only dowload CRL once

hooks/timestamping

@@ -17,22 +17,22 @@
 #
 #    You should have received a copy of the GNU Affero General Public License
 #    along with this program.  If not, see <https://www.gnu.org/licenses/>.
-#    
+#
 #    The interactive user interfaces in modified source and object code versions
 #    of this program must display Appropriate Legal Notices, as required under
 #    Section 5 of the GNU Affero General Public License version 3. In accordance
 #    with Section 7(b) of the GNU Affero General Public License, you must retain
 #    the Info line in every timestamp that is created or manipulated using a
 #    covered work.
-#    
+#
 #    You can be released from the requirements of the license by purchasing
 #    a commercial license. Buying such a license is mandatory as soon as you
 #    develop commercial activities involving this software without
 #    disclosing the source code of your own applications.
 #    These activities include: offering paid services to customers as an ASP,
-#    providing data storage and archival services, shipping this software with a 
+#    providing data storage and archival services, shipping this software with a
 #    closed source product.
-#    
+#
 #    For more information, please contact Mabulous GmbH at this
 #    address: info@mabulous.com
 #
@@ -453,7 +453,7 @@ build_certificate_chain_for_token() {
       fi
     done <<< $(ls "$TMP_DIR"/*.extracted.pem.cer)
   done
-  
+
   if [ ${#CHAIN[@]} -eq 0 ]; then
     echo "Unable to download token that contains signing cert for this token:"
     openssl ts -reply -token_in -token_out -in "$TOKEN_FILE" -text
@@ -471,8 +471,8 @@ build_certificate_chain_for_token() {
           continue 2
         fi
       done <<< $(ls "$TMP_DIR"/*.extracted.pem.cer)
-    fi 
+    fi
-    
+
     #otherwise try to find in trust store
     if ls "$CA_PATH"/*.0 &> "$OUT_STREAM"; then
       local TRUSTED_CERT
@@ -483,7 +483,7 @@ build_certificate_chain_for_token() {
         fi
       done <<< $(ls "$CA_PATH"/*.0)
     fi
-    
+
     #otherwise try to download
     local URL=$(openssl x509 -inform PEM -noout -text -in "${CHAIN[-1]}" \
                 | awk '/Authority Information Access:/{f=1} f && /CA Issuers - URI:/ {print; exit}' \
@@ -535,7 +535,7 @@ download_crls_for_chain() {
   assert "[ -f $CERT_FILE ]" "Precondition: Certificate file $CERT_FILE must exist."
 
   echo -n > "$OUTPUT_FILE"
-  local CRL_TMP="$TMP_DIR"/crl_tmp.crl
+
   #remove files from possible previous runs
   rm -f "$TMP_DIR"/*.extracted.pem.cer
   #extract all contained certificates into separate files
@@ -553,19 +553,25 @@ download_crls_for_chain() {
       local URL=$(openssl x509 -inform PEM -in $EXTRACTED_CERT -text -noout \
                   | awk '/CRL Distribution Points:/{f=1} f && /URI:/ {print; exit}' \
                   | sed 's/^.*URI://1')
-      if curl -L "$URL" --output "$CRL_TMP" &> "$OUT_STREAM"; then
+      local CRL_TMP="$TMP_DIR"/crl_tmp.$(echo "$URL" | sha256sum -z | awk '{printf "%s",$1}').crl
+      local CURL_EXIT_CODE=0
+      if [ ! -f $CRL_TMP ]; then
+        curl -L "$URL" --output "$CRL_TMP" &> "$OUT_STREAM"
+        CURL_EXIT_CODE=$?
+      fi
+      if [ $CURL_EXIT_CODE -eq 0 ]; then
         if openssl crl -in "$CRL_TMP" -inform DER -noout &> "$OUT_STREAM"; then
           openssl crl -in "$CRL_TMP" -inform DER >> "$OUTPUT_FILE"
         elif openssl crl -in "$CRL_TMP" -inform PEM -noout &> "$OUT_STREAM"; then
           openssl crl -in "$CRL_TMP" -inform PEM >> "$OUTPUT_FILE"
         else
           echo "Unknown CRL file format for $URL"
-          return 1    
+          return 1
         fi
       else
         echo "Failed to download CRL from $URL"
         return 1
-      fi  
+      fi
     fi
   done
 }
@@ -625,4 +631,4 @@ verify_token_and_add_ltv_data() {
     echo "Token from $TSA_URL could not be validated."
     return 1
   fi
-}
+}