mirror of
https://github.com/curl/curl.git
synced 2026-07-26 02:07:16 +03:00
GHA: add shellcheck job and fix warnings, shell tidy-ups
Reviewed-by: Daniel Stenberg Closes #13307
This commit is contained in:
Viktor Szakats
parent
2c4f836f70
commit
fa69b41c77
12 changed files with 441 additions and 415 deletions
|
|
@ -1,4 +1,4 @@
|
|||
#!/bin/bash
|
||||
#!/usr/bin/env bash
|
||||
#***************************************************************************
|
||||
# _ _ ____ _
|
||||
# Project ___| | | | _ \| |
|
||||
|
|
@ -23,67 +23,58 @@
|
|||
#
|
||||
###########################################################################
|
||||
|
||||
# exit on first fail
|
||||
set -eu
|
||||
|
||||
OPENSSL=openssl
|
||||
if [ -f /usr/local/ssl/bin/openssl ] ; then
|
||||
OPENSSL=/usr/local/ssl/bin/openssl
|
||||
if [ -f /usr/local/ssl/bin/openssl ]; then
|
||||
OPENSSL=/usr/local/ssl/bin/openssl
|
||||
fi
|
||||
|
||||
USAGE="echo Usage is genroot.sh \<name\>"
|
||||
USAGE='echo Usage is genroot.sh <name>'
|
||||
|
||||
HOME=`pwd`
|
||||
cd $HOME
|
||||
HOME=$(pwd)
|
||||
cd "$HOME"
|
||||
|
||||
KEYSIZE=2048
|
||||
DURATION=6000
|
||||
# The -sha256 option was introduced in OpenSSL 1.0.1
|
||||
DIGESTALGO=-sha256
|
||||
|
||||
PREFIX=$1
|
||||
if [ ".$PREFIX" = . ] ; then
|
||||
echo No configuration prefix
|
||||
NOTOK=1
|
||||
NOTOK=
|
||||
|
||||
PREFIX="${1:-}"
|
||||
if [ -z "$PREFIX" ]; then
|
||||
echo 'No configuration prefix'
|
||||
NOTOK=1
|
||||
else
|
||||
if [ ! -f $PREFIX-ca.prm ] ; then
|
||||
echo No configuration file $PREFIX-ca.prm
|
||||
NOTOK=1
|
||||
fi
|
||||
if [ ! -f "$PREFIX-ca.prm" ]; then
|
||||
echo "No configuration file $PREFIX-ca.prm"
|
||||
NOTOK=1
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ ".$NOTOK" != . ] ; then
|
||||
echo "Sorry, I can't do that for you."
|
||||
$USAGE
|
||||
exit
|
||||
if [ -n "$NOTOK" ]; then
|
||||
echo 'Sorry, I cannot do that for you.'
|
||||
$USAGE
|
||||
exit
|
||||
fi
|
||||
|
||||
GETSERIAL="\$t = time ;\$d = \$t . substr(\$t+$$ ,-4,4)-1;print \$d"
|
||||
SERIAL=`/usr/bin/env perl -e "$GETSERIAL"`
|
||||
SERIAL="$(date +'%s')${RANDOM:(-4)}"
|
||||
|
||||
# exit on first fail
|
||||
set -e
|
||||
echo "SERIAL=$SERIAL PREFIX=$PREFIX DURATION=$DURATION KEYSIZE=$KEYSIZE"
|
||||
|
||||
echo SERIAL=$SERIAL PREFIX=$PREFIX DURATION=$DURATION KEYSIZE=$KEYSIZE
|
||||
set -x
|
||||
|
