Skip to content

Commit e3f360e

Browse files
authored
feature: upgrade go, add -version flag, more bin arch (#1)
* upgrade go to 1.21 * add `-version` flag * more bin arch Signed-off-by: xiexianbin <me@xiexianbin.cn>
1 parent 64c412c commit e3f360e

File tree

15 files changed

+276
-65
lines changed

15 files changed

+276
-65
lines changed

.github/workflows/greetings.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ jobs:
77
runs-on: ubuntu-latest
88
steps:
99
- uses: actions/first-interaction@v1
10+
continue-on-error: true
1011
with:
1112
repo-token: "${{ secrets.GITHUB_TOKEN }}"
1213
issue-message: "# Welcome.\nThanks for your issue."

.github/workflows/label.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,6 @@ jobs:
1414
runs-on: ubuntu-latest
1515

1616
steps:
17-
- uses: actions/labeler@v2
17+
- uses: actions/labeler@v4
1818
with:
1919
repo-token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/licensed.yml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,13 @@
11
name: Licensed
22

33
on:
4+
workflow_dispatch:
5+
inputs:
6+
reason:
7+
description: 'run license action reason'
8+
required: false
9+
type: string
10+
default: 'manually test'
411
push:
512
branches:
613
- main

.github/workflows/release-new-action-version.yml

Lines changed: 15 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,12 @@
11
name: Release new action version
22
on:
3+
workflow_dispatch:
4+
inputs:
5+
reason:
6+
description: 'run release action reason'
7+
required: false
8+
type: string
9+
default: 'manually test'
310
push:
411
tags:
512
- "v*.*.*"
@@ -8,14 +15,9 @@ permissions:
815
contents: write
916

1017
jobs:
11-
build:
18+
release:
1219
runs-on: ubuntu-latest
1320
steps:
14-
- name: Checkout
15-
uses: actions/checkout@v2
16-
- name: Release
17-
uses: softprops/action-gh-release@v1
18-
1921
- name: Checkout
2022
uses: actions/checkout@v3
2123

@@ -40,8 +42,12 @@ jobs:
4042
if: startsWith(github.ref, 'refs/tags/')
4143
with:
4244
files: |
45+
bin/xca-linux-amd64
46+
bin/xca-linux-arm64
47+
bin/xca-linux-ppc64le
48+
bin/xca-linux-s390x
49+
bin/xca-darwin-amd64
50+
bin/xca-darwin-arm64
51+
bin/xca-windows-amd64.exe
4352
Release.txt
4453
LICENSE
45-
bin/xca-linux
46-
bin/xca-darwin
47-
bin/xca-windows

.github/workflows/workflow.yaml

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,21 @@
1-
name: build-test
1+
name: workflow
22
on:
3+
workflow_dispatch:
4+
inputs:
5+
reason:
6+
description: 'run action reason'
7+
required: false
8+
type: string
9+
default: 'manually test'
310
push:
411
branches:
512
- main
13+
- dev
14+
- bug/**
15+
- fix/**
16+
- bugfix/**
17+
- feature/**
18+
- release/**
619
paths-ignore:
720
- '**.md'
821
pull_request:
@@ -14,14 +27,14 @@ jobs:
1427
runs-on: ubuntu-latest
1528
strategy:
1629
matrix:
17-
go: [ '1.17.0-rc.2', '1.16.1' ]
30+
go: [ '1.19.11', '1.20.6', '1.21.10' ]
1831
name: Go ${{ matrix.go }} test
1932
steps:
2033
- name: Checkout
2134
uses: actions/checkout@v3
2235

2336
- name: Setup Go
24-
uses: actions/setup-go@v3
37+
uses: actions/setup-go@v4
2538
with:
2639
go-version: ${{ matrix.go }}
2740

.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,4 +17,5 @@
1717
bin/
1818
.history/
1919
.idea/
20+
.lh/
2021
x-ca

