From f5da984c497af3311d1212d2d674b635bc25a7e5 Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Mon, 2 Jan 2023 20:07:36 +0000
Subject: [PATCH 1/8] build-full: Always enable inline file creation

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 69 ++++++++++++++++++++++++------------------------
 1 file changed, 34 insertions(+), 35 deletions(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index eff4b7b..365734e 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -1894,14 +1894,17 @@ $(display_dn req "$req_in")
 		${EASYRSA_NO_TEXT:+-notext} \
 		${EASYRSA_FIX_OFFSET+ -startdate "$start_fixdate"} \
 		${EASYRSA_FIX_OFFSET+ -enddate "$end_fixdate"} \
-			|| die "signing failed (openssl output above may have more detail)"
+			|| die "\
+Signing failed (openssl output above may have more detail)"
 
 	mv "$crt_out_tmp" "$crt_out"
 	#rm -f "$ext_tmp"
 
 	# Success messages
 	#unset -v EASYRSA_BATCH # This is why batch mode should not silence output
-	notice "Certificate created at: $crt_out"
+	notice "\
+Certificate created at:
+* $crt_out"
 
 	return 0
 } # => sign_req()
@@ -1928,7 +1931,6 @@ Run easyrsa without commands for usage and commands."
 	while [ "$1" ]; do
 		case "$1" in
 			nopass) EASYRSA_NO_PASS=1 ;;
-			inline) EASYRSA_INLINE=1 ;;
 			*) warn "Ignoring unknown command option: '$1'"
 		esac
 		shift
@@ -1937,11 +1939,22 @@ Run easyrsa without commands for usage and commands."
 	# abort on existing req/key/crt files
 	err_exists="\
 file already exists. Aborting build to avoid overwriting this file.
-If you wish to continue, please use a different name or remove the file.
+If you wish to continue, please use a different name.
 Matching file found at: "
 	[ -e "$req_out" ] && die "Request $err_exists $req_out"
 	[ -e "$key_out" ] && die "Key $err_exists $key_out"
 	[ -e "$crt_out" ] && die "Certificate $err_exists $crt_out"
+	unset -v err_exists
+
+	# Confirm over write inline file
+	mkdir -p "$EASYRSA_PKI/inline"
+	inline_out="$EASYRSA_PKI/inline/$name.inline"
+	[ -e "$inline_out" ] && \
+		confirm "Confirm OVER-WRITE existing inline file ? " y "\
+Warning!
+
+An inline file for name '$name' already exists:
+* $inline_out"
 
 	# Set commonName
 	[ "$EASYRSA_REQ_CN" = ChangeMe ] || die "\
@@ -1963,23 +1976,14 @@ See error messages above for details."
 	fi
 
 	# inline it
-	if [ "$EASYRSA_INLINE" ]; then
-		inline_file="$EASYRSA_PKI/$name.creds"
-		if [ -e "$inline_file" ]; then
-			warn "\
-Inline file exists not over-writing:
-* $inline_file"
-		else
-			if inline_creds; then
-				notice "\
+	if inline_creds "$name" > "$inline_out"; then
+		notice "\
 Inline file created:
-* $inline_file"
-			else
-				warn "\
+* $inline_out"
+	else
+		warn "\
 Failed to write inline file:
-* $inline_file"
-			fi
-		fi
+* $inline_out"
 	fi
 
 	return 0
@@ -1988,22 +1992,17 @@ Failed to write inline file:
 # Create inline credentials file for this node
 inline_creds ()
 {
-	{
-		printf "%s\n" "# $crt_type: $EASYRSA_REQ_CN"
-		printf "%s\n" ""
-		printf "%s\n" "<ca>"
-		cat "$EASYRSA_PKI/ca.crt"
-		printf "%s\n" "</ca>"
-		printf "%s\n" ""
-		printf "%s\n" "<cert>"
-		cat "$crt_out"
-		printf "%s\n" "</cert>"
-		printf "%s\n" ""
-		printf "%s\n" "<key>"
-		cat "$key_out"
-		printf "%s\n" "</key>"
-		printf "%s\n" ""
-	} > "$inline_file"
+	[ "$1" ] || die "inline_creds - Name missing"
+	printf "%s\n\n" "# $crt_type: $1"
+	printf "%s\n" "<cert>"
+	cat "$crt_out"
+	printf "%s\n\n" "</cert>"
+	printf "%s\n" "<key>"
+	cat "$key_out"
+	printf "%s\n\n" "</key>"
+	printf "%s\n" "<ca>"
+	cat "$EASYRSA_PKI/ca.crt"
+	printf "%s\n\n" "</ca>"
 } # => inline_creds ()
 
