namecoin / certinject

Inject certificates into Windows CryptoAPI trust store, with EKU and name constraints.
https://www.namecoin.org/
GNU General Public License v3.0
2 stars 6 forks source link

Undefined variables prevent building on Alpine #91

Open sevenrats opened 1 year ago

sevenrats commented 1 year ago
#7 12.17 certblob/certblob.go:82:10: undefined: CertEnhkeyUsagePropID
#7 12.17 certblob/certblob.go:94:10: undefined: CertRootProgramNameConstraintsPropID
JeremyRand commented 1 year ago

Hi, thanks for the report! This sounds like you may have forgotten to run go generate ./...; can you check to see if that fixes it?

sevenrats commented 1 year ago

This is not the cause. I followed the instructions as written. Having done some more exploration though, I may be doing something unsupported. Is building ncdns from source in Alpine supported? Possible? If I run this snippet with docker build, it fails at the marked "go mod tidy" with the aforementioned failures. If I do the same thing in a real shell in a pause container, it fails at the following "go install," with the same error.

FROM alpine:latest as builder
ENV GOPATH=/go
RUN \
mkdir /go && \
apk add --no-cache git bash go nss
RUN \
git clone https://github.com/namecoin/x509-compressed.git && \
cd x509-compressed && \
go mod init github.com/namecoin/x509-compressed && \
go mod tidy && \
go generate ./... && \
go mod tidy && \
cd ..
RUN \
git clone https://github.com/namecoin/certinject.git && \
cd certinject && \
go mod init github.com/namecoin/certinject && \
go mod tidy && \
go generate ./... && \
<mark>go mod tidy && \ </mark>
go install ./...
RUN \
cd .. && \
git clone https://github.com/namecoin/ncdns.git && \
go mod edit -replace github.com/namecoin/x509-compressed=../x509-compressed && \
go mod tidy && \
go mod init github.com/namecoin/ncdns && \
go mod edit -replace github.com/coreos/go-systemd=github.com/coreos/go-systemd/v22@latest -replace github.com/namecoin/certinject=../certinject -replace github.com/namecoin/x509-compressed=../x509-compressed && \
go mod tidy 
JeremyRand commented 1 year ago

Having done some more exploration though, I may be doing something unsupported. Is building ncdns from source in Alpine supported? Possible?

Should work as long as you have Bash installed (which it looks like you do). That said, I've never tested it in Alpine myself, so maybe there's a bug. Can you do cd certblob; ./generate.sh and let me know if there are any errors shown?

(To be clear, building in Alpine sounds like a reasonable use case, so unless there's some reason we can't support it that I'm unaware of, I'd consider a failure there to be a bug that we should fix.)

sevenrats commented 1 year ago

Returns fine with no errors. It writes this propids.go:

