-
-
Notifications
You must be signed in to change notification settings - Fork 2.7k
/
truststore_linux.go
99 lines (83 loc) · 3.07 KB
/
truststore_linux.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
// Copyright 2018 The mkcert Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
package main
import (
"bytes"
"fmt"
"io/ioutil"
"log"
"os"
"path/filepath"
"strings"
)
var (
FirefoxProfiles = []string{os.Getenv("HOME") + "/.mozilla/firefox/*",
os.Getenv("HOME") + "/snap/firefox/common/.mozilla/firefox/*"}
NSSBrowsers = "Firefox and/or Chrome/Chromium"
SystemTrustFilename string
SystemTrustCommand []string
CertutilInstallHelp string
)
func init() {
switch {
case binaryExists("apt"):
CertutilInstallHelp = "apt install libnss3-tools"
case binaryExists("yum"):
CertutilInstallHelp = "yum install nss-tools"
case binaryExists("zypper"):
CertutilInstallHelp = "zypper install mozilla-nss-tools"
}
if pathExists("/etc/pki/ca-trust/source/anchors/") {
SystemTrustFilename = "/etc/pki/ca-trust/source/anchors/%s.pem"
SystemTrustCommand = []string{"update-ca-trust", "extract"}
} else if pathExists("/usr/local/share/ca-certificates/") {
SystemTrustFilename = "/usr/local/share/ca-certificates/%s.crt"
SystemTrustCommand = []string{"update-ca-certificates"}
} else if pathExists("/etc/ca-certificates/trust-source/anchors/") {
SystemTrustFilename = "/etc/ca-certificates/trust-source/anchors/%s.crt"
SystemTrustCommand = []string{"trust", "extract-compat"}
} else if pathExists("/usr/share/pki/trust/anchors") {
SystemTrustFilename = "/usr/share/pki/trust/anchors/%s.pem"
SystemTrustCommand = []string{"update-ca-certificates"}
}
}
func (m *mkcert) systemTrustFilename() string {
return fmt.Sprintf(SystemTrustFilename, strings.Replace(m.caUniqueName(), " ", "_", -1))
}
func (m *mkcert) installPlatform() bool {
if SystemTrustCommand == nil {
log.Printf("Installing to the system store is not yet supported on this Linux 😣 but %s will still work.", NSSBrowsers)
log.Printf("You can also manually install the root certificate at %q.", filepath.Join(m.CAROOT, rootName))
return false
}
cert, err := ioutil.ReadFile(filepath.Join(m.CAROOT, rootName))
fatalIfErr(err, "failed to read root certificate")
cmd := commandWithSudo("tee", m.systemTrustFilename())
cmd.Stdin = bytes.NewReader(cert)
out, err := cmd.CombinedOutput()
fatalIfCmdErr(err, "tee", out)
cmd = commandWithSudo(SystemTrustCommand...)
out, err = cmd.CombinedOutput()
fatalIfCmdErr(err, strings.Join(SystemTrustCommand, " "), out)
return true
}
func (m *mkcert) uninstallPlatform() bool {
if SystemTrustCommand == nil {
return false
}
cmd := commandWithSudo("rm", "-f", m.systemTrustFilename())
out, err := cmd.CombinedOutput()
fatalIfCmdErr(err, "rm", out)
// We used to install under non-unique filenames.
legacyFilename := fmt.Sprintf(SystemTrustFilename, "mkcert-rootCA")
if pathExists(legacyFilename) {
cmd := commandWithSudo("rm", "-f", legacyFilename)
out, err := cmd.CombinedOutput()
fatalIfCmdErr(err, "rm (legacy filename)", out)
}
cmd = commandWithSudo(SystemTrustCommand...)
out, err = cmd.CombinedOutput()
fatalIfCmdErr(err, strings.Join(SystemTrustCommand, " "), out)
return true
}