||||
echo "openssl genrsa -out $PREFIX-ca.key -passout XXX $KEYSIZE"
|
||||
openssl genrsa -out $PREFIX-ca.key -passout pass:secret $KEYSIZE
|
||||
|
||||
echo "openssl req -config $PREFIX-ca.prm -new -key $PREFIX-ca.key -out $PREFIX-ca.csr"
|
||||
$OPENSSL req -config $PREFIX-ca.prm -new -key $PREFIX-ca.key -out $PREFIX-ca.csr -passin pass:secret
|
||||
|
||||
echo "openssl x509 -set_serial $SERIAL -extfile $PREFIX-ca.prm -days $DURATION -req -signkey $PREFIX-ca.key -in $PREFIX-ca.csr -out $PREFIX-$SERIAL.ca-cacert $DIGESTALGO "
|
||||
|
||||
$OPENSSL x509 -set_serial $SERIAL -extfile $PREFIX-ca.prm -days $DURATION -req -signkey $PREFIX-ca.key -in $PREFIX-ca.csr -out $PREFIX-$SERIAL-ca.cacert $DIGESTALGO
|
||||
|
||||
echo "openssl x509 -text -in $PREFIX-$SERIAL-ca.cacert -nameopt multiline > $PREFIX-ca.cacert "
|
||||
$OPENSSL x509 -text -in $PREFIX-$SERIAL-ca.cacert -nameopt multiline > $PREFIX-ca.cacert
|
||||
|
||||
echo "openssl x509 -in $PREFIX-ca.cacert -outform der -out $PREFIX-ca.der "
|
||||
$OPENSSL x509 -in $PREFIX-ca.cacert -outform der -out $PREFIX-ca.der
|
||||
|
||||
echo "openssl x509 -in $PREFIX-ca.cacert -text -nameopt multiline > $PREFIX-ca.crt "
|
||||
|
||||
$OPENSSL x509 -in $PREFIX-ca.cacert -text -nameopt multiline > $PREFIX-ca.crt
|
||||
|
||||
echo "openssl x509 -noout -text -in $PREFIX-ca.cacert -nameopt multiline"
|
||||
$OPENSSL x509 -noout -text -in $PREFIX-ca.cacert -nameopt multiline
|
||||
|
||||
#$OPENSSL rsa -in ../keys/$PREFIX-ca.key -text -noout -pubout
|
||||
"$OPENSSL" genrsa -out "$PREFIX-ca.key" -passout fd:0 "$KEYSIZE" <<EOF
|
||||
pass:secret
|
||||
EOF
|
||||
"$OPENSSL" req -config "$PREFIX-ca.prm" -new -key "$PREFIX-ca.key" -out "$PREFIX-ca.csr" -passin fd:0 <<EOF
|
||||
pass:secret
|
||||
EOF
|
||||
"$OPENSSL" x509 -set_serial "$SERIAL" -extfile "$PREFIX-ca.prm" -days "$DURATION" -req -signkey "$PREFIX-ca.key" -in "$PREFIX-ca.csr" -out "$PREFIX-$SERIAL-ca.cacert" "$DIGESTALGO"
|
||||
"$OPENSSL" x509 -text -in "$PREFIX-$SERIAL-ca.cacert" -nameopt multiline > "$PREFIX-ca.cacert"
|
||||
"$OPENSSL" x509 -in "$PREFIX-ca.cacert" -outform der -out "$PREFIX-ca.der"
|
||||
"$OPENSSL" x509 -in "$PREFIX-ca.cacert" -text -nameopt multiline > "$PREFIX-ca.crt"
|
||||
"$OPENSSL" x509 -noout -text -in "$PREFIX-ca.cacert" -nameopt multiline
|
||||
# "$OPENSSL" rsa -in "../keys/$PREFIX-ca.key" -text -noout -pubout
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
