home/cert-manager
2
0
Fork 0
mirror of https://github.com/wahyd4/cert-manager.git synced 2026-08-09 05:06:38 +10:00
Code Issues Packages Projects Releases Wiki Activity

updated keystore.go to use keystore-go to v4, fixed code and tests to handle breaking changes introduced by v4

Browse Source
This commit is contained in:
george m
2021-07-16 12:25:22 +01:00
parent 6885bcafaf
commit b1e63009e5
4 changed files with 72 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
go.mod
+1 -1
View File
@@ -31,7 +31,7 @@ require (
github.com/munnerz/crd-schema-fuzz v1.0.0
github.com/onsi/ginkgo v1.16.4
github.com/onsi/gomega v1.14.0
github.com/pavel-v-chernykh/keystore-go v2.1.0+incompatible
github.com/pavel-v-chernykh/keystore-go/v4 v4.1.0
github.com/pkg/errors v0.9.1
github.com/prometheus/client_golang v1.11.0
github.com/sergi/go-diff v1.1.0
go.sum
+1 -2
View File
@@ -737,8 +737,7 @@ github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FI
github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
github.com/patrickmn/go-cache v2.1.0+incompatible h1:HRMgzkcYKYpi3C8ajMPV8OFXaaRUnok+kx1WdO15EQc=
github.com/patrickmn/go-cache v2.1.0+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
github.com/pavel-v-chernykh/keystore-go v2.1.0+incompatible h1:Jd6xfriVlJ6hWPvYOE0Ni0QWcNTLRehfGPFxr3eSL80=
github.com/pavel-v-chernykh/keystore-go v2.1.0+incompatible/go.mod h1:xlUlxe/2ItGlQyMTstqeDv9r3U4obH7xYd26TbDQutY=
github.com/pavel-v-chernykh/keystore-go/v4 v4.1.0 h1:xKxUVGoB9VJU+lgQLPN0KURjw+XCVVSpHfQEeyxk3zo=
github.com/pavel-v-chernykh/keystore-go/v4 v4.1.0/go.mod h1:2ejgys4qY+iNVW1IittZhyRYA6MNv8TgM6VHqojbB9g=
github.com/pborman/uuid v1.2.0/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k=
github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
pkg/controller/certificates/internal/secretsmanager/keystore.go
+23 -33
View File
@@ -28,10 +28,9 @@ import (
"crypto/x509"
"time"
jks "github.com/pavel-v-chernykh/keystore-go"
"software.sslmate.com/src/go-pkcs12"
"github.com/jetstack/cert-manager/pkg/util/pki"
jks "github.com/pavel-v-chernykh/keystore-go/v4"
"software.sslmate.com/src/go-pkcs12"
)
const (
@@ -111,35 +110,29 @@ func encodeJKSKeystore(password []byte, rawKey []byte, certPem []byte, caPem []b
}
}
ks := jks.KeyStore{
"certificate": &jks.PrivateKeyEntry{
Entry: jks.Entry{
CreationDate: time.Now(),
},
PrivKey: keyDER,
CertChain: certs,
},
}
// add the CA certificate, if set
ks := jks.New()
ks.SetPrivateKeyEntry("certificate", jks.PrivateKeyEntry{
CreationTime: time.Now(),
PrivateKey: keyDER,
CertificateChain: certs,
}, password)
if len(caPem) > 0 {
ca, err := pki.DecodeX509CertificateBytes(caPem)
if err != nil {
return nil, err
}
ks["ca"] = &jks.TrustedCertificateEntry{
Entry: jks.Entry{
CreationDate: time.Now(),
},
ks.SetTrustedCertificateEntry("ca", jks.TrustedCertificateEntry{
CreationTime: time.Now(),
Certificate: jks.Certificate{
Type: "X509",
Content: ca.Raw,
},
}
}},
)
}
buf := &bytes.Buffer{}
if err := jks.Encode(buf, ks, password); err != nil {
if err := ks.Store(buf, password); err != nil {
return nil, err
}
return buf.Bytes(), nil
@@ -151,20 +144,17 @@ func encodeJKSTruststore(password []byte, caPem []byte) ([]byte, error) {
return nil, err
}
ks := jks.KeyStore{
"ca": &jks.TrustedCertificateEntry{
Entry: jks.Entry{
CreationDate: time.Now(),
},
Certificate: jks.Certificate{
Type: "X509",
Content: ca.Raw,
},
},
}
