From 8fca612a7d5df82371d6e26f8a7e439b0e68296d Mon Sep 17 00:00:00 2001
From: Jan Dittberner <jandd@cacert.org>
Date: Mon, 4 Jan 2021 08:11:23 +0100
Subject: [PATCH] Start work for using the go based signer

---
 .dockerignore       |  1 +
 .gitignore          |  3 ++-
 .mrconfig           |  3 +++
 docker-compose.yml  |  2 +-
 docker/run-gosigner | 31 +++++++++++++++++++++++++++++++
 gosigner.Dockerfile | 20 ++++++++++++++++++++
 6 files changed, 58 insertions(+), 2 deletions(-)
 create mode 100755 docker/run-gosigner
 create mode 100644 gosigner.Dockerfile

diff --git a/.dockerignore b/.dockerignore
index 4c49bd7..f66882e 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1 +1,2 @@
 .env
+**/.idea/**
diff --git a/.gitignore b/.gitignore
index 7269f5a..5829b8a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,7 @@
+.env
 .idea/
 cacert-cats/
+cacert-gosigner/
 cacert-mgr/
 cacert-software/
-.env
 testca/
diff --git a/.mrconfig b/.mrconfig
index 941a88e..b2f6f56 100644
--- a/.mrconfig
+++ b/.mrconfig
@@ -6,3 +6,6 @@ checkout = git clone git+ssh://git.cacert.org/srv/git/cacert-mgr.git cacert-mgr
 
 [cacert-software]
 checkout = git clone git+ssh://git.cacert.org/srv/git/cacert-devel.git cacert-software
+
+[cacert-gosigner]
+checkout = git clone https://git.dittberner.info/jan/cacert-gosigner.git
diff --git a/docker-compose.yml b/docker-compose.yml
index 67cab0e..dd5d909 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -108,7 +108,7 @@ services:
   signer:
     build:
       context: .
-      dockerfile: signer.Dockerfile
+      dockerfile: gosigner.Dockerfile
     environment:
       SIGNER_WORKDIR: /srv/ca/work
       SIGNER_CA_CONFIG: /srv/caconfig
diff --git a/docker/run-gosigner b/docker/run-gosigner
new file mode 100755
index 0000000..44f7a7d
--- /dev/null
+++ b/docker/run-gosigner
@@ -0,0 +1,31 @@
+#!/bin/sh
+
+set -eu
+
+export SERIAL_PORT=/dev/ttyUSB0
+
+mkdir -p /srv/ca/CA/certs /srv/ca/CA/private /srv/ca/CA/newcerts
+cp /srv/testca/root/ca.crt.pem /srv/ca/CA/ca.crt.pem
+cp /srv/testca/root/private/ca.key.pem /srv/ca/CA/private/ca.key.pem
+if [ ! -f /srv/ca/CA/index.txt ]; then cp /srv/testca/root/index.txt /srv/ca/CA/index.txt; fi
+if [ ! -f /srv/ca/CA/index.txt.attr ]; then cp /srv/testca/root/index.txt.attr /srv/ca/CA/index.txt.attr; fi
+if [ ! -f /srv/ca/CA/serial ]; then printf '00' >/srv/ca/CA/serial; fi
+if [ ! -f /srv/ca/CA/crlnumber ]; then echo 1000 >/srv/ca/CA/crlnumber; fi
+
+mkdir -p /srv/ca/class3/certs /srv/ca/class3/private /srv/ca/class3/newcerts /srv/ca/gpg/gpg_root_0
+cp /srv/testca/class3/ca.crt.pem /srv/ca/class3/ca.crt.pem
+cp /srv/testca/class3/private/ca.key.pem /srv/ca/class3/private/ca.key.pem
+if [ ! -f /srv/ca/class3/index.txt ]; then cp /srv/testca/class3/index.txt /srv/ca/class3/index.txt; fi
+if [ ! -f /srv/ca/class3/index.txt.attr ]; then cp /srv/testca/class3/index.txt.attr /srv/ca/class3/index.txt.attr; fi
+if [ ! -f /srv/ca/class3/serial ]; then printf '00' >/srv/ca/class3/serial; fi
+if [ ! -f /srv/ca/class3/crlnumber ]; then echo 1000 >/srv/ca/class3/crlnumber; fi
+if [ ! -f /srv/ca/gpg/gpg_root_0/secring.gpg ]; then cp /srv/testca/gpg/gpg_root_0/secring.gpg /srv/ca/gpg/gpg_root_0/secring.gpg; fi
+if [ ! -f /srv/ca/gpg/gpg_root_0/pubring.gpg ]; then cp /srv/testca/gpg/gpg_root_0/pubring.gpg /srv/ca/gpg/gpg_root_0/pubring.gpg; fi
+
+rm -f /srv/sockets/signer
+socat -d -d PTY,link=/dev/ttyUSB0 UNIX-LISTEN:/srv/sockets/signer 2>&1 &
+sleep 1
+
+cd /app/
+
+exec ./signer
diff --git a/gosigner.Dockerfile b/gosigner.Dockerfile
new file mode 100644
index 0000000..76f0dbf
--- /dev/null
+++ b/gosigner.Dockerfile
@@ -0,0 +1,20 @@
+FROM golang:alpine AS builder
+
+COPY cacert-gosigner /src/
+
+RUN set -ex ; \
+    cd /src/signer ; \
+    go build .
+
+FROM alpine/socat:latest
+
+COPY --from=builder /src/signer/signer /app/
+
+COPY docker/run-gosigner usr/local/bin/
+COPY docker/signer-config/* /srv/caconfig/
+COPY testca /srv/testca/
+
+VOLUME /srv/ca
+
+ENTRYPOINT []
+CMD ["/usr/local/bin/run-gosigner"]