#!/bin/bash
|
||||
#!/usr/bin/env bash
|
||||
#***************************************************************************
|
||||
# _ _ ____ _
|
||||
# Project ___| | | | _ \| |
|
||||
|
|
@ -23,18 +23,18 @@
|
|||
#
|
||||
###########################################################################
|
||||
|
||||
# exit on first fail
|
||||
set -eu
|
||||
|
||||
OPENSSL=openssl
|
||||
if [ -f /usr/local/ssl/bin/openssl ] ; then
|
||||
OPENSSL=/usr/local/ssl/bin/openssl
|
||||
if [ -f /usr/local/ssl/bin/openssl ]; then
|
||||
OPENSSL=/usr/local/ssl/bin/openssl
|
||||
fi
|
||||
|
||||
USAGE="echo Usage is genserv.sh <prefix> <caprefix>"
|
||||
USAGE='echo Usage is genserv.sh <prefix> <caprefix>'
|
||||
|
||||
# exit on first fail
|
||||
set -e
|
||||
|
||||
HOME=`pwd`
|
||||
cd $HOME
|
||||
HOME=$(pwd)
|
||||
cd "$HOME"
|
||||
|
||||
KEYSIZE=2048
|
||||
DURATION=3000
|
||||
|
|
@ -45,99 +45,90 @@ REQ=YES
|
|||
P12=NO
|
||||
DHP=NO
|
||||
|
||||
PREFIX=$1
|
||||
if [ ".$PREFIX" = . ] ; then
|
||||
echo No configuration prefix
|
||||
NOTOK=1
|
||||
NOTOK=
|
||||
|
||||
PREFIX="${1:-}"
|
||||
if [ -z "$PREFIX" ]; then
|
||||
echo 'No configuration prefix'
|
||||
NOTOK=1
|
||||
else
|
||||
if [ ! -f $PREFIX-sv.prm ] ; then
|
||||
echo No configuration file $PREFIX-sv.prm
|
||||
NOTOK=1
|
||||
fi
|
||||
if [ ! -f "$PREFIX-sv.prm" ]; then
|
||||
echo "No configuration file $PREFIX-sv.prm"
|
||||
NOTOK=1
|
||||
fi
|
||||
fi
|
||||
|
||||
CAPREFIX=$2
|
||||
if [ ".$CAPREFIX" = . ] ; then
|
||||
echo No CA prefix
|
||||
NOTOK=1
|
||||
CAPREFIX="${2:-}"
|
||||
if [ -z "$CAPREFIX" ]; then
|
||||
echo No CA prefix
|
||||
NOTOK=1
|
||||
else
|
||||
if [ ! -f $CAPREFIX-ca.cacert ] ; then
|
||||
echo No CA certificate file $CAPREFIX-ca.caert
|
||||
NOTOK=1
|
||||
fi
|
||||
if [ ! -f $CAPREFIX-ca.key ] ; then
|
||||
echo No $CAPREFIX key
|
||||
NOTOK=1
|
||||
fi
|
||||
if [ ! -f "$CAPREFIX-ca.cacert" ]; then
|
||||
echo "No CA certificate file $CAPREFIX-ca.caert"
|
||||
NOTOK=1
|
||||
fi
|
||||
if [ ! -f "$CAPREFIX-ca.key" ]; then
|
||||
echo "No $CAPREFIX key"
|
||||
NOTOK=1
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ ".$NOTOK" != . ] ; then
|
||||
echo "Sorry, I can't do that for you."
|
||||
$USAGE
|
||||
exit
|
||||
if [ -n "$NOTOK" ]; then
|
||||
echo 'Sorry, I cannot do that for you.'
