From b2ed0a2b92f7f202d6dd9fe5e9fa97dd18353f30 Mon Sep 17 00:00:00 2001 From: Richard Wall Date: Fri, 7 Aug 2020 17:15:38 +0100 Subject: [PATCH 1/2] Update to latest version of https://github.com/SSLMate/go-pkcs12 This new version includes a [pkcs12.DecodeChain](https://godoc.org/software.sslmate.com/src/go-pkcs12#DecodeChain) which will help in testing https://github.com/jetstack/cert-manager/pull/3146 Signed-off-by: Richard Wall --- LICENSES | 4 ++-- go.mod | 2 +- go.sum | 2 ++ hack/build/repos.bzl | 4 ++-- 4 files changed, 7 insertions(+), 5 deletions(-) diff --git a/LICENSES b/LICENSES index df50900b8..b227dd7a2 100644 --- a/LICENSES +++ b/LICENSES @@ -19928,7 +19928,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ================================================================================ = vendor/software.sslmate.com/src/go-pkcs12 licensed under: = -Copyright (c) 2015, 2018 Opsmate, Inc. +Copyright (c) 2015, 2018, 2019 Opsmate, Inc. All rights reserved. Copyright (c) 2009 The Go Authors. All rights reserved. Redistribution and use in source and binary forms, with or without @@ -19957,6 +19957,6 @@ THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -= vendor/software.sslmate.com/src/go-pkcs12/LICENSE 59ab963efbc183656060b23893ea5745 += vendor/software.sslmate.com/src/go-pkcs12/LICENSE 259f3802525423b1a33efb1b85f64e18 ================================================================================ diff --git a/go.mod b/go.mod index acab08b54..001ee5fdc 100644 --- a/go.mod +++ b/go.mod @@ -62,5 +62,5 @@ require ( sigs.k8s.io/controller-tools v0.2.9-0.20200414181213-645d44dca7c0 sigs.k8s.io/testing_frameworks v0.1.2 sigs.k8s.io/yaml v1.2.0 - software.sslmate.com/src/go-pkcs12 v0.0.0-20180114231543-2291e8f0f237 + software.sslmate.com/src/go-pkcs12 v0.0.0-20200619203921-c9ed90bd32dc ) diff --git a/go.sum b/go.sum index 7e7e3f024..9b938937c 100644 --- a/go.sum +++ b/go.sum @@ -707,4 +707,6 @@ sigs.k8s.io/yaml v1.2.0 h1:kr/MCeFWJWTwyaHoR9c8EjH9OumOmoF9YGiZd7lFm/Q= sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc= software.sslmate.com/src/go-pkcs12 v0.0.0-20180114231543-2291e8f0f237 h1:iAEkCBPbRaflBgZ7o9gjVUuWuvWeV4sytFWg9o+Pj2k= software.sslmate.com/src/go-pkcs12 v0.0.0-20180114231543-2291e8f0f237/go.mod h1:/xvNRWUqm0+/ZMiF4EX00vrSCMsE4/NHb+Pt3freEeQ= +software.sslmate.com/src/go-pkcs12 v0.0.0-20200619203921-c9ed90bd32dc h1:EsxyX6d5CU9zIK74f0y5OeDRFoQalEMHz1Jdvo4K16g= +software.sslmate.com/src/go-pkcs12 v0.0.0-20200619203921-c9ed90bd32dc/go.mod h1:/xvNRWUqm0+/ZMiF4EX00vrSCMsE4/NHb+Pt3freEeQ= vbom.ml/util v0.0.0-20160121211510-db5cfe13f5cc/go.mod h1:so/NYdZXCz+E3ZpW0uAoCj6uzU2+8OWDFv/HxUSs7kI= diff --git a/hack/build/repos.bzl b/hack/build/repos.bzl index 8df2f4a3e..a882b6e44 100644 --- a/hack/build/repos.bzl +++ b/hack/build/repos.bzl @@ -1695,8 +1695,8 @@ def go_repositories(): build_file_generation = "on", build_file_proto_mode = "disable", importpath = "software.sslmate.com/src/go-pkcs12", - sum = "h1:iAEkCBPbRaflBgZ7o9gjVUuWuvWeV4sytFWg9o+Pj2k=", - version = "v0.0.0-20180114231543-2291e8f0f237", + sum = "h1:EsxyX6d5CU9zIK74f0y5OeDRFoQalEMHz1Jdvo4K16g=", + version = "v0.0.0-20200619203921-c9ed90bd32dc", ) go_repository( name = "in_gopkg_alecthomas_kingpin_v2", From 46d4ea768b6404ae60fd9c9e9dfacc603ed107c5 Mon Sep 17 00:00:00 2001 From: Richard Wall Date: Fri, 7 Aug 2020 17:23:50 +0100 Subject: [PATCH 2/2] Update test for pkcs12 encoded CA data Signed-off-by: Richard Wall --- .../internal/secretsmanager/keystore_test.go | 21 +++++++++++-------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/pkg/controller/certificates/internal/secretsmanager/keystore_test.go b/pkg/controller/certificates/internal/secretsmanager/keystore_test.go index c39e7d0f9..520e54d2d 100644 --- a/pkg/controller/certificates/internal/secretsmanager/keystore_test.go +++ b/pkg/controller/certificates/internal/secretsmanager/keystore_test.go @@ -202,17 +202,20 @@ func TestEncodePKCS12Keystore(t *testing.T) { if err != nil { t.Errorf("expected no error but got: %v", err) } - // The pkcs12 package does not expose a way to decode the CA - // data that has been written. - // It will return an error when attempting to decode a file - // with more than one 'certbag', so we just ensure the error - // returned is the expected error and don't inspect the keystore - // contents. - _, _, err = pkcs12.Decode(out, "password") - if err == nil || err.Error() != "pkcs12: expected exactly two safe bags in the PFX PDU" { - t.Errorf("unexpected error string, exp=%q, got=%v", "pkcs12: expected exactly two safe bags in the PFX PDU", err) + pk, cert, caCerts, err := pkcs12.DecodeChain(out, "password") + if err != nil { + t.Errorf("error decoding keystore: %v", err) return } + if cert == nil { + t.Errorf("no certificate data found in keystore") + } + if pk == nil { + t.Errorf("no private key data found in keystore") + } + if caCerts == nil { + t.Errorf("no ca data found in keystore") + } }, }, }