) {
486538
$skipnum ++;
539+
report "Skipping: $caname" if ($opt_v);
487540
} else {
541+
my $data = $cka_value;
542+
$cka_value = "";
543+
544+
if(!length($data)) {
545+
# if empty, skip
546+
next;
547+
}
488548
my $encoded = MIME::Base64::encode_base64($data, '');
489549
$encoded =~ s/(.{1,${opt_w}})/$1\n/g;
490550
my $skm_encoded = $encoded;
@@ -496,9 +556,9 @@ (%)
496556
print CRT "\n , std::string {";
497557
print CRT "\n \"$caname\\n\"\n";
498558
print CRT @precert if($opt_m);
499-
my $maxStringLength = length(decode('UTF-8', $caname, Encode::FB_CROAK));
559+
my $maxStringLength = length(decode('UTF-8', $caname, Encode::FB_CROAK | Encode::LEAVE_SRC));
500560
if ($opt_t) {
501-
foreach my $key (keys %trust_purposes_by_level) {
561+
foreach my $key (sort keys %trust_purposes_by_level) {
502562
my $string = $key . ": " . join(", ", @{$trust_purposes_by_level{$key}});
503563
$maxStringLength = List::Util::max( length($string), $maxStringLength );
504564
print CRT $string . "\n";

0 commit comments

Comments
 (0)