forked from boxboat/in-toto-golang
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Makefile
136 lines (111 loc) · 4.05 KB
/
Makefile
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
-include .env
#VERSION := $(shell git describe --tags)
#BUILD := $(shell git rev-parse --short HEAD)
PROJECTNAME := in-toto-go
# Go related variables.
#GOBASE := $(shell pwd)
#GOPATH := $(GOBASE)/vendor:$(GOBASE)
#GOBIN := $(GOBASE)/bin
#GOFILES := $(wildcard *.go)
# Use linker flags to provide version/build settings
#LDFLAGS=-ldflags "-X=main.Version=$(VERSION) -X=main.Build=$(BUILD)"
# Make is verbose in Linux. Make it silent.
#MAKEFLAGS += --silent
#Common Certificate Attributes
TRUST_DOMAIN_FQDN := example.com
DEFAULT_BITS := 2048
DEFAULT_MD := sha512
ORGANIZATIONAL_UNIT := example
ORGANIZATION := example
ROOT_DAYS := 3650
INTERMEDIATE_DAYS := 3650
LEAF_DAYS := 1
#Template Location
OPENSSL_TMPL := ./certs/openssl.cnf.tmpl
build: modules
@mkdir -p bin
@go build -o=./bin/in-toto
modules:
@go mod tidy
clean:
@rm -rf ./bin
clean-certs:
@rm ./certs/*.pem ./certs/*.srl ./certs/*.cnf
test: go-test test-verify test-run
test-verify: build
@./bin/in-toto verify
test-run: build
#Step 1
@mkdir -p ./test/products/step1
@./bin/in-toto run -k ./certs/example.com.step1.key.pem -m ./test/data/foo.tar.gz -n step1 -p ./test/products/step1/ -- tar -xzf ./test/data/foo.tar.gz -C ./test/products/step1
go-test:
@go test ./...
generate-test-certs: intermediate_cert
root-cert:
$(call generate_openssl_conf,root)
#Create Root Key
@openssl genrsa -out ./certs/root.key.pem
#Create Root Cert
@openssl req -subj "/C=/ST=/L=/O=$(ORGANIZATION)/OU=$(ORGANIZATIONAL_UNIT)CN=root/" -days $(ROOT_DAYS) -x509 -new \
-key "./certs/root.key.pem" -out "./certs/root.cert.pem" \
-config ./certs/$(TRUST_DOMAIN_FQDN).root.openssl.cnf \
-extensions v3-root
intermediate_cert: root-cert
$(call generate_openssl_conf,intermediate)
#Create intermediate key
@openssl genrsa -out ./certs/$(TRUST_DOMAIN_FQDN).intermediate.key.pem
#Generate intermediate CSR
@openssl req -subj "/C=/ST=/L=/O=$(ORGANIZATION)/OU=$(ORGANIZATIONAL_UNIT)CN=$(TRUST_DOMAIN_FQDN)" -new \
-key ./certs/$(TRUST_DOMAIN_FQDN).intermediate.key.pem \
-out ./certs/$(TRUST_DOMAIN_FQDN).intermediate.csr.pem \
-config ./certs/$(TRUST_DOMAIN_FQDN).intermediate.openssl.cnf \
-extensions v3-intermediate
#Sign Intermediate CSR Using Root Certificate
@openssl x509 -days $(INTERMEDIATE_DAYS) -req \
-CAcreateserial \
-CA ./certs/root.cert.pem \
-CAkey ./certs/root.key.pem \
-in ./certs/$(TRUST_DOMAIN_FQDN).intermediate.csr.pem \
-out ./certs/$(TRUST_DOMAIN_FQDN).intermediate.cert.pem \
-extfile ./certs/$(TRUST_DOMAIN_FQDN).intermediate.openssl.cnf \
-extensions v3-intermediate
@openssl verify -CAfile ./certs/root.cert.pem ./certs/$(TRUST_DOMAIN_FQDN).intermediate.cert.pem
leaf_certs: intermediate_cert
$(call gernerate_leaf_cert,step1)
$(call gernerate_leaf_cert,step2)
define gernerate_leaf_cert
$(call generate_openssl_conf,$(1))
#Generate leaf signing key
@openssl genrsa -out ./certs/$(TRUST_DOMAIN_FQDN).$(1).key.pem
#Generate leaf CSR
openssl req -new \
-key ./certs/$(TRUST_DOMAIN_FQDN).$(1).key.pem \
-out ./certs/$(TRUST_DOMAIN_FQDN).$(1).csr.pem \
-config ./certs/$(TRUST_DOMAIN_FQDN).$(1).openssl.cnf \
-extensions v3-leaf
#Sign leaf CSR Using intermediate Certificate
@openssl x509 -days $(LEAF_DAYS) -req \
-CAcreateserial \
-CA ./certs/$(TRUST_DOMAIN_FQDN).intermediate.cert.pem \
-CAkey ./certs/$(TRUST_DOMAIN_FQDN).intermediate.key.pem \
-in ./certs/$(TRUST_DOMAIN_FQDN).$(1).csr.pem \
-out ./certs/$(TRUST_DOMAIN_FQDN).$(1).cert.pem \
-extfile ./certs/$(TRUST_DOMAIN_FQDN).$(1).openssl.cnf \
-extensions v3-leaf
endef
define generate_openssl_conf
@cat $(OPENSSL_TMPL) | sed -e 's/{{TRUST_DOMAIN_FQDN}}/$(TRUST_DOMAIN_FQDN)/' | \
sed -e 's/{{ORGANIZATIONAL_UNIT}}/$(ORGANIZATIONAL_UNIT)/' | \
sed -e 's/{{ORGANIZATION}}/$(ORGANIZATION)/' | \
sed -e 's/{{DEFUALT_BITS}}/$(DEFAULT_BITS)/' | \
sed -e 's/{{DEFAULT_MD}}/$(DEFAULT_MD)/' | \
sed -e 's/{{SPIFFE_PATH}}/$(1)/' > certs/$(TRUST_DOMAIN_FQDN).$(1).openssl.cnf
endef
.PHONY: help
all: help
help: Makefile
@echo
@echo " Choose a command run in in-toto-golang:"
@echo
@sed -n 's/^##//p' $< | column -t -s ':' | sed -e 's/^/ /'
@echo