ks := jks.New()
ks.SetTrustedCertificateEntry("ca", jks.TrustedCertificateEntry{
CreationTime: time.Now(),
Certificate: jks.Certificate{
Type: "X509",
Content: ca.Raw,
}},
)
buf := &bytes.Buffer{}
if err := jks.Encode(buf, ks, password); err != nil {
if err := ks.Store(buf, password); err != nil {
return nil, err
}
return buf.Bytes(), nil
pkg/controller/certificates/internal/secretsmanager/keystore_test.go
+47 -14
View File
@@ -23,13 +23,12 @@ import (
"fmt"
"testing"
jks "github.com/pavel-v-chernykh/keystore-go"
cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1"
"github.com/jetstack/cert-manager/pkg/util/pki"
jks "github.com/pavel-v-chernykh/keystore-go/v4"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"software.sslmate.com/src/go-pkcs12"
cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1"
"github.com/jetstack/cert-manager/pkg/util/pki"
)
func mustGeneratePrivateKey(t *testing.T, encoding cmapi.PrivateKeyEncoding) []byte {
@@ -158,15 +157,33 @@ func TestEncodeJKSKeystore(t *testing.T) {
return
}
buf := bytes.NewBuffer(out)
ks, err := jks.Decode(buf, []byte("password"))
ks := jks.New()
err = ks.Load(buf, []byte("password"))
if err != nil {
t.Errorf("error decoding keystore: %v", err)
return
}
if ks["certificate"] == nil {
// if ks["certificate"] == nil {
// t.Errorf("no certificate data found in keystore")
// }
// if _, certificate := ks.GetPrivateKeyEntry("certificate"); certificate == nil {
// t.Errorf("no certificate data found in keystore")
// }
if !ks.IsPrivateKeyEntry("certificate") {
t.Errorf("no certificate data found in keystore")
}
if ks["ca"] != nil {
// if ks["ca"] != nil {
// t.Errorf("unexpected ca data found in keystore")
// }
// if _, ca := ks.GetTrustedCertificateEntry("ca"); ca != nil {
// t.Errorf("unexpected ca data found in keystore")
// }
if ks.IsTrustedCertificateEntry("ca") {
t.Errorf("unexpected ca data found in keystore")
}
},
@@ -180,15 +197,23 @@ func TestEncodeJKSKeystore(t *testing.T) {
t.Errorf("expected no error but got: %v", err)
}
buf := bytes.NewBuffer(out)
ks, err := jks.Decode(buf, []byte("password"))
ks := jks.New()
err = ks.Load(buf, []byte("password"))
if err != nil {
t.Errorf("error decoding keystore: %v", err)
return
}
if ks["certificate"] == nil {
// if ks["certificate"] == nil {
// t.Errorf("no certificate data found in keystore")
// }
if !ks.IsPrivateKeyEntry("certificate") {
t.Errorf("no certificate data found in keystore")
}
if ks["ca"] != nil {
// if ks["ca"] != nil {
// t.Errorf("unexpected ca data found in keystore")
// }
if ks.IsTrustedCertificateEntry("ca") {
t.Errorf("unexpected ca data found in keystore")
}
},
@@ -203,16 +228,24 @@ func TestEncodeJKSKeystore(t *testing.T) {
t.Errorf("expected no error but got: %v", err)
}
buf := bytes.NewBuffer(out)
ks, err := jks.Decode(buf, []byte("password"))
ks := jks.New()
err = ks.Load(buf, []byte("password"))
if err != nil {
t.Errorf("error decoding keystore: %v", err)
return
}
if ks["certificate"] == nil {
// if ks["certificate"] == nil {
// t.Errorf("no certificate data found in keystore")
// }
if !ks.IsPrivateKeyEntry("certificate") {
t.Errorf("no certificate data found in keystore")
}
if ks["ca"] == nil {
t.Errorf("no ca data found in keystore")
// if ks["ca"] == nil {
// t.Errorf("no ca data found in keystore")
// }
if !ks.IsTrustedCertificateEntry("ca") {
t.Errorf("unexpected ca data found in keystore")
}
},
},