37 lines
872 B
Bash
Executable File
37 lines
872 B
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
if [ "$#" -ne 2 ]; then
|
|
echo "usage: $0 <client-certificate.pem> <revoked-fingerprint-file>" >&2
|
|
exit 2
|
|
fi
|
|
certificate=$1
|
|
list=$2
|
|
[ -f "$certificate" ] || {
|
|
echo "certificate does not exist: $certificate" >&2
|
|
exit 1
|
|
}
|
|
|
|
fingerprint=$(openssl x509 -in "$certificate" -outform DER | sha256sum | awk '{print $1}')
|
|
[ "${#fingerprint}" -eq 64 ] || {
|
|
echo "could not calculate certificate fingerprint" >&2
|
|
exit 1
|
|
}
|
|
mkdir -p "$(dirname "$list")"
|
|
lock="$list.lock"
|
|
exec 9>"$lock"
|
|
flock -x 9
|
|
if [ -f "$list" ] && grep -Fqx "$fingerprint" "$list"; then
|
|
printf '%s\n' "$fingerprint"
|
|
exit 0
|
|
fi
|
|
temporary="${list}.tmp.$$"
|
|
trap 'rm -f "$temporary"' EXIT
|
|
if [ -f "$list" ]; then
|
|
cat "$list" >"$temporary"
|
|
fi
|
|
printf '%s\n' "$fingerprint" >>"$temporary"
|
|
chmod 600 "$temporary"
|
|
mv -f "$temporary" "$list"
|
|
printf '%s\n' "$fingerprint"
|