Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

crypto/x509: Apple edited HT204132, breaking iOS CA roots updater #22181

Closed
acohn opened this issue Oct 8, 2017 · 2 comments
Closed

crypto/x509: Apple edited HT204132, breaking iOS CA roots updater #22181

acohn opened this issue Oct 8, 2017 · 2 comments

Comments

@acohn
Copy link

@acohn acohn commented Oct 8, 2017

What version of Go are you using (go version)?

go version go1.9 darwin/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

darwin/amd64, macOS 10.12.6
uname -a: Darwin tungsten.local 16.7.0 Darwin Kernel Version 16.7.0: Thu Jun 15 17:36:27 PDT 2017; root:xnu-3789.70.16~2/RELEASE_X86_64 x86_64

What did you do?

cd $(go env GOROOT)/src/crypto/x509 && go generate 

Can't be replicated except on macOS, so no play.golang.org link :(

What did you expect to see?

The $GOROOT/src/crypto/x509/root_darwin_armx.go file should be updated to match the iOS 11 root store.

What did you see instead?

It panics with this error:

panic: runtime error: slice bounds out of range

goroutine 1 [running]:
main.fetchCertIDs(0x0, 0x0, 0x0, 0x0, 0x0)
	[elided]/go/src/crypto/x509/root_darwin_arm_gen.go:147 +0x89c
main.selectCerts(0x1156f6b, 0xc420066060, 0x1409f80, 0xc420046af0, 0x12c992f)
	[elided]/go/src/crypto/x509/root_darwin_arm_gen.go:69 +0x37
main.main()
	[elided]/go/src/crypto/x509/root_darwin_arm_gen.go:37 +0x52
exit status 2
root_darwin.go:5: running "go": exit status 1

Looks like Apple changed the format of the support article that root_darwin_arm_gen.go pulls iOS's root certificate list from. The list of CAs is now on a separate page.

@odeke-em odeke-em changed the title Apple edited HT204132, breaking iOS CA roots updater crypto/x509: Apple edited HT204132, breaking iOS CA roots updater Oct 9, 2017
@odeke-em
Copy link
Member

@odeke-em odeke-em commented Oct 9, 2017

Thank you for the report @acohn, I can reproduce and in deed, now the page contains a listing to different lists by iOS version
screen shot 2017-10-08 at 7 15 00 pm

screen shot 2017-10-08 at 7 15 12 pm

/cc @agl @rsc @ianlancetaylor

@gopherbot
Copy link

@gopherbot gopherbot commented Nov 13, 2017

Change https://golang.org/cl/77252 mentions this issue: crypto/x509: update iOS root certs.

@gopherbot gopherbot closed this in ac53c96 Jan 6, 2018
@golang golang locked and limited conversation to collaborators Jan 6, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
5 participants
You can’t perform that action at this time.