bullion 0.11.0 → 0.11.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 95d9b8437f39397499aaa73d1b9abf932930ab46a29ac5f08d5ab2533b0c0b83
-  data.tar.gz: 78ca06dc463ffffd5e274bee516196d8cbaefe759b413fa5670fedc247c7c9a8
+  metadata.gz: 8821e563a9452dbd524f1bdfbd2f944ee4a3d0c071e57bab6d5f9b2c61e18555
+  data.tar.gz: d31913ae560676de68a57ea6aa308126a6d3c92c7a3da69d4d882e032ed56196
 SHA512:
-  metadata.gz: '02358422a89125d538c4eb8b5c16d875121525658c11988209cc3bd8581c4cf8a7782d37a70ae2498a3d24e4e28015320d65e2d17285e14dce9f94ea09d69063'
-  data.tar.gz: 6d927f92fdd653b044bff00f9683f57a026e1cbd504867dd89b1061cbe92219f0da11612af700d6044c90d99accb588ba19e517875547fe039173683245517e8
+  metadata.gz: 4bcabcb78421e92a48fbd5485631de98bee3bf0d4452ba5d9c08eb04d34ac171934b073e0a441b5dc95aeeb353765a5445188ca7011b98d3e2f376d130aaf2d4
+  data.tar.gz: 5541be539b018f62d1e466e51ada7985f5e37ee460eb98c4e344f79c443aa60fa3f8b2bf1d26d169a15c0b8efef38c7523c4023a416436e85654b585a5fcae6c

data/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.11.0"
+  ".": "0.11.1"
 }

data/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## [0.11.1](https://github.com/jgnagy/bullion/compare/bullion/v0.11.0...bullion/v0.11.1) (2025-08-24)
+
+
+### Features
+
+* add support for ECDSA CAs ([49b752e](https://github.com/jgnagy/bullion/commit/49b752ef6fde2b0543b59fb1c5977073f21b6731))
+
+
+### Bug Fixes
+
+* improve detection of SANS for cert-manager ([605f80d](https://github.com/jgnagy/bullion/commit/605f80d97135727ab9a962d6c3078b2b4a74b533))
+* loading required bigdecimal gem ([98d1668](https://github.com/jgnagy/bullion/commit/98d1668da600bba890dd0eb035af4a363fa79eef))
+
 ## [0.11.0](https://github.com/jgnagy/bullion/compare/bullion/v0.10.3...bullion/v0.11.0) (2025-08-23)
 
 

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    bullion (0.11.0)
+    bullion (0.11.1)
       benchmark (~> 0.4)
       dry-configurable (~> 1.1)
       httparty (~> 0.21)

data/Rakefile

@@ -62,6 +62,7 @@ end
 
 require "openssl"
 require "sqlite3"
+require "bigdecimal"
 require "trilogy"
 require "sinatra/activerecord/rake"
 

data/lib/bullion/helpers/acme.rb

@@ -119,13 +119,13 @@ module Bullion
         csr_attrs = extract_csr_attrs(csr)
         csr_sans = extract_csr_sans(csr_attrs)
         csr_domains = extract_csr_domains(csr_sans)
-        csr_cn = cn_from_csr(csr)
+        csr_cn = cn_from_csr(csr) || csr_domains.first
 
         # Make sure the CSR has a valid public key
         raise Bullion::Acme::Errors::BadCsr unless csr.verify(csr.public_key)
 
         return false unless order.ready_status?
-        raise Bullion::Acme::Errors::BadCsr unless csr_domains.include?(csr_cn)
+        raise Bullion::Acme::Errors::BadCsr if csr_cn && !csr_domains.include?(csr_cn)
         raise Bullion::Acme::Errors::BadCsr unless csr_domains.sort == order.domains.sort
 
         true

data/lib/bullion/helpers/ssl.rb

@@ -127,9 +127,7 @@ module Bullion
         )
 
         # Alternate Names
-        cn = cn_from_csr(csr)
-        existing_sans = filter_sans(csr_sans(csr))
-        valid_alts = (["DNS:#{cn}"] + [*existing_sans]).uniq
+        valid_alts = build_valid_alt_names(csr)
 
         new_cert.add_extension(ef.create_extension("subjectAltName", valid_alts.join(",")))
 
