1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
|
package ca
import (
"encoding/pem"
"fmt"
"os"
"github.com/pkg/errors"
"github.com/smallstep/certificates/api"
"github.com/smallstep/certificates/ca"
"github.com/smallstep/certificates/pki"
"github.com/smallstep/cli/command"
"github.com/smallstep/cli/crypto/pemutil"
"github.com/smallstep/cli/errs"
"github.com/smallstep/cli/flags"
"github.com/smallstep/cli/ui"
"github.com/smallstep/cli/utils"
"github.com/urfave/cli"
)
type flowType int
const (
rootsFlow flowType = iota
federationFlow
)
func rootsCommand() cli.Command {
return cli.Command{
Name: "roots",
Action: command.ActionFunc(rootsAction),
Usage: "download all the root certificates",
UsageText: `**step ca roots** [<roots-file>]
[**--ca-url**=<uri>] [**--root**=<file>]`,
Description: `**step ca roots** downloads a certificate bundle with all the root
certificates.
## POSITIONAL ARGUMENTS
<roots-file>
: File to write all the root certificates (PEM format)
## EXAMPLES
Download the roots with flags set by <step ca bootstrap>:
'''
$ step ca roots roots.pem
'''
Download the roots with custom flags:
'''
$ step ca roots roots.pem \
--ca-url https://ca.example.com \
--root /path/to/root_ca.crt
'''
Print the roots using flags set by <step ca bootstrap>:
'''
$ step ca roots
'''`,
Flags: []cli.Flag{
flags.CaURL,
flags.Force,
flags.Root,
},
}
}
func federationCommand() cli.Command {
return cli.Command{
Name: "federation",
Action: command.ActionFunc(federationAction),
Usage: "download all the federated certificates",
UsageText: `**step ca federation** [<federation-file>]
[**--ca-url**=<uri>] [**--root**=<file>]`,
Description: `**step ca federation** downloads a certificate bundle with all the root
certificates in the federation.
## POSITIONAL ARGUMENTS
<federation-file>
: File to write federation certificates (PEM format)
## EXAMPLES
Download the federated roots with flags set by <step ca bootstrap>:
'''
$ step ca federation federation.pem
'''
Download the federated roots with custom flags:
'''
$ step ca federation federation.pem \
--ca-url https://ca.example.com \
--root /path/to/root_ca.crt
'''
Print the federated roots using flags set by <step ca bootstrap>:
'''
$ step ca federation
'''`,
Flags: []cli.Flag{
flags.CaURL,
flags.Force,
flags.Root,
},
}
}
func rootsAction(ctx *cli.Context) error {
return rootsAndFederationFlow(ctx, rootsFlow)
}
func federationAction(ctx *cli.Context) error {
return rootsAndFederationFlow(ctx, federationFlow)
}
func rootsAndFederationFlow(ctx *cli.Context, typ flowType) error {
if err := errs.MinMaxNumberOfArguments(ctx, 0, 1); err != nil {
return err
}
caURL, err := flags.ParseCaURL(ctx)
if err != nil {
return err
}
root := ctx.String("root")
if len(root) == 0 {
root = pki.GetRootCAPath()
if _, err := os.Stat(root); err != nil {
return errs.RequiredFlag(ctx, "root")
}
}
client, err := ca.NewClient(caURL, ca.WithRootFile(root))
if err != nil {
return err
}
var certs []api.Certificate
switch typ {
case rootsFlow:
roots, err := client.Roots()
if err != nil {
return err
}
certs = roots.Certificates
case federationFlow:
federation, err := client.Federation()
if err != nil {
return err
}
certs = federation.Certificates
default:
return errors.New("unknown flow type: this should not happen")
}
var data []byte
for _, cert := range certs {
block, err := pemutil.Serialize(cert.Certificate)
if err != nil {
return err
}
data = append(data, pem.EncodeToMemory(block)...)
}
if outFile := ctx.Args().Get(0); outFile != "" {
if err := utils.WriteFile(outFile, data, 0600); err != nil {
return err
}
switch typ {
case rootsFlow:
ui.Printf("The root certificate bundle has been saved in %s.\n", outFile)
case federationFlow:
ui.Printf("The federation certificate bundle has been saved in %s.\n", outFile)
default:
return errors.New("unknown flow type: this should not happen")
}
} else {
fmt.Print(string(data))
}
return nil
}
|
