Граф коммитов

68 Коммитов

Автор SHA1 Сообщение Дата
Matteo Bignotti 47762f5583
mk-ca-bundle.pl: make -u delete certdata.txt if found not changed
certdata.txt should be deleted also when the process is interrupted by
"same certificate downloaded, exiting"

The certdata.txt is currently kept on disk even if you give the -u
option

Closes #2655
2018-06-14 00:02:20 +02:00
Vladimir Kotal 9ff67f7b00
mk-ca-bundle.pl: leave certificate name untouched in decode()
Closes #2640
2018-06-08 09:37:56 +02:00
Jay Satiro d4e40f0690 scripts: allow all perl scripts to be run directly
- Enable execute permission (chmod +x)

- Change interpreter to /usr/bin/env perl

Closes https://github.com/curl/curl/pull/2222
2018-01-07 15:42:11 -05:00
Jon DeVree fdd879d549
mk-ca-bundle: Remove URL for aurora
Aurora is no longer used by Mozilla
https://hacks.mozilla.org/2017/04/simplifying-firefox-release-channels/
2017-10-22 23:38:31 +02:00
Jon DeVree f571651a0d
mk-ca-bundle: Fix URL for NSS
The 'tip' is the most recent branch committed to, this should be
'default' like the URLs for the browser are.

Closes #1998
2017-10-22 23:38:23 +02:00
Jay Satiro ec92afc3f4 mk-ca-bundle.pl: Check curl's exit code after certdata download
- No longer allow partial downloads of certdata.

Prior to this change partial downloads were (erroneously?) allowed since
only the server code was checked to be 200.

Bug: https://github.com/curl/curl/pull/1577
Reported-by: Matteo B.
2017-06-16 01:58:23 -04:00
Jay Satiro 2e750ce452 mk-ca-bundle.vbs: Fix UTF-8 output
- Change initial message box to mention delay when downloading/parsing.

Since there is no progress meter it was somewhat unexpected that after
choosing a filename nothing appears to happen, when actually the cert
data is in the process of being downloaded and parsed.

- Warn if OpenSSL is not present.

- Use a UTF-8 stream to make the ca-bundle data.

- Save the UTF-8 ca-bundle stream as binary so that no BOM is added.

---

This is a follow-up to d2c6d15 which switched mk-ca-bundle.vbs output to
ANSI due to corrupt UTF-8 output, now fixed.

This change completes making the default certificate bundle output of
mk-ca-bundle.vbs as close as possible to that of mk-ca-bundle.pl, which
should make it easier to review any difference between their output.

Ref: https://github.com/curl/curl/pull/1012
2016-10-30 01:01:29 -04:00
Jay Satiro d2c6d1568e mk-ca-bundle: Update the vbscript version
Bring the VBScript version more in line with the perl version:

- Change timestamp to UTC.

- Change URL retrieval to HTTPS-only by default.

- Comment out the options that disabled SSL cert checking by default.

- Assume OpenSSL is present, get SHA256. And add a flag to toggle it.

- Fix cert issuer name output.

The cert issuer output is now ansi, converted from UTF-8. Prior to this
it was corrupt UTF-8. It turns out though we can work with UTF-8 the
FSO object that writes ca-bundle can't write UTF-8, so there will have
to be some alternative if UTF-8 is needed (like an ADODB.Stream).

- Disable the certificate text info feature.

The certificate text info doesn't work properly with any recent OpenSSL.
2016-10-25 03:17:26 -04:00
Jay Satiro 1ad2bdcf11 mk-ca-bundle: Change URL retrieval to HTTPS-only by default
- Change all predefined Mozilla URLs to HTTPS (Gregory Szorc).

- New option -k to allow URLs other than HTTPS and enable HTTP fallback.

Prior to this change the default URL retrieval mode was to fall back to
HTTP if HTTPS didn't work.

Reported-by: Gregory Szorc

Closes #1012
2016-10-24 09:41:03 +02:00
Viktor Szakats 8fa20da8e1 mk-ca-bundle.pl: use SHA256 instead of SHA1
This hash is used to verify the original downloaded certificate bundle
and also included in the generated bundle's comment header. Also
rename related internal symbols to algorithm-agnostic names.
2016-09-07 10:41:11 +02:00
Daniel Stenberg 600bb4e852 mk-ca-bundle.pl: -m keeps ca cert meta data in output
Makes the script pass on comments holding meta data to the output
file. Like fingerprinters, issuer, date ranges etc.

