Gecko [ 167.86.127.34 ]

Name	Size	Permission
pkix	[ DIR ]	drwxr-xr-x
testdata	[ DIR ]	drwxr-xr-x
cert_pool.go	3.75 KB	-rw-r--r--
example_test.go	5.32 KB	-rw-r--r--
name_constraints_test.go	44.98 KB	-rw-r--r--
pem_decrypt.go	6.5 KB	-rw-r--r--
pem_decrypt_test.go	8.92 KB	-rw-r--r--
pkcs1.go	4.64 KB	-rw-r--r--
pkcs8.go	4.36 KB	-rw-r--r--
pkcs8_test.go	8.05 KB	-rw-r--r--
root.go	483 B	-rw-r--r--
root_aix.go	290 B	-rw-r--r--
root_bsd.go	518 B	-rw-r--r--
root_cgo_darwin.go	11.47 KB	-rw-r--r--
root_darwin.go	8.24 KB	-rw-r--r--
root_darwin_arm_gen.go	4.54 KB	-rw-r--r--
root_darwin_armx.go	256.1 KB	-rw-r--r--
root_darwin_test.go	4.31 KB	-rw-r--r--
root_js.go	275 B	-rw-r--r--
root_linux.go	684 B	-rw-r--r--
root_nocgo_darwin.go	264 B	-rw-r--r--
root_plan9.go	844 B	-rw-r--r--
root_solaris.go	419 B	-rw-r--r--
root_unix.go	2.16 KB	-rw-r--r--
root_unix_test.go	3.02 KB	-rw-r--r--
root_windows.go	9.98 KB	-rw-r--r--
sec1.go	4.25 KB	-rw-r--r--
sec1_test.go	5.36 KB	-rw-r--r--
test-file.crt	1.9 KB	-rw-r--r--
verify.go	33.48 KB	-rw-r--r--
verify_test.go	88.68 KB	-rw-r--r--
x509.go	81.23 KB	-rw-r--r--
x509_test.go	97.43 KB	-rw-r--r--
x509_test_import.go	1.7 KB	-rw-r--r--

Code Editor : root_darwin_arm_gen.go

// Copyright 2015 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

// +build ignore

// Generates root_darwin_armx.go.
//
// As of iOS 8, there is no API for querying the system trusted X.509 root
// certificates. We could use SecTrustEvaluate to verify that a trust chain
// exists for a certificate, but the x509 API requires returning the entire
// chain.
//
// Apple publishes the list of trusted root certificates for iOS on
// support.apple.com. So we parse the list and extract the certificates from
// an OS X machine and embed them into the x509 package.
package main

import (
	"bytes"
	"crypto/sha256"
	"crypto/x509"
	"encoding/hex"
	"encoding/pem"
	"flag"
	"fmt"
	"go/format"
	"io/ioutil"
	"log"
	"net/http"
	"os/exec"
	"regexp"
	"strings"
)

var output = flag.String("output", "root_darwin_armx.go", "file name to write")

func main() {
	certs, err := selectCerts()
	if err != nil {
		log.Fatal(err)
	}

buf := new(bytes.Buffer)

fmt.Fprintf(buf, "// Code generated by root_darwin_arm_gen --output %s; DO NOT EDIT.\n", *output)
	fmt.Fprintf(buf, "%s", header)

fmt.Fprintf(buf, "const systemRootsPEM = `\n")
	for _, cert := range certs {
		b := &pem.Block{
			Type:  "CERTIFICATE",
			Bytes: cert.Raw,
		}
		if err := pem.Encode(buf, b); err != nil {
			log.Fatal(err)
		}
	}
	fmt.Fprintf(buf, "`")

source, err := format.Source(buf.Bytes())
	if err != nil {
		log.Fatal("source format error:", err)
	}
	if err := ioutil.WriteFile(*output, source, 0644); err != nil {
		log.Fatal(err)
	}
}

func selectCerts() ([]*x509.Certificate, error) {
	ids, err := fetchCertIDs()
	if err != nil {
		return nil, err
	}

scerts, err := sysCerts()
	if err != nil {
		return nil, err
	}

var certs []*x509.Certificate
	for _, id := range ids {
		if c, ok := scerts[id.fingerprint]; ok {
			certs = append(certs, c)
		} else {
			fmt.Printf("WARNING: cannot find certificate: %s (fingerprint: %s)\n", id.name, id.fingerprint)
		}
	}
	return certs, nil
}

func sysCerts() (certs map[string]*x509.Certificate, err error) {
	cmd := exec.Command("/usr/bin/security", "find-certificate", "-a", "-p", "/System/Library/Keychains/SystemRootCertificates.keychain")
	data, err := cmd.Output()
	if err != nil {
		return nil, err
	}
	certs = make(map[string]*x509.Certificate)
	for len(data) > 0 {
		var block *pem.Block
		block, data = pem.Decode(data)
		if block == nil {
			break
		}
		if block.Type != "CERTIFICATE" || len(block.Headers) != 0 {
			continue
		}

cert, err := x509.ParseCertificate(block.Bytes)
		if err != nil {
			continue
		}

fingerprint := sha256.Sum256(cert.Raw)
		certs[hex.EncodeToString(fingerprint[:])] = cert
	}
	return certs, nil
}

type certID struct {
	name        string
	fingerprint string
}

// fetchCertIDs fetches IDs of iOS X509 certificates from apple.com.
func fetchCertIDs() ([]certID, error) {
	// Download the iOS 11 support page. The index for all iOS versions is here:
	// https://support.apple.com/en-us/HT204132
	resp, err := http.Get("https://support.apple.com/en-us/HT208125")
	if err != nil {
		return nil, err
	}
	defer resp.Body.Close()
	body, err := ioutil.ReadAll(resp.Body)
	if err != nil {
		return nil, err
	}
	text := string(body)
	text = text[strings.Index(text, "<div id=trusted"):]
	text = text[:strings.Index(text, "</div>")]

var ids []certID
	cols := make(map[string]int)
	for i, rowmatch := range regexp.MustCompile("(?s)<tr>(.*?)</tr>").FindAllStringSubmatch(text, -1) {
		row := rowmatch[1]
		if i == 0 {
			// Parse table header row to extract column names
			for i, match := range regexp.MustCompile("(?s)<th>(.*?)</th>").FindAllStringSubmatch(row, -1) {
				cols[match[1]] = i
			}
			continue
		}

values := regexp.MustCompile("(?s)<td>(.*?)</td>").FindAllStringSubmatch(row, -1)
		name := values[cols["Certificate name"]][1]
		fingerprint := values[cols["Fingerprint (SHA-256)"]][1]
		fingerprint = strings.ReplaceAll(fingerprint, "<br>", "")
		fingerprint = strings.ReplaceAll(fingerprint, "\n", "")
		fingerprint = strings.ReplaceAll(fingerprint, " ", "")
		fingerprint = strings.ToLower(fingerprint)

ids = append(ids, certID{
			name:        name,
			fingerprint: fingerprint,
		})
	}
	return ids, nil
}

// +build cgo
// +build darwin
// +build arm arm64 ios

package x509

func loadSystemRoots() (*CertPool, error) {
	p := NewCertPool()
	p.AppendCertsFromPEM([]byte(systemRootsPEM))
	return p, nil
}
`

${this.title}

Code Editor : root_darwin_arm_gen.go