Skip to content
This repository was archived by the owner on Oct 15, 2024. It is now read-only.
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
124 commits
Select commit Hold shift + click to select a range
038e4d2
Update README
akoserwal Nov 12, 2019
2bc4eb0
Update READMe
akoserwal Nov 12, 2019
6f10f22
also output sha256 digest when generating certificate
izolight Nov 24, 2019
b41fd33
update documentation with sha256 hashes
izolight Nov 24, 2019
6e8b031
push images to github/docker container registry
nickysemenza Mar 21, 2023
b4d0d87
Merge pull request #1277 from cloudflare/nicky/docker
nickysemenza Mar 28, 2023
f7af124
Respect custom x509 ext in selfsign
sthussey Apr 7, 2023
2fab338
add workflow to run goreleaser snapshot
nickysemenza Nov 30, 2022
908df50
Merge pull request #1285 from cloudflare/nicky/goreleaser-action-snap…
nickysemenza Apr 19, 2023
636ddf8
goreleaser: Add ARMv7 binaries
patrickelectric Apr 18, 2023
415a59e
Merge pull request #1282 from patrickelectric/arm
nickysemenza Apr 26, 2023
76629b5
snapshot.yml: update actions/checkout to v3
kbdharun Apr 28, 2023
e9d0790
go.yml: update actions/checkout to v3, actions/setup-go to v4
kbdharun Apr 28, 2023
5f34df7
fix architecture for docker builds
nickysemenza Apr 26, 2023
88bfcbf
Merge pull request #1288 from kbdharun/master
nickysemenza May 2, 2023
f6cb3e8
build pacakges with latest go
nickysemenza May 11, 2023
2b2dd1a
configure dependabot
ahrtr May 12, 2023
214bd57
Merge pull request #1292 from ahrtr/configure_dependabot_20230512
nickysemenza May 12, 2023
e1d1777
build(deps): bump docker/build-push-action from 3 to 4
dependabot[bot] May 12, 2023
e246148
build(deps): bump github.com/prometheus/client_golang
dependabot[bot] May 12, 2023
58b12e7
Merge pull request #1289 from cloudflare/nicky/docker-arch
nickysemenza May 12, 2023
03a86ea
build(deps): bump github.com/jmoiron/sqlx from 1.3.3 to 1.3.5
dependabot[bot] May 12, 2023
f37a685
Merge pull request #1294 from cloudflare/dependabot/go_modules/github…
nickysemenza May 12, 2023
3e4a060
Merge pull request #1293 from cloudflare/dependabot/github_actions/do…
nickysemenza May 12, 2023
c1cdc1b
Merge pull request #1296 from cloudflare/dependabot/go_modules/github…
nickysemenza May 12, 2023
04f6d3e
build(deps): bump github.com/go-sql-driver/mysql from 1.6.0 to 1.7.1
dependabot[bot] May 12, 2023
be9f3a3
build(deps): bump github.com/lib/pq from 1.10.1 to 1.10.9
dependabot[bot] May 12, 2023
4a5a64d
bump github.com/zmap/zlint/v3 from 3.1.0 to 3.4.1
ahrtr May 12, 2023
bf9636a
update lint test for bumped zlint
nickysemenza May 12, 2023
11796e1
Merge pull request #1291 from ahrtr/bump_zlint_20230512
nickysemenza May 12, 2023
0d872f6
Merge pull request #1298 from cloudflare/dependabot/go_modules/github…
nickysemenza May 12, 2023
7bcbc6d
Merge pull request #1297 from cloudflare/dependabot/go_modules/github…
nickysemenza May 12, 2023
372ef3d
build(deps): bump github.com/google/certificate-transparency-go
dependabot[bot] May 12, 2023
9618eba
Merge pull request #1295 from cloudflare/dependabot/go_modules/github…
