kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

check_hostkeydoc: Fix indentation

Browse Source 
Replace spaces with tabs using `unexpand check_hostkeydoc`.

Acked-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
This commit is contained in:
Steffen Eiden
2025-06-11 13:25:19 +02:00
parent 017377c093
commit 619c466275
1 changed files with 33 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

66
genprotimg/samples/check_hostkeydoc
View File

@@ -31,8 +31,8 @@ CRL_ISSUER_FILE=$(mktemp)
cleanup()
{
rm -f "$ISSUER_PUBKEY_FILE" "$SIGNATURE_FILE" "$BODY_FILE" \
"$ISSUER_DN_FILE" "$SUBJECT_DN_FILE" "$DEF_ISSUER_ARMONK_DN_FILE" "$DEF_ISSUER_POUGHKEEPSIE_DN_FILE" \
"$CANONICAL_ISSUER_DN_FILE" "$CRL_SERIAL_FILE" "$CRL_ISSUER_FILE"
"$ISSUER_DN_FILE" "$SUBJECT_DN_FILE" "$DEF_ISSUER_ARMONK_DN_FILE" "$DEF_ISSUER_POUGHKEEPSIE_DN_FILE" \
"$CANONICAL_ISSUER_DN_FILE" "$CRL_SERIAL_FILE" "$CRL_ISSUER_FILE"
}
trap cleanup EXIT
@@ -75,7 +75,7 @@ curl_crl_by_crt()
CRT="$1"
OFFSET=$2
CRL_URL="$(openssl x509 -noout -text -in "$CRT" \
|grep 'URI:http.*\.crl' | sed -n "$OFFSET"p | xargs)"
|grep 'URI:http.*\.crl' | sed -n "$OFFSET"p | xargs)"
# no CRL at this offset
if [ -z "$CRL_URL" ];
@@ -90,27 +90,27 @@ check_verify_chain()
# Verify certificate chain in case a CA certificate file/bundle
# was specified on the command line.
if [ -z "$2" ]; then
cat >&2 <<-EOF
cat >&2 <<-EOF
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
No CA certificate specified! Skipping trust chain verification.
Make sure that '$1' is a valid certificate.
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
EOF
else
openssl verify -crl_download -crl_check "$2" || exit 1
openssl verify -crl_download -crl_check "$2" || exit 1
if ! stderr=$(openssl verify -crl_download -crl_check -untrusted "$2" "$1" 3>&2 2>&1 1>&3 3>&-); then
if ! stderr=$(openssl verify -crl_download -crl_check -untrusted "$2" "$1" 3>&2 2>&1 1>&3 3>&-); then
if ! printf '%s' "${stderr}" | grep -q 'max resp len exceeded'; then
printf '%s\n' "${stderr}"
exit 1
fi
printf '%s\n' "${stderr}"
exit 1
fi
# Turn off exit-on-error locally to be able to retry on invalid URIs
set +e
off=0;
# Search for a CRL in the CRT. If the first link does not work try
# again with the next one until either no more URIS are available or a
# CRL was found.
while [ $off -le 10 ]; do
while [ $off -le 10 ]; do
i=$(( i + 1 ))
CRL=curl_crl_by_crt "$3" $i
@@ -126,8 +126,8 @@ EOF
# Found one
break
done
openssl verify -CRLfile "${CRL_ISSUER_FILE}" -crl_check -untrusted "$2" "$1" || exit 1
fi
openssl verify -CRLfile "${CRL_ISSUER_FILE}" -crl_check -untrusted "$2" "$1" || exit 1
