roots.sh

#!/usr/bin/env sh
#
# Consolidated roots management script.
#
# Usage: roots.sh [options]
#
# Options:
#   --url <url>           URL to fetch CCADB PEM bundle (default: https://ccadb.my.salesforce-sites.com/mozilla/IncludedRootsPEMTxt?TrustBitsInclude=Websites)
#   --sha256 <hex>        Optional SHA256 checksum to verify the downloaded bundle
#   --extra-dir <dir>     Directory with extra PEM/CRT certs to merge (default: ./user-roots)
#   --out <path>          Output PEM bundle path (default: ./dist/ca-bundle.pem)
#   --hashed-dir <path>   Directory to write hashed certs and run openssl rehash (optional)
#   --keep-work           Keep temporary working directory for debugging
#   --emit-env            Emit environment variables for CI capture
#   -q, --quiet           Quiet mode, less output
#   -v, --verbose         Verbose mode, more output
#   -h, --help            Show this help and exit

set -eu

need() { command -v "$1" >/dev/null 2>&1 || die "Required tool not found: $1"; }
need openssl

log() {
    if [ "${QUIET:-0}" = 0 ]; then
        printf 'LOG:   %s\n' "$*" >&2
    fi
}

debug() {
    if [ "${VERBOSE:-0}" = 1 ]; then
        printf 'DEBUG: %s\n' "$*" >&2
    fi
}

die() {
    printf 'ERROR: %s\n' "$*" >&2
    exit 1
}

usage() {
    cat <<EOF
Usage: $0 [options]s

Options:
  --url <url>           URL to fetch CCADB PEM bundle (default: https://ccadb.my.salesforce-sites.com/mozilla/IncludedRootsPEMTxt?TrustBitsInclude=Websites)
  --sha256 <hex>        Optional SHA256 checksum to verify the downloaded bundle
  --extra-dir <dir>     Directory with extra PEM/CRT certs to merge (default: ./user-roots)
  --out <path>          Output PEM bundle path (default: ./dist/ca-bundle.pem)
  --hashed-dir <path>   Directory to write hashed certs and run openssl rehash (optional)
  --keep-work           Keep temporary working directory for debugging
  --emit-env            Emit environment variables for CI capture
  -q, --quiet           Quiet mode, less output
  -v, --verbose         Verbose mode, more output
  -h, --help            Show this help and exit
EOF
    exit 0
}

fetch_roots() {
    # $1 = url
    # $2 = out_pem
    # $3 = sha256 (optional, empty string if none)
    url=$1
    out_pem=$2
    sha256_expected=$3

    log "Fetching CCADB PEM bundle"
    debug "from $url"
    debug "Saving to:"
    debug "  $out_pem"

    if command -v curl >/dev/null 2>&1; then
        if ! curl -fsSL "$url" -o "$out_pem"; then
            die "Failed to fetch PEM bundle with curl."
        fi
    elif command -v wget >/dev/null 2>&1; then
        if ! wget -qO "$out_pem" "$url"; then
            die "Failed to fetch PEM bundle with wget."
        fi
    else
        die "Neither curl nor wget is installed."
    fi

    # debug file size
    if command -v wc >/dev/null 2>&1; then
        size=$(wc -c <"$out_pem" | tr -d ' ')
    elif command -v stat >/dev/null 2>&1; then
        size=$(stat -c%s "$out_pem")
    else
        size="unknown"
    fi
    debug "Downloaded file size: $size bytes"

    log "Download completed."

    if [ -n "$sha256_expected" ]; then
        log "Verifying SHA256 checksum..."
        if command -v sha256sum >/dev/null 2>&1; then
            hash="$(sha256sum "$out_pem" | awk '{print $1}')"
        elif command -v shasum >/dev/null 2>&1; then
            hash="$(shasum -a 256 "$out_pem" | awk '{print $1}')"
        else
            die "No SHA256 checksum tool found; cannot verify."
        fi

        debug "Computed SHA256: $hash"

        if [ "$hash" = "$sha256_expected" ]; then
            log "SHA256 verified successfully."
        else
            die "SHA256 mismatch! Expected: $sha256_expected Got: $hash"
        fi
    fi
}

normalize_pem() {
    # $1 = input PEM file
    # $2 = output PEM file
    # Splits concatenated PEM bundle into individual certs,
    # normalizes each with openssl x509, dedupes by SHA256 fingerprint.

    in_pem=$1
    out_pem=$2

    # create temp dir for split certs
    tmpdir="$(mktemp -d)"

    log "Normalizing and deduplicating PEM bundle..."

