Compare commits
2 Commits
validate-e
...
4f911c69d4
| Author | SHA1 | Date | |
|---|---|---|---|
|
4f911c69d4
|
||
|
|
9006f166f7
|
@@ -1,32 +0,0 @@
|
||||
name: Validate Trusted Timestamps Actions Demo
|
||||
run-name: ${{ gitea.actor }} is validating the trusted timestamps of all commits 🚀
|
||||
on: [push]
|
||||
|
||||
variables:
|
||||
EXPECTED_TRUSTANCHORS_HASH: "70a1c7e2fc62a0b62e44063f0e730b20b0f209d15c84b310ad06ce616c352829"
|
||||
|
||||
jobs:
|
||||
Validate:
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 2
|
||||
steps:
|
||||
- name: Install extra software
|
||||
run: |
|
||||
apt-get update
|
||||
apt-get install -y xxd
|
||||
- name: Check out repository code
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
- name: Setup timestamping authorities
|
||||
run: |
|
||||
git config --local timestamping.tsa0.url https://freetsa.org/tsr
|
||||
bash -c 'yes | ./hooks/trust.sh https://freetsa.org/tsr'
|
||||
git config --local timestamping.tsa1.url https://tsa.cesnet.cz:3162/tsa
|
||||
bash -c 'yes | ./hooks/trust.sh https://tsa.cesnet.cz:3162/tsa'
|
||||
- name: Check hashes of all trustanchors
|
||||
run: |
|
||||
./hooks/validate_trustanchors_hash.sh .git/hoqoks/trustanchors ${{ EXPECTED_TRUSTANCHORS_HASH }}
|
||||
- name: Validate timestamps of all commits
|
||||
run: |
|
||||
./hooks/validate.sh --minversion 0
|
||||
File diff suppressed because it is too large
Load Diff
@@ -2,17 +2,17 @@
|
||||
MIIC5jCCAc4CAQEwDQYJKoZIhvcNAQELBQAwcjELMAkGA1UEBhMCVVMxFTATBgNV
|
||||
BAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTExMC8G
|
||||
A1UEAxMoRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIFRpbWVzdGFtcGluZyBDQRcN
|
||||
MjUwMjEyMDUyMjQ1WhcNMjUwMjE5MDUyMjQ1WjCB9TAhAhAL2v0LKRQzmpYSZqw1
|
||||
MjUwMTIyMDUxMzE2WhcNMjUwMTI5MDUxMzE2WjCB9TAhAhAL2v0LKRQzmpYSZqw1
|
||||
OkdEFw0xNjEwMjQxNzQyNDlaMCECEAH40oMtKRkZcbNQw9u8pQAXDTE2MTExMTE1
|
||||
MjEzNFowIQIQClKwbEb16yWgi9U/3Ht4hhcNMTgwOTAzMTIxMTQyWjAhAhAFlx7K
|
||||
SlmJinvPTLfjd5doFw0xOTA5MzAwODE2MjRaMCECEAxFkEkmQLBOlEh/jEwCeJAX
|
||||
DTIxMDIwOTIyMzk0MlowIQIQBMvnUVSd49EL7YN0yV7iRBcNMjEwMjA5MjMyMzM3
|
||||
WjAhAhALmUrhw5aLANVesgZ0jpseFw0yMTAyMDkyMzI0MjNaoDAwLjAfBgNVHSME
|
||||
GDAWgBT0tuEgHf4prtLkYaWyoiWyyBc1bjALBgNVHRQEBAICDO8wDQYJKoZIhvcN
|
||||
AQELBQADggEBALr4VopJYkMfQ97HiyqytcWRY/vgyU/LxOwlH0/1DBSeeObQB0Nj
|
||||
uF7vcF2bhbpnxba7gvzOPryudwtbqquf2cl3CJG6MC2D8Nk1XzntDnpxCjVSfsAr
|
||||
158zAWPevyiuj3yzFz04mYALt/ZmOJMTF0vyKN8cg5bwfLu3itV6b6vhpuloIhRc
|
||||
Hmsbgr3BtCVHkf4vJWq/qKDEMcOhSrJ6wxGCzVyphenewSIbVcogj19cRZDFPWOC
|
||||
3sAy/GY3Rz0qK30tDvNbE1uum8gy5ijXFmepJ/lEetRCvrIsxTsXJOj0tqVZfIIQ
|
||||
E1YWUZ57TiBBrdS+dTgmRxkN/zaAfYVAIck=
|
||||
GDAWgBT0tuEgHf4prtLkYaWyoiWyyBc1bjALBgNVHRQEBAICDNowDQYJKoZIhvcN
|
||||
AQELBQADggEBAFxgvuHLyxJ88doIv2nQk02kaURi2IaTraKX+pknGhW6f2v9foSX
|
||||
Ywhx/fyfqpA0eChER6jAReMQil1t+5RLmVU8QGG77wz83TBclMpcNxQNINV7JKVh
|
||||
rqyCemrNrTW+RKgVO/EL02fqRTf9f3mSbSLEo07dI88BYTY1YXtnkrbcwxq1ARPp
|
||||
kCAAoGRHWqxQ9hIKrOhWWnGzG43Vghmo0E8l2xJut+3zyLv16/WBFBgxtTWSK3xI
|
||||
SNSsTcZaQY286Akco+sNnss6JuzG7Lm0/0Hv6zjVJys6qYDZsPP+G6hc1RTAI6w2
|
||||
MEzWgX64tLBdo3L33ZJbVoBhg6mX/euck04=
|
||||
-----END X509 CRL-----
|
||||
|