Makefile

Lines changed: 105 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,108 @@
11
# https://www.xiexianbin.cn/program/tools/2016-01-09-makefile/index.html
2-
.PHONY: all test clean build build-linux build-mac build-windows
3-
4-
GOCMD=go
5-
GOBUILD=$(GOCMD) build
6-
GOCLEAN=$(GOCMD) clean
7-
GOTEST=$(GOCMD) test
8-
BINARY_NAME=xca
9-
BINARY_LINUX=$(BINARY_NAME)-linux
10-
BINARY_MAC=$(BINARY_NAME)-darwin
11-
BINARY_WIN=$(BINARY_NAME)-windows
12-
13-
help: ## Show this help.
14-
@awk 'BEGIN {FS = ":.*?## "} /^[a-zA-Z_-]+:.*?## / {sub("\\\\n",sprintf("\n%22c"," "), $$2);printf "\033[36m%-20s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST)
15-
16-
all: clean test build build-linux build-mac build-windows ## Build all
17-
test: ## run test
2+
export SHELL:=bash
3+
export SHELLOPTS:=$(if $(SHELLOPTS),$(SHELLOPTS):)pipefail:errexit
4+
5+
# https://stackoverflow.com/questions/4122831/disable-make-builtin-rules-and-variables-from-inside-the-make-file
6+
MAKEFLAGS += --no-builtin-rules
7+
.SUFFIXES:
8+
9+
VERSION := latest
10+
BUILD_DATE := $(shell TZ=UTC-8 date +'%Y-%m-%dT%H:%M:%SZ+08:00')
11+
GIT_COMMIT := $(shell git rev-parse HEAD || echo unknown)
12+
GIT_BRANCH := $(shell git rev-parse --symbolic-full-name --verify --quiet --abbrev-ref HEAD)
13+
GIT_TAG := $(shell git describe --exact-match --tags --abbrev=0 2> /dev/null || echo untagged)
14+
GIT_TREE_STATE := $(shell if [ -z "`git status --porcelain`" ]; then echo "clean" ; else echo "dirty"; fi)
15+
RELEASE_TAG := $(shell if [[ "$(GIT_TAG)" =~ ^v[0-9]+\.[0-9]+\.[0-9]+.*$$ ]]; then echo "true"; else echo "false"; fi)
16+
DEV_BRANCH := $(shell [ "$(GIT_BRANCH)" = master ] || [ `echo $(GIT_BRANCH) | cut -c -8` = release- ] || [ `echo $(GIT_BRANCH) | cut -c -4` = dev- ] || [ $(RELEASE_TAG) = true ] && echo false || echo true)
17+
18+
GOCMD ?= go
19+
GOBUILD ?= $(GOCMD) build -v
20+
GOCLEAN ?= $(GOCMD) clean
21+
GOTEST ?= $(GOCMD) test -v -p 20
22+
23+
linux-amd64: GOARGS = GOOS=linux GOARCH=amd64
24+
linux-arm64: GOARGS = GOOS=linux GOARCH=arm64
25+
linux-ppc64le: GOARGS = GOOS=linux GOARCH=ppc64le
26+
linux-s390x: GOARGS = GOOS=linux GOARCH=s390x
27+
darwin-amd64: GOARGS = GOOS=darwin GOARCH=amd64
28+
darwin-arm64: GOARGS = GOOS=darwin GOARCH=arm64
29+
windows-amd64: GOARGS = GOOS=windows GOARCH=amd64
30+
31+
BINARY_NAME ?= xca
32+
IMG ?= xiexianbin/go-actions-demo:latest
33+
34+
ifeq ($(RELEASE_TAG),true)
35+
VERSION := $(GIT_TAG)
36+
endif
37+
38+
# $(info GIT_COMMIT=$(GIT_COMMIT) GIT_BRANCH=$(GIT_BRANCH) GIT_TAG=$(GIT_TAG) GIT_TREE_STATE=$(GIT_TREE_STATE) RELEASE_TAG=$(RELEASE_TAG) DEV_BRANCH=$(DEV_BRANCH) VERSION=$(VERSION))
39+
# $(info MAKEFILE_LIST=${MAKEFILE_LIST})
40+
41+
