mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

build the test certificate in code instead of committing one

Browse source
This commit is contained in:
atlas 2026-10-25 18:41:52 +01:00 • committed by mara
commit 401a3c9a51
1 changed files with 60 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

61
swarm-secret-client/src/cert.rs
View file

@ -49,15 +49,68 @@ pub fn file_validity(path: &Path) -> Result<(i64, i64), Error> {
pub(crate) mod tests {
use super::*;
/// Self-signed, CN `hive-agent-atlas`, valid 2026-01-01T00:00:00Z to
pub(crate) const CERT_PEM: &str = include_str!("../test-cert.pem");
/// The window `certificate_pem` is built with: 2026-01-01T00:00:00Z to
/// 2026-04-01T00:00:00Z.
pub(crate) const NOT_BEFORE: i64 = 1_767_225_600;
pub(crate) const NOT_AFTER: i64 = 1_775_001_600;
/// A certificate valid from `not_before` to `not_after` (unix seconds),
/// PEM-encoded. The name, key and signature are placeholders: [`validity`]
/// reads the window and verifies nothing.
pub(crate) fn certificate_pem(not_before: i64, not_after: i64) -> String {
use x509_cert::der::{
EncodePem as _,
asn1::{BitString, ObjectIdentifier, UtcTime},
pem::LineEnding,
};
use x509_cert::{
Certificate, TbsCertificate, Version,
name::Name,
serial_number::SerialNumber,
spki::{AlgorithmIdentifierOwned, SubjectPublicKeyInfoOwned},
time::{Time, Validity},
};
let time = |secs: i64| {
let secs = u64::try_from(secs).expect("a date after 1970");
Time::UtcTime(
UtcTime::from_unix_duration(std::time::Duration::from_secs(secs))
.expect("a date UTCTime can hold"),
)
};
let algorithm = AlgorithmIdentifierOwned {
oid: ObjectIdentifier::new_unwrap("1.2.840.10045.4.3.2"),
parameters: None,
};
let cert = Certificate {
tbs_certificate: TbsCertificate {
version: Version::V3,
serial_number: SerialNumber::new(&[1]).expect("a serial number"),
signature: algorithm.clone(),
issuer: Name::default(),
validity: Validity {
not_before: time(not_before),
not_after: time(not_after),
},
subject: Name::default(),
subject_public_key_info: SubjectPublicKeyInfoOwned {
algorithm: algorithm.clone(),
subject_public_key: BitString::from_bytes(&[0]).expect("a bit string"),
},
issuer_unique_id: None,
subject_unique_id: None,
extensions: None,
},
signature_algorithm: algorithm,
signature: BitString::from_bytes(&[0]).expect("a bit string"),
};
cert.to_pem(LineEnding::LF).expect("encodes")
}
#[test]
fn the_window_is_read_from_the_certificate() {
assert_eq!(
validity(CERT_PEM).expect("a well-formed certificate"),
validity(&certificate_pem(NOT_BEFORE, NOT_AFTER)).expect("a well-formed certificate"),
(NOT_BEFORE, NOT_AFTER)
);
}
@ -77,7 +130,7 @@ pub(crate) mod tests {
std::env::temp_dir().join(format!("swarm-secret-client-cert-{}", std::process::id()));
std::fs::create_dir_all(&dir).expect("scratch dir");
let path = dir.join("cert.pem");
std::fs::write(&path, CERT_PEM).expect("write");
std::fs::write(&path, certificate_pem(NOT_BEFORE, NOT_AFTER)).expect("write");
assert_eq!(
file_validity(&path).expect("readable"),
(NOT_BEFORE, NOT_AFTER)