package certblob

const (
        CLERTKLEYPLROVHLANDLEPLROPILD                         = 1
        CLERTKLEYPLROVILNFOPLROPILD                           = 2
        CLERTSLHA1HLASHPLROPILD                               = 3
        CLERTMLD5HLASHPLROPILD                                = 4
        CLERTHLASHPLROPILD                                    = CLERTSLHA1HLASHPLROPILD
        CLERTKLEYCLONTEXTPLROPILD                             = 5
        CLERTKLEYSLPECPLROPILD                                = 6
        CLERTILE30RLESERVEDPLROPILD                           = 7
        CLERTPLUBKEYHLASHRLESERVEDPLROPILD                    = 8
        CLERTELNHKEYULSAGEPLROPILD                            = 9
        CLERTCLTLULSAGEPLROPILD                               = CLERTELNHKEYULSAGEPLROPILD
        CLERTNLEXTULPDATELLOCATIONPLROPILD                    = 10
        CLERTFLRIENDLYNLAMEPLROPILD                           = 11
        CLERTPLVKFLILEPLROPILD                                = 12
        CLERTDLESCRIPTIONPLROPILD                             = 13
        CLERTALCCESSSLTATEPLROPILD                            = 14
        CLERTSLIGNATUREHLASHPLROPILD                          = 15
        CLERTSLMARTCLARDDLATAPLROPILD                         = 16
        CLERTELFSPLROPILD                                     = 17
        CLERTFLORTEZZADLATAPLROPILD                           = 18
        CLERTALRCHIVEDPLROPILD                                = 19
        CLERTKLEYILDENTIFIERPLROPILD                          = 20
        CLERTALUTOELNROLLPLROPILD                             = 21
        CLERTPLUBKEYALLGPLARAPLROPILD                         = 22
        CLERTCLROSSCLERTDLISTPLOINTSPLROPILD                  = 23
        CLERTILSSUERPLUBLICKLEYMLD5HLASHPLROPILD              = 24
        CLERTSLUBJECTPLUBLICKLEYMLD5HLASHPLROPILD             = 25
        CLERTELNROLLMENTPLROPILD                              = 26
        CLERTDLATESLTAMPPLROPILD                              = 27
        CLERTILSSUERSLERIALNLUMBERMLD5HLASHPLROPILD           = 28
        CLERTSLUBJECTNLAMEMLD5HLASHPLROPILD                   = 29
        CLERTELXTENDEDELRRORILNFOPLROPILD                     = 30
        CLERTRLENEWALPLROPILD                                 = 64
        CLERTALRCHIVEDKLEYHLASHPLROPILD                       = 65
        CLERTALUTOELNROLLRLETRYPLROPILD                       = 66
        CLERTALIAULRLRLETRIEVEDPLROPILD                       = 67
        CLERTALUTHORITYILNFOALCCESSPLROPILD                   = 68
        CLERTBLACKEDULPPLROPILD                               = 69
        CLERTOLCSPRLESPONSEPLROPILD                           = 70
        CLERTRLEQUESTOLRIGINATORPLROPILD                      = 71
        CLERTSLOURCELLOCATIONPLROPILD                         = 72
        CLERTSLOURCEULRLPLROPILD                              = 73
        CLERTNLEWKLEYPLROPILD                                 = 74
        CLERTOLCSPCLACHEPLREFIXPLROPILD                       = 75
        CLERTSLMARTCLARDRLOOTILNFOPLROPILD                    = 76
        CLERTNLOALUTOELXPIRECLHECKPLROPILD                    = 77
        CLERTNLCRYPTKLEYHLANDLEPLROPILD                       = 78
        CLERTHLCRYPTPROVOLRNLCRYPTKLEYHLANDLEPLROPILD         = 79
        CLERTSLUBJECTILNFOALCCESSPLROPILD                     = 80
        CLERTCLAOLCSPALUTHORITYILNFOALCCESSPLROPILD           = 81
        CLERTCLADLISABLECLRLPLROPILD                          = 82
        CLERTRLOOTPLROGRAMCLERTPLOLICIESPLROPILD              = 83
        CLERTRLOOTPLROGRAMNLAMECLONSTRAINTSPLROPILD           = 84
        CLERTSLUBJECTOLCSPALUTHORITYILNFOALCCESSPLROPILD      = 85
        CLERTSLUBJECTDLISABLECLRLPLROPILD                     = 86
        CLERTCLEPPLROPILD                                     = 87
        CLERTSLIGNHLASHCLNGALLGPLROPILD                       = 89
        CLERTSLCARDPLINILDPLROPILD                            = 90
        CLERTSLCARDPLINILNFOPLROPILD                          = 91
        CLERTSLUBJECTPLUBKLEYBLITLLENGTHPLROPILD              = 92
        CLERTPLUBKLEYCLNGALLGBLITLLENGTHPLROPILD              = 93
        CLERTILSSUERPLUBKLEYBLITLLENGTHPLROPILD               = 94
        CLERTILSSUERCLHAINSLIGNHLASHCLNGALLGPLROPILD          = 95
        CLERTILSSUERCLHAINPLUBKLEYCLNGALLGBLITLLENGTHPLROPILD = 96
        CLERTNLOELXPIRENLOTIFICATIONPLROPILD                  = 97
        CLERTALUTHRLOOTSLHA256HLASHPLROPILD                   = 98
        CLERTNLCRYPTKLEYHLANDLETLRANSFERPLROPILD              = 99
        CLERTHLCRYPTPROVTLRANSFERPLROPILD                     = 100
        CLERTSLMARTCLARDRLEADERPLROPILD                       = 101
        CLERTSLENDALSTLRUSTEDILSSUERPLROPILD                  = 102
        CLERTKLEYRLEPAIRALTTEMPTEDPLROPILD                    = 103
        CLERTDLISALLOWEDFLILETIMEPLROPILD                     = 104
        CLERTRLOOTPLROGRAMCLHAINPLOLICIESPLROPILD             = 105
        CLERTSLMARTCLARDRLEADERNLONRLEMOVABLEPLROPILD         = 106
        CLERTSLHA256HLASHPLROPILD                             = 107
        CLERTSLCEPSLERVERCLERTSPLROPILD                       = 108
        CLERTSLCEPRLASLIGNATURECLERTPLROPILD                  = 109
        CLERTSLCEPRLAELNCRYPTIONCLERTPLROPILD                 = 110
        CLERTSLCEPCLACLERTPLROPILD                            = 111
        CLERTSLCEPSLIGNERCLERTPLROPILD                        = 112
        CLERTSLCEPNLONCEPLROPILD                              = 113
        CLERTSLCEPELNCRYPTHLASHCLNGALLGPLROPILD               = 114
        CLERTSLCEPFLLAGSPLROPILD                              = 115
        CLERTSLCEPGLUIDPLROPILD                               = 116
        CLERTSLERIALIZABLEKLEYCLONTEXTPLROPILD                = 117
        CLERTILSOLATEDKLEYPLROPILD                            = 118
        CLERTSLERIALCLHAINPLROPILD                            = 119
        CLERTKLEYCLLASSIFICATIONPLROPILD                      = 120
        CLERTOLCSPMLUSTSLTAPLEPLROPILD                        = 121
        CLERTDLISALLOWEDELNHKEYULSAGEPLROPILD                 = 122
        CLERTNLONCOMPLIANTRLOOTULRLPLROPILD                   = 123
        CLERTPLINSLHA256HLASHPLROPILD                         = 124
        CLERTCLLRDLELETEKLEYPLROPILD                          = 125
        CLERTNLOTBLEFOREFLILETIMEPLROPILD                     = 126
        CLERTNLOTBLEFOREELNHKEYULSAGEPLROPILD                 = 127
        CLERTFLIRSTRLESERVEDPLROPILD                          = 107
)
sevenrats commented 1 year ago

this is due to some type of sed alpinism. apk add --no-cache sed gets us past this error.

JeremyRand commented 1 year ago

Interesting. I'm not fluent enough in Alpine to know what difference in sed behavior is causing this bug, but if there's a way to fix it without making the code quality worse, I think I'd probably accept a PR.

JeremyRand commented 1 year ago

(Re-opening to reflect the fact that a PR would be appreciated.)

sevenrats commented 1 year ago

The explanation is that busybox's sed and gnu sed are fundamentally different. Busybox's Sed source code describes the implementation as "very minimalist." I have not determined if there is syntax that will work on both distributions for this application, but it seems reasonable to start here: https://superuser.com/questions/485808/sed-command-on-busybox-expects-different-syntax https://stackoverflow.com/questions/69651244/alternative-way-of-sed-range-substitution-in-busybox-sed-or-awk https://github.com/brgl/busybox/blob/master/editors/sed.c