# -X github.com/xiexianbin/go-actions-demo.version=$(VERSION)
42+
override LDFLAGS += \
43+
-X main.version=$(VERSION) \
44+
-X main.buildDate=$(BUILD_DATE) \
45+
-X main.gitCommit=$(GIT_COMMIT) \
46+
-X main.gitTreeState=$(GIT_TREE_STATE)
47+
48+
ifneq ($(GIT_TAG),)
49+
override LDFLAGS += -X main.gitTag=${GIT_TAG}
50+
endif
51+
52+
SUB_BUILD_CMD ?= $(GOBUILD) -gcflags '${GCFLAGS}' -ldflags '${LDFLAGS} -extldflags -static'
53+
54+
.PHONY: help
55+
help: ## Show this help
56+
@awk 'BEGIN {FS = ":.*?## "} /^[a-zA-Z0-9_-]+:.*?## / {sub("\\\\n",sprintf("\n%22c"," "), $$2);printf "\033[36m%-20s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST)
57+
58+
.PHONY: all
59+
all: clean test build linux-amd64 linux-arm64 linux-ppc64le linux-s390x darwin-amd64 darwin-arm64 windows-amd64 ## Build all
60+
61+
.PHONY: test
62+
test: ## Run test
1863
$(GOTEST) -v ./...
19-
clean: ## run clean bin files
64+
65+
.PHONY: clean
66+
clean: ## Run clean bin files
2067
$(GOCLEAN)
21-
rm -f bin/$(BINARY_NAME)
22-
build: ## build for current os
23-
$(GOBUILD) -o bin/$(BINARY_NAME) -v
24-
25-
build-linux: ## build linux amd64
26-
CGO_ENABLED=0 GOOS=linux GOARCH=amd64 $(GOBUILD) -o bin/$(BINARY_LINUX) -v
27-
build-mac: ## build mac amd64
28-
CGO_ENABLED=0 GOOS=darwin GOARCH=amd64 $(GOBUILD) -o bin/$(BINARY_MAC) -v
29-
build-windows: ## build windows amd64
30-
CGO_ENABLED=0 GOOS=windows GOARCH=amd64 $(GOBUILD) -o bin/$(BINARY_WIN) -v
68+
rm -f bin/*
69+
70+
.PHONY: build
71+
build: ## Build for current os
72+
${SUB_BUILD_CMD} -o bin/$(BINARY_NAME)
73+
74+
.PHONY: linux-amd64
75+
linux-amd64: ## Build linux amd64
76+
CGO_ENABLED=0 ${GOARGS} ${SUB_BUILD_CMD} -o bin/${BINARY_NAME}-$@
77+
78+
.PHONY: linux-arm64
79+
linux-arm64: ## Build linux arm64
80+
CGO_ENABLED=0 ${GOARGS} ${SUB_BUILD_CMD} -o bin/${BINARY_NAME}-$@
81+
82+
.PHONY: linux-ppc64le
83+
linux-ppc64le: ## Build linux ppc64le
84+
CGO_ENABLED=0 ${GOARGS} ${SUB_BUILD_CMD} -o bin/${BINARY_NAME}-$@
85+
86+
.PHONY: linux-s390x
87+
linux-s390x: ## Build linux s390x
88+
CGO_ENABLED=0 ${GOARGS} ${SUB_BUILD_CMD} -o bin/${BINARY_NAME}-$@
89+
90+
.PHONY: darwin-amd64
91+
darwin-amd64: ## Build darwin amd64
92+
CGO_ENABLED=0 ${GOARGS} ${SUB_BUILD_CMD} -o bin/${BINARY_NAME}-$@
93+
94+
.PHONY: darwin-arm64
95+
darwin-arm64: ## Build darwin arm64
96+
CGO_ENABLED=0 ${GOARGS} ${SUB_BUILD_CMD} -o bin/${BINARY_NAME}-$@
97+
98+
.PHONY: windows-amd64
99+
windows-amd64: ## Build windows amd64
100+
CGO_ENABLED=0 ${GOARGS} ${SUB_BUILD_CMD} -o bin/${BINARY_NAME}-$@.exe
101+
102+
.PHONY: docker-build
103+
docker-build: test ## Build docker image
104+
docker build -t ${IMG} .
105+
106+
.PHONY: docker-push
107+
docker-push: ## Push docker image
108+
docker push ${IMG}

