dist: Replace openssl with pure Rust libraries for cert generation#67
dist: Replace openssl with pure Rust libraries for cert generation#67
Conversation
Xanewok
force-pushed
the
igor-remove-openssl
branch
from
0c80440 to
67e9c90
Compare
Xanewok
left a comment
Xanewok
left a comment
There was a problem hiding this comment.
I'm in the process of debugging the dist test failures and so I looked closely at the certificate generation process, trying to get the old and new certificate to be bit perfect to rule it out as a potential cause.
It seems that, to achieve backwards compat, we first sign the certificate but later replace its extensions with select few that we used with the openssl code. I'm not 110% sure this is the direct cause of the test failure but it looks like something we need to address before this lands as this looks incorrect.
drahnr
force-pushed
the
igor-remove-openssl
branch
4 times, most recently
from
62c7544 to
85485ad
Compare
Xanewok
force-pushed
the
igor-remove-openssl
branch
from
60e6156 to
0c5b885
Compare
|
Timeouts are gone, now we actually fail to connect due to SSL/cert error 🙃 |
|
Dist tests are finally green now 🎉 |
Xanewok
changed the title
|
The only downside with introducing rsa to |
This removes the extra rsa-* dependencies at the cost of introducing rand 0.8, which other libraries (incl. picky) has not migrated to yet at the time of writing.
This effectively invalidates the signature, and hence the certifacte is rightfully rejected by the dist tests.
Co-authored-by: Bernhard Schuster <[email protected]>
By default, the digital signature and data encipherment key usage are enabled by default, whereas we only specified the former here. Our existing web server (`rouille` with `openssl` backend) is not happy, so don't specify anything different ourselves and rely on the default.
We distribute self-signed certificates so according to RFC 5280 the authority key identifier (AKI) can be safely be omitted (and also openssl omits this), but since picky includes it unconditionally, let's just stick to a default not to give an impression that we rely on this specific key ID generation method.
drahnr
force-pushed
the
igor-remove-openssl
branch
from
a84b0ef to
7a1e672
Compare
|
Should we update our upstream PR with what the fixed/refreshed version from here? |
|
We probably should eventually, but that's not a pressing thing imho. |
2 participants
Last change split from https://github.com/paritytech/sccache/tree/legacy-rebased. This also includes an extra commit which upgrades
rsato 0.4 (see commit for rationale; we can skip that commit for now).Ideally this is something that we'd like to upstream (see mozilla/sccache#879 for previous attempt).