Signed-off-by: Phillip Davis <phil@jankaritech.com>
This commit is contained in:
4 files changed
+22
-22
No files matched your search
+7
-7
@@ -271,10 +271,10 @@ get_tsa_cert_id() {
|
||||
# function to extract hashing algorithm used in the ESSCertID (always sha1) or ESSCertIDv2
|
||||
# param1: path to token in DER encoding
|
||||
# param2: OUT variable, the hashing algorithm string
|
||||
get_cert_id_hash_agorithm() {
|
||||
get_cert_id_hash_algorithm() {
|
||||
local TOKEN_FILE="$1"
|
||||
local -n ALGO_NAME_OUT="$2"
|
||||
log "get_cert_id_hash_agorithm for $TOKEN_FILE"
|
||||
log "get_cert_id_hash_algorithm for $TOKEN_FILE"
|
||||
|
||||
#perform precondition checks
|
||||
assert "[ ! -z $TOKEN_FILE ]" "Precondition: Path to token file must not be empty."
|
||||
@@ -401,7 +401,7 @@ request_token() {
|
||||
# param2: the digest the token was requested for
|
||||
# param3: the tsa url from which the token was requested
|
||||
# param4: the output file for the chain. It contains all certificates in order, with the first
|
||||
# one being the TSA cetificate and the last one the self-signed root certificate.
|
||||
# one being the TSA certificate and the last one the self-signed root certificate.
|
||||
build_certificate_chain_for_token() {
|
||||
local TOKEN_FILE="$1"
|
||||
local DIGEST="$2"
|
||||
@@ -417,18 +417,18 @@ build_certificate_chain_for_token() {
|
||||
local DUMMY_TOKEN="$TMP_DIR"/dummy_token.tst
|
||||
local ALL_EXTRACTED_CERTS="$TMP_DIR"/extracted_certs.pem
|
||||
local CHAIN=()
|
||||
#if the TSA uses multiple certificates to sign tokens it may take a few attempts to get one containint the proper signer
|
||||
#if the TSA uses multiple certificates to sign tokens it may take a few attempts to get one containing the proper signer
|
||||
#TODO: allow to set maximum retry attempts
|
||||
local SIGNING_CERT_ID=""
|
||||
get_tsa_cert_id "$TOKEN_FILE" SIGNING_CERT_ID
|
||||
local CERT_ID_HASH_ALGO=""
|
||||
get_cert_id_hash_agorithm "$TOKEN_FILE" CERT_ID_HASH_ALGO
|
||||
get_cert_id_hash_algorithm "$TOKEN_FILE" CERT_ID_HASH_ALGO
|
||||
local -i i
|
||||
for i in {1..10} ;do
|
||||
#request dummy token. Use current commit digest
|
||||
request_token "$TSA_URL" "$DIGEST" true "$DUMMY_TOKEN"
|
||||
|
||||
#extract certifcates
|
||||
#extract certificates
|
||||
openssl pkcs7 -inform DER -in "$DUMMY_TOKEN" -print_certs -outform PEM -out "$ALL_EXTRACTED_CERTS" &> "$OUT_STREAM"
|
||||
|
||||
#remove files from previous runs
|
||||
@@ -440,7 +440,7 @@ build_certificate_chain_for_token() {
|
||||
| awk '/-----BEGIN CERTIFICATE-----/ { i++; } /-----BEGIN CERTIFICATE-----/, /-----END CERTIFICATE-----/ \
|
||||
{ print > tmpdir i ".extracted.pem.cer" }' tmpdir="$TMP_DIR/"
|
||||
|
||||
#find cetificate that signed token
|
||||
#find certificate that signed token
|
||||
local EXTRACTED_CERT
|
||||
while read EXTRACTED_CERT; do
|
||||
local CERT_ID=$(openssl x509 -inform PEM -in "$EXTRACTED_CERT" -outform DER | openssl dgst -"$CERT_ID_HASH_ALGO" -binary | xxd -p -c 256)
|
||||
|
||||
Reference in new issue
Block a user