54 lines
1.7 KiB
Go
54 lines
1.7 KiB
Go
package deployment
|
|
|
|
import (
|
|
"bytes"
|
|
"crypto/tls"
|
|
"crypto/x509"
|
|
"encoding/pem"
|
|
"errors"
|
|
"fmt"
|
|
"time"
|
|
)
|
|
|
|
// validateArtifact 是传输前的完整性检查；域名覆盖和环境信任策略由证书服务负责。
|
|
func validateArtifact(artifact Artifact) error {
|
|
if len(artifact.Certificate) == 0 || len(artifact.FullChain) == 0 || len(artifact.PrivateKey) == 0 {
|
|
return errors.New("证书部署文件不完整")
|
|
}
|
|
certificate, err := tls.X509KeyPair(artifact.Certificate, artifact.PrivateKey)
|
|
if err != nil {
|
|
return fmt.Errorf("部署证书与私钥不匹配：%w", err)
|
|
}
|
|
chain, err := tls.X509KeyPair(artifact.FullChain, artifact.PrivateKey)
|
|
if err != nil {
|
|
return fmt.Errorf("部署证书链与私钥不匹配：%w", err)
|
|
}
|
|
if !bytes.Equal(certificate.Certificate[0], chain.Certificate[0]) {
|
|
return errors.New("部署证书与完整证书链的叶子证书不一致")
|
|
}
|
|
var previous *x509.Certificate
|
|
remaining := bytes.TrimSpace(artifact.FullChain)
|
|
now := time.Now()
|
|
for len(remaining) > 0 {
|
|
block, rest := pem.Decode(remaining)
|
|
if block == nil || block.Type != "CERTIFICATE" || !bytes.HasPrefix(remaining, []byte("-----BEGIN CERTIFICATE-----")) {
|
|
return errors.New("部署证书链包含无效 PEM 内容")
|
|
}
|
|
cert, err := x509.ParseCertificate(block.Bytes)
|
|
if err != nil {
|
|
return fmt.Errorf("解析部署证书链失败：%w", err)
|
|
}
|
|
if now.Before(cert.NotBefore) || !now.Before(cert.NotAfter) {
|
|
return errors.New("部署证书链包含尚未生效或已过期的证书")
|
|
}
|
|
if previous != nil {
|
|
if err := previous.CheckSignatureFrom(cert); err != nil {
|
|
return fmt.Errorf("部署证书链签名或顺序无效：%w", err)
|
|
}
|
|
}
|
|
previous = cert
|
|
remaining = bytes.TrimSpace(rest)
|
|
}
|
|
return nil
|
|
}
|