 # revoke backend

From ef9b3b8192e5f0ed0b19962c82e46fdf512a8db0 Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Mon, 2 Jan 2023 20:28:44 +0000
Subject: [PATCH 2/8] Add new inline file to command 'revoke' processes

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 41 +++++++++++++++++++++++++++++------------
 1 file changed, 29 insertions(+), 12 deletions(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 365734e..2a5deee 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -2023,6 +2023,7 @@ Run easyrsa without commands for usage and command help."
 	key_in="$in_dir/private/$file_name_base.key"
 	req_in="$in_dir/reqs/$file_name_base.req"
 	creds_in="$in_dir/$file_name_base.creds"
+	inline_in="$in_dir/inline/$file_name_base.inline"
 
 	# Assign possible "crl_reason"
 	if [ "$1" ]; then
@@ -2094,13 +2095,18 @@ Cannot revoke this certificate because a conflicting file exists.
 	warn "\
 This process is destructive!
 
-These files will be moved to the 'revoked' storage sub-directory:
+These files will be MOVED to the 'revoked' storage directory:
 * $crt_in${if_exist_key_in}${if_exist_req_in}
 
 These files will be DELETED:
-* All PKCS files for commonName : $file_name_base
-* The inline credentials file   : $creds_in
-* The duplicate certificate     : $duplicate_crt_by_serial"
+All PKCS files for commonName : $file_name_base
+
+The inline credentials files:
+* $creds_in
+* $inline_in
+
+The duplicate certificate:
+* $duplicate_crt_by_serial"
 
 	confirm "  Continue with revocation: " "yes" "\
 Please confirm you wish to revoke the certificate
@@ -2116,12 +2122,15 @@ with the following subject:
 	easyrsa_openssl ca -utf8 -revoke "$crt_in" \
 		${crl_reason+ -crl_reason "$crl_reason"} \
 		${EASYRSA_PASSIN:+ -passin "$EASYRSA_PASSIN"} \
-			|| die "Failed to revoke certificate: revocation command failed."
+			|| die "\
+Failed to revoke certificate: revocation command failed."
 
-	# move revoked files so we can reissue certificates with the same name
+	# move revoked files
+	# so we can reissue certificates with the same name
 	revoke_move
 
-	notice "                              * IMPORTANT *
+	notice "\
+                              * IMPORTANT *
 
 Revocation was successful. You must run 'gen-crl' and upload a new CRL to your
 infrastructure in order to prevent the revoked certificate from being accepted."
@@ -2172,17 +2181,25 @@ revoke_move() {
 		fi
 	done
 
-	# remove the duplicate certificate in the certs_by_serial folder
+	# remove the duplicate certificate
 	if [ -e "$duplicate_crt_by_serial" ]; then
 		rm "$duplicate_crt_by_serial" || warn "\
-Failed to remove the duplicate certificate in the certs_by_serial folder"
+Failed to remove the duplicate certificate:
+* $duplicate_crt_by_serial"
 	fi
 
-	# remove credentials file (if exists)
+	# remove credentials file
 	if [ -e "$creds_in" ]; then
-		confirm "Remove inline file ? " "yes" "An inline file exists. $creds_in"
 		rm "$creds_in" || warn "\
-Failed to remove inline file: $creds_in"
+Failed to remove credentials file:
+* $creds_in"
+	fi
+
+	# remove inline file
+	if [ -e "$inline_in" ]; then
+		rm "$inline_in" || warn "\
+Failed to remove inline file:
+* $inline_in"
 	fi
 
 	return 0

From 0072f5171c0be09a4676f1f546438a385430e27b Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Mon, 2 Jan 2023 21:38:39 +0000
Subject: [PATCH 3/8] Add new inline file to command 'renew' processes

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 69 ++++++++++++++++++++++++++++++++++++++----------
 1 file changed, 55 insertions(+), 14 deletions(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 2a5deee..a0c6eff 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -1946,8 +1946,10 @@ Matching file found at: "
 	[ -e "$crt_out" ] && die "Certificate $err_exists $crt_out"
 	unset -v err_exists
 
