68 lines
1.8 KiB
Bash
68 lines
1.8 KiB
Bash
#!/bin/sh
|
|
# Install AtlasHorizon CAs into the OS trust store (Debian/Ubuntu apt or Alpine apk).
|
|
set -eu
|
|
|
|
SRC_DIR="/tmp/atlas-ca"
|
|
CERT_DIR="/usr/local/share/ca-certificates"
|
|
BUNDLE="/etc/ssl/certs/ca-certificates.crt"
|
|
EXPECTED=3
|
|
|
|
count=0
|
|
for cert in "${SRC_DIR}"/*.crt; do
|
|
[ -f "${cert}" ] || continue
|
|
count=$((count + 1))
|
|
done
|
|
|
|
if [ "${count}" -ne "${EXPECTED}" ]; then
|
|
echo "expected ${EXPECTED} CA files in ${SRC_DIR}, found ${count}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Install the package first so its postinst does not consume our CAs yet.
|
|
if command -v apk >/dev/null 2>&1; then
|
|
apk add --no-cache ca-certificates
|
|
elif command -v apt-get >/dev/null 2>&1; then
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends ca-certificates
|
|
rm -rf /var/lib/apt/lists/*
|
|
else
|
|
echo "unsupported base image: need apk or apt-get" >&2
|
|
exit 1
|
|
fi
|
|
|
|
mkdir -p "${CERT_DIR}"
|
|
cp "${SRC_DIR}"/*.crt "${CERT_DIR}/"
|
|
|
|
output="$(update-ca-certificates 2>&1)"
|
|
printf '%s\n' "${output}"
|
|
|
|
case "${output}" in
|
|
*" added"*)
|
|
added="$(printf '%s\n' "${output}" | sed -n 's/.*\([0-9][0-9]*\) added.*/\1/p' | head -n 1)"
|
|
if [ -z "${added}" ] || [ "${added}" -lt "${EXPECTED}" ]; then
|
|
echo "update-ca-certificates added ${added:-0} CAs, expected ${EXPECTED}" >&2
|
|
exit 1
|
|
fi
|
|
;;
|
|
esac
|
|
|
|
if [ ! -f "${BUNDLE}" ]; then
|
|
echo "missing trust bundle ${BUNDLE}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
for cert in "${CERT_DIR}"/*.crt; do
|
|
body="$(sed -n '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/p' "${cert}" | sed '1d;$d' | head -n 1)"
|
|
if [ -z "${body}" ]; then
|
|
echo "could not read PEM body from ${cert}" >&2
|
|
exit 1
|
|
fi
|
|
if ! grep -q -F "${body}" "${BUNDLE}"; then
|
|
echo "CA not present in ${BUNDLE}: ${cert}" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
echo "AtlasHorizon PKI: ${EXPECTED} CAs installed in the system trust store"
|