Function ValidateTrustedCertFile

be/src/kudu/util/curl_util.cc:69–98

}

bool ValidateTrustedCertFile() {
  const auto& fpath = FLAGS_trusted_certificate_file;
  if (fpath.empty()) {
    // No validation is needed.
    return true;
  }

  // Make sure the file in question does exist, is readable, and non-empty.
  // There might be extra verification to load the certificate(s) from the file,
  // but since cURL could have some particular requirements on the contents
  // of the file, let's skip that extra validation step and defer to the time
  // when cURL loads the file on its own. Also, the validators might run
  // at the time when the OpenSSL-based crypto runtime context isn't yet
  // initialized, so it's safer to defer to TlsContext::Init() where the
  // initialization is done in a proper way.
  std::unique_ptr<RandomAccessFile> raf;
  if (auto s = Env::Default()->NewRandomAccessFile(fpath, &raf); !s.ok()) {
    LOG(ERROR) << Substitute("could not open file for reading: $0", s.ToString());
    return false;
  }
  // Read just a single byte to make sure that the file is readable.
  uint8_t scratch[1];
  Slice data(scratch, sizeof(scratch));
  if (auto s = raf->Read(0, data); !s.ok()) {
    LOG(ERROR) << Substitute("could not read from file '$0': $1",
                             fpath, s.ToString());
    return false;
  }
  return true;
}

// The validator uses Env API, so it's necessary to use GROUP_FLAG_VALIDATOR()
// instead of regular gflag's DEFINE_validator() macro to allow for custom