    # Split concatenated PEMs into individual files using awk (portable; avoids csplit dependency)
    awk 'BEGIN{RS="-----END CERTIFICATE-----"; ORS=""; i=0}
         NF{ print $0 "-----END CERTIFICATE-----\n" > (dir "/cert-" sprintf("%03d", i++) ".pem") }' \
         dir="$tmpdir" "$in_pem"

    set -- "$tmpdir"/cert-*.pem
    [ -e "$1" ] || die "No certificates found in input PEM"

    # dedupe by SHA256 fingerprint
    # use a temporary file to store fingerprints seen
    fingerprints_file="$tmpdir/fingerprints.txt"
    : > "$fingerprints_file"

    # output file
    : > "$out_pem"

    total=0
    kept=0
    dupes=0
    invalid=0

    for certfile in "$tmpdir"/cert-*.pem; do
        total=$((total + 1))
        debug "Processing cert: $certfile"
        # normalize cert
        normalized="$(openssl x509 -in "$certfile" -outform PEM 2>/dev/null)" || {
            invalid=$((invalid + 1))
            continue
        }
        # get fingerprint
        fingerprint="$(printf '%s' "$normalized" | openssl x509 -fingerprint -sha256 -noout 2>/dev/null | sed 's/^SHA256 Fingerprint=//')"
        if [ -z "$fingerprint" ]; then
            invalid=$((invalid + 1))
            continue
        fi

        if ! grep -qF -- "$fingerprint" "$fingerprints_file"; then
            printf '%s\n' "$fingerprint" >> "$fingerprints_file"
            printf '%s\n' "$normalized" >> "$out_pem"
            kept=$((kept + 1))
        else
            dupes=$((dupes + 1))
        fi
    done

    debug "normalize_pem: total=$total kept=$kept dupes=$dupes invalid=$invalid"

    rm -rf "$tmpdir"
}

merge_roots() {

    # $1 = base PEM file
    # $2 = extra dir with PEM/CRT files
    # $3 = output PEM file
    base_pem=$1
    extra_dir=$2
    out_pem=$3

    tmpdir="$(mktemp -d)"

    log "Merging root certificates..."

    # copy base PEM as start
    cp "$base_pem" "$tmpdir/merged.pem"

    count=0
    # find extra PEM/CRT files (if dir exists)
    if [ -d "$extra_dir" ]; then
        for f in "$extra_dir"/*.pem "$extra_dir"/*.crt; do
            if [ -f "$f" ]; then
                cat "$f" >> "$tmpdir/merged.pem"
                count=$((count + 1))
            fi
        done
    fi

    debug "merge_roots: base=$base_pem extra_dir=$extra_dir appended=$count"

    normalize_pem "$tmpdir/merged.pem" "$out_pem"

    rm -rf "$tmpdir"
}

# Default values
URL="https://ccadb.my.salesforce-sites.com/mozilla/IncludedRootsPEMTxt?TrustBitsInclude=Websites"
SHA256=""
EXTRA_DIR="./user-roots"
OUT_PATH="./dist/ca-bundle.pem"
HASHED_DIR=""
KEEP_WORK=0
EMIT_ENV=0
QUIET=0
VERBOSE=0

# Parse args
while [ $# -gt 0 ]; do
    case "$1" in
        --url)
            shift
            [ $# -gt 0 ] || die "--url requires argument"
            URL="$1"
            ;;
        --sha256)
            shift
            [ $# -gt 0 ] || die "--sha256 requires argument"
            SHA256="$1"
            ;;
        --extra-dir)
            shift
            [ $# -gt 0 ] || die "--extra-dir requires argument"
            EXTRA_DIR="$1"
            ;;
        --out)
            shift
            [ $# -gt 0 ] || die "--out requires argument"
            OUT_PATH="$1"
            ;;
        --hashed-dir)
            shift
            [ $# -gt 0 ] || die "--hashed-dir requires argument"
            HASHED_DIR="$1"
            ;;
        --keep-work)
            KEEP_WORK=1
            ;;
        --emit-env)
            EMIT_ENV=1
            ;;
        -q|--quiet)
            QUIET=1
            ;;
        -v|--verbose)
            VERBOSE=1
            ;;
        -h|--help)
            usage
            ;;
        *)
            die "Unknown option: $1"
            ;;
    esac
    shift
done

