test/cert-tests: use --attime in more tests

With this change, building should be fine until 2049
on platforms with 64-bit time_t.

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

diff --git a/tests/cert-tests/certtool-eddsa.sh b/tests/cert-tests/certtool-eddsa.sh
index 0d61f6761ce1308b9c88d94f5881032ce7916132..88dd418acd8de60abfbe3039f166b9b41fa38f00 100644 (file)
--- a/tests/cert-tests/certtool-eddsa.sh
+++ b/tests/cert-tests/certtool-eddsa.sh
@@ -39,6 +39,13 @@ fi
 
 . "${srcdir}/../scripts/common.sh"
 
+: ${ac_cv_sizeof_time_t=8}
+if test "${ac_cv_sizeof_time_t}" -ge 8; then
+       ATTIME_VALID="2038-10-12"  # almost the pregenerated cert expiration
+else
+       ATTIME_VALID="2030-12-17"  # end of epoch − 2590 days of validity
+fi
+
 # Test certificate in draft-ietf-curdle-pkix-04
 ${VALGRIND} "${CERTTOOL}" -i --infile "${srcdir}/data/cert-eddsa.pem" --outfile "${TMPFILE}"
 
@@ -84,7 +91,7 @@ fi
 
 
 # Create an EdDSA certificate from an EdDSA private key
-${VALGRIND} "${CERTTOOL}" --generate-self-signed \
+${VALGRIND} "${CERTTOOL}" --attime "${ATTIME_VALID}" --generate-self-signed \
        --pkcs8 --load-privkey "$KEYFILE" --password '' \
        --template "${srcdir}/templates/template-test.tmpl" \
        --outfile "${TMPFILE}"
@@ -94,14 +101,14 @@ if test $? != 0; then
        exit 1
 fi
 
-${VALGRIND} "${CERTTOOL}" --verify --load-ca-certificate "${TMPFILE}" --infile "${TMPFILE}"
+${VALGRIND} "${CERTTOOL}" --attime "${ATTIME_VALID}" --verify --load-ca-certificate "${TMPFILE}" --infile "${TMPFILE}"
 if test $? != 0; then
        echo "There was an issue verifying the generated certificate (1)"
        exit 1
 fi
 
 # Create an EdDSA certificate from an RSA key
-${VALGRIND} "${CERTTOOL}" --generate-certificate --key-type eddsa \
+${VALGRIND} "${CERTTOOL}" --attime "${ATTIME_VALID}" --generate-certificate --key-type eddsa \
            --load-privkey ${KEYFILE} \
            --load-ca-privkey "${srcdir}/../../doc/credentials/x509/ca-key.pem" \
            --load-ca-certificate "${srcdir}/../../doc/credentials/x509/ca.pem" \
@@ -113,7 +120,7 @@ if test $? != 0; then
        exit 1
 fi
 
-${VALGRIND} "${CERTTOOL}" --verify --load-ca-certificate "${srcdir}/../../doc/credentials/x509/ca.pem" --infile "${TMPFILE}"
+${VALGRIND} "${CERTTOOL}" --attime "${ATTIME_VALID}" --verify --load-ca-certificate "${srcdir}/../../doc/credentials/x509/ca.pem" --infile "${TMPFILE}"
 if test $? != 0; then
        echo "There was an issue verifying the generated certificate (2)"
        exit 1

diff --git a/tests/cert-tests/gost.sh b/tests/cert-tests/gost.sh
index c16c539814467c80db9433d936c7af21995c9140..8a89d15000f539332de840f5dfd58818b8106947 100644 (file)
--- a/tests/cert-tests/gost.sh
+++ b/tests/cert-tests/gost.sh
@@ -153,7 +153,7 @@ if ! cmp "${srcdir}"/data/gost-cert-new.pem $TMPFILE ; then
        exit 1
 fi
 
-"${CERTTOOL}" --verify --load-ca-certificate "${srcdir}"/data/gost-cert-ca.pem --infile "${srcdir}"/data/gost-cert-new.pem --outfile $TMPFILE
+"${CERTTOOL}" --attime "2037-10-01" --verify --load-ca-certificate "${srcdir}"/data/gost-cert-ca.pem --infile "${srcdir}"/data/gost-cert-new.pem --outfile $TMPFILE
 if [ $? != 0 ]; then
        cat $TMPFILE
        exit 1

diff --git a/tests/cert-tests/pkcs7-broken-sigs.sh b/tests/cert-tests/pkcs7-broken-sigs.sh
index 4e27dfa19788d3968824fa7fb097d0431b0e37b9..e29ea6c86064d857a55f6f5e894b2e7ad0f7af91 100644 (file)
--- a/tests/cert-tests/pkcs7-broken-sigs.sh
+++ b/tests/cert-tests/pkcs7-broken-sigs.sh
@@ -34,6 +34,13 @@ fi
 OUTFILE=out-pkcs7.$$.tmp
 OUTFILE2=out2-pkcs7.$$.tmp
 