+	# Make inline directory
+	mkdir -p "$EASYRSA_PKI/inline" || die "\
+Failed to create inline directoy."
 	# Confirm over write inline file
-	mkdir -p "$EASYRSA_PKI/inline"
 	inline_out="$EASYRSA_PKI/inline/$name.inline"
 	[ -e "$inline_out" ] && \
 		confirm "Confirm OVER-WRITE existing inline file ? " y "\
@@ -1998,7 +2000,7 @@ inline_creds ()
 	cat "$crt_out"
 	printf "%s\n\n" "</cert>"
 	printf "%s\n" "<key>"
-	cat "$key_out"
+	[ -e "$key_out" ] && cat "$key_out"
 	printf "%s\n\n" "</key>"
 	printf "%s\n" "<ca>"
 	cat "$EASYRSA_PKI/ca.crt"
@@ -2086,12 +2088,14 @@ Cannot revoke this certificate because a conflicting file exists.
 	[ -e "$req_out" ] && die "$deny_msg request    : $req_out"
 	unset -v deny_msg
 
-	# confirm operation by displaying DN:
+	# Check for key and request files
 	unset -v if_exist_key_in if_exist_req_in
 	[ -e "$key_in" ] && if_exist_key_in="
 * $key_in"
 	[ -e "$req_in" ] && if_exist_req_in="
 * $req_in"
+
+	# confirm operation by displaying DN:
 	warn "\
 This process is destructive!
 
@@ -2218,10 +2222,15 @@ Run easyrsa without commands for usage and command help."
 	file_name_base="$1"
 	shift
 
+	# Assign input files
 	in_dir="$EASYRSA_PKI"
 	crt_in="$in_dir/issued/$file_name_base.crt"
+	key_in="$in_dir/private/$file_name_base.key"
+	# key_out is used by inline_creds()
+	key_out="$in_dir/private/$file_name_base.key"
 	req_in="$in_dir/reqs/$file_name_base.req"
 	creds_in="$in_dir/$file_name_base.creds"
+	inline_in="$in_dir/inline/$file_name_base.inline"
 
 	# Upgrade CA index.txt.attr - unique_subject = no
 	up23_upgrade_ca || \
@@ -2278,6 +2287,10 @@ Cannot renew this certificate, a conflicting file exists:
 	[ -e "$crt_out" ] && die "$deny_msg certificate: $crt_out"
 	unset -v deny_msg
 
+	# Make inline directory
+	mkdir -p "$EASYRSA_PKI/inline" || die "\
+Failed to create inline directoy."
+
 	# Extract certificate usage from old cert
 	cert_ext_key_usage="$(
 		easyrsa_openssl x509 -in "$crt_in" -noout -text |
@@ -2316,18 +2329,18 @@ subjectAltName = $san"
 	warn "\
 This process is destructive!
 
-These files will be moved to 'renewed' storage sub-directory:
+These files will be MOVED to 'renewed' storage directory:
 * $crt_in
 
 These files will be DELETED:
-* All PKCS files for commonName:
-  $file_name_base
+All PKCS files for commonName: $file_name_base
 
-* The inline credentials file:
-  $creds_in
+The inline credentials files:
+* $creds_in
+* $inline_in
 
-* The duplicate certificate:
-  $duplicate_crt_by_serial"
+The duplicate certificate:
+* $duplicate_crt_by_serial"
 
 	confirm "  Continue with renewal: " "yes" "\
 Please confirm you wish to renew the certificate
@@ -2354,8 +2367,21 @@ with the following subject:
 Renewal has failed to build a new certificate."
 	fi
 
+	# inline it
+	# Over write existing because renew is successful
+	if inline_creds "$file_name_base" > "$inline_in"; then
+		notice "\
+Inline file created:
+* $inline_in"
+	else
+		warn "\
+Failed to write inline file:
+* $inline_in"
+	fi
+
 	# Success messages
-	notice "Renew was successful.
+	notice "\
+Renew was successful.
 
