<commit_before>#!/bin/sh
#
# Script generating a certificate chain
#

rm -f jsign-* keystore*

# Create the file defining the x509 extensions
cat > extensions.cnf <<- "EOF"
[ root ]
basicConstraints = CA:TRUE
keyUsage = keyCertSign,cRLSign
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer

[ intermediate ]
basicConstraints = CA:TRUE,pathlen:0
keyUsage = keyCertSign,cRLSign
extendedKeyUsage = codeSigning
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer

[ final ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature
extendedKeyUsage = codeSigning
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
EOF

CERT_OPTS="-days 7300 -text -sha256"
YEAR=$(date +'%Y')

# Generate the root certificate
openssl req -new -newkey rsa:2048 -nodes -keyout jsign-root-ca.key -x509 -extensions v3_ca -subj "/CN=Jsign Root Certificate Authority $YEAR" -out jsign-root-ca.pem $CERT_OPTS

# Generate the intermediate certificate
openssl req -new -newkey rsa:2048 -nodes -keyout jsign-code-signing-ca.key -subj "/CN=Jsign Code Signing CA $YEAR" -out jsign-code-signing-ca.csr
openssl x509 -req -in jsign-code-signing-ca.csr -CA jsign-root-ca.pem -CAkey jsign-root-ca.key -CAcreateserial \
             -out jsign-code-signing-ca.pem $CERT_OPTS -extfile extensions.cnf -extensions intermediate

# Generate the test certificates (reusing the existing keys)
openssl req -new -key privatekey.pkcs1.pem -subj "/CN=Jsign Code Signing Test Certificate $YEAR (RSA)" -out jsign-test-certificate.csr
openssl x509 -req -in jsign-test-certificate.csr -CA jsign-code-signing-ca.pem -CAkey jsign-code-signing-ca.key -CAcreateserial \
             -out jsign-test-certificate.pem $CERT_OPTS -extfile extensions.cnf -extensions final

openssl req -new -key privatekey-ec-<KEY> -subj "/CN=Jsign Code Signing Test Certificate $YEAR (EC)" -out jsign-test-certificate-ec.csr
openssl x509 -req -in jsign-test-certificate-ec.csr -CA jsign-code-signing-ca.pem -CAkey jsign-code-signing-ca.key -CAcreateserial \
             -out jsign-test-certificate-ec.pem $CERT_OPTS -extfile extensions.cnf -extensions final

# Generate the certificate chains
cat jsign-root-ca.pem jsign-code-signing-ca.pem jsign-test-certificate.pem > jsign-test-certificate-full-chain-reversed.pem
cat jsign-test-certificate.pem jsign-code-signing-ca.pem jsign-root-ca.pem > jsign-test-certificate-full-chain.pem
cat jsign-root-ca.pem jsign-code-signing-ca.pem > jsign-test-certificate-partial-chain-reversed.pem
cat jsign-code-signing-ca.pem jsign-root-ca.pem > jsign-test-certificate-partial-chain.pem

# Generate the SPC files (DER encoded certificate chains)
openssl crl2pkcs7 -nocrl -certfile jsign-test-certificate-full-chain.pem          -outform DER -out jsign-test-certificate-full-chain.spc
openssl crl2pkcs7 -nocrl -certfile jsign-test-certificate-full-chain-reversed.pem -outform DER -out jsign-test-certificate-full-chain-reversed.spc

# Generate the PKCS#12 keystores
OPENSSL_OPTS="-export -inkey privatekey.pkcs1.pem -name test -passout env:PASSWORD"
PASSWORD=password openssl pkcs12 $OPENSSL_OPTS -in jsign-test-certificate-full-chain.pem -out keystore.p12
PASSWORD=password openssl pkcs12 $OPENSSL_OPTS -in jsign-test-certificate.pem            -out keystore-no-chain.p12

OPENSSL_OPTS="-export -inkey privatekey-ec-p384.pkcs1.pem -name test -passout env:PASSWORD"
PASSWORD=password openssl pkcs12 $OPENSSL_OPTS -in jsign-test-certificate-ec.pem         -out keystore-ec.p12<commit_msg>Simplified the openssl commands in the certificate generation script<commit_after>#!/bin/sh
#
# Script generating a certificate chain
#

rm -f jsign-* keystore*

# Create the file defining the x509 extensions
cat > extensions.cnf <<- "EOF"
[ root ]
basicConstraints = CA:TRUE
keyUsage = keyCertSign,cRLSign
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer

