feat: harden control-plane deployment

2026-09-12 11:09:42 +08:00
parent 13c31fc902
commit 0d29b828bb
22 changed files with 1213 additions and 71 deletions
@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [ "$#" -ne 2 ]; then
+  echo "usage: $0 <client-certificate.pem> <revoked-fingerprint-file>" >&2
+  exit 2
+fi
+certificate=$1
+list=$2
+[ -f "$certificate" ] || { echo "certificate does not exist: $certificate" >&2; exit 1; }
+
+fingerprint=$(openssl x509 -in "$certificate" -outform DER | sha256sum | awk '{print $1}')
+[ "${#fingerprint}" -eq 64 ] || { echo "could not calculate certificate fingerprint" >&2; exit 1; }
+mkdir -p "$(dirname "$list")"
+lock="$list.lock"
+exec 9>"$lock"
+flock -x 9
+if [ -f "$list" ] && grep -Fqx "$fingerprint" "$list"; then
+  printf '%s\n' "$fingerprint"
+  exit 0
+fi
+temporary="${list}.tmp.$$"
+trap 'rm -f "$temporary"' EXIT
+if [ -f "$list" ]; then
+  cat "$list" > "$temporary"
+fi
+printf '%s\n' "$fingerprint" >> "$temporary"
+chmod 600 "$temporary"
+mv -f "$temporary" "$list"
+printf '%s\n' "$fingerprint"