|
||||
$USAGE
|
||||
exit
|
||||
fi
|
||||
|
||||
if [ ".$SERIAL" = . ] ; then
|
||||
GETSERIAL="\$t = time ;\$d = \$t . substr(\$t+$$ ,-4,4)-1;print \$d"
|
||||
SERIAL=`/usr/bin/env perl -e "$GETSERIAL"`
|
||||
if [ -z "${SERIAL:-}" ]; then
|
||||
SERIAL="$(date +'%s')${RANDOM:(-4)}"
|
||||
fi
|
||||
|
||||
echo SERIAL=$SERIAL PREFIX=$PREFIX CAPREFIX=$CAPREFIX DURATION=$DURATION KEYSIZE=$KEYSIZE
|
||||
echo "SERIAL=$SERIAL PREFIX=$PREFIX CAPREFIX=$CAPREFIX DURATION=$DURATION KEYSIZE=$KEYSIZE"
|
||||
|
||||
if [ "$DHP." = YES. ] ; then
|
||||
echo "openssl dhparam -2 -out $PREFIX-sv.dhp $KEYSIZE"
|
||||
$OPENSSL dhparam -2 -out $PREFIX-sv.dhp $KEYSIZE
|
||||
set -x
|
||||
|
||||
if [ "$DHP" = YES ]; then
|
||||
"$OPENSSL" dhparam -2 -out "$PREFIX-sv.dhp" "$KEYSIZE"
|
||||
fi
|
||||
if [ "$REQ" = YES ]; then
|
||||
"$OPENSSL" req -config "$PREFIX-sv.prm" -newkey "rsa:$KEYSIZE" -keyout "$PREFIX-sv.key" -out "$PREFIX-sv.csr" -passout fd:0 <<EOF
|
||||
pass:secret
|
||||
EOF
|
||||
fi
|
||||
|
||||
if [ "$REQ." = YES. ] ; then
|
||||
echo "openssl req -config $PREFIX-sv.prm -newkey rsa:$KEYSIZE -keyout $PREFIX-sv.key -out $PREFIX-sv.csr -passout XXX"
|
||||
$OPENSSL req -config $PREFIX-sv.prm -newkey rsa:$KEYSIZE -keyout $PREFIX-sv.key -out $PREFIX-sv.csr -passout pass:secret
|
||||
"$OPENSSL" rsa -in "$PREFIX-sv.key" -out "$PREFIX-sv.key" -passin fd:0 <<EOF
|
||||
pass:secret
|
||||
EOF
|
||||
|
||||
echo 'pseudo secrets generated'
|
||||
|
||||
"$OPENSSL" rsa -in "$PREFIX-sv.key" -pubout -outform DER -out "$PREFIX-sv.pub.der"
|
||||
"$OPENSSL" rsa -in "$PREFIX-sv.key" -pubout -outform PEM -out "$PREFIX-sv.pub.pem"
|
||||
"$OPENSSL" x509 -set_serial "$SERIAL" -extfile "$PREFIX-sv.prm" -days "$DURATION" -CA "$CAPREFIX-ca.cacert" -CAkey "$CAPREFIX-ca.key" -in "$PREFIX-sv.csr" -req -text -nameopt multiline "$DIGESTALGO" > "$PREFIX-sv.crt"
|
||||
|
||||
if [ "$P12" = YES ]; then
|
||||
"$OPENSSL" pkcs12 -export -des3 -out "$PREFIX-sv.p12" -caname "$CAPREFIX" -name "$PREFIX" -inkey "$PREFIX-sv.key" -in "$PREFIX-sv.crt" -certfile "$CAPREFIX-ca.crt"
|
||||
fi
|
||||
|
||||
echo "openssl rsa -in $PREFIX-sv.key -out $PREFIX-sv.key"
|
||||
$OPENSSL rsa -in $PREFIX-sv.key -out $PREFIX-sv.key -passin pass:secret
|
||||
echo pseudo secrets generated
|
||||
|
||||
echo "openssl rsa -in $PREFIX-sv.key -pubout -outform DER -out $PREFIX-sv.pub.der"
|
||||
$OPENSSL rsa -in $PREFIX-sv.key -pubout -outform DER -out $PREFIX-sv.pub.der
|
||||
|
||||
echo "openssl rsa -in $PREFIX-sv.key -pubout -outform PEM -out $PREFIX-sv.pub.pem"
|
||||
$OPENSSL rsa -in $PREFIX-sv.key -pubout -outform PEM -out $PREFIX-sv.pub.pem
|
||||
|
||||