nickysemenza May 12, 2023
b2e0b85
Merge pull request #1290 from cloudflare/nicky/golang-cross-latest
nickysemenza May 12, 2023
7479ed6
build(deps): bump github.com/stretchr/testify from 1.8.0 to 1.8.2
dependabot[bot] May 15, 2023
21c13ab
build(deps): bump golang.org/x/crypto from 0.8.0 to 0.9.0
dependabot[bot] May 15, 2023
ce41e38
Merge pull request #1299 from cloudflare/dependabot/go_modules/github…
nickysemenza May 15, 2023
e1165bb
Merge pull request #1300 from cloudflare/dependabot/go_modules/golang…
nickysemenza May 15, 2023
b946db1
reenable vcs stamping with docker image that supports it
nickysemenza May 19, 2023
726dc22
build(deps): bump github.com/stretchr/testify from 1.8.2 to 1.8.3
dependabot[bot] May 22, 2023
c21e85d
Merge pull request #1303 from cloudflare/dependabot/go_modules/github…
nickysemenza May 22, 2023
5e37590
code optimization
testwill May 31, 2023
c46cc2b
build(deps): bump github.com/zmap/zlint/v3 from 3.4.1 to 3.5.0
dependabot[bot] Jun 12, 2023
9a0778d
Add support for generating ed25519 keys and certs (#1061)
izolight Jun 12, 2023
d042e64
Merge pull request #1309 from cloudflare/dependabot/go_modules/github…
nickysemenza Jun 12, 2023
6ea8605
Merge pull request #1063 from izolight/sha256-digest
nickysemenza Jun 12, 2023
c1a100a
build(deps): bump github.com/stretchr/testify from 1.8.3 to 1.8.4
dependabot[bot] Jun 12, 2023
68e04e2
Merge pull request #1302 from cloudflare/nicky/release-with-vcs
nickysemenza Jun 12, 2023
50f8789
Merge pull request #1304 from testwill/master
nickysemenza Jun 12, 2023
b447c47
Merge pull request #1305 from cloudflare/dependabot/go_modules/github…
nickysemenza Jun 12, 2023
1ba4686
build(deps): bump github.com/mattn/go-sqlite3 from 1.14.16 to 1.14.17
dependabot[bot] Jun 12, 2023
3513646
Merge pull request #1306 from cloudflare/dependabot/go_modules/github…
nickysemenza Jun 12, 2023
682fa4a
build(deps): bump golang.org/x/crypto from 0.9.0 to 0.10.0
dependabot[bot] Jun 19, 2023
c6ac238
build(deps): bump github.com/prometheus/client_golang
dependabot[bot] Jun 19, 2023
277c524
Merge pull request #1310 from cloudflare/dependabot/go_modules/golang…
nickysemenza Jun 19, 2023
707f415
Merge pull request #1311 from cloudflare/dependabot/go_modules/github…
nickysemenza Jun 19, 2023
6619c79
Add DER support for gernerating and parsing CSR
Jun 26, 2023
f0549e3
Merge pull request #1312 from kongweiguo/add-csr-der
nickysemenza Jun 28, 2023
8d25f25
certdb/sql: remove uses of github.com/stretchr/testify/require
thaJeztah Nov 20, 2022
0f0664a
Merge pull request #1256 from thaJeztah/remove_testify
nickysemenza Aug 1, 2023
48e8f99
build(deps): bump golang.org/x/crypto from 0.10.0 to 0.12.0
dependabot[bot] Aug 7, 2023
f4c7545
Merge pull request #1316 from cloudflare/dependabot/go_modules/golang…
nickysemenza Aug 7, 2023
b97dede
build(deps): bump golang.org/x/crypto from 0.12.0 to 0.13.0
dependabot[bot] Sep 11, 2023
ff634d9
build(deps): bump actions/checkout from 3 to 4
dependabot[bot] Sep 11, 2023
465384f
