mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
5137465c6f
3529 invalid comments in 528 files, grandfathered in while the linter only saw the working-tree diff. Removal ran through the linter's own collectors, so detection and deletion cannot drift: a comment whose opener line is blank before it and whose closer line is blank after it loses all its lines, anything else loses only the comment region, and a line left holding a bare delimiter goes with it. Five files keep their comments behind a nocheck marker instead. Four are upstream configs whose inline docs are upstream's own (mautrix, systemd journald, nextcloud-oidc-login, MediaWiki). In littlejs the commented-out entries ARE the deactivation mechanism for an example tile, so deleting them would delete configuration. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
111 lines
2.7 KiB
Bash
Executable File
111 lines
2.7 KiB
Bash
Executable File
#!/bin/sh
|
|
# In-container CA + per-hostname cert generator.
|
|
# See docs/contributing/environment/cache.md.
|
|
|
|
set -eu
|
|
|
|
CA_CRT=/ca/ca.crt
|
|
CA_KEY=/ca/ca.key
|
|
|
|
CA_DAYS=3650
|
|
LEAF_DAYS=730
|
|
|
|
HOSTNAMES="pypi.org files.pythonhosted.org registry.npmjs.org rubygems.org index.rubygems.org repo.packagist.org proxy.golang.org dl-cdn.alpinelinux.org raw.githubusercontent.com codeload.github.com"
|
|
|
|
log() { printf '[package-frontend-certs] %s\n' "$*" >&2; }
|
|
|
|
ensure_openssl() {
|
|
if command -v openssl >/dev/null 2>&1; then
|
|
return 0
|
|
fi
|
|
log "openssl not present in image — installing via apk"
|
|
apk add --no-cache openssl >/dev/null 2>&1
|
|
}
|
|
|
|
mkdir -p /ca /certs
|
|
chmod 0700 /ca
|
|
|
|
ensure_openssl
|
|
|
|
cert_still_valid() {
|
|
crt="$1"
|
|
[ -s "${crt}" ] || return 1
|
|
openssl x509 -in "${crt}" -noout -checkend 2592000 >/dev/null 2>&1
|
|
}
|
|
|
|
# OpenSSL 3.x rejects a trust-anchor CA that lacks keyUsage, so a CA generated
|
|
# before that extension was added must be regenerated even while still valid.
|
|
ca_has_key_usage() {
|
|
openssl x509 -in "$1" -noout -text 2>/dev/null | grep -q "Key Usage"
|
|
}
|
|
|
|
ensure_ca() {
|
|
if cert_still_valid "${CA_CRT}" && [ -s "${CA_KEY}" ] && ca_has_key_usage "${CA_CRT}"; then
|
|
log "CA already valid: ${CA_CRT}"
|
|
return 0
|
|
fi
|
|
log "Generating new root CA at ${CA_CRT}"
|
|
openssl genrsa -out "${CA_KEY}" 4096 >/dev/null 2>&1
|
|
chmod 0600 "${CA_KEY}"
|
|
openssl req -x509 -new -nodes \
|
|
-key "${CA_KEY}" \
|
|
-sha256 \
|
|
-days "${CA_DAYS}" \
|
|
-subj "/CN=Infinito Package-Cache Frontend CA/O=Infinito.Nexus" \
|
|
-addext "basicConstraints=critical,CA:TRUE" \
|
|
-addext "keyUsage=critical,keyCertSign,cRLSign" \
|
|
-addext "subjectKeyIdentifier=hash" \
|
|
-out "${CA_CRT}" >/dev/null 2>&1
|
|
chmod 0644 "${CA_CRT}"
|
|
}
|
|
|
|
ensure_leaf() {
|
|
hostname="$1"
|
|
crt="/certs/${hostname}.crt"
|
|
key="/certs/${hostname}.key"
|
|
|
|
if cert_still_valid "${crt}" && [ -s "${key}" ]; then
|
|
if openssl verify -CAfile "${CA_CRT}" "${crt}" >/dev/null 2>&1; then
|
|
return 0
|
|
fi
|
|
log "Leaf for ${hostname} no longer chains to current CA; regenerating"
|
|
fi
|
|
|
|
log "Generating leaf cert for ${hostname}"
|
|
openssl genrsa -out "${key}" 2048 >/dev/null 2>&1
|
|
chmod 0600 "${key}"
|
|
|
|
extfile="$(mktemp)"
|
|
{
|
|
printf 'subjectAltName = DNS:%s\n' "${hostname}"
|
|
printf 'extendedKeyUsage = serverAuth\n'
|
|
} >"${extfile}"
|
|
|
|
csr="$(mktemp)"
|
|
openssl req -new \
|
|
-key "${key}" \
|
|
-subj "/CN=${hostname}" \
|
|
-out "${csr}" >/dev/null 2>&1
|
|
|
|
openssl x509 -req \
|
|
-in "${csr}" \
|
|
-CA "${CA_CRT}" \
|
|
-CAkey "${CA_KEY}" \
|
|
-CAcreateserial \
|
|
-out "${crt}" \
|
|
-days "${LEAF_DAYS}" \
|
|
-sha256 \
|
|
-extfile "${extfile}" >/dev/null 2>&1
|
|
chmod 0644 "${crt}"
|
|
|
|
rm -f "${csr}" "${extfile}"
|
|
}
|
|
|
|
ensure_ca
|
|
count=0
|
|
for h in ${HOSTNAMES}; do
|
|
ensure_leaf "${h}"
|
|
count=$((count + 1))
|
|
done
|
|
log "CA + ${count} leaf certs ready under /certs"
|