Trim excess whitespace
This commit is contained in:
a1346054
parent
c903669eef
commit
212c18a83c
@ -19,4 +19,3 @@ matrix:
|
||||
script:
|
||||
- openssl version
|
||||
- sh op_test.sh -vv
|
||||
|
||||
|
||||
@ -79,11 +79,11 @@ Easy-RSA 3 ChangeLog
|
||||
|
||||
* 8b42eea Make aes256 default, replacing 3des
|
||||
(keros: Github)
|
||||
|
||||
|
||||
* f2f4ac8 Make -utf8 default
|
||||
(roubert: Github)
|
||||
|
||||
|
||||
|
||||
3.0.0-rc2 (2014/07/27)
|
||||
|
||||
* 1551e5f docs: fix typo
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
# Overview
|
||||
|
||||
easy-rsa is a CLI utility to build and manage a PKI CA. In laymen's terms,
|
||||
this means to create a root certificate authority, and request and sign
|
||||
this means to create a root certificate authority, and request and sign
|
||||
certificates, including intermediate CAs and certificate revocation lists (CRL).
|
||||
|
||||
# Downloads
|
||||
@ -30,8 +30,8 @@ You can also try libera.chat IRC network, in channels #openvpn for general suppo
|
||||
# Branch structure
|
||||
|
||||
The easy-rsa master branch is currently tracking development for the 3.x release
|
||||
cycle. Please note that, at any given time, master may be broken. Feel free to
|
||||
create issues against master, but have patience when using the master branch. It
|
||||
cycle. Please note that, at any given time, master may be broken. Feel free to
|
||||
create issues against master, but have patience when using the master branch. It
|
||||
is recommended to use a release, and priority will be given to bugs identified in
|
||||
the most recent release.
|
||||
|
||||
|
||||
@ -70,14 +70,14 @@ dist_clean() {
|
||||
stage_unix() {
|
||||
# make our unix stage if it doesn't exist
|
||||
mkdir -p "$DIST_ROOT/unix/$PV"
|
||||
|
||||
|
||||
# Copy files into $PV, starting with easyrsa3 as the initial root dir
|
||||
src_files="easyrsa3/. Licensing/. COPYING.md ChangeLog README.md README.quickstart.md doc"
|
||||
for f in $src_files
|
||||
do
|
||||
cp -R "$SRC_ROOT/$f" "$DIST_ROOT/unix/$PV/" || die "failed to copy $f"
|
||||
done
|
||||
|
||||
|
||||
# FreeBSD does not accept -i without argument in a way also acceptable by GNU sed
|
||||
sed -i.tmp -e "s/~VER~/$VERSION/" \
|
||||
-e "s/~DATE~/$(date)/" \
|
||||
@ -95,7 +95,7 @@ stage_win() {
|
||||
do
|
||||
# make our windows stage if it doesn't exist
|
||||
mkdir -p "$DIST_ROOT/$win/$PV"
|
||||
|
||||
|
||||
# make doc dir
|
||||
mkdir -p "$DIST_ROOT/$win/$PV/doc"
|
||||
|
||||
@ -106,28 +106,28 @@ stage_win() {
|
||||
rm -f "$SRC_ROOT/$f.tmp"
|
||||
python -m markdown "$SRC_ROOT/$f" > "$DIST_ROOT/$win/$PV/${f%.md}.html" || die "Failed to convert markdown to HTML"
|
||||
done
|
||||
|
||||
|
||||
# Copy files into $PV, starting with easyrsa3 as the initial root dir
|
||||
src_files="easyrsa3/. ChangeLog COPYING.md Licensing distro/windows/Licensing distro/windows/bin distro/windows/$win/lib* distro/windows/$win/openssl.exe"
|
||||
for f in $src_files
|
||||
do
|
||||
cp -R "$SRC_ROOT/$f" "$DIST_ROOT/$win/$PV/" || die "failed to copy $f"
|
||||
done
|
||||
|
||||
|
||||
src_files="README-Windows.txt EasyRSA-Start.bat"
|
||||
for f in $src_files
|
||||
do
|
||||
cp -R "$SRC_ROOT/distro/windows/$f" "$DIST_ROOT/$win/$PV/" || die "failed to copy $f"