README.md

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# go-ca
22

3-
[![build-test](https://github.com/x-ca/go-ca/actions/workflows/workflow.yaml/badge.svg)](https://github.com/x-ca/go-ca/actions/workflows/workflow.yaml)
3+
[![build](https://github.com/x-ca/go-ca/actions/workflows/workflow.yaml/badge.svg)](https://github.com/x-ca/go-ca/actions/workflows/workflow.yaml)
44
[![GoDoc](https://godoc.org/github.com/x-ca/go-ca?status.svg)](https://pkg.go.dev/github.com/x-ca/go-ca)
55
[![Go Report Card](https://goreportcard.com/badge/github.com/x-ca/go-ca)](https://goreportcard.com/report/github.com/x-ca/go-ca)
66

@@ -11,7 +11,7 @@ shell implement at [x-ca/x-ca](https://github.com/x-ca/x-ca)
1111
## install
1212

1313
```
14-
curl -Lfs -o xca https://github.com/x-ca/go-ca/releases/latest/download/xca-{linux|darwin|windows}
14+
curl -Lfs -o xca https://github.com/x-ca/go-ca/releases/latest/download/xca-{linux|darwin|windows}-{amd64|arm64|s390x|ppc64le}
1515
chmod +x xca
1616
mv xca /usr/local/bin/
1717
```
@@ -58,6 +58,8 @@ Usage:
5858
Second-Level private key file path, PEM format. (default "x-ca/ca/tls-ca/private/tls-ca.key")
5959
-tls-key-password string
6060
tls key password, only work for load github.com/x-ca/x-ca.
61+
-version
62+
show version info.
6163
6264
Source Code:
6365
https://github.com/x-ca/go-ca
@@ -109,7 +111,7 @@ visit https://dev.xiexianbin.cn:8443/
109111

110112
## FaQ
111113

112-
if CA Cert begin with `BEGIN ENCRYPTED PRIVATE KEY`(raise `Error: fromPEMBytes: x509: no DEK-Info header in block`),
114+
if CA Cert begin with `BEGIN ENCRYPTED PRIVATE KEY`(raise `Error: fromPEMBytes: x509: no DEK-Info header in block`),
113115
Use `openssl rsa -in root-ca.key -des3` change cipher
114116

115117
## Ref

SECURITY.md

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Security Policy
2+
3+
If you have discovered a security vulnerability in this project, please report it
4+
privately. **Do not disclose it as a public issue.** This gives us time to work with you
5+
to fix the issue before public exposure, reducing the chance that the exploit will be
6+
used before a patch is released.
7+
8+
You may submit the report in the following ways:
9+
10+
- send an email to me@xiexianbin.cn
11+
- send us a [private vulnerability report](https://github.com/x-ca/go-ca/security/advisories/new)
12+
13+
Please provide the following information in your report:
14+
15+
- A description of the vulnerability and its impact
16+
- How to reproduce the issue
17+
18+
We ask that you give us 90 days to work on a fix before public exposure.

ca/root.go

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,6 @@ import (
2121
"crypto/x509/pkix"
2222
"encoding/pem"
2323
"fmt"
24-
"io/ioutil"
2524
"os"
2625
"path"
2726
"sort"
@@ -66,8 +65,8 @@ func NewRootCA(keyBits int) (*RootCA, error) {
6665

6766
// LoadRootCA create new tls CA
6867
func LoadRootCA(keyPath, certPath, password string) (*RootCA, error) {
69-
keyBytes, kErr := ioutil.ReadFile(keyPath)
70-
certBytes, cErr := ioutil.ReadFile(certPath)
68+
keyBytes, kErr := os.ReadFile(keyPath)
69+
certBytes, cErr := os.ReadFile(certPath)
7170
if kErr != nil {
7271
return nil, kErr
7372
} else if cErr != nil {
@@ -103,6 +102,11 @@ func LoadRootCA(keyPath, certPath, password string) (*RootCA, error) {
103102
var key *rsa.PrivateKey
104103
var err error
105104
if x509.IsEncryptedPEMBlock(keyBlock) == true {
105+
// https://pkg.go.dev/crypto/x509@go1.22.2#IsEncryptedPEMBlock
106+
fmt.Println("Legacy PEM encryption as specified in RFC 1423 is insecure by design. " +
107+
"Since it does not authenticate the ciphertext, it is vulnerable to padding " +
108+
"oracle attacks that can let an attacker recover the plaintext.\n" +
109+
"https://pkg.go.dev/crypto/x509@go1.22.2#IsEncryptedPEMBlock")
106110
der, err := x509.DecryptPEMBlock(keyBlock, []byte(password))
107111
if err != nil {
108112
return nil, err
@@ -136,7 +140,7 @@ func LoadRootCA(keyPath, certPath, password string) (*RootCA, error) {
136140
if certPKErr != nil {
137141
return nil, certPKErr
138142
}
139-
if bytes.Compare(keyPKBytes, certPKBytes) != 0 {
143+
if !bytes.Equal(keyPKBytes, certPKBytes) {
140144
return nil, fmt.Errorf("public key in CA certificate %s don't match private key in %s", certPath, keyPath)
141145
}
142146

0 commit comments

Comments
 (0)