6f439dc34f
Rework the generation of certificates, in order to make use of the SubjectAltName (SAN) extension, that is required for modern usage of TLS (see RFC 2818, or [1]) and now enforced by default for go version 1.15[2] (Fedora 33). For this a different config file is used, originally written by Lars, and assign SANs to the server and client certificates. Additionally, the correct extensions are used for each of those, so that their usage is limited to the server or client use case. The client certificate is renamed from "worker" to "client". The lifetime of the certificates is increased, as a side effect of the new config file. [1] https://github.com/urllib3/urllib3/issues/497 [2] https://golang.org/doc/go1.15#commonname Co-authored-by: Lars Karlitski <lars@karlitski.net>
47 lines
1.2 KiB
Bash
Executable file
47 lines
1.2 KiB
Bash
Executable file
#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
# this script must be run as root
|
|
if [ $UID != 0 ]; then
|
|
echo This script must be run as root.
|
|
exit 1
|
|
fi
|
|
|
|
TEST_DATA=${TEST_DATA:-test/data}
|
|
SHARE_DIR=${SHARE_DIR:-/tmp/osbuild-composer-koji-test}
|
|
|
|
if [[ -f "/etc/osbuild-composer/client-key.pem" ]]; then
|
|
echo "Copying client certificates"
|
|
|
|
cp /etc/osbuild-composer/client-key.pem ${SHARE_DIR}
|
|
cp /etc/osbuild-composer/client-crt.pem ${SHARE_DIR}
|
|
cp /etc/osbuild-composer/ca-crt.pem ${SHARE_DIR}/client-ca.pem
|
|
fi
|
|
|
|
mkdir -p /etc/osbuild-composer
|
|
mkdir -p /etc/osbuild-worker
|
|
|
|
echo "Copying kerberos keytabs"
|
|
cp ${SHARE_DIR}/client.keytab \
|
|
/etc/osbuild-composer/client.keytab
|
|
|
|
cp ${SHARE_DIR}/client.keytab \
|
|
/etc/osbuild-worker/client.keytab
|
|
|
|
echo "Copying composer kerberos configuration"
|
|
cp ${TEST_DATA}/osbuild-composer.toml \
|
|
/etc/osbuild-composer/
|
|
|
|
mkdir -p /etc/osbuild-worker
|
|
cp ${TEST_DATA}/osbuild-worker.toml \
|
|
/etc/osbuild-worker/
|
|
|
|
echo "Copying system kerberos configuration"
|
|
cp ${TEST_DATA}/krb5.local.conf \
|
|
/etc/krb5.conf.d/local
|
|
|
|
echo "Updating system trust chain"
|
|
cp ${SHARE_DIR}/ca-crt.pem \
|
|
/etc/pki/ca-trust/source/anchors/koji-ca-crt.pem
|
|
|
|
update-ca-trust
|