search

semaj / hammurabi

MIT License
7 stars 2 forks source link

Missing assets/roots.pem #1

Open mmcloughlin opened 1 year ago

mmcloughlin commented 1 year ago

When running the command from the README:

> ./target/debug/single chrome certs/141c7a18a5a00ef35ef43f89288f80405b358ea407c2deee933fa7d07a52559f.pem hrm.auth.gr
thread 'main' panicked at 'called `Result::unwrap()` on an `Err` value: Os { code: 2, kind: NotFound, message: "No such file or directory" }', src/lib.rs:51:61

The missing file appears to be assets/roots.pem:

https://github.com/semaj/hammurabi/blob/16b253ebd8e2768f9295439bf70e2d50954fba73/src/lib.rs#L51

It appears this file was deleted in https://github.com/semaj/hammurabi/commit/16b253ebd8e2768f9295439bf70e2d50954fba73, along with some other assets files.

I resurrected the files from the prior commit and it worked correctly. What is this file exactly? Should it be recovered and committed to the repository again? Or is there a process I should use to generate another version?

Thanks!

semaj commented 1 year ago

Hi Michael, that file is a snapshot of a root certificate store (I believe a combination of Firefox and Debian's). More specifically, it is a collection of PEM-encoded trust anchors (root certificates). When you give Hammurabi a leaf certificate (and optionally intermediates), it will construct all chains (checking signatures and subject/issuer pairs only) from that leaf to a trust anchor found in that file. Only such chains will be checked by Prolog validation code.

Feel free to resurrect and commit it (I'll accept that PR), though just know it is probably out of date. To generate a new version, you'd need to look at Debian's /etc/ssl/certs directory and/or Mozilla NSS's certdata.txt. More generally, one could use whatever trust anchors they desire (e.g., a self-signed certificate of your choosing).

Please let me know if you have any further questions or if there's any other help you need with the repo.

mmcloughlin commented 1 year ago

Thanks!

Probably the ideal would be to check in something that would be enough to run the examples (perhaps just the existing assets/roots.pem), and then a script that can be used to re-generate it.

mmcloughlin commented 1 year ago

/etc/ssl/certs/ca-certificates.crt works directly in place of assets/roots.pem.