+: ${ac_cv_sizeof_time_t=8}
+if test "${ac_cv_sizeof_time_t}" -ge 8; then
+       ATTIME_VALID="2038-10-12"  # almost the pregenerated cert expiration
+else
+       ATTIME_VALID="2037-12-31"  # before 2038
+fi
+
 # Test signing with MD5
 FILE="signing"
 ${VALGRIND} "${CERTTOOL}" --p7-sign --hash md5 --load-privkey  "${srcdir}/../../doc/credentials/x509/key-rsa.pem" --load-certificate "${srcdir}/../../doc/credentials/x509/cert-rsa.pem" --infile "${srcdir}/data/pkcs7-detached.txt" >"${OUTFILE}"
@@ -45,7 +52,7 @@ if test "${rc}" != "0"; then
 fi
 
 FILE="signing-verify"
-${VALGRIND} "${CERTTOOL}" --p7-verify --load-certificate "${srcdir}/../../doc/credentials/x509/cert-rsa.pem" <"${OUTFILE}"
+${VALGRIND} "${CERTTOOL}" --attime "${ATTIME_VALID}" --p7-verify --load-certificate "${srcdir}/../../doc/credentials/x509/cert-rsa.pem" <"${OUTFILE}"
 rc=$?
 
 if test "${rc}" != "1"; then
@@ -54,7 +61,7 @@ if test "${rc}" != "1"; then
 fi
 
 FILE="signing-verify"
-${VALGRIND} "${CERTTOOL}" --p7-verify --verify-allow-broken --load-certificate "${srcdir}/../../doc/credentials/x509/cert-rsa.pem" <"${OUTFILE}"
+${VALGRIND} "${CERTTOOL}" --attime "${ATTIME_VALID}" --p7-verify --verify-allow-broken --load-certificate "${srcdir}/../../doc/credentials/x509/cert-rsa.pem" <"${OUTFILE}"
 rc=$?
 
 if test "${rc}" != "0"; then

diff --git a/tests/cert-tests/pkcs7.sh b/tests/cert-tests/pkcs7.sh
index af900f185ff98f82a4f2ebebdd603c3f294b9886..26d511d89cdd39ac36b959d309ca1a19d0d90353 100644 (file)
--- a/tests/cert-tests/pkcs7.sh
+++ b/tests/cert-tests/pkcs7.sh
@@ -37,6 +37,12 @@ TMPFILE=tmp-pkcs7.$$.tmp
 
 . ${srcdir}/../scripts/common.sh
 
+: ${ac_cv_sizeof_time_t=8}
+if test "${ac_cv_sizeof_time_t}" -ge 8; then
+       ATTIME_VALID="2038-10-12"  # almost the pregenerated cert expiration
+else
+       ATTIME_VALID="2037-12-31"  # before 2038
+fi
 
 if test "${ENABLE_GOST}" = "1" && test "${GNUTLS_FORCE_FIPS_MODE}" != "1"
 then
@@ -97,15 +103,17 @@ if test "${rc}" = "0"; then
 fi
 
 # check validation with date after intermediate cert issuance
-${VALGRIND} "${CERTTOOL}" --attime "2038-10-13" --inder --p7-verify --load-ca-certificate "${srcdir}/../../doc/credentials/x509/ca.pem" --infile "${srcdir}/data/${FILE}" >"${OUTFILE}"
-rc=$?
+if test "${ac_cv_sizeof_time_t}" -ge 8; then
+       ${VALGRIND} "${CERTTOOL}" --attime "2038-10-13" --inder --p7-verify --load-ca-certificate "${srcdir}/../../doc/credentials/x509/ca.pem" --infile "${srcdir}/data/${FILE}" >"${OUTFILE}"
+       rc=$?
 
-if test "${rc}" = "0"; then
-       echo "${FILE}: PKCS7 verification succeeded with invalid date (3)"
-       exit 1
-fi
+       if test "${rc}" = "0"; then
+               echo "${FILE}: PKCS7 verification succeeded with invalid date (3)"
+               exit 1
+       fi
+fi  # cannot test that with 32-bit time_t
 
-${VALGRIND} "${CERTTOOL}" --inder --p7-verify --load-ca-certificate "${srcdir}/../../doc/credentials/x509/ca.pem" --infile "${srcdir}/data/${FILE}" >"${OUTFILE}"
+${VALGRIND} "${CERTTOOL}" --attime "${ATTIME_VALID}" --inder --p7-verify --load-ca-certificate "${srcdir}/../../doc/credentials/x509/ca.pem" --infile "${srcdir}/data/${FILE}" >"${OUTFILE}"
 rc=$?
 
 if test "${rc}" != "0"; then
@@ -118,7 +126,7 @@ done
 #check key purpose verification
 for FILE in full.p7b; do
 
