From 8751cfc409cb605f078a3951be4d035da1f72bd4 Mon Sep 17 00:00:00 2001 From: Marc Hartmayer Date: Fri, 15 Mar 2024 09:50:33 +0000 Subject: [PATCH] genprotimg/samples/check_hostkeydoc: code formatting Reviewed-by: Steffen Eiden Reviewed-by: Christoph Schlameuss Signed-off-by: Marc Hartmayer Signed-off-by: Steffen Eiden --- genprotimg/samples/check_hostkeydoc | 70 +++++++++++++---------------- 1 file changed, 32 insertions(+), 38 deletions(-) diff --git a/genprotimg/samples/check_hostkeydoc b/genprotimg/samples/check_hostkeydoc index 81da6347..de8178ba 100755 --- a/genprotimg/samples/check_hostkeydoc +++ b/genprotimg/samples/check_hostkeydoc @@ -15,7 +15,6 @@ # s390-tools is free software; you can redistribute it and/or modify # it under the terms of the MIT license. See LICENSE for details. - # Allocate temporary files ISSUER_PUBKEY_FILE=$(mktemp) SIGNATURE_FILE=$(mktemp) @@ -37,8 +36,7 @@ cleanup() trap cleanup EXIT # Enhanced error checking for bash -if [ -n "${BASH}" ] -then +if [ -n "${BASH}" ]; then # shellcheck disable=SC3040 set -o posix # shellcheck disable=SC3040 @@ -51,7 +49,7 @@ set -e # Usage usage() { -cat <<-EOF + cat <<-EOF Usage: $(basename "$1") [-d] [-c CA-cert] [-r CRL] host-key-doc signing-key-cert Verify an IBM Secure Execution host key document against @@ -75,8 +73,7 @@ check_verify_chain() { # Verify certificate chain in case a CA certificate file/bundle # was specified on the command line. - if [ -z "$2" ] - then + if [ -z "$2" ]; then cat >&2 <<-EOF !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! No CA certificate specified! Skipping trust chain verification. @@ -85,14 +82,14 @@ Make sure that '$1' is a valid certificate. EOF else openssl verify -crl_download -crl_check "$2" && - openssl verify -crl_download -crl_check -untrusted "$2" "$1" || - exit 1 + openssl verify -crl_download -crl_check -untrusted "$2" "$1" || + exit 1 fi } extract_pubkey() { - openssl x509 -in "$1" -pubkey -noout > "$2" + openssl x509 -in "$1" -pubkey -noout >"$2" } extract_signature() @@ -124,8 +121,8 @@ canonical_dn() DNTYPE=$3 OUTPUT=$4 - openssl "$OBJTYPE" -in "$OBJ" -"$DNTYPE" -noout -nameopt multiline \ - | LC_ALL=C sort | grep -v "$DNTYPE"= > "$OUTPUT" + openssl "$OBJTYPE" -in "$OBJ" -"$DNTYPE" -noout -nameopt multiline | + LC_ALL=C sort | grep -v "$DNTYPE"= >"$OUTPUT" } default_issuer_armonk() @@ -157,24 +154,24 @@ EOF # stripping off the prefix verify_default_issuer() { - default_issuer_pougkeepsie > "$DEF_ISSUER_POUGHKEEPSIE_DN_FILE" - default_issuer_armonk > "$DEF_ISSUER_ARMONK_DN_FILE" + default_issuer_pougkeepsie >"$DEF_ISSUER_POUGHKEEPSIE_DN_FILE" + default_issuer_armonk >"$DEF_ISSUER_ARMONK_DN_FILE" sed "s/\(^[ ]*organizationalUnitName[ ]*=[ ]*\).