From 4340c68fa9626ab3db81dd774f79305dc774a7e6 Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Fri, 14 Jun 2024 01:14:22 +0200 Subject: Backport upstream patches to fix fix post-issuance validation logic. As well as the upstream test suite. Closes: #1072847 --- ...e-against-current-Let-s-Encrypt-staging-e.patch | 123 +++++++++++++++++++++ 1 file changed, 123 insertions(+) create mode 100644 debian/patches/Adjust-test-suite-against-current-Let-s-Encrypt-staging-e.patch (limited to 'debian/patches/Adjust-test-suite-against-current-Let-s-Encrypt-staging-e.patch') diff --git a/debian/patches/Adjust-test-suite-against-current-Let-s-Encrypt-staging-e.patch b/debian/patches/Adjust-test-suite-against-current-Let-s-Encrypt-staging-e.patch new file mode 100644 index 0000000..0065c39 --- /dev/null +++ b/debian/patches/Adjust-test-suite-against-current-Let-s-Encrypt-staging-e.patch @@ -0,0 +1,123 @@ +From: Guilhem Moulin +Date: Wed, 26 Apr 2023 17:41:24 +0200 +Subject: Adjust test suite against current Let's Encrypt staging environment + +Origin: https://git.guilhem.org/lacme/commit/?id=cb0b301e7a62a71d9e4454f9f7af5358c857c48c +Origin: https://git.guilhem.org/lacme/commit/?id=f84716c064312dd9dc0d149f0ec7a12f5c88c3af +Origin: https://git.guilhem.org/lacme/commit/?id=a41444b8b1fe5349a4a33c45f1e96036845609bb +Origin: https://git.guilhem.org/lacme/commit/?id=98e4397f5330245cb7f8a21054ab078c4d0bba82 +--- + tests/account-encrypted-gpg | 2 +- + tests/account-encrypted-openssl | 1 + + tests/cert-install | 2 +- + tests/cert-verify | 22 +++++----------------- + tests/old-lacme | 9 +++++---- + 5 files changed, 13 insertions(+), 23 deletions(-) + +diff --git a/tests/account-encrypted-gpg b/tests/account-encrypted-gpg +index fd1e4ac..7cb978d 100644 +--- a/tests/account-encrypted-gpg ++++ b/tests/account-encrypted-gpg +@@ -9,7 +9,7 @@ keyid="$(gpg --list-secret-key --with-colons | grep -m1 ^fpr: | cut -sd: -f10)" + gpg --encrypt -r "$keyid" /etc/lacme/account.key + sed -ri '0,\|^#?privkey\s*=.*| {s||privkey = gpg:/etc/lacme/account.key.gpg|}' /etc/lacme/lacme-accountd.conf + +-export GPG_TTY="$(tty)" ++export GPG_TTY="$(tty)" TERM="linux" + lacme account + + # vim: set filetype=sh : +diff --git a/tests/account-encrypted-openssl b/tests/account-encrypted-openssl +index e79a528..a3ad707 100644 +--- a/tests/account-encrypted-openssl ++++ b/tests/account-encrypted-openssl +@@ -5,6 +5,7 @@ PASSPHRASE="test" + openssl rsa -aes128 -passout pass:"$PASSPHRASE" /etc/lacme/account.enc.key + sed -ri '0,\|^#?privkey\s*=.*| {s||privkey = file:/etc/lacme/account.enc.key|}' /etc/lacme/lacme-accountd.conf + ++export TERM="linux" + lacme account + + # vim: set filetype=sh : +diff --git a/tests/cert-install b/tests/cert-install +index 4415cdd..03360fd 100644 +--- a/tests/cert-install ++++ b/tests/cert-install +@@ -79,7 +79,7 @@ check_chain() { + + # 'certificate' installs only the leaf certificate + openssl genpkey -algorithm RSA -out /etc/lacme/test1.key +-subject="/CN=$(head -c10 /dev/urandom | base32 -w0).$DOMAINNAME" ++subject="/CN=$(head -c10 /dev/urandom | base32 -w0 | tr "A-Z" "a-z").