Closes #937
2016-08-04 00:28:28 +02:00
Daniel Stenberg 4af40b3646 URLs: change all http:// URLs to https:// 2016-02-03 00:19:02 +01:00
Alexander Pepper 143acd6222 mk-ca-bundle bugfix: Don't report SHA1 numbers with "-q".
Also unified printing to STDERR by creating the helper method "report".
2015-03-11 14:47:41 +01:00
Guenter Knauf 834608c39d mk-ca-bundle.pl: restored forced run again. 2014-12-13 13:46:45 +01:00
Daniel Stenberg 76b2f53707 mk-ca-bundle: spell fix "version" 2014-10-28 15:21:11 +01:00
Guenter Knauf 7be56906d6 Cosmetics: lowercase non-special subroutine names. 2014-10-26 19:07:35 +01:00
Guenter Knauf 4b7d499e64 Some cosmetics and simplifies. 2014-10-23 16:27:40 +02:00
Guenter Knauf 2be6941f42 Remove dependency on openssl and cut.
Prefer usage of Perl modules for sha1 calculation since there
might be systems where openssl is not installed or not in path.
If openssl is used for sha1 calculation then dont rely on cut
since it is usually not available on other systems than Linux.
2014-10-23 15:22:56 +02:00
Bruno Thomsen 3621045631 mk-ca-bundle: added SHA-384 signature algorithm
Certificates based on SHA-1 are being phased out[1].
So we should expect a rise in certificates based on SHA-2.
Adding SHA-384 as a valid signature algorithm.

[1] https://blog.mozilla.org/security/2014/09/23/phasing-out-certificates-with-sha-1-based-signature-algorithms/

Signed-off-by: Bruno Thomsen <bth@kamstrup.dk>
2014-10-15 13:23:22 +02:00
Viktor Szakáts 82b8b6865c mk-ca-bundle.pl: converted tabs to spaces, deleted trailing spaces 2014-09-11 16:59:03 +02:00
Daniel Stenberg df0a480058 mk-ca-bundle.pl: first, try downloading HTTPS with curl
As a sort of step forward, this script will now first try to get the
data from the HTTPS URL using curl, and only if that fails it will
switch back to the HTTP transfer using perl's native LWP functionality.
To reduce the risk of this script being tricked.

Using HTTPS to get a cert bundle introduces a chicken-and-egg problem so
we can't really ever completely disable HTTP, but chances are that most
users already have a ca cert bundle that trusts the mozilla.org site
that this script downloads from.

A future version of this script will probably switch to require a
dedicated "insecure" command line option to allow downloading over HTTP
(or unverified HTTPS).
2014-09-10 12:14:13 +02:00
Daniel Stenberg 076c0ab683 mk-ca-bundle.pl: add missing $ 2014-08-13 23:49:01 +02:00
Daniel Stenberg 57b53918d1 mk-ca-bundle.pl: switched to using hg.mozilla.org
... as mxr.mozilla.org is due to be retired.

The new host doesn't support If-Modified-Since nor ETags, meaning that
the script will now defer to download and do a post-transfer checksum
check to see if a new output is to be generated. The new output format
will hold the SHA1 checksum of the source file for that purpose.

We call this version 1.22

Reported-by: Ed Morley
Bug: http://curl.haxx.se/bug/view.cgi?id=1409
2014-08-13 23:42:53 +02:00
Patrick Watson 94898303d2 mk-ca-bundle: added -p
-p takes a list of Mozilla trust purposes and levels for certificates to
include in output.  Takes the form of a comma separated list of
purposes, a colon, and a comma separated list of levels.
2014-05-08 11:37:45 +02:00
Daniel Stenberg 619d1704ae mk-ca-bundle.pl: avoid warnings with -d without parameter 2014-01-05 23:53:26 +01:00
Leif W d5f1590d5c mk-ca-bundle: introduces -d and warns about using this script 2014-01-05 23:38:32 +01:00
Guenter Knauf 0ce410a629 Simplify check for trusted certificates.
This changes the previous check for untrusted certs to a check for
certs explicitely marked as trusted.
The change is backward-compatible (tested with certdata.txt v1.80).
2013-08-05 13:02:27 +02:00
Guenter Knauf 51f0b798fa Skip more untrusted certificates.
Christian Heimes brought to our attention that the certdata.txt
format has recently changed [1], causing ca-bundle.crt created
with mk-ca-bundle.[pl|vbs] to include untrusted certs.

[1] http://lists.debian.org/debian-release/2012/11/msg00411.html
2013-08-04 21:30:11 +02:00
Guenter Knauf 577703495e Fixed lost OpenSSL output with "-t" - followup.
The previously applied patch didnt work on Windows; we cant rely
on shell commands like 'echo' since they act diffently on each
platform and each shell.
In order to keep this script platform-independent the code must
only use pure Perl.
2013-04-10 00:20:37 +02:00
Guenter Knauf 88535d593e Fixed lost OpenSSL output with "-t".
The OpenSSL pipe wrote to the final CA bundle file, but the encoded PEM
output wrote to a temporary file.  Consequently, the OpenSSL output was
lost when the temp file was renamed to the final file at script finish
(overwriting the final file written earlier by openssl).
Patch posted to the list by Richard Michael (rmichael edgeofthenet org).
2013-04-09 16:59:57 +02:00
Guenter Knauf fbc35d394c Another small output fix for --help and --version. 2013-04-04 04:02:12 +02:00
Guenter Knauf ce8a35c318 Fixed version output. 2013-04-04 00:23:58 +02:00
Guenter Knauf c3fa3aaf2c Added support for --help and --version options. 2013-04-04 00:21:10 +02:00
Guenter Knauf 8efd74de46 Added option to specify length of base64 output.
Based on a patch posted to the list by Richard Michael.
2013-04-04 00:02:49 +02:00
Daniel Stenberg cc4ac82bb6 mk-ca-bundle: add -f, support passing to stdout and more
1. When the downloaded data file from Mozilla is current, but the output
bundle does not exist: continue processing to create the bundle.  The
goal is to have the output file - not just download the latest input.

