Обновить scripts/Base/create-truststore.sh
This commit is contained in:
m9k committed
1 parent
c31d45c331
commit
605595aa94
1 file changed
@@ -0,0 +1,155 @@
|
||||
#!/bin/bash
|
||||
# Usage:
|
||||
# ./create-truststore.sh [CA_CERT [TRUSTSTORE [ALIAS]]]
|
||||
# ./create-truststore.sh --verify [CA_CERT [TRUSTSTORE [ALIAS]]]
|
||||
# Defaults may be overridden with CERT_DIR, CA_CERT, TRUSTSTORE, CA_ALIAS, JAVA_BIN.
|
||||
# Requires Java 8+; javac is required on Java 8-10.
|
||||
# Java 11+ supports source-file mode when the jdk.compiler module is available.
|
||||
set -euo pipefail
|
||||
|
||||
CERT_DIR="${CERT_DIR:-/site/var/spring/key}"
|
||||
CA_CERT="${CA_CERT:-${CERT_DIR}/local-root-ca.crt}"
|
||||
TRUSTSTORE="${TRUSTSTORE:-${CERT_DIR}/truststore-empty.jks}"
|
||||
CA_ALIAS="${CA_ALIAS:-local-root-ca}"
|
||||
|
||||
MODE=create
|
||||
if [[ "${1:-}" == --verify ]]; then
|
||||
MODE=verify
|
||||
shift
|
||||
fi
|
||||
CA_CERT="${1:-${CA_CERT}}"
|
||||
TRUSTSTORE="${2:-${TRUSTSTORE}}"
|
||||
CA_ALIAS="${3:-${CA_ALIAS}}"
|
||||
if (( $# > 3 )); then
|
||||
echo 'Usage: create-truststore.sh [--verify] [CA_CERT [TRUSTSTORE [ALIAS]]]' >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
if [[ ! -r "${CA_CERT}" ]]; then
|
||||
echo "ERROR: CA certificate not readable: ${CA_CERT}" >&2
|
||||
exit 1
|
||||
fi
|
||||
if [[ "${MODE}" == create && -e "${TRUSTSTORE}" ]]; then
|
||||
echo "ERROR: TrustStore already exists: ${TRUSTSTORE}" >&2
|
||||
exit 1
|
||||
fi
|
||||
if [[ "${MODE}" == verify && ! -r "${TRUSTSTORE}" ]]; then
|
||||
echo "ERROR: TrustStore not readable: ${TRUSTSTORE}" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
JAVA_BIN="${JAVA_BIN:-$(which java 2>/dev/null || true)}"
|
||||
if [[ -z "${JAVA_BIN}" || ! -x "${JAVA_BIN}" ]]; then
|
||||
echo 'ERROR: java not found (set JAVA_BIN or add java to PATH)' >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
JAVA_MAJOR="$("${JAVA_BIN}" -version 2>&1 | awk -F '"' '/version/ {split($2, v, "."); print (v[1] == "1" ? v[2] : v[1]); exit}')"
|
||||
if [[ ! "${JAVA_MAJOR}" =~ ^[0-9]+$ || "${JAVA_MAJOR}" -lt 8 ]]; then
|
||||
echo 'ERROR: cannot determine Java version or Java is older than 8' >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
WORK_DIR="$(mktemp -d)"
|
||||
trap 'rm -rf -- "${WORK_DIR}"' EXIT
|
||||
SOURCE="${WORK_DIR}/CreateTrustStore.java"
|
||||
|
||||
cat > "${SOURCE}" <<'JAVA'
|
||||
import java.io.InputStream;
|
||||
import java.io.OutputStream;
|
||||
import java.nio.file.Files;
|
||||
import java.nio.file.Paths;
|
||||
import java.nio.file.StandardOpenOption;
|
||||
import java.security.KeyStore;
|
||||
import java.security.cert.Certificate;
|
||||
import java.security.cert.CertificateFactory;
|
||||
|
||||
public class CreateTrustStore {
|
||||
public static void main(String[] args) throws Exception {
|
||||
String mode = args[0];
|
||||
String certPath = args[1];
|
||||
String storePath = args[2];
|
||||
String alias = args[3];
|
||||
char[] password = new char[0];
|
||||
|
||||
Certificate ca;
|
||||
try (InputStream in = Files.newInputStream(Paths.get(certPath))) {
