mirror of
https://github.com/anchore/syft.git
synced 2025-11-17 16:33:21 +01:00
129 lines
4.4 KiB
Bash
Executable File
129 lines
4.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -eu
|
|
|
|
NAME=syft-dev
|
|
SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
|
|
DIR=$SCRIPT_DIR/dev-pki
|
|
FILE_PREFIX=$DIR/$NAME
|
|
IDENTITY=${NAME}-id-415d8c69793
|
|
|
|
## OpenSSL material
|
|
|
|
KEY_PASSWORD="letthedevin"
|
|
P12_PASSWORD="popeofnope"
|
|
|
|
KEY_FILE=$FILE_PREFIX-key.pem
|
|
CSR_FILE=$FILE_PREFIX-csr.pem
|
|
CERT_FILE=$FILE_PREFIX-cert.pem
|
|
EXT_FILE=$FILE_PREFIX-ext.cnf
|
|
P12_FILE=$FILE_PREFIX.p12
|
|
|
|
EXT_SECTION=codesign_reqext
|
|
|
|
# setup_signing
|
|
#
|
|
# preps the MAC_SIGNING_IDENTITY env var for use in the signing process, using ephemeral developer certificate material
|
|
#
|
|
function setup_signing() {
|
|
# check to see if this has already been done... if so, bail!
|
|
set +ue
|
|
if security find-identity -p codesigning "$KEYCHAIN_PATH" | grep $IDENTITY ; then
|
|
export MAC_SIGNING_IDENTITY=$IDENTITY
|
|
commentary "skipping creating dev certificate material (already exists)"
|
|
commentary "setting MAC_SIGNING_IDENTITY=${IDENTITY}"
|
|
return 0
|
|
fi
|
|
set -ue
|
|
|
|
title "setting up developer certificate material"
|
|
|
|
mkdir -p "${DIR}"
|
|
|
|
# configure the openssl extensions
|
|
cat << EOF > "$EXT_FILE"
|
|
[ req ]
|
|
default_bits = 2048 # RSA key size
|
|
encrypt_key = yes # Protect private key
|
|
default_md = sha256 # MD to use
|
|
utf8 = yes # Input is UTF-8
|
|
string_mask = utf8only # Emit UTF-8 strings
|
|
prompt = yes # Prompt for DN
|
|
distinguished_name = codesign_dn # DN template
|
|
req_extensions = $EXT_SECTION # Desired extensions
|
|
|
|
[ codesign_dn ]
|
|
commonName = $IDENTITY
|
|
commonName_max = 64
|
|
|
|
[ $EXT_SECTION ]
|
|
keyUsage = critical,digitalSignature
|
|
extendedKeyUsage = critical,codeSigning
|
|
subjectKeyIdentifier = hash
|
|
EOF
|
|
|
|
title "create the private key"
|
|
openssl genrsa \
|
|
-des3 \
|
|
-out "$KEY_FILE" \
|
|
-passout "pass:$KEY_PASSWORD" \
|
|
2048
|
|
|
|
title "create the csr"
|
|
openssl req \
|
|
-new \
|
|
-key "$KEY_FILE" \
|
|
-out "$CSR_FILE" \
|
|
-passin "pass:$KEY_PASSWORD" \
|
|
-config "$EXT_FILE" \
|
|
-subj "/CN=$IDENTITY"
|
|
|
|
commentary "verify the csr: we should see X509 v3 extensions for codesigning in the CSR"
|
|
openssl req -in "$CSR_FILE" -noout -text | grep -A1 "X509v3" || exit_with_error "could not find x509 extensions in CSR"
|
|
|
|
title "create the certificate"
|
|
# note: Extensions in certificates are not transferred to certificate requests and vice versa. This means that
|
|
# just because the CSR has x509 v3 extensions doesn't mean that you'll see these extensions in the cert output.
|
|
# To prove this do:
|
|
# openssl x509 -text -noout -in server.crt | grep -A10 "X509v3 extensions:"
|
|
# ... and you will see no output (if -extensions is not used). (see https://www.openssl.org/docs/man1.1.0/man1/x509.html#BUGS)
|
|
# To get the extensions, use "-extensions codesign_reqext" when creating the cert. The codesign_reqext value matches
|
|
# the section name in the ext file used in CSR / cert creation (-extfile and -config).
|
|
openssl x509 \
|
|
-req \
|
|
-days 10000 \
|
|
-in "$CSR_FILE" \
|
|
-signkey "$KEY_FILE" \
|
|
-out "$CERT_FILE" \
|
|
-extfile "$EXT_FILE" \
|
|
-passin "pass:$KEY_PASSWORD" \
|
|
-extensions $EXT_SECTION
|
|
|
|
commentary "verify the certificate: we should see our extensions"
|
|
openssl x509 -text -noout -in "$CERT_FILE" | grep -A1 'X509v3' || exit_with_error "could not find x509 extensions in certificate"
|
|
|
|
title "export cert and private key to .p12 file"
|
|
# note: this step may be entirely optional, however, I found it useful to follow the prod path which goes the route of using a p12
|
|
openssl pkcs12 \
|
|
-export \
|
|
-out "$P12_FILE" \
|
|
-inkey "$KEY_FILE" \
|
|
-in "$CERT_FILE" \
|
|
-passin "pass:$KEY_PASSWORD" \
|
|
-passout "pass:$P12_PASSWORD"
|
|
|
|
# delete the keychain if it already exists
|
|
if [ -f "${KEYCHAIN_PATH}" ]; then
|
|
cleanup_dev_signing
|
|
fi
|
|
|
|
import_signing_certificate "$P12_FILE" "$P12_PASSWORD" "$IDENTITY"
|
|
}
|
|
|
|
function cleanup_dev_signing() {
|
|
title "delete the dev keychain and all certificate material"
|
|
set -xue
|
|
security delete-keychain "$KEYCHAIN_NAME" || true
|
|
rm -f "$KEYCHAIN_PATH" || true
|
|
rm -rf "${DIR}" || true
|
|
}
|