From 619c46627548aa42874730b44094812e6e87e202 Mon Sep 17 00:00:00 2001 From: Steffen Eiden Date: Wed, 11 Jun 2025 13:25:19 +0200 Subject: [PATCH] check_hostkeydoc: Fix indentation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replace spaces with tabs using `unexpand check_hostkeydoc`. Acked-by: Jan Höppner Signed-off-by: Steffen Eiden --- genprotimg/samples/check_hostkeydoc | 66 ++++++++++++++--------------- 1 file changed, 33 insertions(+), 33 deletions(-) diff --git a/genprotimg/samples/check_hostkeydoc b/genprotimg/samples/check_hostkeydoc index b34b5d13..44152d79 100755 --- a/genprotimg/samples/check_hostkeydoc +++ b/genprotimg/samples/check_hostkeydoc @@ -31,8 +31,8 @@ CRL_ISSUER_FILE=$(mktemp) cleanup() { rm -f "$ISSUER_PUBKEY_FILE" "$SIGNATURE_FILE" "$BODY_FILE" \ - "$ISSUER_DN_FILE" "$SUBJECT_DN_FILE" "$DEF_ISSUER_ARMONK_DN_FILE" "$DEF_ISSUER_POUGHKEEPSIE_DN_FILE" \ - "$CANONICAL_ISSUER_DN_FILE" "$CRL_SERIAL_FILE" "$CRL_ISSUER_FILE" + "$ISSUER_DN_FILE" "$SUBJECT_DN_FILE" "$DEF_ISSUER_ARMONK_DN_FILE" "$DEF_ISSUER_POUGHKEEPSIE_DN_FILE" \ + "$CANONICAL_ISSUER_DN_FILE" "$CRL_SERIAL_FILE" "$CRL_ISSUER_FILE" } trap cleanup EXIT @@ -75,7 +75,7 @@ curl_crl_by_crt() CRT="$1" OFFSET=$2 CRL_URL="$(openssl x509 -noout -text -in "$CRT" \ - |grep 'URI:http.*\.crl' | sed -n "$OFFSET"p | xargs)" + |grep 'URI:http.*\.crl' | sed -n "$OFFSET"p | xargs)" # no CRL at this offset if [ -z "$CRL_URL" ]; @@ -90,27 +90,27 @@ check_verify_chain() # Verify certificate chain in case a CA certificate file/bundle # was specified on the command line. if [ -z "$2" ]; then - cat >&2 <<-EOF + cat >&2 <<-EOF !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! No CA certificate specified! Skipping trust chain verification. Make sure that '$1' is a valid certificate. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! EOF else - openssl verify -crl_download -crl_check "$2" || exit 1 + openssl verify -crl_download -crl_check "$2" || exit 1 - if ! stderr=$(openssl verify -crl_download -crl_check -untrusted "$2" "$1" 3>&2 2>&1 1>&3 3>&-); then + if ! stderr=$(openssl verify -crl_download -crl_check -untrusted "$2" "$1" 3>&2 2>&1 1>&3 3>&-); then if ! printf '%s' "${stderr}" | grep -q 'max resp len exceeded'; then - printf '%s\n' "${stderr}" - exit 1 - fi + printf '%s\n' "${stderr}" + exit 1 + fi # Turn off exit-on-error locally to be able to retry on invalid URIs set +e off=0; # Search for a CRL in the CRT. If the first link does not work try # again with the next one until either no more URIS are available or a # CRL was found. - while [ $off -le 10 ]; do + while [ $off -le 10 ]; do i=$(( i + 1 )) CRL=curl_crl_by_crt "$3" $i @@ -126,8 +126,8 @@ EOF # Found one break done - openssl verify -CRLfile "${CRL_ISSUER_FILE}" -crl_check -untrusted "$2" "$1" || exit 