2. added -f option to force re-processing the file.  Useful for
debugging/testing the process.

3. added support for output to '-' (stdout), allowing the output to be
piped.

4. All progress and error messages go to STDERR rather than STDOUT (3)

5. The script opened and closed the output file many times
unnecessarily.  It now opens it once, does the output and closes it.

6. Backup of the input files happens after successful processing, not
before.

7. The output is written to a temporary file, and renamed to the
requested name after backup - this greatly reduces the window where the
file can be seen partially written.

8. all die calls have a \n at the end to suppress perl's traceback - the
traceback isn't useful to end users.

Patch: http://curl.haxx.se/mail/lib-2013-01/0045.html
2013-01-05 23:51:12 +01:00
Daniel Stenberg 3a0b64489f mk-ca-bundle: detect start of trust section better
Each certificate section of the input certdata.txt file has a trust
section following it with details.

This script failed to detect the start of the trust for at least one
cert[*], which made the script continue pass that section into the next
one where it found an 'untrusted' marker and as a result that certficate
was not included in the output.

[*] = "Hellenic Academic and Research Institutions RootCA 2011"

Bug: http://curl.haxx.se/mail/lib-2012-09/0019.html
2012-09-04 23:21:15 +02:00
Tim Heckman f9bb5d2984 Revert "access the CA source file using HTTPS"
This reverts commit f7e2ab6.

This change caused fetching of the certificates to become unreliable.

Bug: http://curl.haxx.se/mail/lib-2012-03/0238.html
Reported by: Tim Heckman
2012-04-04 23:54:02 +02:00
Daniel Stenberg 33d044a862 Revert "mk-ca-bundle.pl: use LWP::UserAgent for https"
This reverts commit 9f0e1689f1.

It turned out that "improvement" instead made the fetching of the
certificates unreliable

Bug: http://curl.haxx.se/mail/lib-2012-03/0238.html
Reported by: Tim Heckman
2012-03-31 19:51:36 +02:00
John Joseph Bachir 9f0e1689f1 mk-ca-bundle.pl: use LWP::UserAgent with proper https verify behavior.
An alternative would be:

1. specify HTTPS_CA_DIR and/or HTTPS_CA_FILE
2. ensure that Net::SSL is being used, and IO::Socket::SSL is NOT being
   used

This question and answer explain:
http://stackoverflow.com/questions/74358/
2012-03-10 15:51:24 +01:00
John Joseph Bachir f7e2ab629e access the CA source file using HTTPS 2012-03-10 15:50:27 +01:00
Guenter Knauf cd3cf55b47 Also skip certs masked as CKT_NSS_TRUST_UNKNOWN.
Fix posted by Tomas Hoger <thoger redhat com>.
2011-09-20 12:05:31 +02:00
Guenter Knauf d52f3eb598 Fixed final message output. 2011-09-04 22:05:32 +02:00
Guenter Knauf 809cde5416 Fix to skip untrusted certs. 2011-09-04 17:05:49 +02:00
Guenter Knauf e84730948d Replaced var manipulations with perlish hacks. 2011-04-14 01:27:39 +02:00
Daniel Stenberg 23544f35fd mk-ca-bundle.pl: show full URL in output
When I decided to search for a potential error with the cacert bundle it
struck me I wanted to see the full source URL in the output...
2011-04-07 22:42:22 +02:00
Guenter Knauf c37ad9e909 Increased script version. 2011-04-01 15:04:53 +02:00
Guenter Knauf 5eda4bf726 Make use of proxy vars if set.
Posted to the list by Quanah Gibson-Mount [quanah zimbra.com].
2011-04-01 14:58:36 +02:00
Guenter Knauf e02c90dc19 Use var again instead of hard-coded filename. 2011-04-01 14:38:01 +02:00
Ask Bjørn Hansen 3e00af34c8 mk-ca-bundle.pl: Only download if modified
Only download and convert the certdata to the ca-bundle.crt if Mozilla
changed the data

The Perl LWP module (which in a bit of a circular reference is used by
mk-ca-bundle.pl) is now indirectly using this script. I made this small
tweak to make it easier to automatically maintain the generated
ca-bundle.crt file in version control.
2011-03-14 10:20:21 +01:00
Daniel Stenberg ec7978c512 mk-ca-bundle.pl: use new cacert url
The official Mozilla page at
http://www.mozilla.org/projects/security/certs/ points out a new place
as the "proper" place to get Mozilla's CA certs from so this script is
now updated to use that instead.

Reported by: Daniel Mentz
2011-02-02 22:22:15 +01:00