$DOMAINNAME" + cat >"/etc/lacme/lacme-certs.conf.d/test1.conf" <<- EOF + [test1] + certificate-key = /etc/lacme/test1.key +diff --git a/tests/cert-verify b/tests/cert-verify +index 4d254c6..6ee9211 100644 +--- a/tests/cert-verify ++++ b/tests/cert-verify +@@ -8,31 +8,19 @@ for ca in /usr/share/lacme/letsencrypt-stg-root-*.pem; do + done + update-ca-certificates + +-# test (modified) trust store for intermediate certificates +-openssl verify -no-CAfile -CApath /etc/ssl/certs -show_chain /usr/share/lacme/letsencrypt-stg-int-*.pem +-openssl verify -no-CApath -CAfile /etc/ssl/certs/ca-certificates.crt -show_chain /usr/share/lacme/letsencrypt-stg-int-*.pem ++# test (modified) trust store ++openssl verify -no-CAfile -CApath /etc/ssl/certs -show_chain /usr/share/lacme/letsencrypt-stg-root-x1.pem ++openssl verify -no-CApath -CAfile /etc/ssl/certs/ca-certificates.crt -show_chain /usr/share/lacme/letsencrypt-stg-root-x1.pem + + mv /usr/share/lacme/ca-certificates.crt /usr/share/lacme/ca-certificates.crt.back + ! lacme newOrder 2>"$STDERR" || fail +-grepstderr -Fxq "Could not open file or uri for loading certs of trusted certificates from /usr/share/lacme/ca-certificates.crt" ++grepstderr -Fq " certs of trusted certificates from /usr/share/lacme/ca-certificates.crt" + grepstderr -Fxq "[simpletest-rsa] Error: Received invalid X.509 certificate from ACME server!" + + # verification error for unrelated CA bundle + cat /etc/ssl/certs/ssl-cert-snakeoil.pem >/usr/share/lacme/ca-certificates.crt + ! lacme newOrder 2>"$STDERR" || fail +-grepstderr -Fxq "error 20 at 0 depth lookup: unable to get local issuer certificate" +-grepstderr -Fxq "[simpletest-rsa] Error: Received invalid X.509 certificate from ACME server!" +- +-# verification error when the CA bundle contains only the root certificates +-cat /usr/share/lacme/letsencrypt-stg-root-*.pem >/usr/share/lacme/ca-certificates.crt +-! lacme newOrder 2>"$STDERR" || fail +-grepstderr -Fxq "error 20 at 0 depth lookup: unable to get local issuer certificate" +-grepstderr -Fxq "[simpletest-rsa] Error: Received invalid X.509 certificate from ACME server!" +- +-# verification error when the CA bundle contains only the intermediate certificates +-cat /usr/share/lacme/letsencrypt-stg-int-*.pem >/usr/share/lacme/ca-certificates.crt +-! lacme newOrder 2>"$STDERR" || fail +-grepstderr -Fxq "error 2 at 1 depth lookup: unable to get issuer certificate" ++grepstderr -Fxq "error 20 at 1 depth lookup: unable to get local issuer certificate" + grepstderr -Fxq "[simpletest-rsa] Error: Received invalid X.509 certificate from ACME server!" + + # use saved bundle as custom CAfile +diff --git a/tests/old-lacme b/tests/old-lacme +index b1c9f88..278a705 100644 +--- a/tests/old-lacme ++++ b/tests/old-lacme +@@ -1,5 +1,6 @@ +-# IPC test between recent lacme-accountd(1) and ancient lacme(8) 0.5 from Debian buster +-# (we don't try earlier versions as we need v2 support of the ACME API) ++# IPC test between recent lacme-accountd(1) and ancient lacme(8) 0.8 from Debian Bullseye ++# (we don't try earlier versions as we need v2 support of the ACME API ++# and non-pinned intermediates) + + adduser --disabled-password \ + --home /home/lacme-account \ +@@ -14,12 +15,12 @@ cat >~lacme-account/.config/lacme/lacme-accountd.conf <<-EOF + privkey = file:/etc/lacme/account.key + EOF + +-echo "deb http://deb.debian.org/debian buster main" >>/etc/apt/sources.list ++echo "deb http://deb.debian.org/debian bullseye main" >>/etc/apt/sources.list + DEBIAN_FRONTEND="noninteractive" apt update + DEBIAN_FRONTEND="noninteractive" apt install -y --no-install-recommends \ + --reinstall --allow-downgrades \ + -oDPkg::Options::="--force-confdef" -oDPkg::Options::="--force-overwrite" \ +- lacme/buster ++ lacme/bullseye + + # restore staging environment + mv -f /usr/share/lacme/ca-certificates.crt.back /usr/share/lacme/ca-certificates.crt -- cgit v1.2.3