Adding -verify and expanding -x509 options for our OpenSSL tool #1951
Conversation
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #1951 +/- ##
===========================================
Coverage ? 79.01%
===========================================
Files 0 595 +595
Lines 0 102255 +102255
Branches 0 14485 +14485
===========================================
+ Hits 0 80800 +80800
- Misses 0 20809 +20809
- Partials 0 646 +646 ☔ View full report in Codecov by Sentry. |
| RunCommandsAndCompareOutput(tool_command, openssl_command, out_path_tool, out_path_openssl, tool_output_str, openssl_output_str); | ||
|
|
||
| ASSERT_EQ(tool_output_str, openssl_output_str); | ||
| } |
There was a problem hiding this comment.
Can you add a test that verify verifies a public cert (like amazon.com), this will verify that we are correctly loading the default system trust store certs. Traps to avoid:
- Don't create a time bomb
- Not everywhere that runs our CI has network access
| ASSERT_EQ(tool_output_str, openssl_output_str); | ||
| } | ||
|
|
||
| // Test against OpenSSL output "openssl x509 -in file -inform DER -enddate" |
There was a problem hiding this comment.
Can you add a test for using the wrong inform.
There was a problem hiding this comment.
Are you suggesting a test to check that the output for the error case of using a wrong inform is the same as openssl?
I have an erroneous usage test case for this option here: https://github.com/aws/aws-lc/pull/1951/files#diff-8b8002fb4d9429e7a3d9c3b9f2fddee7d50b81db27af7321ab566d0a1359b430R283
Issues:
CryptoAlg-2679Description of changes:
-subject,-fingerprint,-inform,-enddate,-subject_hash,-subject_hash_oldoptions added to the x509 toolverifytool with-CAfileverifytool takes a file as input or defaults to reading from stdinCallouts:
The subject field differs in OpenSSL master and versions <= 3.2. A normalization function that removes whitespaces is used to compare output.
Testing:
Added option tests for new functionality and OpenSSL comparison tests for the new options.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.