Compare commits
2 Commits
limit-num-
...
8b507a7dbd
| Author | SHA1 | Date | |
|---|---|---|---|
|
8b507a7dbd
|
||
|
|
cb082d29fb
|
@@ -1,3 +1,14 @@
|
|||||||
|
location / {
|
||||||
|
proxy_pass http://localhost:5232/;
|
||||||
|
proxy_set_header X-Script-Name /radicale;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Host $host;
|
||||||
|
proxy_set_header X-Forwarded-Port $server_port;
|
||||||
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
proxy_set_header Host $http_host;
|
||||||
|
proxy_pass_header Authorization;
|
||||||
|
}
|
||||||
|
|
||||||
name: Validate Trusted Timestamps Actions Demo
|
name: Validate Trusted Timestamps Actions Demo
|
||||||
run-name: ${{ gitea.actor }} is validating the trusted timestamps of all commits 🚀
|
run-name: ${{ gitea.actor }} is validating the trusted timestamps of all commits 🚀
|
||||||
on: [push]
|
on: [push]
|
||||||
|
|||||||
File diff suppressed because it is too large
Load Diff
@@ -2,17 +2,17 @@
|
|||||||
MIIC5jCCAc4CAQEwDQYJKoZIhvcNAQELBQAwcjELMAkGA1UEBhMCVVMxFTATBgNV
|
MIIC5jCCAc4CAQEwDQYJKoZIhvcNAQELBQAwcjELMAkGA1UEBhMCVVMxFTATBgNV
|
||||||
BAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTExMC8G
|
BAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTExMC8G
|
||||||
A1UEAxMoRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIFRpbWVzdGFtcGluZyBDQRcN
|
A1UEAxMoRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIFRpbWVzdGFtcGluZyBDQRcN
|
||||||
MjUwMjEyMDUyMjQ1WhcNMjUwMjE5MDUyMjQ1WjCB9TAhAhAL2v0LKRQzmpYSZqw1
|
MjUwMTI0MDUxNDI4WhcNMjUwMTMxMDUxNDI4WjCB9TAhAhAL2v0LKRQzmpYSZqw1
|
||||||
OkdEFw0xNjEwMjQxNzQyNDlaMCECEAH40oMtKRkZcbNQw9u8pQAXDTE2MTExMTE1
|
OkdEFw0xNjEwMjQxNzQyNDlaMCECEAH40oMtKRkZcbNQw9u8pQAXDTE2MTExMTE1
|
||||||
MjEzNFowIQIQClKwbEb16yWgi9U/3Ht4hhcNMTgwOTAzMTIxMTQyWjAhAhAFlx7K
|
MjEzNFowIQIQClKwbEb16yWgi9U/3Ht4hhcNMTgwOTAzMTIxMTQyWjAhAhAFlx7K
|
||||||
SlmJinvPTLfjd5doFw0xOTA5MzAwODE2MjRaMCECEAxFkEkmQLBOlEh/jEwCeJAX
|
SlmJinvPTLfjd5doFw0xOTA5MzAwODE2MjRaMCECEAxFkEkmQLBOlEh/jEwCeJAX
|
||||||
DTIxMDIwOTIyMzk0MlowIQIQBMvnUVSd49EL7YN0yV7iRBcNMjEwMjA5MjMyMzM3
|
DTIxMDIwOTIyMzk0MlowIQIQBMvnUVSd49EL7YN0yV7iRBcNMjEwMjA5MjMyMzM3
|
||||||
WjAhAhALmUrhw5aLANVesgZ0jpseFw0yMTAyMDkyMzI0MjNaoDAwLjAfBgNVHSME
|
WjAhAhALmUrhw5aLANVesgZ0jpseFw0yMTAyMDkyMzI0MjNaoDAwLjAfBgNVHSME
|
||||||
GDAWgBT0tuEgHf4prtLkYaWyoiWyyBc1bjALBgNVHRQEBAICDO8wDQYJKoZIhvcN
|
GDAWgBT0tuEgHf4prtLkYaWyoiWyyBc1bjALBgNVHRQEBAICDNwwDQYJKoZIhvcN
|
||||||
AQELBQADggEBALr4VopJYkMfQ97HiyqytcWRY/vgyU/LxOwlH0/1DBSeeObQB0Nj
|
AQELBQADggEBAGuGW4lrI1pz4IwilL1u3rFRWD43/2Cu0+Pc1+tRx+QqB42aB0Jl
|
||||||
uF7vcF2bhbpnxba7gvzOPryudwtbqquf2cl3CJG6MC2D8Nk1XzntDnpxCjVSfsAr