|
||||
unix2dos "$DIST_ROOT/$win/$PV/$f" || die "unix2dos conversion failed for $f"
|
||||
done
|
||||
|
||||
|
||||
sed -i.tmp -e "s/~VER~/$VERSION/" \
|
||||
-e "s/~DATE~/$(date)/" \
|
||||
-e "s/~HOST~/$(hostname -s)/" \
|
||||
-e "s/~GITHEAD~/$(git rev-parse HEAD)/" \
|
||||
"$DIST_ROOT/$win/$PV/easyrsa" || die "Cannot update easyrsa version data"
|
||||
rm -f "$DIST_ROOT/$win/$PV/easyrsa.tmp"
|
||||
|
||||
|
||||
# files not included
|
||||
rm -rf "$DIST_ROOT/$win/$PV/doc/TODO" || die "failed rm TODO"
|
||||
done
|
||||
@ -135,14 +135,14 @@ stage_win() {
|
||||
|
||||
make_tar() {
|
||||
(cd "$DIST_ROOT/unix/"; tar -czf "../${PV}.tgz" "$PV") || die "tar failed"
|
||||
note "tarball created at: $DIST_ROOT/${PV}.tgz"
|
||||
note "tarball created at: $DIST_ROOT/${PV}.tgz"
|
||||
}
|
||||
|
||||
make_zip() {
|
||||
for win in win32 win64;
|
||||
do
|
||||
(cd "$DIST_ROOT/$win/"; zip -qr "../${PV}-$win.zip" "$PV") || die "zip failed"
|
||||
note "zip file created at: $DIST_ROOT/${PV}-$win.zip"
|
||||
note "zip file created at: $DIST_ROOT/${PV}-$win.zip"
|
||||
done
|
||||
}
|
||||
|
||||
|
||||
@ -2,4 +2,3 @@ This distro/ directory contains distro/platform specific tools.
|
||||
|
||||
Components that are not platform neutral end up here, sorted into further dirs
|
||||
based on the platform.
|
||||
|
||||
|
||||
@ -1,4 +1,3 @@
|
||||
-----------------------------------------------------------------------
|
||||
OpenSSL v1.1.1g from https://bintray.com/vszakats/generic/openssl
|
||||
OpenSSL v1.1.1g from https://bintray.com/vszakats/generic/openssl
|
||||
-----------------------------------------------------------------------
|
||||
|
||||
|
||||
@ -3,7 +3,7 @@ Easy-RSA 3 Windows README
|
||||
Easy-RSA 3 runs POSIX shell code, so use on Windows has some additional
|
||||
requirements: an OpenSSL installation, and a usable shell environment.
|
||||
|
||||
The Windows packages of EasyRSA 3.0.7+ include an OpenSSL binary and
|
||||
The Windows packages of EasyRSA 3.0.7+ include an OpenSSL binary and
|
||||
libraries that will be used by default. If you want to use a system binary
|
||||
instead, remove the openssl.exe and the lib*.dll files from the bin
|
||||
directory.
|
||||
@ -110,5 +110,5 @@ Contents of this file:
|
||||
maintainer, Michael Langguth <mksh-w32@gmx.net>. This shell offers features
|
||||
that allow Easy-RSA to run smoothly under Windows; by using mksh/Win32,
|
||||
Easy-RSA can deliver the same PKI flexibility to all major platforms.
|
||||
|
||||
|
||||
vim: wrap tw=80 expandtab
|
||||
|
||||
@ -120,5 +120,5 @@ possible terse description is shown below:
|
||||
password using any openssl password options like pass:1234 or env:var
|
||||
* `EASYRSA_PASSOUT` (CLI: `--passout`) - allows to specify a source for
|
||||
password using any openssl password options like pass:1234 or env:var
|
||||
|
||||
|
||||
**NOTE:** the global options need to be provided before the actual commands.
|
||||
|
||||
@ -233,4 +233,3 @@ In order to obtain a signed certificate, the request file must be sent to the
|
||||
CA for signing; this step is obviously not required if a single PKI is used as
|
||||
both the CA and keypair/request generation as the generated request is already
|
||||
"imported."