@@ -137,21 +135,6 @@ module Bullion
         [new_cert, valid_alts]
       end
 
-      def csr_sans(csr)
-        raw_attributes = csr.attributes
-        return [] unless raw_attributes
-
-        seq = extract_csr_attrs(csr)
-        return [] unless seq
-
-        values = extract_san_values(seq)
-        return [] unless values
-
-        values = OpenSSL::ASN1.decode(values).value
-
-        values.select { |v| v.tag == 2 }.map { |v| "DNS:#{v.value}" }
-      end
-
       def extract_csr_attrs(csr)
         csr.attributes.select { |a| a.oid == "extReq" }.map { |a| a.value.map(&:value) }
       end
@@ -161,8 +144,9 @@ module Bullion
       end
 
       def extract_csr_domains(csr_sans)
-        csr_decoded_sans = OpenSSL::ASN1.decode(csr_sans.first.value[1].value)
-        csr_decoded_sans.select { |v| v.tag == 2 }.map(&:value)
+        subject_alt_names = csr_sans.first.value.find { |v| v.tag == 4 }
+        csr_decoded_sans = OpenSSL::ASN1.decode(subject_alt_names.value)
+        csr_decoded_sans.value.select { |v| v.tag == 2 }.map(&:value)
       end
 
       def extract_san_values(sequence)
@@ -184,13 +168,33 @@ module Bullion
       end
 
       def cn_from_csr(csr)
-        if csr.subject.to_s
-          cns = csr.subject.to_s.split("/").grep(/^CN=/)
+        return unless csr.subject.to_s
 
-          return cns.first.split("=").last if cns && !cns.empty?
-        end
+        cns = csr.subject.to_s.split("/").grep(/^CN=/)
+
+        cns.first.split("=").last if cns && !cns.empty?
+      end
+
+      def cn_or_first_san_from_csr(csr)
+        cn = cn_from_csr(csr)
+        return cn if cn
+
+        csr_attrs = extract_csr_attrs(csr)
+        csr_sans = extract_csr_sans(csr_attrs)
+        extract_csr_domains(csr_sans).first
+      end
+
+      def domains_from_csr(csr)
+        csr_attrs = extract_csr_attrs(csr)
+        csr_sans = extract_csr_sans(csr_attrs)
+        extract_csr_domains(csr_sans)
+      end
 
-        csr_sans(csr).first.split(":").last
+      def build_valid_alt_names(csr)
+        cn = cn_or_first_san_from_csr(csr)
+        csr_domains = domains_from_csr(csr)
+        existing_sans = filter_sans(csr_domains).map { |d| "DNS:#{d}" }
+        (["DNS:#{cn}"] + [*existing_sans]).uniq
       end
 
       # Signs an ACME CSR
@@ -206,7 +210,7 @@ module Bullion
         csr_cert.not_after = csr_cert.not_before + (3 * 30 * 24 * 60 * 60)
 
         # Force a subject if the cert doesn't have one
-        cert.subject = simple_subject(cn_from_csr(csr)) unless cert.subject
+        cert.subject = simple_subject(cn_or_first_san_from_csr(csr)) unless cert.subject
 
         csr_cert.subject = simple_subject(cert.subject.to_s)
 

data/lib/bullion/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Bullion
-  VERSION = "0.11.0"
+  VERSION = "0.11.1"
 end

data/lib/bullion.rb

@@ -7,6 +7,7 @@ require "securerandom"
 require "time"
 require "logger"
 require "openssl"
+require "bigdecimal"
 
 # External requirements
 require "benchmark"
@@ -68,7 +69,11 @@ module Bullion
   MetricsRegistry = Prometheus::Client.registry
 
   def self.ca_key
-    @ca_key ||= OpenSSL::PKey::RSA.new(File.read(config.ca.key_path), config.ca.secret)
+    @ca_key ||= begin
+      OpenSSL::PKey::RSA.new(File.read(config.ca.key_path), config.ca.secret)
+    rescue OpenSSL::PKey::RSAError
+      OpenSSL::PKey::EC.new(File.read(config.ca.key_path), config.ca.secret)
+    end
   end
 
   def self.ca_cert_file

data/scripts/docker-entrypoint.sh

@@ -1,5 +1,4 @@
 #!/bin/sh
 
 # Starts the server
-rake db:migrate
 itsi

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bullion
 version: !ruby/object:Gem::Version
-  version: 0.11.0
+  version: 0.11.1
 platform: ruby
 authors:
 - Jonathan Gnagy