fi
set -e
fi
}
@@ -167,7 +167,7 @@ canonical_dn()
OUTPUT=$4
openssl "$OBJTYPE" -in "$OBJ" -"$DNTYPE" -noout -nameopt multiline |
LC_ALL=C sort | grep -v "$DNTYPE"= >"$OUTPUT"
LC_ALL=C sort | grep -v "$DNTYPE"= >"$OUTPUT"
}
default_issuer_armonk()
@@ -203,20 +203,20 @@ verify_default_issuer()
default_issuer_armonk >"$DEF_ISSUER_ARMONK_DN_FILE"
sed "s/\(^[ ]*organizationalUnitName[ ]*=[ ]*\).*\(Key Signing Service$\)/\1\2/" \
"$ISSUER_DN_FILE" >"$CANONICAL_ISSUER_DN_FILE"
"$ISSUER_DN_FILE" >"$CANONICAL_ISSUER_DN_FILE"
if ! {
diff "$CANONICAL_ISSUER_DN_FILE" "$DEF_ISSUER_POUGHKEEPSIE_DN_FILE" ||
diff "$CANONICAL_ISSUER_DN_FILE" "$DEF_ISSUER_ARMONK_DN_FILE"
diff "$CANONICAL_ISSUER_DN_FILE" "$DEF_ISSUER_POUGHKEEPSIE_DN_FILE" ||
diff "$CANONICAL_ISSUER_DN_FILE" "$DEF_ISSUER_ARMONK_DN_FILE"
} >/dev/null 2>&1; then
echo Incorrect default issuer >&2 && exit 1
echo Incorrect default issuer >&2 && exit 1
fi
}
verify_issuer_files()
{
if [ "$1" -eq 1 ]; then
verify_default_issuer
verify_default_issuer
fi
}
@@ -242,16 +242,16 @@ verify_dates()
NOW=$(date +%s)
if [ "$START" -le "$NOW" ] && [ "$NOW" -le "$END" ]; then
echo "${MSG} dates are OK"
echo "${MSG} dates are OK"
else
echo "${MSG} date verification failed" >&2 && exit 1
echo "${MSG} date verification failed" >&2 && exit 1
fi
}
crl_serials()
{
openssl crl -in "$1" -text -noout |
grep "Serial Number" >"$CRL_SERIAL_FILE"
grep "Serial Number" >"$CRL_SERIAL_FILE"
}
check_serial()
@@ -264,7 +264,7 @@ check_serial()
check_file()
{
[ -e "$1" ] ||
(echo "File '$1' not found" >&2 && exit 1)
(echo "File '$1' not found" >&2 && exit 1)
}
# check args
@@ -278,13 +278,13 @@ while getopts 'dr:c:h' opt; do
r) CRL_FILE=$OPTARG ;;
c) CA_FILE=$OPTARG ;;
h)
usage "$0"
exit 0
;;
usage "$0"
exit 0
;;
?)
usage "$0"
exit 1
;;
usage "$0"
exit 1
;;
esac
done
shift "$((OPTIND - 1))"
@@ -327,9 +327,9 @@ verify_dates "$(cert_time "$HKD_FILE" startdate)" "$(cert_time "$HKD_FILE" endda
if [ -n "$CRL_FILE" ]; then
printf "Checking CRL signature: "
extract_signature "$CRL_FILE" "$SIGNATURE_FILE" &&
extract_body "$CRL_FILE" "$BODY_FILE" &&
verify_signature "$ISSUER_PUBKEY_FILE" "$SIGNATURE_FILE" "$BODY_FILE" ||
exit 1
extract_body "$CRL_FILE" "$BODY_FILE" &&
verify_signature "$ISSUER_PUBKEY_FILE" "$SIGNATURE_FILE" "$BODY_FILE" ||
exit 1
printf "CRL "
canonical_dn crl "$CRL_FILE" issuer "$ISSUER_DN_FILE"
@@ -340,8 +340,8 @@ if [ -n "$CRL_FILE" ]; then
crl_serials "$CRL_FILE"
check_serial "$HKD_FILE" &&
echo "Certificate is revoked, do not use it anymore!" >&2 &&
exit 1
echo "Certificate is revoked, do not use it anymore!" >&2 &&
exit 1
fi
# We made it