Merge pull request #1322 from cloudflare/dependabot/github_actions/ac…
nickysemenza Sep 13, 2023
c448632
build(deps): bump docker/metadata-action from 4 to 5
dependabot[bot] Sep 18, 2023
47aa9b7
build(deps): bump docker/build-push-action from 4 to 5
dependabot[bot] Sep 18, 2023
4452a0e
build(deps): bump docker/login-action from 2 to 3
dependabot[bot] Sep 18, 2023
4adaa6a
build(deps): bump docker/setup-qemu-action from 2 to 3
dependabot[bot] Sep 18, 2023
7fc015e
Merge pull request #1324 from cloudflare/dependabot/github_actions/do…
nickysemenza Sep 18, 2023
2a88d0c
Merge pull request #1321 from cloudflare/dependabot/go_modules/golang…
nickysemenza Sep 18, 2023
78df137
Merge pull request #1326 from cloudflare/dependabot/github_actions/do…
nickysemenza Sep 18, 2023
73cd6b5
Merge pull request #1325 from cloudflare/dependabot/github_actions/do…
nickysemenza Sep 18, 2023
8a40f98
build(deps): bump docker/setup-buildx-action from 2 to 3
dependabot[bot] Sep 18, 2023
e95f50e
Merge pull request #1327 from cloudflare/dependabot/github_actions/do…
nickysemenza Sep 19, 2023
947f651
Merge pull request #1323 from cloudflare/dependabot/github_actions/do…
nickysemenza Oct 6, 2023
33c9f30
build(deps): bump golang.org/x/crypto from 0.13.0 to 0.14.0
dependabot[bot] Oct 9, 2023
00ef5b9
Merge pull request #1332 from cloudflare/dependabot/go_modules/golang…
nickysemenza Oct 9, 2023
f930541
build(deps): bump github.com/prometheus/client_golang
dependabot[bot] Oct 9, 2023
73b6dc9
build(deps): bump golang.org/x/net from 0.10.0 to 0.17.0
dependabot[bot] Oct 11, 2023
0784631
Merge pull request #1333 from cloudflare/dependabot/go_modules/golang…
nickysemenza Oct 23, 2023
e33630c
Merge pull request #1330 from cloudflare/dependabot/go_modules/github…
nickysemenza Oct 23, 2023
5690a91
build(deps): bump github.com/mattn/go-sqlite3 from 1.14.17 to 1.14.18
dependabot[bot] Nov 6, 2023
df32d88
build(deps): bump github.com/google/certificate-transparency-go
dependabot[bot] Nov 6, 2023
8b0d1b8
Merge pull request #1336 from cloudflare/dependabot/go_modules/github…
nickysemenza Nov 9, 2023
86cf475
Merge pull request #1337 from cloudflare/dependabot/go_modules/github…
nickysemenza Nov 9, 2023
d124eca
build(deps): bump golang.org/x/crypto from 0.14.0 to 0.15.0
dependabot[bot] Nov 13, 2023
f47ec3b
Merge pull request #1338 from cloudflare/dependabot/go_modules/golang…
nickysemenza Nov 14, 2023
3d88142
build(deps): bump actions/setup-go from 4 to 5
dependabot[bot] Dec 11, 2023
7af0669
build(deps): bump github.com/mattn/go-sqlite3 from 1.14.18 to 1.14.19
dependabot[bot] Dec 18, 2023
15955d7
build(deps): bump actions/upload-artifact from 3 to 4
dependabot[bot] Dec 18, 2023
9243529
build(deps): bump golang.org/x/crypto from 0.15.0 to 0.17.0
dependabot[bot] Dec 18, 2023
7e1c6cc
Merge pull request #1346 from cloudflare/dependabot/github_actions/ac…
nickysemenza Dec 20, 2023
6d4e660
Merge pull request #1347 from cloudflare/dependabot/go_modules/golang…
nickysemenza Dec 20, 2023
319a111
Merge pull request #1345 from cloudflare/dependabot/go_modules/github…
