54
89%

Ran 13 Apr 2015 08:58PM UTC

Jobs 2

Files 55

Run time 11s

Badge

Embed ▾

pending completion

Build # 54

Build Type

push

travis-ci

Committed by

warner

Commit Message

fix cert-creation: use SHA256 for certRequest too

The problem was:

* cert-sign-requests are themselves signed by the keypair contained in
  the request. This signature defaulted to using MD5, because we did not
  provide an override to keypair.certificateRequest()
* keypair.signCertificateRequest() starts by parsing the pubkey out of
  the request. In the process of doing this, it might notice that the
  request contains an MD5 signature. We don't really care about this
  signature (it just wants the pubkey to put into the new certificate).
* a FIPS-compliant OpenSSL would see the MD5 signature and abort,
  because hey, MD5 is bad. My laptop's OpenSSL tolerated the MD5
  signature when I was testing this.
* The final generated certificate always uses SHA256, because we use
  signCertificateRequest(digestAlgorithm=sha256). Only the
  cert-sign-request signature is affected by this patch, and we throw
  out this request as soon as we build the certificate. So the output
  .pem file is not affected by this patch.

This patch allows the cert-creation process to not crash when used with
a FIPS-compliant (no-MD5) version of OpenSSL.

Thanks to Daira and LeastAuthority user "Gabe" for figuring it out.

refs ticket:141

Run Details

7704 of 8648 relevant lines covered (89.08%)

1.78 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	54.1	13 Apr 2015 08:59PM UTC	55	89.08	Travis Job 54.1
2	54.2	13 Apr 2015 08:58PM UTC	55	89.03	Travis Job 54.2

Source Files on build 54

Coverage	∆	File	Lines	Relevant	Covered	Missed	Hits/Line

warner / foolscap / 54
89%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 54

warner / foolscap / 54 89%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 54

warner / foolscap / 54
89%

README BADGES
x