                               * IMPORTANT *
 
@@ -2420,11 +2446,26 @@ renew_move() {
 		rm -f "$in_dir/private/$file_name_base.$pkcs"
 	done
 
-	# remove duplicate cert in 'certs_by_serial' folder
-	rm -f "$duplicate_crt_by_serial"
+	# remove the duplicate certificate
+	if [ -e "$duplicate_crt_by_serial" ]; then
+		rm "$duplicate_crt_by_serial" || warn "\
+Failed to remove the duplicate certificate:
+* $duplicate_crt_by_serial"
+	fi
 
 	# remove credentials file
-	rm -f "$creds_in"
+	if [ -e "$creds_in" ]; then
+		rm "$creds_in" || warn "\
+Failed to remove credentials file:
+* $creds_in"
+	fi
+
+	# remove inline file
+	if [ -e "$inline_in" ]; then
+		rm "$inline_in" || warn "\
+Failed to remove inline file:
+* $inline_in"
+	fi
 
 	return 0
 } # => renew_move()

From a7f5044c0d9c378249a5c0b8b5976e49d7aad6f7 Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Mon, 2 Jan 2023 22:01:27 +0000
Subject: [PATCH 4/8] Add new inline file to command 'rebuild' processes

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 32 ++++++++++++++++++++++++--------
 1 file changed, 24 insertions(+), 8 deletions(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index a0c6eff..d63e1d1 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -2753,6 +2753,7 @@ Run easyrsa without commands for usage and command help."
 	key_in="$in_dir/private/$file_name_base.key"
 	req_in="$in_dir/reqs/$file_name_base.req"
 	creds_in="$in_dir/$file_name_base.creds"
+	inline_in="$in_dir/inline/$file_name_base.inline"
 
 	# Upgrade CA index.txt.attr - unique_subject = no
 	up23_upgrade_ca || die "Failed to upgrade CA to support renewal."
@@ -2850,13 +2851,18 @@ subjectAltName = $san"
 	warn "\
 This process is destructive!
 
-These files will be moved to the 'renewed' storage sub-directory:
+These files will be moved to the 'renewed' storage directory:
 * $crt_in${if_exist_key_in}${if_exist_req_in}
 
 These files will be DELETED:
-* All PKCS files for commonName : $file_name_base
-* The inline credentials file   : $creds_in
-* The duplicate certificate     : $duplicate_crt_by_serial
+All PKCS files for commonName : $file_name_base
+
+The inline credentials files:
+* $creds_in
+* $inline_in
+
+The duplicate certificate:
+* $duplicate_crt_by_serial
 
 IMPORTANT: The new key will${EASYRSA_NO_PASS+ NOT} be password protected."
 
@@ -2988,15 +2994,25 @@ rebuild_move() {
 		fi
 	done
 
-	# remove the duplicate certificate in the certs_by_serial folder
+	# remove the duplicate certificate
 	if [ -e "$duplicate_crt_by_serial" ]; then
 		rm "$duplicate_crt_by_serial" || warn "\
-Failed to remove the duplicate certificate in the certs_by_serial folder"
+Failed to remove the duplicate certificate:
+* $duplicate_crt_by_serial"
 	fi
 
-	# remove credentials file (if exists)
+	# remove credentials file
 	if [ -e "$creds_in" ]; then
-		rm "$creds_in" || warn "Failed to remove the inline file."
+		rm "$creds_in" || warn "\
+Failed to remove credentials file:
+* $creds_in"
+	fi
+
+	# remove inline file
+	if [ -e "$inline_in" ]; then
+		rm "$inline_in" || warn "\
+Failed to remove inline file:
+* $inline_in"
 	fi
 
 	return 0

From ae0020acdca8d297faf00b771dd4cc501d032573 Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Tue, 3 Jan 2023 16:08:16 +0000
Subject: [PATCH 5/8] Create new 'inline' directory as required

Require creation during init-pki, renew and rebuild.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index d63e1d1..0a235d6 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -1361,8 +1361,8 @@ Please update openssl-easyrsa.cnf to the latest official release."
 
 	# create necessary files and dirs:
 	err_file="Unable to create necessary PKI files (permissions?)"
-	for i in issued certs_by_serial \
-		 revoked/certs_by_serial revoked/private_by_serial revoked/reqs_by_serial;
+	for i in issued inline certs_by_serial revoked/certs_by_serial \
+		revoked/private_by_serial revoked/reqs_by_serial
 	do
 		mkdir -p "$EASYRSA_PKI/$i" || die "$err_file"
 	done
@@ -1947,8 +1947,10 @@ Matching file found at: "
 	unset -v err_exists
 