nickysemenza Dec 20, 2023
bbcbbe3
Merge pull request #1344 from cloudflare/dependabot/github_actions/ac…
nickysemenza Dec 20, 2023
2e59ba1
build(deps): bump github.com/prometheus/client_golang
dependabot[bot] Jan 1, 2024
dac37af
Merge pull request #1350 from cloudflare/dependabot/go_modules/github…
nickysemenza Jan 2, 2024
6410467
build(deps): bump golang.org/x/crypto from 0.17.0 to 0.18.0
dependabot[bot] Jan 15, 2024
753132f
build(deps): bump github.com/mattn/go-sqlite3 from 1.14.19 to 1.14.20
dependabot[bot] Jan 29, 2024
aa40f70
Merge pull request #1353 from cloudflare/dependabot/go_modules/github…
nickysemenza Jan 31, 2024
8af55f6
Merge pull request #1352 from cloudflare/dependabot/go_modules/golang…
nickysemenza Jan 31, 2024
71dd338
build(deps): bump codecov/codecov-action from 3 to 4
dependabot[bot] Feb 5, 2024
710546a
build(deps): bump github.com/mattn/go-sqlite3 from 1.14.20 to 1.14.22
dependabot[bot] Feb 5, 2024
ad3f22f
Merge pull request #1354 from cloudflare/dependabot/github_actions/co…
nickysemenza Feb 8, 2024
c53e678
Merge pull request #1355 from cloudflare/dependabot/go_modules/github…
nickysemenza Feb 8, 2024
5ac7cd9
Add unit test for custom extension supt
sthussey Feb 11, 2024
f19cf51
build(deps): bump golangci/golangci-lint-action from 3 to 4
dependabot[bot] Feb 12, 2024
ca7fd50
build(deps): bump golang.org/x/crypto from 0.18.0 to 0.19.0
dependabot[bot] Feb 12, 2024
4b17f8c
Merge pull request #1356 from cloudflare/dependabot/github_actions/go…
nickysemenza Feb 21, 2024
b7c3094
Merge pull request #1358 from cloudflare/dependabot/go_modules/golang…
nickysemenza Feb 21, 2024
02d4045
Merge pull request #1281 from sthussey/fix/selfsign-extensions
nickysemenza Feb 21, 2024
7f58e9c
Build images on base image for target platform
killianmuldoon Feb 22, 2024
0f5c14c
build(deps): bump github.com/prometheus/client_golang
dependabot[bot] Mar 4, 2024
44b96cf
Merge pull request #1360 from killianmuldoon/pr-fix-docker-build
nickysemenza Mar 5, 2024
96259aa
Merge pull request #1363 from cloudflare/dependabot/go_modules/github…
nickysemenza Mar 5, 2024
d13ac5d
build(deps): bump golang.org/x/crypto from 0.19.0 to 0.21.0
dependabot[bot] Mar 5, 2024
b4650b5
build(deps): bump github.com/go-sql-driver/mysql from 1.7.1 to 1.8.0
dependabot[bot] Mar 11, 2024
03f2681
Merge pull request #1365 from cloudflare/dependabot/go_modules/github…
nickysemenza Mar 11, 2024
361a3a5
Merge pull request #1364 from cloudflare/dependabot/go_modules/golang…
nickysemenza Mar 11, 2024
a421aee
build(deps): bump github.com/google/certificate-transparency-go
dependabot[bot] Mar 18, 2024
d6d030a
Merge pull request #1368 from cloudflare/dependabot/go_modules/github…
nickysemenza Mar 19, 2024
12a0add
Merge pull request #1055 from akoserwal/master
nickysemenza Jul 11, 2024
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
12 changes: 12 additions & 0 deletions .github/dependabot.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
version: 2
updates:
- package-ecosystem: github-actions
directory: /
schedule:
interval: weekly

