anchor-pki 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 342dadd5c28835816da2c07cdd1d4b7b546cc2a35ca80738cc98707d2a048cd4
-  data.tar.gz: 97cb3d7c9c9bbb770c8a3a52eae0690bc7f18cadd5f3a31689d6d00239f5a523
+  metadata.gz: c07e54ede7ccff887e6023fe9842989720fdf9d63f159e4a5a3b4ba1a92c6c1a
+  data.tar.gz: dc0ba249f2125b9cc9d6a4a2dfda9fb042e86c0c7691d45fd6f7b432c5aa2d43
 SHA512:
-  metadata.gz: 06b0f93d4bc1962f60a4122bd2f4a046818e36c49779eae9255ff24d6cbb7ba9bd9029bb4f72f516b96c5fa8aef98cea7fbbd6f29ae3b69e42e6cb31e5990ade
-  data.tar.gz: f220a29a0c170f74b8926a1ae804f65d1719a4f9956edc04c6844ac27b2404f15c56908cf5b608a35fec1fe10679b74442ace2b3f6034af3eab814d564da670d
+  metadata.gz: e074e115e1035f8ed0b2289859073516b9cad04f9452f5dd8aa8dc070b8cdd119db2abf26b5bf2540a410818948fd4dfff4ca854cdc579b457bf15ae4065428a
+  data.tar.gz: 916f262c31580a3f92ca909bd0900d979a9ccb7a93d3f2cdb9e538bc9b29e8215db96468b5fe21c49c16ed836260857cc392f697772f032e6f76c28540af0653

data/README.md

@@ -44,6 +44,27 @@ ACME_KID=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 ACME_HMAC_KEY=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 ```
 
+## Record new test cassettes
+
+This code base tests against vcr recordings. These may need to be
+regenerated periodically.
+
+1. check out the code base locally
+1. go to <https://anchor.dev/autocert-cab3bc/services/anchor-pki-rb-testing>
+1. in the **Server Setup** section, generate new `ACME_KID` & `ACME_HMAC_KEY`
+   tokens.
+1. Make a local `.env` file or similar containing:
+
+        export ACME_DIRECTORY_URL='https://anchor.dev/autocert-cab3bc/development/x509/ca/acme'
+        export ACME_KID=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+        export ACME_HMAC_KEY=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+
+1. on the command line execute:
+
+        $ . .env
+        $ rm -r spec/cassettes
+        $ bundle exec rake spec
+
 ## License
 
 The gem is available as open source under the terms of the [MIT

data/lib/anchor/auto_cert/managed_certificate.rb

@@ -36,6 +36,10 @@ module Anchor
         x509.serial.to_s(16).scan(/.{2}/).join(joiner)
       end
 
+      def expired?(now: Time.now.utc)
+        not_after <= now
+      end
+
       def needs_renewal?(now = Time.now.utc)
         manager.needs_renewal?(cert: x509, now: now)
       end

data/lib/anchor/auto_cert/manager.rb

@@ -62,14 +62,16 @@ module Anchor
         key_pem = cache&.read("#{common_name}+#{algorithm}")
         cert_pem = cache&.read(common_name)
 
-        if key_pem.nil? || cert_pem.nil?
-          cert_pem, key_pem = provision(identifiers: identifiers, algorithm: algorithm, common_name: common_name,
-                                        **opts)
-
-          cache&.write("#{common_name}+#{algorithm}", key_pem)
-          cache&.write(common_name, cert_pem)
+        if !key_pem.nil? && !cert_pem.nil?
+          managed_cert = ManagedCertificate.new(manager: self, cert_pem: cert_pem, key_pem: key_pem)
+          return managed_cert unless managed_cert.expired?
         end
 
+        cert_pem, key_pem = provision(identifiers: identifiers, algorithm: algorithm, common_name: common_name, **opts)
+
+        cache&.write("#{common_name}+#{algorithm}", key_pem)
+        cache&.write(common_name, cert_pem)
+
         ManagedCertificate.new(manager: self, cert_pem: cert_pem, key_pem: key_pem)
       end
 

data/lib/anchor/oid.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Anchor
+  # Oid is ASN.1 Object Identifiers.
+  module Oid
+    PEN      = OpenSSL::ASN1::ObjectId.new('1.3.6.1.4.1.60900', OpenSSL::ASN1::OBJECT, :EXPLICIT, :PRIVATE)
+    CERT_EXT = OpenSSL::ASN1::ObjectId.new("#{PEN.oid}.1", OpenSSL::ASN1::OBJECT, :EXPLICIT, :PRIVATE)
+
+    OpenSSL::ASN1::ObjectId.register(CERT_EXT.oid, 'anchorCertExt', 'Anchor Certificate Extension')
+  end
+end

data/lib/anchor/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Anchor
-  VERSION = '0.4.0'
+  VERSION = '0.5.0'
 end

data/lib/anchor-pki.rb

@@ -5,5 +5,5 @@
 # this file is named anchor-pki.rb to match the gem name and to be consistent
 # with the other anchor modules for other languages
 
-require_relative './anchor'
+require_relative 'anchor'
 # rubocop:enable Naming/FileName

data/lib/anchor.rb

@@ -19,5 +19,6 @@ module Anchor
   end
 end
 
-require_relative './anchor/version'
-require_relative './anchor/auto_cert'
+require_relative 'anchor/version'
+require_relative 'anchor/auto_cert'
+require_relative 'anchor/oid'

data/lib/puma/plugin/auto_cert.rb

@@ -22,9 +22,10 @@ module Puma
       # a plugin is created
       module PluginInstanceMethods
         attr_accessor :managed_certificate
+        attr_reader :port
 
         def config(dsl)
-          port          = dsl.auto_cert_port || ENV.fetch('HTTPS_PORT', nil)
+          @port         = dsl.auto_cert_port || ENV.fetch('HTTPS_PORT', nil)
           name          = dsl.auto_cert_name || ENV.fetch('AUTO_CERT_NAME', 'default')
           configuration = ::Anchor::AutoCert::Registry.fetch(name)
           identifiers   = configuration.allow_identifiers
@@ -46,7 +47,10 @@ module Puma
             return
           end
 
-          log_writer.log "AutoCert >> Configured for #{managed_certificate.identifiers.join(', ')}"
+          @managed_certificate.identifiers.each do |identifier|
+            log_writer.log "AutoCert >> Available at https://#{identifier}:#{port}/"
+          end
+
           check_every = launcher.config.options[:auto_cert_check_every] ||
                         ENV.fetch('AUTO_CERT_CHECK_EVERY', nil) ||
                         ::Anchor::AutoCert::RenewalBusyWait::ONE_HOUR

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: anchor-pki
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Anchor Security, Inc
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-06-06 00:00:00.000000000 Z
+date: 2023-09-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: acme-client
@@ -152,6 +152,7 @@ files:
 - lib/anchor/auto_cert/registry.rb
 - lib/anchor/auto_cert/renewal_busy_wait.rb
 - lib/anchor/auto_cert/terms_of_service_acceptor.rb
+- lib/anchor/oid.rb
 - lib/anchor/version.rb
 - lib/puma/dsl.rb
 - lib/puma/plugin/auto_cert.rb