lukechilds
/
node
mirror of https://github.com/lukechilds/node.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
Browse Source

tools: customize mk-ca-bundle.pl 

Remove unneeded functionality and tweak the generated output so we
can #include it in C++ source code.
v0.11.9-release
Ben Noordhuis 11 years ago
parent
5ab863de22
commit
e159073da5
1 changed files with 30 additions and 70 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Unified View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 100
      tools/mk-ca-bundle.pl

100
tools/mk-ca-bundle.pl
View File

@ -30,11 +30,11 @@
# dependency is the OpenSSL commandline tool for optional text listing. # dependency is the OpenSSL commandline tool for optional text listing.
# Hacked by Guenter Knauf. # Hacked by Guenter Knauf.
# #
use File::Basename 'dirname';
use Getopt::Std; use Getopt::Std;
use MIME::Base64; use MIME::Base64;
use LWP::UserAgent;
use strict; use strict;
use vars qw($opt_b $opt_f $opt_h $opt_i $opt_l $opt_n $opt_q $opt_t $opt_u $opt_v $opt_w); use vars qw($opt_h $opt_i $opt_l $opt_q $opt_t $opt_v $opt_w);
my $url = 'http://mxr.mozilla.org/mozilla/source/security/nss/lib/ckfw/builtins/certdata.txt?raw=1'; my $url = 'http://mxr.mozilla.org/mozilla/source/security/nss/lib/ckfw/builtins/certdata.txt?raw=1';
# If the OpenSSL commandline is not in search path you can configure it here! # If the OpenSSL commandline is not in search path you can configure it here!
@ -42,7 +42,7 @@ my $openssl = 'openssl';
my $version = '1.19'; my $version = '1.19';
$opt_w = 76; # default base64 encoded lines length $opt_w = 72; # default base64 encoded lines length
$0 =~ s@.*(/|\\)@@; $0 =~ s@.*(/|\\)@@;
$Getopt::Std::STANDARD_HELP_VERSION = 1; $Getopt::Std::STANDARD_HELP_VERSION = 1;
@ -55,21 +55,15 @@ if ($opt_i) {
print "Operating System Name : $^O\n"; print "Operating System Name : $^O\n";
print "Getopt::Std.pm Version : ${Getopt::Std::VERSION}\n"; print "Getopt::Std.pm Version : ${Getopt::Std::VERSION}\n";
print "MIME::Base64.pm Version : ${MIME::Base64::VERSION}\n"; print "MIME::Base64.pm Version : ${MIME::Base64::VERSION}\n";
print "LWP::UserAgent.pm Version : ${LWP::UserAgent::VERSION}\n";
print "LWP.pm Version : ${LWP::VERSION}\n";
print ("=" x 78 . "\n"); print ("=" x 78 . "\n");
} }
sub HELP_MESSAGE() { sub HELP_MESSAGE() {
print "Usage:\t${0} [-b] [-f] [-i] [-l] [-n] [-q] [-t] [-u] [-v] [-w<l>] [<outputfile>]\n"; print "Usage:\t${0} [-i] [-l] [-q] [-t] [-v] [-w<l>] [<outputfile>]\n";
print "\t-b\tbackup an existing version of ca-bundle.crt\n";
print "\t-f\tforce rebuild even if certdata.txt is current\n";
print "\t-i\tprint version info about used modules\n"; print "\t-i\tprint version info about used modules\n";
print "\t-l\tprint license info about certdata.txt\n"; print "\t-l\tprint license info about certdata.txt\n";
print "\t-n\tno download of certdata.txt (to use existing)\n";
print "\t-q\tbe really quiet (no progress output at all)\n"; print "\t-q\tbe really quiet (no progress output at all)\n";
print "\t-t\tinclude plain text listing of certificates\n"; print "\t-t\tinclude plain text listing of certificates\n";
print "\t-u\tunlink (remove) certdata.txt after processing\n";
print "\t-v\tbe verbose and print out processed CAs\n"; print "\t-v\tbe verbose and print out processed CAs\n";
print "\t-w <l>\twrap base64 output lines after <l> chars (default: ${opt_w})\n"; print "\t-w <l>\twrap base64 output lines after <l> chars (default: ${opt_w})\n";
exit; exit;
@ -81,56 +75,36 @@ sub VERSION_MESSAGE() {
HELP_MESSAGE() if ($opt_h); HELP_MESSAGE() if ($opt_h);
my $crt = $ARGV[0] || 'ca-bundle.crt'; my $crt = $ARGV[0] || dirname(__FILE__) . '/../src/node_root_certs.h';
(my $txt = $url) =~ s@(.*/|\?.*)@@g; my $txt = dirname(__FILE__) . '/certdata.txt';
my $stdout = $crt eq '-'; my $stdout = $crt eq '-';
my $resp; my $resp;
my $fetched; my $fetched;
unless ($opt_n and -e $txt) {
print STDERR "Downloading '$txt' ...\n" if (!$opt_q);
my $ua = new LWP::UserAgent(agent => "$0/$version");
$ua->env_proxy();
$resp = $ua->mirror($url, $txt);
if ($resp && $resp->code eq '304') {
print STDERR "Not modified\n" unless $opt_q;
exit 0 if -e $crt && !$opt_f;
} else {
$fetched = 1;
}
if( !$resp || $resp->code !~ /^(?:200|304)$/ ) {
print STDERR "Unable to download latest data: "
. ($resp? $resp->code . ' - ' . $resp->message : "LWP failed") . "\n"