1 - fi + openssl verify -CRLfile "${CRL_ISSUER_FILE}" -crl_check -untrusted "$2" "$1" || exit 1 + fi set -e fi } @@ -167,7 +167,7 @@ canonical_dn() OUTPUT=$4 openssl "$OBJTYPE" -in "$OBJ" -"$DNTYPE" -noout -nameopt multiline | - LC_ALL=C sort | grep -v "$DNTYPE"= >"$OUTPUT" + LC_ALL=C sort | grep -v "$DNTYPE"= >"$OUTPUT" } default_issuer_armonk() @@ -203,20 +203,20 @@ verify_default_issuer() default_issuer_armonk >"$DEF_ISSUER_ARMONK_DN_FILE" sed "s/\(^[ ]*organizationalUnitName[ ]*=[ ]*\).*\(Key Signing Service$\)/\1\2/" \ - "$ISSUER_DN_FILE" >"$CANONICAL_ISSUER_DN_FILE" + "$ISSUER_DN_FILE" >"$CANONICAL_ISSUER_DN_FILE" if ! { - diff "$CANONICAL_ISSUER_DN_FILE" "$DEF_ISSUER_POUGHKEEPSIE_DN_FILE" || - diff "$CANONICAL_ISSUER_DN_FILE" "$DEF_ISSUER_ARMONK_DN_FILE" + diff "$CANONICAL_ISSUER_DN_FILE" "$DEF_ISSUER_POUGHKEEPSIE_DN_FILE" || + diff "$CANONICAL_ISSUER_DN_FILE" "$DEF_ISSUER_ARMONK_DN_FILE" } >/dev/null 2>&1; then - echo Incorrect default issuer >&2 && exit 1 + echo Incorrect default issuer >&2 && exit 1 fi } verify_issuer_files() { if [ "$1" -eq 1 ]; then - verify_default_issuer + verify_default_issuer fi } @@ -242,16 +242,16 @@ verify_dates() NOW=$(date +%s) if [ "$START" -le "$NOW" ] && [ "$NOW" -le "$END" ]; then - echo "${MSG} dates are OK" + echo "${MSG} dates are OK" else - echo "${MSG} date verification failed" >&2 && exit 1 + echo "${MSG} date verification failed" >&2 && exit 1 fi } crl_serials() { openssl crl -in "$1" -text -noout | - grep "Serial Number" >"$CRL_SERIAL_FILE" + grep "Serial Number" >"$CRL_SERIAL_FILE" } check_serial() @@ -264,7 +264,7 @@ check_serial() check_file() { [ -e "$1" ] || - (echo "File '$1' not found" >&2 && exit 1) + (echo "File '$1' not found" >&2 && exit 1) } # check args @@ -278,13 +278,13 @@ while getopts 'dr:c:h' opt; do r) CRL_FILE=$OPTARG ;; c) CA_FILE=$OPTARG ;; h) - usage "$0" - exit 0 - ;; + usage "$0" + exit 0 + ;; ?) - usage "$0" - exit 1 - ;; + usage "$0" + exit 1 + ;; esac done shift "$((OPTIND - 1))" @@ -327,9 +327,9 @@ verify_dates "$(cert_time "$HKD_FILE" startdate)" "$(cert_time "$HKD_FILE" endda if [ -n "$CRL_FILE" ]; then printf "Checking CRL signature: " extract_signature "$CRL_FILE" "$SIGNATURE_FILE" && - extract_body "$CRL_FILE" "$BODY_FILE" && - verify_signature "$ISSUER_PUBKEY_FILE" "$SIGNATURE_FILE" "$BODY_FILE" || - exit 1 + extract_body "$CRL_FILE" "$BODY_FILE" && + verify_signature "$ISSUER_PUBKEY_FILE" "$SIGNATURE_FILE" "$BODY_FILE" || + exit 1 printf "CRL " canonical_dn crl "$CRL_FILE" issuer "$ISSUER_DN_FILE" @@ -340,8 +340,8 @@ if [ -n "$CRL_FILE" ]; then crl_serials "$CRL_FILE" check_serial "$HKD_FILE" && - echo "Certificate is revoked, do not use it anymore!" >&2 && - exit 1 + echo "Certificate is revoked, do not use it anymore!" >&2 && + exit 1 fi # We made it