sdf-jkl commented on code in PR #12020: URL: https://github.com/apache/arrow-rs/pull/12020#discussion_r4495954483
########## arrow-flight/examples/data/gen_certs.sh: ########## @@ -1,30 +1,40 @@ #!/bin/sh +# SPDX-License-Identifier: Apache-2.0 +# SPDX-FileCopyrightText: See the NOTICE file distributed with this work for additional information regarding copyright ownership +# SPDX-FileContributor: Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements -# source: https://users.rust-lang.org/t/use-tokio-tungstenite-with-rustls-instead-of-native-tls-for-secure-websockets/90130 +# Generate test-only certificates with OpenSSL 1.1.1 or later. +# Run from arrow-flight/examples/data: sh gen_certs.sh +# Overwrites ca_root, client and server .pem/.key files in the current directory. +set -eu -make_and_sign() { - # Create unencrypted private key and a CSR (certificate signing request) - openssl req -newkey rsa:2048 -nodes -subj "/C=FI/CN=vahid" -keyout "$1.key" -out "$1.csr" +cert_tmp=$(mktemp -d) +trap 'rm -rf "$cert_tmp"' EXIT +trap 'exit 1' HUP INT TERM - # Create self-signed certificate (`$1.pem`) with the private key and CSR - openssl x509 -signkey "$1.key" -in "$1.csr" -req -days 365 -out "$1.pem" +openssl req -new -x509 -newkey rsa:2048 -nodes -sha256 -days 1825 \ + -config /dev/null -subj "/CN=Arrow Flight Test CA" \ + -addext "basicConstraints=critical,CA:TRUE" \ + -addext "keyUsage=critical,keyCertSign,cRLSign" \ + -addext "subjectKeyIdentifier=hash" \ + -keyout ca_root.key -out ca_root.pem - # Sign the CSR (`$1.pem`) with the root CA certificate and private key - # => this overwrites `$1.pem` because it gets signed - openssl x509 -req -CA ca_root.pem -CAkey ca_root.key -in "$1.csr" -out "$1.pem" -days 1825 -CAcreateserial -extfile localhost.ext -} +for identity in client server; do + openssl req -new -newkey rsa:2048 -nodes -sha256 \ + -config /dev/null -subj "/CN=Arrow Flight Test $identity" \ Review Comment: Same change for the client and server requests. It needs the `req.cnf` line from the suggestion above, so please apply both together. ```suggestion -config "$cert_tmp/req.cnf" -subj "/CN=Arrow Flight Test $identity" \ ``` ########## arrow-flight/examples/data/gen_certs.sh: ########## @@ -1,30 +1,40 @@ #!/bin/sh +# SPDX-License-Identifier: Apache-2.0 +# SPDX-FileCopyrightText: See the NOTICE file distributed with this work for additional information regarding copyright ownership +# SPDX-FileContributor: Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements -# source: https://users.rust-lang.org/t/use-tokio-tungstenite-with-rustls-instead-of-native-tls-for-secure-websockets/90130 +# Generate test-only certificates with OpenSSL 1.1.1 or later. +# Run from arrow-flight/examples/data: sh gen_certs.sh +# Overwrites ca_root, client and server .pem/.key files in the current directory. +set -eu -make_and_sign() { - # Create unencrypted private key and a CSR (certificate signing request) - openssl req -newkey rsa:2048 -nodes -subj "/C=FI/CN=vahid" -keyout "$1.key" -out "$1.csr" +cert_tmp=$(mktemp -d) +trap 'rm -rf "$cert_tmp"' EXIT +trap 'exit 1' HUP INT TERM - # Create self-signed certificate (`$1.pem`) with the private key and CSR - openssl x509 -signkey "$1.key" -in "$1.csr" -req -days 365 -out "$1.pem" +openssl req -new -x509 -newkey rsa:2048 -nodes -sha256 -days 1825 \ + -config /dev/null -subj "/CN=Arrow Flight Test CA" \ Review Comment: 🤖 💬(claude) : `-config /dev/null` breaks this script on OpenSSL 1.1.1 and LibreSSL (the macOS default): `openssl req` fails with `unable to find 'distinguished_name' in config`, after `ca_root.key` has already been overwritten. The previous script ran on both. A minimal config with an empty `distinguished_name` section still keeps the system config out of the way. I tested this change on OpenSSL 1.1.1w, 1.1.1f, 3.0 and 3.5 and LibreSSL 3.5.3: the generated certs match the committed fixtures and the Flight example tests pass with each set. ```suggestion trap 'exit 1' HUP INT TERM printf '[req]\ndistinguished_name = dn\n[dn]\n' >"$cert_tmp/req.cnf" openssl req -new -x509 -newkey rsa:2048 -nodes -sha256 -days 1825 \ -config "$cert_tmp/req.cnf" -subj "/CN=Arrow Flight Test CA" \ ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
