faerbit/archiso
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

.gitlab/ci/build_archiso.sh: improve CI codesigning certificate

Browse Source 
Adjust subject name to more closely match what's used in create_ephemeral_pgp_key.

Reduce the certificate validity to two days. These are just temporary
certificates, they will not be used anywhere.

Fixes #196
This commit is contained in:
nl6720 2023-06-01 09:33:00 +03:00
parent 17a71ade2e
commit 279d3c0971
No known key found for this signature in database
GPG Key ID: 5CE88535E188D369
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
.gitlab/ci/build_archiso.sh
View File

@ -219,12 +219,12 @@ create_ephemeral_codesigning_keys() {
local ca_dir="${codesigning_dir}/ca/" local ca_dir="${codesigning_dir}/ca/"
local ca_conf="${ca_dir}/certificate_authority.cnf" local ca_conf="${ca_dir}/certificate_authority.cnf"
local ca_subj="/C=DE/ST=Berlin/L=Berlin/O=Arch Linux/OU=Release Engineering/CN=archlinux.org" local ca_subj='/C=DE/ST=Berlin/L=Berlin/O=Arch Linux/OU=Release Engineering/emailAddress=arch-releng@lists.archlinux.org/CN=Arch Linux Release Engineering (Ephemeral Certificate Authority)'
ca_cert="${ca_dir}/cacert.pem" ca_cert="${ca_dir}/cacert.pem"
ca_key="${ca_dir}/private/cakey.pem" ca_key="${ca_dir}/private/cakey.pem"
local codesigning_conf="${codesigning_dir}/code_signing.cnf" local codesigning_conf="${codesigning_dir}/code_signing.cnf"
local codesigning_subj="/C=DE/ST=Berlin/L=Berlin/O=Arch Linux/OU=Release Engineering/CN=archlinux.org" local codesigning_subj='/C=DE/ST=Berlin/L=Berlin/O=Arch Linux/OU=Release Engineering/emailAddress=arch-releng@lists.archlinux.org/CN=Arch Linux Release Engineering (Ephemeral Signing Key)'
codesigning_cert="${codesigning_dir}/codesign.crt" codesigning_cert="${codesigning_dir}/codesign.crt"
codesigning_key="${codesigning_dir}/codesign.key" codesigning_key="${codesigning_dir}/codesign.key"
@ -249,6 +249,7 @@ create_ephemeral_codesigning_keys() {
-keyout "${ca_key}" \ -keyout "${ca_key}" \
-config "${ca_conf}" \ -config "${ca_conf}" \
-subj "${ca_subj}" \ -subj "${ca_subj}" \
-days 2 \
-out "${ca_cert}" -out "${ca_cert}"
cat <<EOF >>"${ca_conf}" cat <<EOF >>"${ca_conf}"
@ -285,7 +286,7 @@ EOF
-batch \ -batch \
-config "${ca_conf}" \ -config "${ca_conf}" \
-extensions v3_intermediate_ca \ -extensions v3_intermediate_ca \
-days 3650 \ -days 2 \
-notext \ -notext \
-md sha256 \ -md sha256 \
-in "${codesigning_cert}.csr" \ -in "${codesigning_cert}.csr" \