- package-ecosystem: gomod
directory: /
schedule:
interval: weekly

49 changes: 33 additions & 16 deletions .github/workflows/docker-builds.yml
Original file line number Diff line number Diff line change
@@ -1,42 +1,59 @@
name: Build and publish cfssl docker image
name: cfssl docker

on:
workflow_dispatch:
push:
branches:
- "master"
tags:
- 'v*.*.*'

- "v*"
jobs:
build-and-push-image:
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
strategy:
matrix:
include:
# github container registry
- registry: "ghcr.io"
username: ${{ github.actor }}
password_secret: GITHUB_TOKEN
image: ghcr.io/cloudflare/cfssl
# docker test publish, todo: switch to service account
- registry: ""
username: nicky
password_secret: DOCKER_REGISTRY_TOKEN_NICKY
image: cfssl/cfssl
steps:
- name: Checkout repository
uses: actions/checkout@v3
uses: actions/checkout@v4
with:
fetch-depth: 0

- name: Get tag
id: cfssl
run: echo "::set-output name=tag::$(git describe --tags HEAD)"

- name: Set up QEMU
uses: docker/setup-qemu-action@v2
uses: docker/setup-qemu-action@v3

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v2
uses: docker/setup-buildx-action@v3

- name: Log in to the Docker hub
uses: docker/login-action@v2
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}

registry: ${{ matrix.registry }}
username: ${{ matrix.username }}
password: ${{ secrets[matrix.password_secret] }}
- name: Extract metadata (tags, labels) for Docker
id: meta
uses: docker/metadata-action@v5
with:
images: ${{ matrix.image }}
- name: Build and push
uses: docker/build-push-action@v3
uses: docker/build-push-action@v5
with:
context: .
platforms: linux/amd64,linux/arm64,linux/s390x
push: true
tags: cfssl:${{ steps.cfssl.outputs.tag }}
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
14 changes: 7 additions & 7 deletions .github/workflows/go.yml
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ jobs:
runs-on: ubuntu-latest
strategy:
matrix:
go: ["1.18", "1.19"]
go: [stable, oldstable]
services:
# Label used to access the service container
postgres:
Expand Down Expand Up @@ -50,10 +50,10 @@ jobs:
- run: psql -c 'create database certdb_development;' -U postgres;
- run: mysql -e 'create database certdb_development;' -u root;
- run: mysql -e 'SET global sql_mode = 0;' -u root;
- uses: actions/checkout@v2
- uses: actions/checkout@v4

- name: Set up Go
uses: actions/setup-go@v2
uses: actions/setup-go@v5
with:
go-version: ${{ matrix.go }}

Expand All @@ -64,15 +64,15 @@ jobs:
- run: ./bin/goose -path certdb/mysql up;
- name: Test
run: ./test.sh
- uses: codecov/codecov-action@v3
- uses: codecov/codecov-action@v4

golangci:
name: lint
runs-on: ubuntu-latest
steps:
- uses: actions/setup-go@v3
- uses: actions/setup-go@v5
with:
go-version: 1.18
- uses: actions/checkout@v3
- uses: actions/checkout@v4
- name: golangci-lint
uses: golangci/golangci-lint-action@v3
uses: golangci/golangci-lint-action@v4
18 changes: 18 additions & 0 deletions .github/workflows/snapshot.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
name: Image snapshots

on:
push:
pull_request:
branches: [master]

jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- run: make snapshot
- name: Archive snapshot artifacts
uses: actions/upload-artifact@v4
with:
name: binaries
path: dist/
8 changes: 8 additions & 0 deletions .goreleaser.yml
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ builds:
- linux
goarch:
- amd64
- arm
- arm64
- s390x
main: ./cmd/cfssl
Expand Down Expand Up @@ -60,6 +61,7 @@ builds:
- linux
goarch:
- amd64
- arm
- arm64
- s390x
main: ./cmd/cfssl-bundle
Expand Down Expand Up @@ -96,6 +98,7 @@ builds:
- linux
goarch:
- amd64
- arm
- arm64
- s390x
main: ./cmd/cfssl-certinfo
Expand Down Expand Up @@ -132,6 +135,7 @@ builds:
- linux
goarch:
- amd64
- arm
- arm64
- s390x
main: ./cmd/cfssl-newkey
Expand Down Expand Up @@ -168,6 +172,7 @@ builds:
- linux
goarch:
- amd64
- arm
- arm64
- s390x
main: ./cmd/cfssl-scan
Expand Down Expand Up @@ -204,6 +209,7 @@ builds:
- linux
goarch:
- amd64
- arm
- arm64
- s390x
main: ./cmd/cfssljson
Expand Down Expand Up @@ -240,6 +246,7 @@ builds:
- linux
goarch:
- amd64
- arm
- arm64
- s390x
main: ./cmd/mkbundle
Expand Down Expand Up @@ -276,6 +283,7 @@ builds:
- linux
goarch:
- amd64
- arm
- arm64
- s390x
main: ./cmd/multirootca
Expand Down
9 changes: 8 additions & 1 deletion Dockerfile
Original file line number Diff line number Diff line change
@@ -1,4 +1,11 @@
FROM --platform=${BUILDPLATFORM} golang:1.19.3
FROM --platform=${TARGETPLATFORM} golang:1.20