||||
0
hooks/post-commit
Executable file → Normal file
0
hooks/post-commit
Executable file → Normal file
2
hooks/timestamping
Executable file → Normal file
2
hooks/timestamping
Executable file → Normal file
@@ -553,7 +553,7 @@ download_crls_for_chain() {
|
||||
local URL=$(openssl x509 -inform PEM -in $EXTRACTED_CERT -text -noout \
|
||||
| awk '/CRL Distribution Points:/{f=1} f && /URI:/ {print; exit}' \
|
||||
| sed 's/^.*URI://1')
|
||||
if curl -L "$URL" --output "$CRL_TMP" &> "$OUT_STREAM"; then
|
||||
if curl "$URL" --output "$CRL_TMP" &> "$OUT_STREAM"; then
|
||||
if openssl crl -in "$CRL_TMP" -inform DER -noout &> "$OUT_STREAM"; then
|
||||
openssl crl -in "$CRL_TMP" -inform DER >> "$OUTPUT_FILE"
|
||||
elif openssl crl -in "$CRL_TMP" -inform PEM -noout &> "$OUT_STREAM"; then
|
||||
|
||||
0
hooks/trust.sh
Executable file → Normal file
0
hooks/trust.sh
Executable file → Normal file
19
hooks/validate.sh
Executable file → Normal file
19
hooks/validate.sh
Executable file → Normal file
@@ -42,9 +42,8 @@ if [[ ! -d "$DIR" ]]; then DIR="$PWD"; fi
|
||||
. "$DIR/timestamping"
|
||||
|
||||
declare -i MINVERSION=$TIMESTAMPING_VERSION
|
||||
declare -A PROCESSED_COMMIT
|
||||
|
||||
while [[ $# -gt 0 ]]; do
|
||||
while [[ $# -gt 1 ]]; do
|
||||
KEY="$1"
|
||||
|
||||
case $KEY in
|
||||
@@ -67,12 +66,12 @@ while [[ $# -gt 0 ]]; do
|
||||
shift # past argument
|
||||
;;
|
||||
*) # unknown option
|
||||
OBJECT=$KEY
|
||||
shift # past argument
|
||||
echo_error "Unknown argument: $KEY"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
OBJECT="$1"
|
||||
if [ -z "$OBJECT" ]; then
|
||||
OBJECT="HEAD"
|
||||
fi
|
||||
@@ -90,10 +89,6 @@ fi
|
||||
# tokens, the function will return 0 but echo a warning about the invalid token.
|
||||
validate_commit() {
|
||||
local COMMIT_HASH="$1"
|
||||
if [[ ${PROCESSED_COMMIT[$COMMIT_HASH]} ]]; then
|
||||
log "validate_commit for $COMMIT_HASH has already been validated"
|
||||
return 0
|
||||
fi
|
||||
log "validate_commit for $COMMIT_HASH"
|
||||
|
||||
local TIMESTAMP_COMMIT_VERSION
|
||||
@@ -280,8 +275,6 @@ validate_commit() {
|
||||
#assert that all extracted timestamps have been processed
|
||||
assert "[ $NUM_PROCESSED -eq $NUM_EXTRACTED ]" "All extracted token must be processed."
|
||||
|
||||
PROCESSED_COMMIT[$COMMIT_HASH]=1
|
||||
|
||||
if [ $NUM_VALID -gt 0 ]; then
|
||||
if [ $NUM_INVALID -gt 0 ]; then
|
||||
echo_warning "Warning: While commit $COMMIT_HASH contains $NUM_VALID valid timestamp tokens and thus is considered proppely timestamped, it also contains $NUM_INVALID invalid timestamp tokens."
|
||||
@@ -316,7 +309,7 @@ validate_commit_and_parents() {
|
||||
fi
|
||||
done <<< $(printf "%s" "$PARENTS")
|
||||
fi
|
||||
if [ "$ALL_PASSED" = true ]; then
|
||||
if [ "$ALL_PASSED"=true ]; then
|
||||
return 0
|
||||
fi
|
||||
return 1
|
||||
@@ -339,4 +332,4 @@ if validate_commit_and_parents "$COMMIT_HASH"; then
|
||||
else
|
||||
echo_error "Validation Failed: There are timestamped commits in the commit history of $COMMIT_HASH which do not contain any valid timestamps."
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
Reference in New Issue
Block a user