update_certs.py 2.9 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273
  1. #!/usr/bin/env vpython3
  2. # Copyright 2018 The Chromium Authors. All rights reserved.
  3. # Use of this source code is governed by a BSD-style license that can be
  4. # found in the LICENSE file.
  5. import logging
  6. import os
  7. import subprocess
  8. import sys
  9. _THIS_DIR = os.path.dirname(__file__)
  10. sys.path.append(os.path.join(_THIS_DIR, 'wpt', 'tools', 'wptserve', 'wptserve'))
  11. from sslutils.openssl import OpenSSLEnvironment
  12. _DOMAIN = '127.0.0.1'
  13. def main():
  14. cert_dir = os.path.join(_THIS_DIR, 'certs')
  15. print('===> Removing old files...')
  16. old_files = filter(lambda filename: '.sxg.' not in filename,
  17. os.listdir(cert_dir))
  18. old_files = [os.path.join(cert_dir, fn) for fn in old_files]
  19. if subprocess.call(['git', 'rm'] + old_files) != 0:
  20. sys.exit(1)
  21. print('\n===> Regenerating keys and certificates...')
  22. env = OpenSSLEnvironment(logging.getLogger(__name__),
  23. base_path=cert_dir,
  24. force_regenerate=True,
  25. duration=3000)
  26. with env:
  27. key_path, pem_path = env.host_cert_path(
  28. [_DOMAIN,
  29. # See '_subdomains' in wpt/tools/serve/serve.py.
  30. 'www.' + _DOMAIN,
  31. 'www1.' + _DOMAIN,
  32. 'www2.' + _DOMAIN,
  33. 'xn--n8j6ds53lwwkrqhv28a.' + _DOMAIN,
  34. 'xn--lve-6lad.' + _DOMAIN])
  35. if subprocess.call('git add -v ' + os.path.join(cert_dir, '*'), shell=True) != 0:
  36. sys.exit(1)
  37. print('\n===> Updating wpt.config.json and base.py...')
  38. key_basename = os.path.basename(key_path)
  39. pem_basename = os.path.basename(pem_path)
  40. config_path = os.path.join(_THIS_DIR, 'wpt.config.json')
  41. if subprocess.call(['sed', '-i', '', '-E',
  42. 's%/[^/]+[.]key%/{key}%g;s%/[^/]+[.]pem%/{pem}%g'.format(
  43. key=key_basename, pem=pem_basename),
  44. config_path]) != 0:
  45. sys.exit(1)
  46. base_py_path = os.path.join(_THIS_DIR, '..', '..',
  47. 'web_tests', 'port', 'base.py')
  48. proc = subprocess.Popen('openssl x509 -noout -pubkey -in ' + pem_path +
  49. ' | openssl pkey -pubin -outform der'
  50. ' | openssl dgst -sha256 -binary'
  51. ' | base64', shell=True, stdout=subprocess.PIPE)
  52. base64, _ = proc.communicate()
  53. if subprocess.call(['sed', '-i', '', '-E',
  54. 's%WPT_FINGERPRINT = \'.*\'%WPT_FINGERPRINT = \'' +
  55. base64.strip() + '\'%', base_py_path]) != 0:
  56. sys.exit(1)
  57. if subprocess.call(['git', 'add', '-v', config_path, base_py_path]) != 0:
  58. sys.exit(1)
  59. print('\n===> Certificate validity:')
  60. subprocess.call(['grep', 'Not After', pem_path])
  61. if __name__ == "__main__":
  62. main()