|
esdIRc7t7bZ+5wmJyl5DTToQ3Vm7v34dXlblmmlJ2IM+1BKNEO4jMg82i4CFHtaE
|
||||||
158zAWPevyiuj3yzFz04mYALt/ZmOJMTF0vyKN8cg5bwfLu3itV6b6vhpuloIhRc
|
1e2lTfCOKR7YiTmUv/E44jAeQNJbt3k/6gnpDTGafJTIybYNh3uVDtC8Iiun4DKH
|
||||||
Hmsbgr3BtCVHkf4vJWq/qKDEMcOhSrJ6wxGCzVyphenewSIbVcogj19cRZDFPWOC
|
x1qe0qzuixF2TDdTRgPP293nShxNJP5G9G5JaOGSreVOItwEhI+GP6rrPffcanfJ
|
||||||
3sAy/GY3Rz0qK30tDvNbE1uum8gy5ijXFmepJ/lEetRCvrIsxTsXJOj0tqVZfIIQ
|
v7ghEutuJCE2BGZkqL5iEGgAbMYhFitCu58rfwCHF78uz8T/kxbe5Ax2Zu1IV3is
|
||||||
E1YWUZ57TiBBrdS+dTgmRxkN/zaAfYVAIck=
|
kuc5vOHsT/GFYnMC4PZn9J9eYKLE6mzr0SY=
|
||||||
-----END X509 CRL-----
|
-----END X509 CRL-----
|
||||||
|
|||||||
@@ -553,7 +553,7 @@ download_crls_for_chain() {
|
|||||||
local URL=$(openssl x509 -inform PEM -in $EXTRACTED_CERT -text -noout \
|
local URL=$(openssl x509 -inform PEM -in $EXTRACTED_CERT -text -noout \
|
||||||
| awk '/CRL Distribution Points:/{f=1} f && /URI:/ {print; exit}' \
|
| awk '/CRL Distribution Points:/{f=1} f && /URI:/ {print; exit}' \
|
||||||
| sed 's/^.*URI://1')
|
| sed 's/^.*URI://1')
|
||||||
if curl -L "$URL" --output "$CRL_TMP" &> "$OUT_STREAM"; then
|
if curl "$URL" --output "$CRL_TMP" &> "$OUT_STREAM"; then
|
||||||
if openssl crl -in "$CRL_TMP" -inform DER -noout &> "$OUT_STREAM"; then
|
if openssl crl -in "$CRL_TMP" -inform DER -noout &> "$OUT_STREAM"; then
|
||||||
openssl crl -in "$CRL_TMP" -inform DER >> "$OUTPUT_FILE"
|
openssl crl -in "$CRL_TMP" -inform DER >> "$OUTPUT_FILE"
|
||||||
elif openssl crl -in "$CRL_TMP" -inform PEM -noout &> "$OUT_STREAM"; then
|
elif openssl crl -in "$CRL_TMP" -inform PEM -noout &> "$OUT_STREAM"; then
|
||||||
|
|||||||
@@ -42,8 +42,6 @@ if [[ ! -d "$DIR" ]]; then DIR="$PWD"; fi
|
|||||||
. "$DIR/timestamping"
|
. "$DIR/timestamping"
|
||||||
|
|
||||||
declare -i MINVERSION=$TIMESTAMPING_VERSION
|
declare -i MINVERSION=$TIMESTAMPING_VERSION
|
||||||
declare -i MAX_COMMITS_TO_CHECK=0
|
|
||||||
declare -A PROCESSED_COMMIT
|
|
||||||
|
|
||||||
while [[ $# -gt 0 ]]; do
|
while [[ $# -gt 0 ]]; do
|
||||||
KEY="$1"
|
KEY="$1"
|
||||||
@@ -63,16 +61,6 @@ while [[ $# -gt 0 ]]; do
|
|||||||
shift # past argument
|
shift # past argument
|
||||||
shift # past value
|
shift # past value
|
||||||
;;
|
;;
|
||||||
-max|--maxcommits)
|
|
||||||
INTEGER_REGEX='^[0-9]+$'
|
|
||||||
if ! [[ "$2" =~ $INTEGER_REGEX ]]; then
|
|
||||||
echo_error "$KEY: expected positive integer"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
MAX_COMMITS_TO_CHECK="$2"
|
|
||||||
shift # past argument
|
|
||||||
shift # past value
|
|
||||||
;;
|
|
||||||
-v|--verbose)
|
-v|--verbose)