[ intermediate ]
basicConstraints = CA:TRUE,pathlen:0
keyUsage = keyCertSign,cRLSign
extendedKeyUsage = codeSigning
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer

[ final ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature
extendedKeyUsage = codeSigning
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
EOF

CERT_OPTS="-days 7300 -text -sha256"
YEAR=$(date +'%Y')

# Generate the root certificate
openssl req -new -newkey rsa:2048 -nodes -keyout jsign-root-ca.key -x509 -extensions v3_ca -subj "/CN=Jsign Root Certificate Authority $YEAR" -out jsign-root-ca.pem $CERT_OPTS

# Generate the intermediate certificate
openssl req -new -newkey rsa:2048 -nodes -keyout jsign-code-signing-ca.key -subj "/CN=Jsign Code Signing CA $YEAR" -out jsign-code-signing-ca.csr
openssl x509 -req -in jsign-code-signing-ca.csr -CA jsign-root-ca.pem -CAkey jsign-root-ca.key -CAcreateserial \
             -out jsign-code-signing-ca.pem $CERT_OPTS -extfile extensions.cnf -extensions intermediate

# Generate the test certificates (reusing the existing keys)
openssl req -new -key privatekey.pkcs1.pem -subj "/CN=Jsign Code Signing Test Certificate $YEAR (RSA)" -out jsign-test-certificate.csr
openssl x509 -req -in jsign-test-certificate.csr -CA jsign-code-signing-ca.pem -CAkey jsign-code-signing-ca.key -CAcreateserial \
             -out jsign-test-certificate.pem $CERT_OPTS -extfile extensions.cnf -extensions final

openssl req -new -key privatekey-ec-p384.pkcs1.pem -subj "/CN=Jsign Code Signing Test Certificate $YEAR (EC)" -out jsign-test-certificate-ec.csr
openssl x509 -req -in jsign-test-certificate-ec.csr -CA jsign-code-signing-ca.pem -CAkey jsign-code-signing-ca.key -CAcreateserial \
             -out jsign-test-certificate-ec.pem $CERT_OPTS -extfile extensions.cnf -extensions final

# Generate the certificate chains
cat jsign-root-ca.pem jsign-code-signing-ca.pem jsign-test-certificate.pem > jsign-test-certificate-full-chain-reversed.pem
cat jsign-test-certificate.pem jsign-code-signing-ca.pem jsign-root-ca.pem > jsign-test-certificate-full-chain.pem
cat jsign-root-ca.pem jsign-code-signing-ca.pem > jsign-test-certificate-partial-chain-reversed.pem
cat jsign-code-signing-ca.pem jsign-root-ca.pem > jsign-test-certificate-partial-chain.pem

# Generate the SPC files (DER encoded certificate chains)
openssl crl2pkcs7 -nocrl -certfile jsign-test-certificate-full-chain.pem          -outform DER -out jsign-test-certificate-full-chain.spc
openssl crl2pkcs7 -nocrl -certfile jsign-test-certificate-full-chain-reversed.pem -outform DER -out jsign-test-certificate-full-chain-reversed.spc

# Generate the PKCS#12 keystores
OPENSSL_OPTS="-export -inkey privatekey.pkcs1.pem -name test -passout <PASSWORD>:password"
openssl pkcs12 $OPENSSL_OPTS -in jsign-test-certificate-full-chain.pem -out keystore.p12
openssl pkcs12 $OPENSSL_OPTS -in jsign-test-certificate.pem            -out keystore-no-chain.p12

OPENSSL_OPTS="-export -inkey privatekey-ec-p384.pkcs1.pem -name test -passout <PASSWORD>:password"
openssl pkcs12 $OPENSSL_OPTS -in jsign-test-certificate-ec.pem         -out keystore-ec.p12
{'fraction_non_alphanumeric': 0.10696943730362754, 'fraction_numerical': 0.016566695229934304, 'mean_word_length': 4.39522342064715, 'pattern_counts': {'":': 0, '<': 10, '<?xml version=': 0, '>': 16, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4231115', 'n_tokens_mistral': 2578, 'n_tokens_neox': 2468, 'n_words': 554}