Revize df7f5fda

Re #8708 - Changed the behaviour of the generate_pkcs_identity method in the CryptographyService that now does not use the -CAfile argument when the passed chain of trust is empty

Added a unit test verifying that the changed method works as expected when empty chain of trust is passed

src/services/cryptography.py

@@ -462 +462 @@
         :return: byte array containing the generated identity
         """
         with TemporaryFile("cert_key.pem", cert_key_pem) as cert_key_pem_file:
-            args = ["pkcs12", "-export", "-name", identity_name, "-in", "-", "-inkey", cert_key_pem_file, "-CAfile",
-                    "-", "-passout", f"pass:{identity_passphrase}", "-passin", f"pass:{cert_key_passphrase}"]
+            args = ["pkcs12", "-export", "-name", identity_name, "-in", "-", "-inkey", cert_key_pem_file, "-passout", f"pass:{identity_passphrase}", "-passin", f"pass:{cert_key_passphrase}"]
+            proc_input = cert_pem
+            # when the chain of trust is not empty append the -CAfile argument and the concatenated list of CoT PEMs
+            # to the input of the process to be launched
+            if len(chain_of_trust_pems) > 0:
+                args.extend(["-CAfile", "-", ])
+                proc_input += "".join(chain_of_trust_pems)
             return self.__run_for_output(args,
-                                         proc_input=bytes(cert_pem + "".join(chain_of_trust_pems),
-                                                          encoding="utf-8"))
+                                         proc_input=bytes(proc_input, encoding="utf-8"))
 
 
 class CryptographyException(Exception):

tests/unit_tests/services/cryptography/generate_pkcs_identity_test.py

@@ +1 @@
+import re
 import subprocess
 
 import pytest
@@ -61 +62 @@
     assert inter_cert in pkcs_info
 
 
+def test_generate_pkcs_identity_empty_chain_of_trust(service):
+    root_key = service.create_private_key()
+    root_cert = service.create_sscrt(Subject(common_name="Foo"), root_key)
+
+    pkcs = service.generate_pkcs_identity(root_cert, root_key, "Baz Pkcs", "secret_pass",
+                                          "")
+
+    # print out the pkcs store in order to be able to check it
+    pkcs_info = subprocess.check_output(
+        ["openssl", "pkcs12", "-info", "-in", "-", "-nodes", "-passin", "pass:secret_pass"],
+        input=pkcs,
+        stderr=subprocess.STDOUT).decode()
+
+
+    assert "-----BEGIN PRIVATE KEY-----" in pkcs_info
+    assert root_cert in pkcs_info
+    assert len(re.findall("BEGIN CERTIFICATE", pkcs_info)) == 1
+    assert len(re.findall("END CERTIFICATE", pkcs_info)) == 1
+
+
 def test_generate_pkcs_identity_encrypted_key_passphrase_not_provided(service):
     root_key = service.create_private_key()
     root_cert = service.create_sscrt(Subject(common_name="Foo"), root_key)