-${VALGRIND} "${CERTTOOL}" --verify-purpose=1.3.6.1.5.5.7.3.1 --inder --p7-verify --load-ca-certificate "${srcdir}/../../doc/credentials/x509/ca.pem" --infile "${srcdir}/data/${FILE}" >"${OUTFILE}"
+${VALGRIND} "${CERTTOOL}" --attime "${ATTIME_VALID}" --verify-purpose=1.3.6.1.5.5.7.3.1 --inder --p7-verify --load-ca-certificate "${srcdir}/../../doc/credentials/x509/ca.pem" --infile "${srcdir}/data/${FILE}" >"${OUTFILE}"
 rc=$?
 
 if test "${rc}" != "0"; then
@@ -147,11 +155,11 @@ if test "${rc}" = "0"; then
        exit 2
 fi
 
-${VALGRIND} "${CERTTOOL}" --inder --p7-verify --load-data "${srcdir}/data/pkcs7-detached.txt" --load-ca-certificate "${srcdir}/../../doc/credentials/x509/ca.pem" --infile "${srcdir}/data/${FILE}"
+${VALGRIND} "${CERTTOOL}" --attime "${ATTIME_VALID}" --inder --p7-verify --load-data "${srcdir}/data/pkcs7-detached.txt" --load-ca-certificate "${srcdir}/../../doc/credentials/x509/ca.pem" --infile "${srcdir}/data/${FILE}"
 rc=$?
 
 if test "${rc}" != "0"; then
-       echo "${FILE}: PKCS7 verification failed"
+       echo "${FILE}: PKCS7 verification failed with detached data"
        exit ${rc}
 fi
 
@@ -188,7 +196,7 @@ if test "${rc}" != "0"; then
 fi
 
 FILE="signing-verify"
-${VALGRIND} "${CERTTOOL}" --p7-verify --load-certificate "${srcdir}/../../doc/credentials/x509/cert-rsa.pem" <"${OUTFILE}"
+${VALGRIND} "${CERTTOOL}" --attime "${ATTIME_VALID}" --p7-verify --load-certificate "${srcdir}/../../doc/credentials/x509/cert-rsa.pem" <"${OUTFILE}"
 rc=$?
 
 if test "${rc}" != "0"; then
@@ -198,7 +206,7 @@ fi
 
 #check extraction of embedded data in signature
 FILE="signing-verify-data"
-${VALGRIND} "${CERTTOOL}" --p7-verify --p7-show-data --load-certificate "${srcdir}/../../doc/credentials/x509/cert-rsa.pem" --outfile "${OUTFILE2}" <"${OUTFILE}"
+${VALGRIND} "${CERTTOOL}" --attime "${ATTIME_VALID}" --p7-verify --p7-show-data --load-certificate "${srcdir}/../../doc/credentials/x509/cert-rsa.pem" --outfile "${OUTFILE2}" <"${OUTFILE}"
 rc=$?
 
 if test "${rc}" != "0"; then
@@ -223,7 +231,7 @@ if test "${rc}" != "0"; then
 fi
 
 FILE="signing-detached-verify"
-${VALGRIND} "${CERTTOOL}" --p7-verify --load-certificate "${srcdir}/../../doc/credentials/x509/cert-rsa.pem" --load-data "${srcdir}/data/pkcs7-detached.txt" <"${OUTFILE}"
+${VALGRIND} "${CERTTOOL}" --attime "${ATTIME_VALID}" --p7-verify --load-certificate "${srcdir}/../../doc/credentials/x509/cert-rsa.pem" --load-data "${srcdir}/data/pkcs7-detached.txt" <"${OUTFILE}"
 rc=$?
 
 if test "${rc}" != "0"; then
@@ -273,7 +281,7 @@ if test "${rc}" != "0"; then
 fi
 
 FILE="signing-time-verify"
-${VALGRIND} "${CERTTOOL}" --p7-verify --load-certificate "${srcdir}/../../doc/credentials/x509/cert-rsa.pem" --load-data "${srcdir}/data/pkcs7-detached.txt" <"${OUTFILE}"
+${VALGRIND} "${CERTTOOL}" --attime "${ATTIME_VALID}" --p7-verify --load-certificate "${srcdir}/../../doc/credentials/x509/cert-rsa.pem" --load-data "${srcdir}/data/pkcs7-detached.txt" <"${OUTFILE}"
 rc=$?
 
 if test "${rc}" != "0"; then
@@ -302,7 +310,7 @@ fi
 # Test BER encoding, see RFC 4134 Section 4.5
 # SHA1 signature, so --verify-allow-broken
 FILE="rfc4134-4.5"
-${VALGRIND} "${CERTTOOL}" --p7-verify --verify-allow-broken --load-ca-certificate "${srcdir}/data/rfc4134-ca-rsa.pem" --infile "${srcdir}/data/rfc4134-4.5.p7b" --inder
+${VALGRIND} "${CERTTOOL}" --attime "${ATTIME_VALID}" --p7-verify --verify-allow-broken --load-ca-certificate "${srcdir}/data/rfc4134-ca-rsa.pem" --infile "${srcdir}/data/rfc4134-4.5.p7b" --inder
 rc=$?
 
 if test "${rc}" != "0"; then