unless $opt_q;
exit 1 if -e $crt || ! -r $txt;
}
}
my $currentdate = scalar gmtime($fetched ? $resp->last_modified : (stat($txt))[9]); my $currentdate = scalar gmtime($fetched ? $resp->last_modified : (stat($txt))[9]);
my $format = $opt_t ? "plain text and " : ""; my $format = $opt_t ? "plain text and " : "";
if( $stdout ) { if( $stdout ) {
open(CRT, '> -') or die "Couldn't open STDOUT: $!\n"; open(CRT, '> -') or die "Couldn't open STDOUT: $!\n";
} else { } else {
open(CRT,">$crt.~") or die "Couldn't open $crt.~: $!\n"; open(CRT,">$crt") or die "Couldn't open $crt: $!\n";
} }
print CRT <<EOT; print CRT <<EOT;
## /* $crt -- Bundle of CA Root Certificates
## $crt -- Bundle of CA Root Certificates *
## * Certificate data from Mozilla as of: ${currentdate}
## Certificate data from Mozilla as of: ${currentdate} *
## * This is a bundle of X.509 certificates of public Certificate Authorities
## This is a bundle of X.509 certificates of public Certificate Authorities * (CA). These were automatically extracted from Mozilla's root certificates
## (CA). These were automatically extracted from Mozilla's root certificates * file (certdata.txt). This file can be found in the mozilla source tree:
## file (certdata.txt). This file can be found in the mozilla source tree: * ${url}
## ${url} *
## * It contains the certificates in ${format}PEM format and therefore
## It contains the certificates in ${format}PEM format and therefore * can be directly used with curl / libcurl / php_curl, or with
## can be directly used with curl / libcurl / php_curl, or with * an Apache+mod_ssl webserver for SSL client authentication.
## an Apache+mod_ssl webserver for SSL client authentication. * Just configure this file as the SSLCACertificateFile.
## Just configure this file as the SSLCACertificateFile. */
##
EOT EOT
@ -154,7 +128,7 @@ while (<TXT>) {
next if /^#|^\s*$/; next if /^#|^\s*$/;
chomp; chomp;
if (/^CVS_ID\s+\"(.*)\"/) { if (/^CVS_ID\s+\"(.*)\"/) {
print CRT "# $1\n"; print CRT "/* $1 */\n";
} }
# this is a match for the start of a certificate # this is a match for the start of a certificate
@ -192,25 +166,24 @@ while (<TXT>) {
$skipnum ++; $skipnum ++;
} else { } else {
my $encoded = MIME::Base64::encode_base64($data, ''); my $encoded = MIME::Base64::encode_base64($data, '');
$encoded =~ s/(.{1,${opt_w}})/$1\n/g; $encoded =~ s/(.{1,${opt_w}})/"$1\\n"\n/g;
my $pem = "-----BEGIN CERTIFICATE-----\n" my $pem = "\"-----BEGIN CERTIFICATE-----\\n\"\n"
. $encoded . $encoded
. "-----END CERTIFICATE-----\n"; . "\"-----END CERTIFICATE-----\\n\",\n";
print CRT "\n$caname\n"; print CRT "\n/* $caname */\n";
print CRT ("=" x length($caname) . "\n");
if (!$opt_t) { if (!$opt_t) {
print CRT $pem; print CRT $pem;
} else { } else {
my $pipe = "|$openssl x509 -md5 -fingerprint -text -inform PEM"; my $pipe = "|$openssl x509 -md5 -fingerprint -text -inform PEM";
if (!$stdout) { if (!$stdout) {
$pipe .= " >> $crt.~"; $pipe .= " >> $crt";
close(CRT) or die "Couldn't close $crt.~: $!"; close(CRT) or die "Couldn't close $crt: $!";
} }
open(TMP, $pipe) or die "Couldn't open openssl pipe: $!"; open(TMP, $pipe) or die "Couldn't open openssl pipe: $!";
print TMP $pem; print TMP $pem;
close(TMP) or die "Couldn't close openssl pipe: $!"; close(TMP) or die "Couldn't close openssl pipe: $!";
if (!$stdout) { if (!$stdout) {
open(CRT, ">>$crt.~") or die "Couldn't open $crt.~: $!"; open(CRT, ">>$crt") or die "Couldn't open $crt: $!";
} }
} }
print STDERR "Parsing: $caname\n" if ($opt_v); print STDERR "Parsing: $caname\n" if ($opt_v);
@ -220,20 +193,7 @@ while (<TXT>) {
} }
} }
close(TXT) or die "Couldn't close $txt: $!\n"; close(TXT) or die "Couldn't close $txt: $!\n";
close(CRT) or die "Couldn't close $crt.~: $!\n"; close(CRT) or die "Couldn't close $crt: $!\n";
unless( $stdout ) {
if ($opt_b && -e $crt) {
my $bk = 1;
while (-e "$crt.~${bk}~") {
$bk++;
}
rename $crt, "$crt.~${bk}~" or die "Failed to create backup $crt.~$bk}~: $!\n";
} elsif( -e $crt ) {
unlink( $crt ) or die "Failed to remove $crt: $!\n";
}
rename "$crt.~", $crt or die "Failed to rename $crt.~ to $crt: $!\n";
}
unlink $txt if ($opt_u);
print STDERR "Done ($certnum CA certs processed, $skipnum untrusted skipped).\n" if (!$opt_q); print STDERR "Done ($certnum CA certs processed, $skipnum untrusted skipped).\n" if (!$opt_q);
exit; exit;

Write Preview
Loading…
Cancel
Save