crypto/x509: Apple edited HT204132, breaking iOS CA roots updater

[acohn]

What version of Go are you using (go version)?

go version go1.9 darwin/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

darwin/amd64, macOS 10.12.6
uname -a: Darwin tungsten.local 16.7.0 Darwin Kernel Version 16.7.0: Thu Jun 15 17:36:27 PDT 2017; root:xnu-3789.70.16~2/RELEASE_X86_64 x86_64

What did you do?

cd $(go env GOROOT)/src/crypto/x509 && go generate 

Can't be replicated except on macOS, so no play.golang.org link :(

What did you expect to see?

The $GOROOT/src/crypto/x509/root_darwin_armx.go file should be updated to match the iOS 11 root store.

What did you see instead?

It panics with this error:

panic: runtime error: slice bounds out of range

goroutine 1 [running]:
main.fetchCertIDs(0x0, 0x0, 0x0, 0x0, 0x0)
	[elided]/go/src/crypto/x509/root_darwin_arm_gen.go:147 +0x89c
main.selectCerts(0x1156f6b, 0xc420066060, 0x1409f80, 0xc420046af0, 0x12c992f)
	[elided]/go/src/crypto/x509/root_darwin_arm_gen.go:69 +0x37
main.main()
	[elided]/go/src/crypto/x509/root_darwin_arm_gen.go:37 +0x52
exit status 2
root_darwin.go:5: running "go": exit status 1

Looks like Apple changed the format of the support article that root_darwin_arm_gen.go pulls iOS's root certificate list from. The list of CAs is now on a separate page.

[odeke-em]

Thank you for the report @acohn, I can reproduce and in deed, now the page contains a listing to different lists by iOS version

/cc @agl @rsc @ianlancetaylor

[gopherbot]

Change https://golang.org/cl/77252 mentions this issue: crypto/x509: update iOS root certs.