Great job! We can link to this project from the babashka README - or if the script matures, maybe we can just put it into babashka's repo eventually

Sure! I'd love to mature the script some more so that it has much more feature parity

This code is know to work in bb: https://github.com/gnarroway/hato/blob/7862f9e3ab692ea499b935842978688831e61bfd/src/hato/client.clj#L79-L125

@UDXEK491P What is the context of your question? I think we could add support for this to bb but it would be good to know more about the why

i am writing a script to automate some cert management for my team. it comes split apart and i need to assemble it in a specific order so i want to parse the certs. basically the flow is zip -> cert -> chained cert -> install into gcp

it would be useful to know what more you need after adding this class. would it be possible to give a full example? then I'll make sure it will work with bb

sure, this is what i'm working with at the moment

(ns certificate
  (:import
   (java.time.format DateTimeFormatter)
   (java.security.cert X509Certificate CertificateFactory))
  (:require
   [ :as io]
   [com.stuartsierra.dependency :as dep]
   [clojure.string :as str]))

(defn x509-certificate
  ^X509Certificate
  [f]
  (let [input   (io/input-stream f)
        factory (CertificateFactory/getInstance "X.509")]
    (.generateCertificate factory input)))

(defn not-before
  [certificate]
  (.toInstant (.getNotBefore certificate)))

(defn not-after
  [certificate]
  (.toInstant (.getNotAfter certificate)))

(defn valid-dates
  [certificate]
  ((juxt not-before not-after) certificate))

(defn issuer
  [certificate]
  (.getName (.getIssuerX500Principal certificate)))

(defn subject
  [certificate]
  (.getName (.getSubjectX500Principal certificate)))

(defn subject-alternative-names
  [certificate]
  (.getIssuerAlternativeNames certificate))

(defn chain-sort-step
  [graph current others]
  (reduce (fn [graph other]
            (if (= (issuer current) (subject other))
              (dep/depend graph current other)
              graph))
          graph
          others))

(defn chain-sort
  [certificates]
  (let [certs (set certificates)]
    (dep/topo-sort
     (reduce (fn [graph cert] (chain-sort-step graph cert (disj certs cert)))
             (dep/graph)
             certs))))

;; Text Utils for working with X.509 principal strings

(defn common-name
  [string]
  (second (re-find  #"CN=(?<name>\S+)" string)))


(defn- inst->iso-date-string
  [instant]
  (let [formatter (.withZone DateTimeFormatter/BASIC_ISO_DATE (java.time.ZoneId/of "UTC"))]
    (.format formatter instant)))

And perhaps some example function calls, so I can test it locally?

something like this would demo it

(chain-sort
   [(x509-certificate "child.crt")
    (x509-certificate "root.crt")])

i think being able to just create an instance of X509Certificate form the CertificateFactory would be sufficient though. since the rest of the code definitely works in bb

@UDXEK491P what OS are you on?

macOS

m1 or intel?

M1

if m1, you can download a binary from here: https://cirrus-ci.com/task/5896904853159936 to test with. Note that you need to do sudo xattr -c ~/path/to/bb to clear some quarantaine stuff after downloading.

If successful, I'll merge

Sweet! Will check after lunch 🙏

ran into

clojure.lang.ExceptionInfo: Method getSubjectX500Principal on class sun.security.x509.X509CertImpl not allowed! [at <repl>:26:1]

(import java.security.cert.X509Certificate)
(import java.security.cert.CertificateFactory)
(require '[ :as io])
(defn x509-certificate
  ^X509Certificate
  [f]
  (let [input   (io/input-stream f)
        factory (CertificateFactory/getInstance "X.509")]
    (.generateCertificate factory input)))
(def cert (x509-certificate (io/file "certificate.crt")))
(.getSubjectX500Principal cert)

ok, just a moment

do you have a .crt file for me I can work with?

here's a good one 😄

in jvm clojure

user=> 
(import java.security.cert.X509Certificate)
(import java.security.cert.CertificateFactory)
(require '[ :as io])
(defn x509-certificate
  ^X509Certificate
  [f]
  (let [input   (io/input-stream f)
        factory (CertificateFactory/getInstance "X.509")]
    (.generateCertificate factory input)))
java.security.cert.X509Certificate
user=> java.security.cert.CertificateFactory
user=> nil
user=> #'user/x509-certificate
user=> (def cert (x509-certificate (io/file "clojure.crt")))
#'user/cert
user=> (.getSubjectX500Principal cert)
#object[javax.security.auth.x500.X500Principal 0x344426bf "CN="]

Thanks. A workaround for now:

(prn (let [^X509Certificate cert cert]
       (.getSubjectX500Principal cert)))

The type inference in bb isn't so great, but I'll push a fix so it will work without this workaround

ok, try this binary, it should work with your previous code: https://cirrus-ci.com/task/5336053058371584

merged to master. when the current master build finishes, you can install the dev build with:

bash <(curl ) --dev-build --dir /tmp

this is great! works on my end