|
||||
|
||||
|
||||
2
doc/TODO
2
doc/TODO
@ -9,7 +9,7 @@ Feature support:
|
||||
* Keep platform-specific tools separate from platform-neutral code
|
||||
* add detection for duplicate CN prior to OpenSSL failure
|
||||
* This gets tricky if `updatedb` requires a CA passphrase
|
||||
* It would help to warn users before OpenSSL throws errors
|
||||
* It would help to warn users before OpenSSL throws errors
|
||||
|
||||
Longer term wishlist:
|
||||
* Support openssl's -password source mechanism:
|
||||
|
||||
@ -106,8 +106,8 @@ cmd_help() {
|
||||
inline - create an inline credentials file for this node" ;;
|
||||
revoke) text="
|
||||
revoke <filename_base> [reason]
|
||||
Revoke a certificate specified by the filename_base, with an optional
|
||||
revocation reason that is one of:
|
||||
Revoke a certificate specified by the filename_base, with an optional
|
||||
revocation reason that is one of:
|
||||
unspecified
|
||||
keyCompromise
|
||||
CACompromise
|
||||
@ -549,7 +549,7 @@ and initialize a fresh PKI here."
|
||||
for i in private reqs; do
|
||||
mkdir -p "$EASYRSA_PKI/$i" || die "Failed to create PKI file structure (permissions?)"
|
||||
done
|
||||
|
||||
|
||||
# Create $EASYRSA_SAFE_CONF ($OPENSSL_CONF) prevents bogus warnings (especially useful on win32)
|
||||
if [ ! -f "$EASYRSA_SSL_CONF" ] && [ -f "$EASYRSA/openssl-easyrsa.cnf" ];
|
||||
then
|
||||
@ -1042,7 +1042,7 @@ Run easyrsa without commands for usage and command help."
|
||||
if [ "$2" ]; then
|
||||
opts="$opts -crl_reason $2"
|
||||
fi
|
||||
|
||||
|
||||
verify_file x509 "$crt_in" || die "\
|
||||
Unable to revoke as the input file is not a valid certificate. Unexpected
|
||||
input in file: $crt_in"
|
||||
@ -1332,7 +1332,7 @@ import_req() {
|
||||
|
||||
# pull passed paths
|
||||
in_req="$1" short_name="$2"
|
||||
out_req="$EASYRSA_PKI/reqs/$2.req"
|
||||
out_req="$EASYRSA_PKI/reqs/$2.req"
|
||||
|
||||
[ -n "$short_name" ] || die "\
|
||||
Unable to import: incorrect command syntax.
|
||||
@ -1347,7 +1347,7 @@ File Path: $in_req"
|
||||
Unable to import the request as the destination file already exists.
|
||||
Please choose a different name for your imported request file.
|
||||
Existing file at: $out_req"
|
||||
|
||||
|
||||
# now import it
|
||||
cp "$in_req" "$out_req"
|
||||
|
||||
@ -1557,7 +1557,7 @@ default_server_san() {
|
||||
|
||||
# verify a file seems to be a valid req/X509
|
||||
verify_file() {
|
||||
format="$1"
|
||||
format="$1"
|
||||
path="$2"
|
||||
easyrsa_openssl "$format" -in "$path" -noout 2>/dev/null || return 1
|
||||
return 0
|
||||
@ -1566,8 +1566,8 @@ verify_file() {
|
||||
# show-* command backend
|
||||
# Prints req/cert details in a readable format
|
||||
show() {
|
||||
type="$1"
|
||||
name="$2"
|
||||
type="$1"
|
||||
name="$2"
|
||||
in_file=""
|
||||
format=""
|
||||
[ -n "$name" ] || die "\
|
||||
@ -1579,11 +1579,11 @@ Run easyrsa without commands for usage help."
|
||||
opts="-${type}opt no_pubkey,no_sigdump"
|
||||
while [ -n "$1" ]; do
|
||||
case "$1" in
|
||||
full)
|
||||
full)
|
||||
opts=""
|
||||
;;
|
||||
*)
|
||||
warn "Ignoring unknown command option: '$1'"
|
||||
*)
|
||||
warn "Ignoring unknown command option: '$1'"
|
||||
;;
|
||||
esac
|
||||
shift
|
||||
@ -1689,7 +1689,7 @@ vars_setup() {
|
||||
elif [ -f "$prog_vars" ]; then
|
||||
vars="$prog_vars"
|
||||
fi
|
||||
|
||||
|
||||
# If a vars file was located, source it
|
||||
# If $EASYRSA_NO_VARS is defined (not blank) this is skipped
|
||||
if [ -z "$EASYRSA_NO_VARS" ] && [ -n "$vars" ]; then
|
||||
@ -1700,13 +1700,13 @@ file. Storing sensitive information in the configuration file is not \
|
||||
recommended - please remove it from there before continuing."
