anchor-pki 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8c204ca34e433d268fe98808738b1c0250ad3b2035e178cb6fd15add6f8a05a3
-  data.tar.gz: 621128f1434720eaeeb0c44f54b6c29b779c12bc5faf3321192a766fe7da6b1d
+  metadata.gz: cc0b9b7fe9893fc5d4f23157bbb2a18c4a15066e929024c197b610ef5f6ffd80
+  data.tar.gz: 5cc3e63d7acbc16531c9abf60d04d205fe5ed0b638e595653a8aed74d8abc49a
 SHA512:
-  metadata.gz: e51132aa31a45a11a2153b6e118d6864905d6f3b2b2fb656ad16d11c0944a8e6625fb239ac515ab4b93aec58231bc98ffc0323eb6907e7c75d49b2f4537b1395
-  data.tar.gz: 66e37bb731e25e4abe95a020a7660cc94284960181752b6dd50eef474656ac9492e9f2d5a83c05ea5158e3fb436bb1a14230423b534ef9945ceaab453397434d
+  metadata.gz: 7d5d6bb50ee250800df59aa17ecca780cddc08293ff4bb609a4b944fcc611ef76ec916d5d6b75026694b0740addeabf592533c4117ea90cd3a1032c21c816f5e
+  data.tar.gz: 4e2c6f2a836c59319a6cab2a6f48204d75ae7e8fb1b721e6177c2ec75be57c1f8271a18fef02afc847dc822b1db8e70c228c4cbd90ec023fd54bd8ecd620d87c

data/lib/anchor-pki/auto_cert.rb

@@ -0,0 +1,134 @@
+# frozen_string_literal: true
+
+require 'acme/client'
+require 'uri'
+
+module Anchor
+  # AutoCert provides automatic access to certificates from Anchor, but
+  # theoretically it could work with Let's Encrypt and any other ACME-based CA.
+  class AutoCert
+    ACCEPT_ANY_TOS = [//].freeze
+
+    def initialize(name_policies, tos_acceptor, directory, account: {}, **opts)
+      @name_policies = name_policies
+      @tos_acceptor = tos_acceptor
+      @directory_url = URI.parse(directory)
+
+      @renew_before = opts[:renew_before]
+      @work_dir = Pathname(opts[:work_dir] || Dir.mktmpdir)
+      @cache = opts[:cache]
+      @client = opts[:client]
+
+      @client ||= new_client(**account)
+      @account_opts = account
+    end
+
+    def certificate(*names, algo: :ecdsa, common_name: names.first, **opts)
+      if (arr = unmatched_names(names)).size.positive?
+        raise StandardError, "unallowed names '#{arr.join(',')}'"
+      end
+
+      key_pem = @cache&.read("#{common_name}+#{algo}")
+      cert_pem = @cache&.read(common_name)
+
+      if key_pem.nil? || cert_pem.nil? || needs_renewal?(cert_pem)
+        cert_pem, key_pem = provision(names, algo, common_name, **opts)
+
+        @cache&.write("#{common_name}+#{algo}", key_pem)
+        @cache&.write(common_name, cert_pem)
+      end
+
+      cert = (@work_dir / common_name).open('w') { |f| f << cert_pem }.path
+      key = (@work_dir / "#{common_name}+#{algo}").open('w') { |f| f << key_pem }.path
+
+      [cert, key]
+    end
+
+    private
+
+    def provision(names, algo, common_name, **opts)
+      load_or_build_account
+
+      order = @client.new_order(identifiers: names, **opts)
+
+      key_pem ||= new_key(algo).to_pem
+      csr = Acme::Client::CertificateRequest.new(private_key: parse_key_pem(key_pem), common_name: common_name, names: names)
+
+      order.finalize(csr: csr)
+      # TODO: loop over order.authorizations and process the challenges
+
+      while order.status == 'processing'
+        sleep(1)
+        order.reload
+      end
+
+      return order.certificate, key_pem
+    end
+
+    def load_or_build_account
+      @account ||= build_account(**@account_opts)
+    end
+
+    def build_account(contact: nil, external_account_binding: nil, terms_of_service_agreed: false, **)
+      terms_of_service_agreed ||= @tos_acceptor.any? { |a| a.match?(@client.terms_of_service) }
+
+      @client.new_account(contact: contact, terms_of_service_agreed: terms_of_service_agreed, external_account_binding: external_account_binding)
+    end
+
+    def needs_renewal?(cert_pem)
+      cert = OpenSSL::X509::Certificate.new(cert_pem)
+
+      (Time.zone.now + @renew_before.to_i) > cert.not_after
+    end
+
+    def new_client(account_key: nil, contact: nil, **)
+      account_key ||= fetch_account_key(contact) { new_key(:ecdsa) }
+
+      Acme::Client.new(private_key: account_key, directory: @directory_url)
+    end
+
+    def new_key(algo)
+      case algo
+      when :ecdsa then OpenSSL::PKey::EC.generate('prime256v1')
+      else
+        raise "unknown key algo '#{algo}'"
+      end
+    end
+
+    def fetch_account_key(contact)
+      id = "#{contact || 'default'}+#{@directory_url.host}+key"
+      parse_key_pem(@cache&.fetch(id) { parse_key_pem(yield.to_pem) } || yield.to_pem)
+    end
+
+    def parse_key_pem(data)
+      begin
+        OpenSSL::PKey::RSA.new(data)
+      rescue StandardError
+        nil
+      end ||
+        begin
+          OpenSSL::PKey::EC.new(data)
+        rescue StandardError
+          nil
+        end ||
+        (raise 'unknown key data format')
+    end
+
+    def unmatched_names(names)
+      names.reject do |name|
+        @name_policies.any? do |policy|
+          case policy
+          when String then name == policy
+          when Regexp then policy.match?(name)
+          when IPAddr
+            begin
+              policy.include?(name)
+            rescue IPAddr::Error
+              nil
+            end
+          end
+        end
+      end
+    end
+  end
+end

metadata

@@ -1,15 +1,29 @@
 --- !ruby/object:Gem::Specification
 name: anchor-pki
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Anchor
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-11-05 00:00:00.000000000 Z
-dependencies: []
+date: 2023-04-18 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: acme-client
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.0.13
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.0.13
 description: Anchor is a hosted PKI platform for your internal organization.
 email: support@anchor.dev
 executables: []
@@ -17,6 +31,7 @@ extensions: []
 extra_rdoc_files: []
 files:
 - lib/anchor-pki.rb
+- lib/anchor-pki/auto_cert.rb
 homepage: https://anchor.dev/
 licenses:
 - MIT
@@ -36,7 +51,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.30
+rubygems_version: 3.3.26
 signing_key:
 specification_version: 4
 summary: Ruby client for Anchor PKI. See https://anchor.dev/ for details.