*\(Key Signing Service$\)/\1\2/" \ - "$ISSUER_DN_FILE" > "$CANONICAL_ISSUER_DN_FILE" + "$ISSUER_DN_FILE" >"$CANONICAL_ISSUER_DN_FILE" - if ! { diff "$CANONICAL_ISSUER_DN_FILE" "$DEF_ISSUER_POUGHKEEPSIE_DN_FILE" || - diff "$CANONICAL_ISSUER_DN_FILE" "$DEF_ISSUER_ARMONK_DN_FILE"; } >/dev/null 2>&1 - then + if ! { + diff "$CANONICAL_ISSUER_DN_FILE" "$DEF_ISSUER_POUGHKEEPSIE_DN_FILE" || + diff "$CANONICAL_ISSUER_DN_FILE" "$DEF_ISSUER_ARMONK_DN_FILE" + } >/dev/null 2>&1; then echo Incorrect default issuer >&2 && exit 1 fi } verify_issuer_files() { - if [ "$1" -eq 1 ] - then - verify_default_issuer + if [ "$1" -eq 1 ]; then + verify_default_issuer fi } @@ -199,8 +196,7 @@ verify_dates() MSG="${3:-Certificate}" NOW=$(date +%s) - if [ "$START" -le "$NOW" ] && [ "$NOW" -le "$END" ] - then + if [ "$START" -le "$NOW" ] && [ "$NOW" -le "$END" ]; then echo "${MSG} dates are OK" else echo "${MSG} date verification failed" >&2 && exit 1 @@ -209,8 +205,8 @@ verify_dates() crl_serials() { - openssl crl -in "$1" -text -noout | \ - grep "Serial Number" > "$CRL_SERIAL_FILE" + openssl crl -in "$1" -text -noout | + grep "Serial Number" >"$CRL_SERIAL_FILE" } check_serial() @@ -223,7 +219,7 @@ check_serial() check_file() { [ -e "$1" ] || - (echo "File '$1' not found" >&2 && exit 1) + (echo "File '$1' not found" >&2 && exit 1) } # check args @@ -248,8 +244,7 @@ while getopts 'dr:c:h' opt; do done shift "$((OPTIND - 1))" -if [ $# -ne 2 ] -then +if [ $# -ne 2 ]; then usage "$0" >&2 exit 1 fi @@ -270,10 +265,10 @@ check_verify_chain "$HKSK_FILE" "$CA_FILE" # Verify host key document signature printf "Checking host key document signature: " extract_pubkey "$HKSK_FILE" "$ISSUER_PUBKEY_FILE" && -extract_signature "$HKD_FILE" "$SIGNATURE_FILE" && -extract_body "$HKD_FILE" "$BODY_FILE" && -verify_signature "$ISSUER_PUBKEY_FILE" "$SIGNATURE_FILE" "$BODY_FILE" || -exit 1 + extract_signature "$HKD_FILE" "$SIGNATURE_FILE" && + extract_body "$HKD_FILE" "$BODY_FILE" && + verify_signature "$ISSUER_PUBKEY_FILE" "$SIGNATURE_FILE" "$BODY_FILE" || + exit 1 # Verify the issuer canonical_dn x509 "$HKD_FILE" issuer "$ISSUER_DN_FILE" @@ -284,13 +279,12 @@ verify_issuer_files $CHECK_DEFAULT_ISSUER verify_dates "$(cert_time "$HKD_FILE" startdate)" "$(cert_time "$HKD_FILE" enddate)" # Check CRL if specified -if [ -n "$CRL_FILE" ] -then +if [ -n "$CRL_FILE" ]; then printf "Checking CRL signature: " extract_signature "$CRL_FILE" "$SIGNATURE_FILE" && - extract_body "$CRL_FILE" "$BODY_FILE" && - verify_signature "$ISSUER_PUBKEY_FILE" "$SIGNATURE_FILE" "$BODY_FILE" || - exit 1 + extract_body "$CRL_FILE" "$BODY_FILE" && + verify_signature "$ISSUER_PUBKEY_FILE" "$SIGNATURE_FILE" "$BODY_FILE" || + exit 1 printf "CRL " canonical_dn crl "$CRL_FILE" issuer "$ISSUER_DN_FILE" @@ -301,8 +295,8 @@ then crl_serials "$CRL_FILE" check_serial "$HKD_FILE" && - echo "Certificate is revoked, do not use it anymore!" >&2 && - exit 1 + echo "Certificate is revoked, do not use it anymore!" >&2 && + exit 1 fi # We made it