Validates the input P12 file, adds any missing standard CAs, and returns the new P12 along with the team ID.
(originalP12 []byte, pass string)
| 86 | |
| 87 | // Validates the input P12 file, adds any missing standard CAs, and returns the new P12 along with the team ID. |
| 88 | func processP12(originalP12 []byte, pass string) ([]byte, string, error) { |
| 89 | blocks, err := pkcs12.ToPEM(originalP12, pass) |
| 90 | if err != nil { |
| 91 | return nil, "", errors.WithMessage(err, "p12 to pem") |
| 92 | } |
| 93 | appleCerts, err := assets.AppleCerts.ReadDir("certs") |
| 94 | if err != nil { |
| 95 | return nil, "", errors.WithMessage(err, "read certs dir") |
| 96 | } |
| 97 | for _, cert := range appleCerts { |
| 98 | certBytes, err := assets.AppleCerts.ReadFile(path.Join("certs", cert.Name())) |
| 99 | if err != nil { |
| 100 | return nil, "", errors.WithMessagef(err, "read cert %s", cert.Name()) |
| 101 | } |
| 102 | block, _ := pem.Decode(certBytes) |
| 103 | blocks = append(blocks, block) |
| 104 | } |
| 105 | keyMap := map[any]PublicKeyComparator{} |
| 106 | var authorities []*x509.Certificate |
| 107 | var certificates []*x509.Certificate |
| 108 | serialNumbers := map[string]bool{} |
| 109 | for _, block := range blocks { |
| 110 | switch block.Type { |
| 111 | case "CERTIFICATE": |
| 112 | cert, err := x509.ParseCertificate(block.Bytes) |
| 113 | if err != nil { |
| 114 | return nil, "", errors.WithMessage(err, "parse certificate") |
| 115 | } |
| 116 | serialNumber := cert.SerialNumber.String() |
| 117 | if _, ok := serialNumbers[serialNumber]; ok { |
| 118 | continue |
| 119 | } |
| 120 | serialNumbers[serialNumber] = true |
| 121 | if cert.IsCA { |
| 122 | authorities = append(authorities, cert) |
| 123 | } else { |
| 124 | certificates = append(certificates, cert) |
| 125 | } |
| 126 | case "PRIVATE KEY": |
| 127 | var key any |
| 128 | if key, err = x509.ParsePKCS1PrivateKey(block.Bytes); err == nil { |
| 129 | keyMap[key] = key.(*rsa.PrivateKey).Public().(*rsa.PublicKey) |
| 130 | } else if key, err = x509.ParsePKCS8PrivateKey(block.Bytes); err == nil { |
| 131 | switch v := key.(type) { |
| 132 | case *rsa.PrivateKey: |
| 133 | keyMap[key] = v.Public().(*rsa.PublicKey) |
| 134 | case *ecdsa.PrivateKey: |
| 135 | keyMap[key] = v.Public().(*ecdsa.PublicKey) |
| 136 | case *ed25519.PrivateKey: |
| 137 | keyMap[key] = v.Public().(*ed25519.PublicKey) |
| 138 | default: |
| 139 | return nil, "", errors.New("unknown private key type") |
| 140 | } |
| 141 | } else if key, err = x509.ParseECPrivateKey(block.Bytes); err == nil { |
| 142 | keyMap[key] = key.(*ecdsa.PrivateKey).Public().(*ecdsa.PublicKey) |
| 143 | } else { |
| 144 | return nil, "", errors.New("unknown private key type") |
| 145 | } |
no test coverage detected