PR#226: Update csrgen test to understand OpenSSL 3.0.0 output - certmonger

certmonger

#226 Update csrgen test to understand OpenSSL 3.0.0 output

Merged 2 years ago by rcritten. Opened 2 years ago by rcritten.

rcritten/certmonger issue_223 into master

Update csrgen test to understand OpenSSL 3.0.0 output

Rob Crittenden • 2 years ago

46cd5a7

tests/003-csrgen-ec/run.sh

file modified

+2 -2

		`@@ -42,8 +42,8 @@`
		`openssl x509 -out minicert.nss.$size.pem -in minicert.nss.$size -inform der`
		`# The RSA tests already verify the contents of the requests, so we really only`
		`# need to care about the signatures passing verification.`
		`- openssl req -verify -noout < csr.nss.$size 2>&1`
		`- openssl req -verify -noout < csr.openssl.$size 2>&1`
		`+ openssl req -verify -noout < csr.nss.$size 2>&1 \| sed 's/Certificate request self-signature //'`
		`+ openssl req -verify -noout < csr.openssl.$size 2>&1 \| sed 's/Certificate request self-signature //'`
		`openssl spkac -verify -noout < spkac.nss.$size 2>&1`
		`openssl spkac -verify -noout < spkac.openssl.$size 2>&1`
		`openssl verify -CAfile minicert.openssl.$size.pem minicert.openssl.$size.pem 2>&1`

tests/003-csrgen-rsa/run.sh

file modified

+2 -2

		`@@ -118,14 +118,14 @@`
		`echo key_pubkey=616263 >> entry.openssl.$size`
		`$toolsdir/csrgen entry.nss.$size > csr.nss.$size`
		`# Both should verify.`
		- if test "`openssl req -verify -key key.$size -in csr.openssl.$size -noout 2>&1`" != "verify OK" ; then
		+ if test "`openssl req -verify -key key.$size -in csr.openssl.$size -noout 2>&1 \| grep -c "verify OK"`" != "1" ; then
		`echo Signature failed for OpenSSL:`
		`cat csr.openssl.$size`
		`echo Private key:`
		`awk '/BEGIN PRIVATE KEY/,/END PRIVATE KEY/{print}{;}' $tmpdir/key.$size`
		`exit 1`
		`fi`
		- if test "`openssl req -verify -key key.$size -in csr.nss.$size -noout 2>&1`" != "verify OK" ; then
		+ if test "`openssl req -verify -key key.$size -in csr.nss.$size -noout 2>&1 \| grep -c "verify OK"`" != "1" ; then
		`echo Signature failed for NSS:`
		`cat csr.nss.$size`
		`echo Private key:`

tests/003-csrgen/run.sh

file modified

+2 -2

		`@@ -170,14 +170,14 @@`
		`echo key_pubkey=616263 >> entry.openssl.$size`
		`$toolsdir/csrgen entry.nss.$size > csr.nss.$size`
		`# Both should verify.`
		- if test "`openssl req -verify -key key.$size -in csr.openssl.$size -noout 2>&1`" != "verify OK" ; then
		+ if test "`openssl req -verify -key key.$size -in csr.openssl.$size -noout 2>&1 \| grep -c "verify OK"`" != "1" ; then
		`echo Signature failed for OpenSSL:`
		`cat csr.openssl.$size`
		`echo Private key:`
		`awk '/BEGIN PRIVATE KEY/,/END PRIVATE KEY/{print}{;}' $tmpdir/key.$size`
		`exit 1`
		`fi`
		- if test "`openssl req -verify -key key.$size -in csr.nss.$size -noout 2>&1`" != "verify OK" ; then
		+ if test "`openssl req -verify -key key.$size -in csr.nss.$size -noout 2>&1 \| grep -c "verify OK"`" != "1" ; then
		`echo Signature failed for NSS:`
		`cat csr.nss.$size`
		`echo Private key:`

rcritten commented 2 years ago

OpenSSL 3.0.0 change a lot of output messages. When verifying
a certificate instead of printing just "verify OK" it prints
"Certificate request self-signature verify OK"

Modify the check to match both OpenSSL 1.x and 3.x

Signed-off-by: Rob Crittenden rcritten@redhat.com