-
Notifications
You must be signed in to change notification settings - Fork 116
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
gen-certurl: Read SCT files from directory specified with -sctDir #259
Conversation
Instead of reading a serialized SignedCertificateTimestampList from a file, read all *.sct files in a directory given by the -sctDir flag and serialize them into SignedCertificateTimestampList. This matches the way how nginx-ct and Apache's mod_ssl_ct module work, and allows users to use existing SCT generation tools.
# Fill in dummy data for OCSP/SCT, since the certificate is self-signed. | ||
gen-certurl -pem cert.pem -ocsp <(echo ocsp) -sct <(echo sct) > cert.cbor | ||
# Fill in dummy data for OCSP, since the certificate is self-signed. | ||
gen-certurl -pem cert.pem -ocsp <(echo ocsp) > cert.cbor |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I removed -sct
here since SCT is not necessary for self-signed certs.
I plan to add a separate section for instructions to create signed exchanges with trusted certificates, and will explain the usage of -sctDir
there.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
sgtm
# Fill in dummy data for OCSP/SCT, since the certificate is self-signed. | ||
gen-certurl -pem cert.pem -ocsp <(echo ocsp) -sct <(echo sct) > cert.cbor | ||
# Fill in dummy data for OCSP, since the certificate is self-signed. | ||
gen-certurl -pem cert.pem -ocsp <(echo ocsp) > cert.cbor |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
sgtm
go/signedexchange/certurl/sct.go
Outdated
} | ||
|
||
var buf bytes.Buffer | ||
buf.Grow(total_length + 2) // +2 for length |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is this line necessary?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Removed.
go/signedexchange/certurl/sct.go
Outdated
|
||
var buf bytes.Buffer | ||
buf.Grow(total_length + 2) // +2 for length | ||
binary.Write(&buf, binary.BigEndian, uint16(total_length)) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
please catch err:
if err := binary.Write(...); err != nil {
panic(err) or return nil, err
}
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Done (here and elsewhere).
go/signedexchange/certurl/sct.go
Outdated
buf.Grow(total_length + 2) // +2 for length | ||
binary.Write(&buf, binary.BigEndian, uint16(total_length)) | ||
for _, sct := range scts { | ||
binary.Write(&buf, binary.BigEndian, uint16(len(sct))) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
ditto
go/signedexchange/certurl/sct.go
Outdated
binary.Write(&buf, binary.BigEndian, uint16(total_length)) | ||
for _, sct := range scts { | ||
binary.Write(&buf, binary.BigEndian, uint16(len(sct))) | ||
buf.Write(sct) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
ditto
gen-certurl's -sct option is deprecated in WICG/webpackage#259. Bug: 803774 Change-Id: I4fbc575366aba978b262418d2cf415121e840099 Reviewed-on: https://chromium-review.googlesource.com/1154745 Commit-Queue: Kunihiko Sakamoto <ksakamoto@chromium.org> Reviewed-by: Kouhei Ueno <kouhei@chromium.org> Cr-Commit-Position: refs/heads/master@{#578999}
Instead of reading a serialized SignedCertificateTimestampList from a
file, read all
*.sct
files in a directory given by the-sctDir
flagand serialize them into SignedCertificateTimestampList.
This matches the way how nginx-ct and Apache's mod_ssl_ct module work,
and allows users to use existing SCT generation tools.