|
||||
fi
|
||||
#shellcheck disable=SC2034
|
||||
EASYRSA_CALLER=1
|
||||
EASYRSA_CALLER=1
|
||||
# shellcheck disable=SC1090
|
||||
. "$vars"
|
||||
notice "\
|
||||
Note: using Easy-RSA configuration from: $vars"
|
||||
fi
|
||||
|
||||
|
||||
# Set defaults, preferring existing env-vars if present
|
||||
set_var EASYRSA "$prog_dir"
|
||||
set_var EASYRSA_OPENSSL openssl
|
||||
@ -1723,7 +1723,7 @@ Note: using Easy-RSA configuration from: $vars"
|
||||
set_var EASYRSA_CURVE secp384r1
|
||||
set_var EASYRSA_EC_DIR "$EASYRSA_PKI/ecparams"
|
||||
set_var EASYRSA_CA_EXPIRE 3650
|
||||
set_var EASYRSA_CERT_EXPIRE 825 # new default of 36 months
|
||||
set_var EASYRSA_CERT_EXPIRE 825 # new default of 36 months
|
||||
set_var EASYRSA_CERT_RENEW 30
|
||||
set_var EASYRSA_CRL_DAYS 180
|
||||
set_var EASYRSA_NS_SUPPORT no
|
||||
@ -1738,7 +1738,7 @@ Note: using Easy-RSA configuration from: $vars"
|
||||
# Same as above for the x509-types extensions dir
|
||||
if [ -d "$EASYRSA_PKI/x509-types" ]; then
|
||||
set_var EASYRSA_EXT_DIR "$EASYRSA_PKI/x509-types"
|
||||
else
|
||||
else
|
||||
#TODO: This should be removed. Not really suitable for packaging.
|
||||
set_var EASYRSA_EXT_DIR "$EASYRSA/x509-types"
|
||||
fi
|
||||
@ -2027,7 +2027,7 @@ up23_upgrade_ca ()
|
||||
# Otherwise this is required for all easyrsa v3
|
||||
#confirm "Set 'unique_subject = no' in index.txt.attr for your current CA: " \
|
||||
#"yes" "This version of easyrsa requires that 'unique_subject = no' is set correctly"
|
||||
|
||||
|
||||
printf "%s\n" "unique_subject = no" > "$EASYRSA_PKI/index.txt.attr"
|
||||
up23_verbose "> OK"
|
||||
up23_verbose " Upgraded index.txt.attr to v306+"
|
||||
|
||||
@ -135,4 +135,3 @@ keyUsage = cRLSign, keyCertSign
|
||||
|
||||
# issuerAltName=issuer:copy
|
||||
authorityKeyIdentifier=keyid:always,issuer:always
|
||||
|
||||
|
||||
@ -27,7 +27,7 @@
|
||||
# "C:/Program Files/OpenSSL-Win32/bin/openssl.exe"
|
||||
|
||||
# A little housekeeping: DON'T EDIT THIS SECTION
|
||||
#
|
||||
#
|
||||
# Easy-RSA 3.x doesn't source into the environment directly.
|
||||
# Complain if a user tries to do this:
|
||||
if [ -z "$EASYRSA_CALLER" ]; then
|
||||
@ -218,4 +218,3 @@ fi
|
||||
# or most output. Setting this to any non-blank string enables batch mode.
|
||||
|
||||
#set_var EASYRSA_BATCH ""
|
||||
|
||||
|
||||
@ -10,4 +10,3 @@ basicConstraints = CA:TRUE
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid:always,issuer:always
|
||||
keyUsage = cRLSign, keyCertSign
|
||||
|
||||
|
||||
@ -5,4 +5,3 @@ subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer:always
|
||||
extendedKeyUsage = clientAuth
|
||||
keyUsage = digitalSignature
|
||||
|
||||
|
||||
@ -5,4 +5,3 @@ subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer:always
|
||||
extendedKeyUsage = codeSigning
|
||||
keyUsage = digitalSignature
|
||||
|
||||
|
||||
@ -5,4 +5,3 @@ subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer:always
|
||||
extendedKeyUsage = emailProtection
|
||||
keyUsage = digitalSignature,keyEncipherment,nonRepudiation
|
||||
|
||||
|
||||
@ -5,4 +5,3 @@ subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer:always
|
||||
extendedKeyUsage = serverAuth
|
||||
keyUsage = digitalSignature,keyEncipherment
|
||||
|
||||
|
||||
@ -5,4 +5,3 @@ subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer:always
|
||||
extendedKeyUsage = serverAuth,clientAuth
|
||||
keyUsage = digitalSignature,keyEncipherment
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user