|
||||||
OUT_STREAM=/dev/stdout
|
OUT_STREAM=/dev/stdout
|
||||||
shift # past argument
|
shift # past argument
|
||||||
@@ -101,10 +89,6 @@ fi
|
|||||||
# tokens, the function will return 0 but echo a warning about the invalid token.
|
# tokens, the function will return 0 but echo a warning about the invalid token.
|
||||||
validate_commit() {
|
validate_commit() {
|
||||||
local COMMIT_HASH="$1"
|
local COMMIT_HASH="$1"
|
||||||
if [[ ${PROCESSED_COMMIT[$COMMIT_HASH]} ]]; then
|
|
||||||
log "validate_commit for $COMMIT_HASH has already been validated"
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
log "validate_commit for $COMMIT_HASH"
|
log "validate_commit for $COMMIT_HASH"
|
||||||
|
|
||||||
local TIMESTAMP_COMMIT_VERSION
|
local TIMESTAMP_COMMIT_VERSION
|
||||||
@@ -291,8 +275,6 @@ validate_commit() {
|
|||||||
#assert that all extracted timestamps have been processed
|
#assert that all extracted timestamps have been processed
|
||||||
assert "[ $NUM_PROCESSED -eq $NUM_EXTRACTED ]" "All extracted token must be processed."
|
assert "[ $NUM_PROCESSED -eq $NUM_EXTRACTED ]" "All extracted token must be processed."
|
||||||
|
|
||||||
PROCESSED_COMMIT[$COMMIT_HASH]=1
|
|
||||||
|
|
||||||
if [ $NUM_VALID -gt 0 ]; then
|
if [ $NUM_VALID -gt 0 ]; then
|
||||||
if [ $NUM_INVALID -gt 0 ]; then
|
if [ $NUM_INVALID -gt 0 ]; then
|
||||||
echo_warning "Warning: While commit $COMMIT_HASH contains $NUM_VALID valid timestamp tokens and thus is considered proppely timestamped, it also contains $NUM_INVALID invalid timestamp tokens."
|
echo_warning "Warning: While commit $COMMIT_HASH contains $NUM_VALID valid timestamp tokens and thus is considered proppely timestamped, it also contains $NUM_INVALID invalid timestamp tokens."
|
||||||
@@ -318,19 +300,14 @@ validate_commit_and_parents() {
|
|||||||
if ! validate_commit "$COMMIT_HASH"; then
|
if ! validate_commit "$COMMIT_HASH"; then
|
||||||
ALL_PASSED=false
|
ALL_PASSED=false
|
||||||
fi
|
fi
|
||||||
# If MAX_COMMITS_TO_CHECK is zero (or a negative number) then that is understood as "infinity".
|
local PARENTS=$(git cat-file -p "$COMMIT_HASH" | awk '/^$/{exit} /parent/ {print}' | sed 's/parent //')
|
||||||
# So perform the next commit check if we have not reached the limit, or if the limit is "infinity".
|
#iterate over all parents of commit
|
||||||
NUM_COMMITS_CHECKED=${#PROCESSED_COMMIT[@]}
|
if [ ! -z "$PARENTS" ]; then
|
||||||
if [[ ${NUM_COMMITS_CHECKED} -lt ${MAX_COMMITS_TO_CHECK} ]] || [[ ${MAX_COMMITS_TO_CHECK} -lt 1 ]]; then
|
while read PARENT_HASH; do
|
||||||
local PARENTS=$(git cat-file -p "$COMMIT_HASH" | awk '/^$/{exit} /parent/ {print}' | sed 's/parent //')
|
if ! validate_commit_and_parents "$PARENT_HASH"; then
|
||||||
#iterate over all parents of commit
|
ALL_PASSED=false
|
||||||
if [ ! -z "$PARENTS" ]; then
|
fi
|
||||||
while read PARENT_HASH; do
|
done <<< $(printf "%s" "$PARENTS")
|
||||||
if ! validate_commit_and_parents "$PARENT_HASH"; then
|
|
||||||
ALL_PASSED=false
|
|
||||||
fi
|
|
||||||
done <<< $(printf "%s" "$PARENTS")
|
|
||||||
fi
|
|
||||||
fi
|
fi
|
||||||
if [ "$ALL_PASSED" = true ]; then
|
if [ "$ALL_PASSED" = true ]; then
|
||||||
return 0
|
return 0
|
||||||
|
|||||||
Reference in New Issue
Block a user