| 218 | # Note: this function is reused by update-compile-commands.py. When renaming |
| 219 | # this, please update that file too! |
| 220 | def detect_reclient_cert(): |
| 221 | now = int(time.time()) |
| 222 | # We cache the cert expiration time in a file, because that's much faster |
| 223 | # to read than invoking `gcertstatus`. |
| 224 | if RECLIENT_CERT_CACHE.exists(): |
| 225 | cached_time = int(RECLIENT_CERT_CACHE.read_text()) |
| 226 | if now < cached_time: |
| 227 | return True |
| 228 | cmd = ["gcertstatus", "-nocheck_ssh", "-format=simple"] |
| 229 | ret = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT) |
| 230 | if ret.returncode != 0: |
| 231 | return False |
| 232 | gcertstatus_output = ret.stdout.decode("utf-8").strip() |
| 233 | if not gcertstatus_output: |
| 234 | return False |
| 235 | # Request fresh cert if less than an hour remains. Reproxy will refuse to |
| 236 | # start when the certificate is close to expiring. |
| 237 | MARGIN = 3600 |
| 238 | lifetime = int(gcertstatus_output.split(":")[1]) - MARGIN |
| 239 | if lifetime < 0: |
| 240 | return False |
| 241 | RECLIENT_CERT_CACHE.write_text(str(now + lifetime)) |
| 242 | return True |
| 243 | |
| 244 | |
| 245 | RECLIENT_MODE = detect_reclient() |