|
||||
ca = CertificateFactory.getInstance("X.509").generateCertificate(in);
|
||||
}
|
||||
|
||||
KeyStore store = KeyStore.getInstance("JKS");
|
||||
if ("create".equals(mode)) {
|
||||
store.load(null, password);
|
||||
store.setCertificateEntry(alias, ca);
|
||||
try (OutputStream out = Files.newOutputStream(
|
||||
Paths.get(storePath), StandardOpenOption.CREATE_NEW)) {
|
||||
store.store(out, password);
|
||||
}
|
||||
} else if (!"verify".equals(mode)) {
|
||||
throw new IllegalArgumentException("Unknown mode: " + mode);
|
||||
}
|
||||
|
||||
try (InputStream in = Files.newInputStream(Paths.get(storePath))) {
|
||||
store.load(in, password);
|
||||
}
|
||||
if (!store.isCertificateEntry(alias) || !ca.equals(store.getCertificate(alias))) {
|
||||
throw new IllegalStateException("CA certificate/alias mismatch");
|
||||
}
|
||||
System.out.println("OK: JKS verified with empty password; alias=" + alias);
|
||||
}
|
||||
}
|
||||
JAVA
|
||||
|
||||
umask 077
|
||||
# Prefer javac from the selected Java installation to avoid mixing JDK versions.
|
||||
# For Java 11+ source-file mode is preferred, especially on JRE-only systems.
|
||||
resolve_javac() {
|
||||
local java_real java_dir candidate
|
||||
java_real="$(readlink -f -- "${JAVA_BIN}" 2>/dev/null || printf '%s' "${JAVA_BIN}")"
|
||||
java_dir="$(dirname -- "${java_real}")"
|
||||
candidate="${JAVAC_BIN:-${java_dir}/javac}"
|
||||
if [[ -x "${candidate}" ]]; then
|
||||
printf '%s\n' "${candidate}"
|
||||
return 0
|
||||
fi
|
||||
# A java executable in PATH may be a wrapper; javac from PATH is usable
|
||||
# only when it belongs to the same major Java version.
|
||||
if [[ -z "${JAVAC_BIN:-}" ]]; then
|
||||
candidate="$(which javac 2>/dev/null || true)"
|
||||
if [[ -n "${candidate}" && -x "${candidate}" ]]; then
|
||||
local compiler_major
|
||||
compiler_major="$("${candidate}" -version 2>&1 | awk '{split($2,v,"."); print (v[1] == "1" ? v[2] : v[1])}')"
|
||||
if [[ "${compiler_major}" == "${JAVA_MAJOR}" ]]; then
|
||||
printf '%s\n' "${candidate}"
|
||||
return 0
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
return 1
|
||||
}
|
||||
|
||||
run_compiled() {
|
||||
local compiler
|
||||
compiler="$(resolve_javac)" || {
|
||||
echo "ERROR: Java ${JAVA_MAJOR}: javac from the matching JDK is required" >&2
|
||||
return 1
|
||||
}
|
||||
"${compiler}" -d "${WORK_DIR}" "${SOURCE}"
|
||||
"${JAVA_BIN}" -cp "${WORK_DIR}" CreateTrustStore "${MODE}" "${CA_CERT}" "${TRUSTSTORE}" "${CA_ALIAS}"
|
||||
}
|
||||
|
||||
if (( JAVA_MAJOR >= 11 )); then
|
||||
# A runtime image can omit jdk.compiler: fall back to javac if available.
|
||||
if "${JAVA_BIN}" --list-modules 2>/dev/null | grep -q '^jdk.compiler@'; then
|
||||
"${JAVA_BIN}" "${SOURCE}" "${MODE}" "${CA_CERT}" "${TRUSTSTORE}" "${CA_ALIAS}"
|
||||
else
|
||||
run_compiled
|
||||
fi
|
||||
else
|
||||
run_compiled
|
||||
fi
|
||||
|
||||
if [[ "${MODE}" == create ]]; then
|
||||
chmod 640 -- "${TRUSTSTORE}"
|
||||
echo "TrustStore created: ${TRUSTSTORE}"
|
||||
fi
|
||||
Reference in new issue
Block a user