 	# Make inline directory
-	mkdir -p "$EASYRSA_PKI/inline" || die "\
-Failed to create inline directoy."
+	[ -d "$EASYRSA_PKI/inline" ] ||	\
+		mkdir -p "$EASYRSA_PKI/inline" || \
+			die "Failed to create inline directoy."
+
 	# Confirm over write inline file
 	inline_out="$EASYRSA_PKI/inline/$name.inline"
 	[ -e "$inline_out" ] && \
@@ -2288,8 +2290,9 @@ Cannot renew this certificate, a conflicting file exists:
 	unset -v deny_msg
 
 	# Make inline directory
-	mkdir -p "$EASYRSA_PKI/inline" || die "\
-Failed to create inline directoy."
+	[ -d "$EASYRSA_PKI/inline" ] ||	\
+		mkdir -p "$EASYRSA_PKI/inline" || \
+			die "Failed to create inline directoy."
 
 	# Extract certificate usage from old cert
 	cert_ext_key_usage="$(

From 5d5960536579bb86cf025323185acf4aa8f7b7f3 Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Tue, 3 Jan 2023 19:19:30 +0000
Subject: [PATCH 6/8] init-pki: Add new inline directory (Wrap long lines)

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 59 ++++++++++++++++++++++++++++--------------------
 1 file changed, 34 insertions(+), 25 deletions(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 0a235d6..2552274 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -1009,7 +1009,7 @@ init_pki() {
 		shift
 	done
 
-	# If EASYRSA_PKI exists, confirm before we rm -rf (skipped with EASYRSA_BATCH)
+	# If EASYRSA_PKI exists, confirm before deletion
 	if [ -e "$EASYRSA_PKI" ]; then
 		confirm "Confirm removal: " "yes" "\
 WARNING!!!
@@ -1018,6 +1018,7 @@ You are about to remove the EASYRSA_PKI at:
 * $EASYRSA_PKI
 
 and initialize a fresh PKI here."
+
 		# now remove it:
 		case "$reset" in
 		hard)
@@ -1028,31 +1029,30 @@ and initialize a fresh PKI here."
 
 * This will remove everything in your current PKI directory.
   To keep your current settings use 'init-pki soft' instead.
-  Using 'init-pki soft' is recommended.
-"
+  Using 'init-pki soft' is recommended."
 
-				# # # shellcheck disable=SC2115 # Use "${var:?}" to ensure
-				rm -rf "$EASYRSA_PKI" || \
-					die "init-pki hard reset failed."
-				# If vars was in the old pki then it has been removed
-				# If vars was somewhere else then it is user defined
-				# Clear found_vars because we MUST not find pki/vars
-				if [ "$vars_in_pki" ]; then unset -v found_vars; fi
+			# # # shellcheck disable=SC2115 # Use "${var:?}" to
+			rm -rf "$EASYRSA_PKI" || \
+				die "init-pki hard reset failed."
+
+			# If vars was in the old pki, it has been removed
+			# If vars was somewhere else, it is user defined
+			# Clear found_vars, we MUST not find pki/vars
+			[ "$vars_in_pki" ] && unset -v found_vars
 		;;
 		soft)
 		# There is no unit test for a soft reset
 			for i in ca.crt \
-					issued private reqs certs_by_serial revoked renewed \
-					serial serial.old ecparams index.txt index.txt.old \
-					index.txt.attr index.txt.attr.old
+				issued private reqs inline revoked renewed \
+				serial serial.old index.txt index.txt.old \
+				index.txt.attr index.txt.attr.old \
+				ecparams certs_by_serial
 			do
-				# # # shellcheck disable=SC2115 # Use "${var:?}" to ensure
+				# # # shellcheck disable=SC2115 # Use "${var:?}"
 				rm -rf "$EASYRSA_PKI/${i}" || \
 					die "init-pki soft reset failed."
 			done
 		;;
-		# More modes could be added here, e.g. only remove
-		# issued certs (and clean database), but keep CA intact.
 		*)
 			die "Unknown reset type: $reset"
 		esac
@@ -1061,15 +1061,18 @@ and initialize a fresh PKI here."
 	# new dirs:
 	for i in private reqs; do
 		mkdir -p "$EASYRSA_PKI/$i" || \
-			die "Failed to create PKI file structure (permissions?)"
+			die "\
+Failed to create PKI file structure (permissions?)"
 	done
 
 	# for 'init-pki' create a secure_session
-	secure_session || die "init_pki - secure_session failed."
+	secure_session || die "\
+init_pki - secure_session failed."
 