ARG TARGETPLATFORM
ARG BUILDPLATFORM
RUN echo "I am running on $BUILDPLATFORM, building for $TARGETPLATFORM"

LABEL org.opencontainers.image.source https://github.com/cloudflare/cfssl
LABEL org.opencontainers.image.description "Cloudflare's PKI toolkit"

ARG TARGETOS
ARG TARGETARCH
Expand Down
4 changes: 2 additions & 2 deletions Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ snapshot:
--rm \
-v $(PWD):/cross \
-w /cross \
ghcr.io/gythialy/golang-cross:v1.18 --rm-dist --snapshot --skip-publish
ghcr.io/goreleaser/goreleaser-cross:latest --clean --snapshot --skip-publish

.PHONY: github-release
github-release:
Expand All @@ -71,7 +71,7 @@ github-release:
-e GITHUB_TOKEN=$(GITHUB_TOKEN) \
-v $(PWD):/cross \
-w /cross \
ghcr.io/gythialy/golang-cross:v1.18 --rm-dist
ghcr.io/goreleaser/goreleaser-cross:latest --clean

.PHONY: docker-build
docker-build:
Expand Down
1 change: 1 addition & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@ Building cfssl requires a
$ git clone git@github.com:cloudflare/cfssl.git
$ cd cfssl
$ make
$ make install
```

The resulting binaries will be in the bin folder:
Expand Down
4 changes: 4 additions & 0 deletions api/generator/generator.go
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ package generator
import (
"crypto/md5"
"crypto/sha1"
"crypto/sha256"
"crypto/x509"
"encoding/json"
"encoding/pem"
Expand Down Expand Up @@ -35,6 +36,7 @@ specifically, section 10.2.3 ("Information Requirements").`
type Sum struct {
MD5 string `json:"md5"`
SHA1 string `json:"sha-1"`
SHA256 string `json:"sha-256"`
}

// Validator is a type of function that contains the logic for validating
Expand Down Expand Up @@ -97,8 +99,10 @@ func computeSum(in []byte) (sum Sum, err error) {

md5Sum := md5.Sum(data)
sha1Sum := sha1.Sum(data)
sha256Sum := sha256.Sum256(data)
sum.MD5 = fmt.Sprintf("%X", md5Sum[:])
sum.SHA1 = fmt.Sprintf("%X", sha1Sum[:])
sum.SHA256 = fmt.Sprintf("%X", sha256Sum[:])
return
}

Expand Down
7 changes: 7 additions & 0 deletions bundler/bundle.go
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ package bundler
import (
"bytes"
"crypto/ecdsa"
"crypto/ed25519"
"crypto/rsa"
"crypto/x509"
"crypto/x509/pkix"
Expand All @@ -13,6 +14,7 @@ import (
"time"

"github.com/cloudflare/cfssl/helpers"
"github.com/cloudflare/cfssl/helpers/derhelpers"
)

// A Bundle contains a certificate and its trust chain. It is intended
Expand Down Expand Up @@ -108,6 +110,8 @@ func (b *Bundle) MarshalJSON() ([]byte, error) {
keyType = fmt.Sprintf("%d-bit RSA", keyLength)
case x509.DSA:
keyType = "DSA"
case x509.Ed25519:
keyType = "Ed25519"
default:
keyType = "Unknown"
}
Expand All @@ -119,6 +123,9 @@ func (b *Bundle) MarshalJSON() ([]byte, error) {
case *ecdsa.PrivateKey:
keyBytes, _ = x509.MarshalECPrivateKey(key)
keyString = PemBlockToString(&pem.Block{Type: "EC PRIVATE KEY", Bytes: keyBytes})
case ed25519.PrivateKey:
keyBytes, _ = derhelpers.MarshalEd25519PrivateKey(key)
keyString = PemBlockToString(&pem.Block{Type: "Ed25519 PRIVATE KEY", Bytes: keyBytes})
case fmt.Stringer:
keyString = key.String()
}
Expand Down
4 changes: 2 additions & 2 deletions bundler/bundle_from_file_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -260,12 +260,12 @@ var fileTests = []fileTest{