debug "VERBOSE mode is ON"

debug "Arguments summary:"
debug "  URL=$URL"
debug "  SHA256=${SHA256:-}"
debug "  EXTRA_DIR=$EXTRA_DIR"
debug "  OUT_PATH=$OUT_PATH"
debug "  HASHED_DIR=$HASHED_DIR"
debug "  KEEP_WORK=$KEEP_WORK"
debug "  EMIT_ENV=$EMIT_ENV"
debug "  QUIET=$QUIET"
debug "  VERBOSE=$VERBOSE"

# Create work directory
debug "Setting up work directory..."
if [ -n "${WORKDIR:-}" ]; then
    WORKDIR=$WORKDIR
    if [ ! -d "$WORKDIR" ]; then
        die "WORKDIR environment variable set but directory does not exist: $WORKDIR"
    fi
else
    WORKDIR="$(mktemp -d)"
    if [ "$KEEP_WORK" -eq 0 ]; then
        trap 'rm -rf "$WORKDIR"' EXIT
    else
        log "Keeping work directory: $WORKDIR"
    fi
fi
debug "Work directory: $WORKDIR"

# remove any existing output file
if [ -f "$OUT_PATH" ]; then
    debug "Removing existing output file: $OUT_PATH"
    rm -f "$OUT_PATH"
fi

# re create output directory
mkdir -p "$(dirname "$OUT_PATH")"

CCADB_PEM="$WORKDIR/ccadb.pem"

# Fetch the CCADB PEM bundle. Normalization is performed later in merge_roots.
fetch_roots "$URL" "$CCADB_PEM" "$SHA256"

if [ ! -s "$CCADB_PEM" ]; then
    die "Fetched CCADB PEM bundle is empty or missing: $CCADB_PEM"
fi
debug "Fetched CCADB PEM bundle is present and non-empty: $CCADB_PEM"

# Merge roots and normalize only once inside merge_roots.
merge_roots "$CCADB_PEM" "$EXTRA_DIR" "$OUT_PATH"

if [ -f "$OUT_PATH" ]; then
    if command -v wc >/dev/null 2>&1; then
        out_size=$(wc -c <"$OUT_PATH" | tr -d ' ')
    elif command -v stat >/dev/null 2>&1; then
        out_size=$(stat -c%s "$OUT_PATH")
    else
        out_size="unknown"
    fi
    debug "Merged output PEM file size: $out_size bytes"
else
    die "Output PEM bundle not found after merge: $OUT_PATH"
fi

# Generate hashed certs directory if requested
if [ -n "$HASHED_DIR" ]; then
    debug "Generating hashed certs directory at: $HASHED_DIR"
    mkdir -p "$HASHED_DIR"
    cp "$OUT_PATH" "$HASHED_DIR/ca-certificates.crt"
    if command -v openssl >/dev/null 2>&1; then
        (
            cd "$HASHED_DIR" || exit 1
            if openssl rehash . >/dev/null 2>&1; then
                :
            elif command -v c_rehash >/dev/null 2>&1; then
                c_rehash . >/dev/null 2>&1 || log "Warning: c_rehash failed"
            else
                log "Warning: neither 'openssl rehash' nor 'c_rehash' is available; skipping hash dir generation"
            fi
        )
    else
        log "Warning: openssl not found, skipping rehash"
    fi
fi

if [ "$EMIT_ENV" -eq 1 ]; then
    printf 'CCADB_WORKDIR=%s\n' "$WORKDIR"
    printf 'CCADB_BUNDLE=%s\n' "$OUT_PATH"
    if [ -n "$HASHED_DIR" ]; then
        printf 'CCADB_HASHED_DIR=%s\n' "$HASHED_DIR"
    fi
fi

log "Done."
exit 0