 	# Install data-files into ALL new PKIs
 	install_data_to_pki init-pki || \
-		warn "Failed to install required data-files to PKI. (init)"
+		warn "\
+Failed to install required data-files to PKI. (init)"
 
 	notice "\
 'init-pki' complete; you may now create a CA or requests.
@@ -1081,15 +1084,21 @@ Your newly created PKI dir is:
 	# if $no_new_vars then there are one or more known vars
 	# which are not in the PKI. All further commands will fail
 	# until vars is manually corrected
-	[ "$no_new_vars" ] || information "Using Easy-RSA configuration: $vars"
-	# For new PKIs where pki/vars was auto-created, show user message
+	[ "$no_new_vars" ] || information "\
+Using Easy-RSA configuration: $vars"
+
+	# For new PKIs , pki/vars was auto-created, show message
 	if [ "$new_vars_true" ]; then
 		information "\
-IMPORTANT: Easy-RSA 'vars' template file has been created in your new PKI.
-             Edit this 'vars' file to customise the settings for your PKI.
-             To use a global vars file, use global option --vars=<YOUR_VARS>"
+IMPORTANT: \
+Easy-RSA 'vars' template file has been created in your new PKI.
+             \
+Edit this 'vars' file to customise the settings for your PKI.
+             \
+To use a global vars file, use global option --vars=<YOUR_VARS>"
 
-	elif [ "$user_vars_true" ] || [ "$old_vars_true" ] || [ "$no_new_vars" ]
+	elif [ "$user_vars_true" ] || [ "$old_vars_true" ] || \
+		[ "$no_new_vars" ]
 	then
 		: # ok - User defined, old or no vars file exist
 	else

From 866557a5898095f891ae6b8fbd67b124c8eacd3d Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Tue, 3 Jan 2023 20:23:50 +0000
Subject: [PATCH 7/8] install_data_to_pki(): Wrap long lines, no functional
 changes

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 72 +++++++++++++++++-------------------------------
 1 file changed, 25 insertions(+), 47 deletions(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 2552274..b66c1f1 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -1031,7 +1031,7 @@ and initialize a fresh PKI here."
   To keep your current settings use 'init-pki soft' instead.
   Using 'init-pki soft' is recommended."
 
-			# # # shellcheck disable=SC2115 # Use "${var:?}" to
+			# # # shellcheck disable=SC2115 # Use "${var:?}"
 			rm -rf "$EASYRSA_PKI" || \
 				die "init-pki hard reset failed."
 
@@ -1119,36 +1119,13 @@ The preferred location for 'vars' is within the PKI folder.
 # Copy data-files from various sources
 install_data_to_pki() {
 #
-# This function will explicitly find and optionally copy data-files to the PKI.
+# Explicitly find and optionally copy data-files to the PKI.
 # During 'init-pki' this is the new default.
-# During all other functions these requirements are tested for and
-# files will be copied to the PKI, if they do not already exist there.
+# During all other functions these requirements are tested for
+# and files will be copied to the PKI, if they do not already
+# exist there.
 #
-# One of the reasons for this change is to make packaging EasyRSA work.
-#
-# First: search favoured and then common 'areas' for the EasyRSA data-files(A):
-# * 'openssl-easyrsa.cnf' and 'x509-types' (folder).
-#
-# These files MUST be found in at least one location.
-# * 'openssl-easyrsa.cnf' will be copied to the PKI.
-#   A warning will be issued if this file cannot be found.
-#
-# * 'x509-types' will set EASYRSA_EXT_DIR to the found location.
-#   If x509-types cannot be found then that is a FATAL error.
-#
-# Other EasyRSA data-files(B): it is not crucial that these are found
-# but if they are then they are copied to the PKI. (Note: 1)
-# * 'vars' and 'vars.example'
-#
-# Note 1: For 'vars' consideration must be given to:
-#   "Where the user expects to find vars!"
-#
-# Currently, *if* 'vars' is copied to the PKI then the PKI 'vars' will take
-# priority over './vars'. But it will not be updated if './vars' is changed.
-#
-# For that reason a vars file in the PKI is only created during init-pki.
-# For old PKIs where vars is elsewhere a warning is issued that the PKI
-# folder is the preferred location of vars.
+# One reason for this is to make packaging work.
 
 	context="$1"
 	shift
@@ -1159,14 +1136,14 @@ install_data_to_pki() {
 	ssl_cnf_file='openssl-easyrsa.cnf'
 	x509_types_dir='x509-types'
 