},

// DSA is NOT supported.
// Keyless bundling, expect private key error "NotRSAOrECC"
// Keyless bundling, expect private key error "NotRSAOrECCOrEd25519"
{
cert: certDSA2048,
caBundleFile: testCFSSLRootBundle,
intBundleFile: testCFSSLIntBundle,
errorCallback: ExpectErrorMessages([]string{`"code":2200,`, `"message":"Private key algorithm is not RSA or ECC"`}),
errorCallback: ExpectErrorMessages([]string{`"code":2200,`, `"message":"Private key algorithm is not RSA or ECC or Ed25519"`}),
},
// Bundling with DSA private key, expect error "Failed to parse private key"
{
Expand Down
22 changes: 14 additions & 8 deletions bundler/bundler.go
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ import (
"bytes"
"crypto"
"crypto/ecdsa"
"crypto/ed25519"
"crypto/rsa"
"crypto/tls"
"crypto/x509"
Expand Down Expand Up @@ -398,10 +399,7 @@ func isSelfSigned(cert *x509.Certificate) bool {
}

func isChainRootNode(cert *x509.Certificate) bool {
if isSelfSigned(cert) {
return true
}
return false
return isSelfSigned(cert)
}

func (b *Bundler) verifyChain(chain []*fetchedIntermediate) bool {
Expand Down Expand Up @@ -555,7 +553,7 @@ func (b *Bundler) fetchIntermediates(certs []*x509.Certificate) (err error) {

// Bundle takes an X509 certificate (already in the
// Certificate structure), a private key as crypto.Signer in one of the appropriate
// formats (i.e. *rsa.PrivateKey or *ecdsa.PrivateKey, or even a opaque key), using them to
// formats (i.e. *rsa.PrivateKey, *ecdsa.PrivateKey or ed25519.PrivateKey, or even a opaque key), using them to
// build a certificate bundle.
func (b *Bundler) Bundle(certs []*x509.Certificate, key crypto.Signer, flavor BundleFlavor) (*Bundle, error) {
log.Infof("bundling certificate for %+v", certs[0].Subject)
Expand All @@ -576,7 +574,6 @@ func (b *Bundler) Bundle(certs []*x509.Certificate, key crypto.Signer, flavor Bu
if key != nil {
switch {
case cert.PublicKeyAlgorithm == x509.RSA:

var rsaPublicKey *rsa.PublicKey
if rsaPublicKey, ok = key.Public().(*rsa.PublicKey); !ok {
return nil, errors.New(errors.PrivateKeyError, errors.KeyMismatch)
Expand All @@ -592,15 +589,24 @@ func (b *Bundler) Bundle(certs []*x509.Certificate, key crypto.Signer, flavor Bu
if cert.PublicKey.(*ecdsa.PublicKey).X.Cmp(ecdsaPublicKey.X) != 0 {
return nil, errors.New(errors.PrivateKeyError, errors.KeyMismatch)
}
case cert.PublicKeyAlgorithm == x509.Ed25519:
var ed25519PublicKey ed25519.PublicKey
if ed25519PublicKey, ok = key.Public().(ed25519.PublicKey); !ok {
return nil, errors.New(errors.PrivateKeyError, errors.KeyMismatch)
}
if !(bytes.Equal(cert.PublicKey.(ed25519.PublicKey), ed25519PublicKey)) {
return nil, errors.New(errors.PrivateKeyError, errors.KeyMismatch)
}
default:
return nil, errors.New(errors.PrivateKeyError, errors.NotRSAOrECC)
return nil, errors.New(errors.PrivateKeyError, errors.NotRSAOrECCOrEd25519)
}
} else {
switch {
case cert.PublicKeyAlgorithm == x509.RSA:
case cert.PublicKeyAlgorithm == x509.ECDSA:
case cert.PublicKeyAlgorithm == x509.Ed25519:
default:
return nil, errors.New(errors.PrivateKeyError, errors.NotRSAOrECC)
return nil, errors.New(errors.PrivateKeyError, errors.NotRSAOrECCOrEd25519)
}
}

Expand Down
Loading