-
-
Notifications
You must be signed in to change notification settings - Fork 12.1k
/
step.rb
123 lines (110 loc) 路 5.89 KB
/
step.rb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
class Step < Formula
desc "Crypto and x509 Swiss-Army-Knife"
homepage "https://smallstep.com"
url "https://github.com/smallstep/cli/releases/download/v0.20.0/step_0.20.0.tar.gz"
sha256 "28c1a3f59f625992454328e466672d3974acbe67bb666a959d57331496b2042c"
license "Apache-2.0"
bottle do
sha256 cellar: :any_skip_relocation, arm64_monterey: "41a591c1b2a931ec05d4b9a395eb65d4afe1d5b0019aaa96f4fe19499db8a0cb"
sha256 cellar: :any_skip_relocation, arm64_big_sur: "b27d4d8d833b0f73de652a71e4b9ef90f956e1641bba68ec9a1c6fae0567e0de"
sha256 cellar: :any_skip_relocation, monterey: "66b10c23998346c8018ff37c74105a571d21d01c321a6c9f779448ae4dbcbfb9"
sha256 cellar: :any_skip_relocation, big_sur: "96826ef5e6c00fa6a75f12bd58db33bd65fd38ac8c90a70e7abc629f7e04cf3f"
sha256 cellar: :any_skip_relocation, catalina: "1bd2c4d01bd00459836b49e0e0e047d99148a963a9eea57325368281ce2e70db"
sha256 cellar: :any_skip_relocation, x86_64_linux: "38717e78e0512af76b9039b3822757d201e07f2359c388abd64b5822d2ae1244"
end
depends_on "go" => :build
resource "certificates" do
url "https://github.com/smallstep/certificates/releases/download/v0.20.0/step-ca_0.20.0.tar.gz"
sha256 "89751704be475ebfee6dba322fc8d31afca02b8993a33cfe9c7dba92d06b1b00"
end
def install
ENV["VERSION"] = version.to_s
ENV["CGO_OVERRIDE"] = "CGO_ENABLED=1"
system "make", "build"
bin.install "bin/step" => "step"
bash_completion.install "autocomplete/bash_autocomplete" => "step"
zsh_completion.install "autocomplete/zsh_autocomplete" => "_step"
resource("certificates").stage do |r|
ENV["VERSION"] = r.version.to_s
ENV["CGO_OVERRIDE"] = "CGO_ENABLED=1"
system "make", "build"
bin.install "bin/step-ca" => "step-ca"
end
end
test do
# Generate a public / private key pair. Creates foo.pub and foo.priv.
system "#{bin}/step", "crypto", "keypair", "foo.pub", "foo.priv", "--no-password", "--insecure"
assert_predicate testpath/"foo.pub", :exist?
assert_predicate testpath/"foo.priv", :exist?
# Generate a root certificate and private key with subject baz written to baz.crt and baz.key.
system "#{bin}/step", "certificate", "create", "--profile", "root-ca",
"--no-password", "--insecure", "baz", "baz.crt", "baz.key"
assert_predicate testpath/"baz.crt", :exist?
assert_predicate testpath/"baz.key", :exist?
baz_crt = File.read(testpath/"baz.crt")
assert_match(/^-----BEGIN CERTIFICATE-----.*/, baz_crt)
assert_match(/.*-----END CERTIFICATE-----$/, baz_crt)
baz_key = File.read(testpath/"baz.key")
assert_match(/^-----BEGIN EC PRIVATE KEY-----.*/, baz_key)
assert_match(/.*-----END EC PRIVATE KEY-----$/, baz_key)
shell_output("#{bin}/step certificate inspect --format json baz.crt > baz_crt.json")
baz_crt_json = JSON.parse(File.read(testpath/"baz_crt.json"))
assert_equal "CN=baz", baz_crt_json["subject_dn"]
assert_equal "CN=baz", baz_crt_json["issuer_dn"]
# Generate a leaf certificate signed by the previously created root.
system "#{bin}/step", "certificate", "create", "--profile", "intermediate-ca",
"--no-password", "--insecure", "--ca", "baz.crt", "--ca-key", "baz.key",
"zap", "zap.crt", "zap.key"
assert_predicate testpath/"zap.crt", :exist?
assert_predicate testpath/"zap.key", :exist?
zap_crt = File.read(testpath/"zap.crt")
assert_match(/^-----BEGIN CERTIFICATE-----.*/, zap_crt)
assert_match(/.*-----END CERTIFICATE-----$/, zap_crt)
zap_key = File.read(testpath/"zap.key")
assert_match(/^-----BEGIN EC PRIVATE KEY-----.*/, zap_key)
assert_match(/.*-----END EC PRIVATE KEY-----$/, zap_key)
shell_output("#{bin}/step certificate inspect --format json zap.crt > zap_crt.json")
zap_crt_json = JSON.parse(File.read(testpath/"zap_crt.json"))
assert_equal "CN=zap", zap_crt_json["subject_dn"]
assert_equal "CN=baz", zap_crt_json["issuer_dn"]
# Initialize a PKI and step-ca configuration, boot the CA, and create a
# certificate using the API.
(testpath/"password.txt").write("password")
steppath = "#{testpath}/.step"
mkdir_p(steppath)
ENV["STEPPATH"] = steppath
system "#{bin}/step", "ca", "init", "--address", "127.0.0.1:8081",
"--dns", "127.0.0.1", "--password-file", "#{testpath}/password.txt",
"--provisioner-password-file", "#{testpath}/password.txt", "--name",
"homebrew-smallstep-test", "--provisioner", "brew"
begin
pid = fork do
exec "#{bin}/step-ca", "--password-file", "#{testpath}/password.txt",
"#{steppath}/config/ca.json"
end
sleep 2
shell_output("#{bin}/step ca health > health_response.txt")
assert_match(/^ok$/, File.read(testpath/"health_response.txt"))
shell_output("#{bin}/step ca token --password-file #{testpath}/password.txt " \
"homebrew-smallstep-leaf > token.txt")
token = File.read(testpath/"token.txt")
system "#{bin}/step", "ca", "certificate", "--token", token,
"homebrew-smallstep-leaf", "brew.crt", "brew.key"
assert_predicate testpath/"brew.crt", :exist?
assert_predicate testpath/"brew.key", :exist?
brew_crt = File.read(testpath/"brew.crt")
assert_match(/^-----BEGIN CERTIFICATE-----.*/, brew_crt)
assert_match(/.*-----END CERTIFICATE-----$/, brew_crt)
brew_key = File.read(testpath/"brew.key")
assert_match(/^-----BEGIN EC PRIVATE KEY-----.*/, brew_key)
assert_match(/.*-----END EC PRIVATE KEY-----$/, brew_key)
shell_output("#{bin}/step certificate inspect --format json brew.crt > brew_crt.json")
brew_crt_json = JSON.parse(File.read(testpath/"brew_crt.json"))
assert_equal "CN=homebrew-smallstep-leaf", brew_crt_json["subject_dn"]
assert_equal "O=homebrew-smallstep-test, CN=homebrew-smallstep-test Intermediate CA", brew_crt_json["issuer_dn"]
ensure
Process.kill(9, pid)
Process.wait(pid)
end
end
end