-		# "$EASYRSA_PKI" - Preferred
-		# "$EASYRSA" - Old default and Windows
-		# "$PWD" - Usually the same as above, avoid
-		# "${0%/*}" - Usually the same as above, avoid
-		# '/usr/local/share/easy-rsa' - Default user installed
-		# '/usr/share/easy-rsa' - Default system installed
-		# Room for more..
-		# '/etc/easy-rsa' - Last resort
+	# "$EASYRSA_PKI" - Preferred
+	# "$EASYRSA" - Old default and Windows
+	# "$PWD" - Usually the same as above, avoid
+	# "${0%/*}" - Usually the same as above, avoid
+	# '/usr/local/share/easy-rsa' - Default user installed
+	# '/usr/share/easy-rsa' - Default system installed
+	# Room for more..
+	# '/etc/easy-rsa' - Last resort
 
 	# Find and optionally copy data-files, in specific order
 	for area in \
@@ -1183,14 +1160,14 @@ install_data_to_pki() {
 			# Find x509-types ONLY
 			# Declare in preferred order, first wins
 			# beaten by command line.
-			[ -e "${area}/${x509_types_dir}" ] && \
-				set_var EASYRSA_EXT_DIR "${area}/${x509_types_dir}"
+			[ -e "${area}/${x509_types_dir}" ] && set_var \
+				EASYRSA_EXT_DIR "${area}/${x509_types_dir}"
 		else
 			# Find x509-types ALSO
 			# Declare in preferred order, first wins
 			# beaten by command line.
-			[ -e "${area}/${x509_types_dir}" ] && \
-				set_var EASYRSA_EXT_DIR "${area}/${x509_types_dir}"
+			[ -e "${area}/${x509_types_dir}" ] && set_var \
+				EASYRSA_EXT_DIR "${area}/${x509_types_dir}"
 
 			# Find other files - Omitting "$vars_file"
 			for source in \
@@ -1201,12 +1178,12 @@ install_data_to_pki() {
 				# Find each item
 				[ -e "${area}/${source}" ] || continue
 
-				# If the item does not exist in the PKI then copy it.
+				# If source does not exist in PKI then copy it
 				if [ -e "${EASYRSA_PKI}/${source}" ]; then
 					continue
 				else
-					cp "${area}/${source}" "$EASYRSA_PKI" || \
-						die "Failed to copy to PKI: ${area}/${source}"
+					cp "${area}/${source}" "$EASYRSA_PKI" || die \
+						"Failed to copy to PKI: ${area}/${source}"
 				fi
 			done
 		fi
@@ -1217,7 +1194,8 @@ install_data_to_pki() {
 
 	# Create PKI/vars from PKI/example
 	unset -v new_vars_true
-	if [ "$found_vars" ] || [ "$user_vars_true" ] || [ "$no_new_vars" ]
+	if [ "$found_vars" ] || [ "$user_vars_true" ] || \
+		[ "$no_new_vars" ]
 	then
 		: # ok - Do not make a PKI/vars if another vars exists
 	else
@@ -1249,9 +1227,9 @@ install_data_to_pki() {
 
 	# Check PKI is updated - Omit unnecessary checks
 	[ -e "${EASYRSA_PKI}/${ssl_cnf_file}" ] || \
-		die "install_data_to_pki - Missing: ${ssl_cnf_file}"
+		die "install_data_to_pki - Missing: '$ssl_cnf_file'"
 	[ -d "$EASYRSA_EXT_DIR" ] || \
-		die "install_data_to_pki - Missing: $x509_types_dir"
+		die "install_data_to_pki - Missing: '$x509_types_dir'"
 
 } # => install_data_to_pki ()
 

From 51a82a7fb59bf674e77d5a409737ad388ebf74c9 Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Tue, 3 Jan 2023 21:56:58 +0000
Subject: [PATCH 8/8] build-full: Always enable inline file creation

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 ChangeLog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ChangeLog b/ChangeLog
index faa19f1..15e598f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,6 +1,7 @@
 Easy-RSA 3 ChangeLog
 
 3.1.2 (TBD)
+   * build-full: Always enable inline file creation (#834)
    * Make default Edwards curve ED25519 (#828)
    * Allow --fix-offset to create post-dated certificates (#804)
    * Introduce command 'set-pass' (#756)