98 lines
2.2 KiB
Ruby
98 lines
2.2 KiB
Ruby
|
#!/usr/bin/env ruby
|
||
|
|
|
||
|
|
require "pathname"
|
||
|
|
require "tmpdir"
|
||
|
|
require "open3"
|
||
|
|
require "fileutils"
|
||
|
|
|
||
|
|
require "/fudo/lib/fudo.rb"
|
||
|
|
|
||
|
|
Fudo::require("fudo/config")
|
||
|
|
Fudo::require("network")
|
||
|
|
|
||
|
|
config = Fudo::Config::default
|
||
|
|
hostname = Fudo::Network::hostname
|
||
|
|
|
||
|
|
keystore = Pathname.new(
|
||
|
|
config.get("services::#{hostname}::service::keystore"))
|
||
|
|
passwd_file = Pathname.new(
|
||
|
|
config.get("services::#{hostname}::service::keystore_passwd_file"))
|
||
|
|
|
||
|
|
if ARGV.length != 2
|
||
|
|
puts "usage: #{$0} [KEY_FILE] [CERT_FILE]"
|
||
|
|
exit 1
|
||
|
|
end
|
||
|
|
|
||
|
|
KEYNAME = Pathname.new(ARGV[0])
|
||
|
|
CERTNAME = Pathname.new(ARGV[1])
|
||
|
|
|
||
|
|
if not File::readable?(KEYNAME)
|
||
|
|
raise RuntimeError.new("Key #{KEYNAME.to_s} can't be read!")
|
||
|
|
end
|
||
|
|
|
||
|
|
if not File::readable?(CERTNAME)
|
||
|
|
raise RuntimeError.new("Certificate #{CERTNAME.to_s} can't be read!")
|
||
|
|
end
|
||
|
|
|
||
|
|
if not keystore.parent.writable?
|
||
|
|
raise RuntimeError.new("Can't write JKS to directory #{keystore.parent.to_s}")
|
||
|
|
end
|
||
|
|
|
||
|
|
if keystore.exist?
|
||
|
|
raise RuntimeError.new("Keystore exists: #{keystore}! Aborting...")
|
||
|
|
end
|
||
|
|
|
||
|
|
if passwd_file.exist?
|
||
|
|
raise RuntimeError.new("Keystore password file exists: #{passwd_file}! Aborting...")
|
||
|
|
end
|
||
|
|
|
||
|
|
def exec_or_die(cmd)
|
||
|
|
out, err, status = Open3::capture3(cmd)
|
||
|
|
if status != 0
|
||
|
|
puts err
|
||
|
|
raise RuntimeError.new(err)
|
||
|
|
end
|
||
|
|
end
|
||
|
|
|
||
|
|
def randpass
|
||
|
|
(0...50).map { ('a'..'z').to_a[rand(26)] }.join
|
||
|
|
end
|
||
|
|
|
||
|
|
finalpass = randpass
|
||
|
|
|
||
|
|
Dir::mktmpdir { |tmp_0|
|
||
|
|
begin
|
||
|
|
PRIV = Pathname.new(tmp_0) + "private"
|
||
|
|
Dir::mkdir(PRIV)
|
||
|
|
File::chmod(0700, PRIV)
|
||
|
|
pkcs12 = PRIV + "key_crt.p12"
|
||
|
|
pem_to_pkcs12 = <<EOF
|
||
|
|
openssl pkcs12 \
|
||
|
|
-export \
|
||
|
|
-inkey #{KEYNAME.to_s} \
|
||
|
|
-in #{CERTNAME.to_s} \
|
||
|
|
-out #{pkcs12.to_s} \
|
||
|
|
-name key_crt \
|
||
|
|
-password pass:#{finalpass}
|
||
|
|
EOF
|
||
|
|
pkcs12_to_jks = <<EOF
|
||
|
|
keytool -importkeystore \
|
||
|
|
-srckeystore #{pkcs12.to_s} \
|
||
|
|
-srcstoretype pkcs12 \
|
||
|
|
-srcstorepass #{finalpass} \
|
||
|
|
-srcalias key_crt \
|
||
|
|
-destkeystore #{keystore.to_s} \
|
||
|
|
-deststoretype jks \
|
||
|
|
-deststorepass #{finalpass}
|
||
|
|
EOF
|
||
|
|
exec_or_die(pem_to_pkcs12)
|
||
|
|
exec_or_die(pkcs12_to_jks)
|
||
|
|
|
||
|
|
File::open(passwd_file, "w", 0600) { |file|
|
||
|
|
file.print(finalpass)
|
||
|
|
}
|
||
|
|
ensure
|
||
|
|
FileUtils::rm(pkcs12)
|
||
|
|
end
|
||
|
|
}
|