From abf2f38d37435099dc7e10b75d3f6efc352b5ec2 Mon Sep 17 00:00:00 2001 From: Karen Arutyunov Date: Tue, 23 Apr 2024 12:25:33 +0300 Subject: Suppress the 'reading certificate from stdin' openssl warning on POSIX systems in bpkg-fetch --- bpkg/auth.cxx | 125 ++++++++++++++++++++++++++++++++++++---------------------- 1 file changed, 77 insertions(+), 48 deletions(-) diff --git a/bpkg/auth.cxx b/bpkg/auth.cxx index 663054d..db67257 100644 --- a/bpkg/auth.cxx +++ b/bpkg/auth.cxx @@ -23,15 +23,15 @@ using namespace butl; namespace bpkg { - static const string openssl_version ("version"); - static const string openssl_pkeyutl ("pkeyutl"); - static const string openssl_rsautl ("rsautl"); - static const string openssl_x509 ("x509"); - - const char* openssl_commands[5] = {openssl_version.c_str (), - openssl_pkeyutl.c_str (), - openssl_rsautl.c_str (), - openssl_x509.c_str (), + static const string openssl_version_cmd ("version"); + static const string openssl_pkeyutl_cmd ("pkeyutl"); + static const string openssl_rsautl_cmd ("rsautl"); + static const string openssl_x509_cmd ("x509"); + + const char* openssl_commands[5] = {openssl_version_cmd.c_str (), + openssl_pkeyutl_cmd.c_str (), + openssl_rsautl_cmd.c_str (), + openssl_x509_cmd.c_str (), nullptr}; // Print process command line. @@ -43,9 +43,42 @@ namespace bpkg print_process (args, n); } + // Query the openssl information and return the openssl version. Cache the + // version on the first function call. Fail on the underlying process and IO + // error. Return the 0.0.0 version if unable to parse the openssl stdout. + // + static optional openssl_ver; + + static const semantic_version& + openssl_version (const common_options& co) + { + const path& openssl_path (co.openssl ()[openssl_version_cmd]); + + if (!openssl_ver) + try + { + optional oi ( + openssl::info (print_command, 2, openssl_path)); + + openssl_ver = (oi && oi->name == "OpenSSL" + ? move (oi->version) + : semantic_version ()); + } + catch (const process_error& e) + { + fail << "unable to execute " << openssl_path << ": " << e << endf; + } + catch (const io_error& e) + { + fail << "unable to read '" << openssl_path << "' output: " << e + << endf; + } + + return *openssl_ver; + } + // Return true if the openssl version is greater or equal to 3.0.0 and so - // pkeyutl needs to be used instead of rsautl. Cache the result on the first - // function call. + // pkeyutl needs to be used instead of rsautl. // // Note that openssl 3.0.0 deprecates rsautl in favor of pkeyutl. // @@ -54,36 +87,22 @@ namespace bpkg // (see the 'pkeyutl -verifyrecover error "input data too long to be a // hash"' issue report for details). // - static optional use_pkeyutl; - - static bool + static inline bool use_openssl_pkeyutl (const common_options& co) { - if (!use_pkeyutl) - { - const path& openssl_path (co.openssl ()[openssl_version]); - - try - { - optional oi ( - openssl::info (print_command, 2, openssl_path)); - - use_pkeyutl = oi && - oi->name == "OpenSSL" && - oi->version >= semantic_version {3, 0, 0}; - } - catch (const process_error& e) - { - fail << "unable to execute " << openssl_path << ": " << e << endf; - } - catch (const io_error& e) - { - fail << "unable to read '" << openssl_path << "' output: " << e - << endf; - } - } + return openssl_version (co) >= semantic_version {3, 0, 0}; + } - return *use_pkeyutl; + // Return true if `openssl x509 -fingerprint` command issues the 'Reading + // certificate from stdin since no -in or -new option is given' warning, + // which is the case for the openssl version in the [3.2.0 3.3.0) range (see + // GH issue #353 for details). + // + static inline bool + openssl_warn_stdin (const common_options& co) + { + const semantic_version& v (openssl_version (co)); + return v >= semantic_version {3, 2, 0} && v < semantic_version {3, 3, 0}; } // Find the repository location prefix that ends with the version component. @@ -190,15 +209,25 @@ namespace bpkg dr << ": " << *e; }; - const path& openssl_path (co.openssl ()[openssl_x509]); - const strings& openssl_opts (co.openssl_option ()[openssl_x509]); + const path& openssl_path (co.openssl ()[openssl_x509_cmd]); + const strings& openssl_opts (co.openssl_option ()[openssl_x509_cmd]); try { openssl os (print_command, fdstream_mode::text, fdstream_mode::text, 2, - openssl_path, openssl_x509, - openssl_opts, "-sha256", "-noout", "-fingerprint"); + openssl_path, openssl_x509_cmd, + openssl_opts, + "-sha256", + "-noout", + "-fingerprint" +#ifndef _WIN32 + , + (openssl_warn_stdin (co) + ? cstrings ({"-in", "/dev/stdin"}) + : cstrings ()) +#endif + ); os.out << pem; os.out.close (); @@ -288,8 +317,8 @@ namespace bpkg dr << ": " << *e; }; - const path& openssl_path (co.openssl ()[openssl_x509]); - const strings& openssl_opts (co.openssl_option ()[openssl_x509]); + const path& openssl_path (co.openssl ()[openssl_x509_cmd]); + const strings& openssl_opts (co.openssl_option ()[openssl_x509_cmd]); try { @@ -315,7 +344,7 @@ namespace bpkg openssl os ( print_command, fdstream_mode::text, fdstream_mode::text, 2, - openssl_path, openssl_x509, + openssl_path, openssl_x509_cmd, openssl_opts, "-noout", "-subject", "-dates", "-email", // Previously we have used "RFC2253,sep_multiline" format to display @@ -877,7 +906,7 @@ namespace bpkg }; bool ku (use_openssl_pkeyutl (co)); - const string& cmd (ku ? openssl_pkeyutl : openssl_rsautl); + const string& cmd (ku ? openssl_pkeyutl_cmd : openssl_rsautl_cmd); const path& openssl_path (co.openssl ()[cmd]); const strings& openssl_opts (co.openssl_option ()[cmd]); @@ -973,8 +1002,8 @@ namespace bpkg }; const string& cmd (use_openssl_pkeyutl (co) - ? openssl_pkeyutl - : openssl_rsautl); + ? openssl_pkeyutl_cmd + : openssl_rsautl_cmd); const path& openssl_path (co.openssl ()[cmd]); const strings& openssl_opts (co.openssl_option ()[cmd]); -- cgit v1.1