nik/easyrsa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Disable shellcheck 2086 when building CA cert/key pair

Browse Source 
SC2086 - Double quote to prevent globbing and word splitting.

It is not suitable to quote $opts and $EASYRSA_EXTRA_EXTS
because then they are passed to SSL as a single option
with spaces, which is not the intended use.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
This commit is contained in:
Richard T Bonhomme 2022-04-19 13:17:45 +01:00
parent 1b8a1122d3
commit 2fe73a5040
No known key found for this signature in database
GPG Key ID: 2D767DB92FB6C246
1 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
easyrsa3/easyrsa
View File

@ -957,6 +957,7 @@ current CA keypair. If you intended to start a new CA, run init-pki first."
die "Unknown algorithm: $EASYRSA_ALGO"
esac
# Apply password or not
# Private key encryption password or use no_password
# 'req' requires '-passin'
crypto_opts=""
@ -968,6 +969,10 @@ current CA keypair. If you intended to start a new CA, run init-pki first."
fi
# create the CA keypair:
# It is not suitable to quote $opts and $EASYRSA_EXTRA_EXTS
# because then they are passed to SSL as a single option
# with spaces, which is not the intended use.
# shellcheck disable=SC2086 # Double quote to prevent ..
easyrsa_openssl req -utf8 -new \
-key "$out_key_tmp" -keyout "$out_key_tmp" -out "$out_file_tmp" \
$opts $EASYRSA_EXTRA_EXTS \
@ -1028,7 +1033,7 @@ current CA keypair. If you intended to start a new CA, run init-pki first."
*) die "Unknown algorithm: $EASYRSA_ALGO"
esac
# create the CA keypair:
# Apply password or not
crypto_opts=""
if [ -z "$nopass" ] && [ -z "$EASYRSA_PASSIN" ]; then
#crypto_opts="-passin file:$out_key_pass_tmp"
@ -1037,6 +1042,11 @@ current CA keypair. If you intended to start a new CA, run init-pki first."
crypto_opts="$no_password"
fi
# create the CA keypair:
# It is not suitable to quote $opts and $EASYRSA_EXTRA_EXTS
# because then they are passed to SSL as a single option
# with spaces, which is not the intended use.
# shellcheck disable=SC2086 # Double quote to prevent ..
easyrsa_openssl req -utf8 -new \
-key "$out_key_tmp" -keyout "$out_key_tmp" -out "$out_file_tmp" \
$opts $EASYRSA_EXTRA_EXTS \