echo "openssl x509 -set_serial $SERIAL -extfile $PREFIX-sv.prm -days $DURATION -CA $CAPREFIX-ca.cacert -CAkey $CAPREFIX-ca.key -in $PREFIX-sv.csr -req -text -nameopt multiline $DIGESTALGO > $PREFIX-sv.crt "
|
||||
|
||||
$OPENSSL x509 -set_serial $SERIAL -extfile $PREFIX-sv.prm -days $DURATION -CA $CAPREFIX-ca.cacert -CAkey $CAPREFIX-ca.key -in $PREFIX-sv.csr -req -text -nameopt multiline $DIGESTALGO > $PREFIX-sv.crt
|
||||
|
||||
if [ "$P12." = YES. ] ; then
|
||||
|
||||
echo "$OPENSSL pkcs12 -export -des3 -out $PREFIX-sv.p12 -caname $CAPREFIX -name $PREFIX -inkey $PREFIX-sv.key -in $PREFIX-sv.crt -certfile $CAPREFIX-ca.crt "
|
||||
|
||||
$OPENSSL pkcs12 -export -des3 -out $PREFIX-sv.p12 -caname $CAPREFIX -name $PREFIX -inkey $PREFIX-sv.key -in $PREFIX-sv.crt -certfile $CAPREFIX-ca.crt
|
||||
fi
|
||||
|
||||
echo "openssl x509 -noout -text -hash -in $PREFIX-sv.selfcert -nameopt multiline"
|
||||
$OPENSSL x509 -noout -text -hash -in $PREFIX-sv.crt -nameopt multiline
|
||||
"$OPENSSL" x509 -noout -text -hash -in "$PREFIX-sv.crt" -nameopt multiline
|
||||
|
||||
# revoke server cert
|
||||
touch $CAPREFIX-ca.db
|
||||
echo 01 > $CAPREFIX-ca.cnt
|
||||
echo "openssl ca -config $CAPREFIX-ca.cnf -revoke $PREFIX-sv.crt"
|
||||
$OPENSSL ca -config $CAPREFIX-ca.cnf -revoke $PREFIX-sv.crt
|
||||
touch "$CAPREFIX-ca.db"
|
||||
echo 01 > "$CAPREFIX-ca.cnt"
|
||||
"$OPENSSL" ca -config "$CAPREFIX-ca.cnf" -revoke "$PREFIX-sv.crt"
|
||||
|
||||
# issue CRL
|
||||
echo "openssl ca -config $CAPREFIX-ca.cnf -gencrl -out $PREFIX-sv.crl"
|
||||
$OPENSSL ca -config $CAPREFIX-ca.cnf -gencrl -out $PREFIX-sv.crl
|
||||
"$OPENSSL" ca -config "$CAPREFIX-ca.cnf" -gencrl -out "$PREFIX-sv.crl"
|
||||
|
||||
echo "openssl x509 -in $PREFIX-sv.crt -outform der -out $PREFIX-sv.der "
|
||||
$OPENSSL x509 -in $PREFIX-sv.crt -outform der -out $PREFIX-sv.der
|
||||
"$OPENSSL" x509 -in "$PREFIX-sv.crt" -outform der -out "$PREFIX-sv.der"
|
||||
|
||||
# all together now
|
||||
touch $PREFIX-sv.dhp
|
||||
cat $PREFIX-sv.prm $PREFIX-sv.key $PREFIX-sv.crt $PREFIX-sv.dhp >$PREFIX-sv.pem
|
||||
chmod o-r $PREFIX-sv.prm
|
||||
touch "$PREFIX-sv.dhp"
|
||||
cat "$PREFIX-sv.prm" "$PREFIX-sv.key" "$PREFIX-sv.crt" "$PREFIX-sv.dhp" > "$PREFIX-sv.pem"
|
||||
chmod o-r "$PREFIX-sv.prm"
|
||||
|
||||
$OPENSSL x509 -in $PREFIX-sv.pem -pubkey -noout | \
|
||||
$OPENSSL pkey -pubin -outform der | $OPENSSL dgst -sha256 -binary | \
|
||||
$OPENSSL enc -base64 >$PREFIX-sv.pubkey-pinned
|
||||
"$OPENSSL" x509 -in "$PREFIX-sv.pem" -pubkey -noout | \
|
||||
"$OPENSSL" pkey -pubin -outform der | "$OPENSSL" dgst -sha256 -binary | \
|
||||
"$OPENSSL" enc -base64 > "$PREFIX-sv.pubkey-pinned"
|
||||
|
||||
echo "$PREFIX-sv.pem done"
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue