Check for Google Root CA Updates #2784
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Check for Google Root CA Updates | |
| on: | |
| schedule: | |
| - cron: '23 23 * * *' | |
| workflow_dispatch: | |
| defaults: | |
| run: | |
| shell: bash | |
| working-directory: src/gam | |
| jobs: | |
| check-certs: | |
| runs-on: ubuntu-slim | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false # otherwise, the token used is the GITHUB_TOKEN, instead of your personal token | |
| fetch-depth: 0 # otherwise, you will failed to push refs to dest repo | |
| - name: Get Current cacerts.pem hash | |
| run: | | |
| export CURRENT_HASH=$(sha256sum ./cacerts.pem) | |
| echo "Current hash is: ${CURRENT_HASH}" | |
| echo "CURRENT_HASH=${CURRENT_HASH}" >> $GITHUB_ENV | |
| - name: Generate GAM-specific bundle with LE + Google roots | |
| run: | | |
| OUTPUT_FILE="cacerts.pem" | |
| > "$OUTPUT_FILE" | |
| process_cert() { | |
| local url="$1" | |
| local op_ca="$2" | |
| local label="$3" | |
| local tmp_cert=$(mktemp) | |
| curl "$url" > "$tmp_cert" | |
| local issuer=$(openssl x509 -noout -issuer -in "$tmp_cert" | sed -e 's/^issuer= *//') | |
| local subject=$(openssl x509 -noout -subject -in "$tmp_cert" | sed -e 's/^subject= *//') | |
| local serial_hex=$(openssl x509 -noout -serial -in "$tmp_cert" | sed -e 's/^serial=//') | |
| local serial_dec=$(python3 -c "print(int('$serial_hex', 16))") | |
| local md5=$(openssl x509 -noout -fingerprint -md5 -in "$tmp_cert" | sed -e 's/.*=//' | tr '[:upper:]' '[:lower:]') | |
| local sha1=$(openssl x509 -noout -fingerprint -sha1 -in "$tmp_cert" | sed -e 's/.*=//' | tr '[:upper:]' '[:lower:]') | |
| local sha256=$(openssl x509 -noout -fingerprint -sha256 -in "$tmp_cert" | sed -e 's/.*=//' | tr '[:upper:]' '[:lower:]') | |
| echo "# Operating CA: $op_ca" >> "$OUTPUT_FILE" | |
| echo "# Issuer: $issuer" >> "$OUTPUT_FILE" | |
| echo "# Subject: $subject" >> "$OUTPUT_FILE" | |
| echo "# Label: \"$label\"" >> "$OUTPUT_FILE" | |
| echo "# Serial: $serial_dec" >> "$OUTPUT_FILE" | |
| echo "# MD5 Fingerprint: $md5" >> "$OUTPUT_FILE" | |
| echo "# SHA1 Fingerprint: $sha1" >> "$OUTPUT_FILE" | |
| echo "# SHA256 Fingerprint: $sha256" >> "$OUTPUT_FILE" | |
| cat "$tmp_cert" >> "$OUTPUT_FILE" | |
| echo "" >> "$OUTPUT_FILE" | |
| rm "$tmp_cert" | |
| } | |
| echo "#" >> "$OUTPUT_FILE" | |
| echo "# This is a custom certificate authority bundle for GAM" >> "$OUTPUT_FILE" | |
| echo "# It's composed of Let's Encrypt Root CAs and Google's" >> "$OUTPUT_FILE" | |
| echo "# certificate bundle. This should be the minimal list of" >> "$OUTPUT_FILE" | |
| echo "# CAs required to talk to Google and Github." >> "$OUTPUT_FILE" | |
| echo"" >> "$OUTPUT_FILE" | |
| echo "Processing Let's Encrypt ISRG Root X1..." | |
| process_cert "https://letsencrypt.org/certs/isrgrootx1.pem" "Let's Encrypt" "ISRG Root X1" | |
| echo "Processing Let's Encrypt ISRG Root X2..." | |
| process_cert "https://letsencrypt.org/certs/isrg-root-x2.pem" "Let's Encrypt" "ISRG Root X2" | |
| echo "Appending Google's roots.pem..." | |
| curl -s https://pki.goog/roots.pem >> "$OUTPUT_FILE" | |
| echo "Done! The new bundle has been saved to $OUTPUT_FILE." | |
| - name: Compare hashes | |
| run: | | |
| export NEW_HASH=$(sha256sum ./cacerts.pem) | |
| if [ "$NEW_HASH" == "$CURRENT_HASH" ]; then | |
| echo "Same file." | |
| else | |
| echo "New file content. Was ${CURRENT_HASH} and now is ${NEW_HASH}" | |
| fi | |
| - name: Commit file | |
| run: | | |
| git config --local user.email "action@github.com" | |
| git config --local user.name "GitHub Action" | |
| git add cacerts.pem | |
| git diff --quiet && git diff --staged --quiet || git commit -am '[ci skip] Updated cacerts.pem' | |
| - name: Push changes | |
| uses: ad-m/github-push-action@77c5b412c50b723d2a4fbc6d71fb5723bcd439aa | |
| with: | |
| github_token: ${{ secrets.GITHUB_TOKEN }} |