heiko/mailseal
heiko/mailseal
Watch
1
0
Fork
You've already forked mailseal
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

TSA/tsca: anchor CA state to the script directory and make --force deletion safe #5

New issue
Closed
opened 2026-07-21 17:20:16 +02:00 by heiko · 1 comment
heiko commented 2026-07-21 17:20:16 +02:00
Owner
Copy link

Problem

TSA/tsca performs destructive and secret-generating operations relative to the caller's current working directory:

--force|-f) rm -rf ./ca;;
...
install -d ./ca
openssl ... -out ca/key.pem ...

Running TSA/tsca from the repository root already creates a separate root-level ca/; running it from another directory can overwrite or delete an unrelated ./ca. --force is especially dangerous because the target is not anchored or sanity-checked.

The OpenSSL configuration is resolved relative to the script, but key/certificate/serial paths from openssl.cnf still depend on the working directory.

Checklist analogue: #12 (project/path organization; avoid implicit working-directory state).

Proposed fix

  • Resolve script_dir with a robust absolute path and place all test CA state under a single documented directory such as $script_dir/ca.
  • Pass absolute paths or cd -- "$script_dir" after validating it.
  • Before rm -rf, require a nonempty absolute expected path and reject /, ., the current directory, and paths outside the test fixture directory.
  • Quote all path variables and $0 uses.
  • Document that generated keys are disposable test credentials and enforce restrictive permissions.
  • Consider replacing deletion with creation of a fresh mktemp -d fixture for tests.

Acceptance criteria

  • Invoking the script from repository root, TSA/, or another directory uses the same safe fixture location.
  • --force cannot delete any path outside that location.
  • Generated private keys are mode 0600 and remain ignored/untracked.
  • ShellCheck passes and tests exercise path names containing spaces.

Reviewed against 948b7a9 on master (Go 1.26.2).

## Problem `TSA/tsca` performs destructive and secret-generating operations relative to the caller's current working directory: ```sh --force|-f) rm -rf ./ca;; ... install -d ./ca openssl ... -out ca/key.pem ... ``` Running `TSA/tsca` from the repository root already creates a separate root-level `ca/`; running it from another directory can overwrite or delete an unrelated `./ca`. `--force` is especially dangerous because the target is not anchored or sanity-checked. The OpenSSL configuration is resolved relative to the script, but key/certificate/serial paths from `openssl.cnf` still depend on the working directory. Checklist analogue: #12 (project/path organization; avoid implicit working-directory state). ## Proposed fix - Resolve `script_dir` with a robust absolute path and place all test CA state under a single documented directory such as `$script_dir/ca`. - Pass absolute paths or `cd -- "$script_dir"` after validating it. - Before `rm -rf`, require a nonempty absolute expected path and reject `/`, `.`, the current directory, and paths outside the test fixture directory. - Quote all path variables and `$0` uses. - Document that generated keys are disposable test credentials and enforce restrictive permissions. - Consider replacing deletion with creation of a fresh `mktemp -d` fixture for tests. ## Acceptance criteria - Invoking the script from repository root, `TSA/`, or another directory uses the same safe fixture location. - `--force` cannot delete any path outside that location. - Generated private keys are mode 0600 and remain ignored/untracked. - ShellCheck passes and tests exercise path names containing spaces. Reviewed against `948b7a9` on `master` (Go 1.26.2).
heiko commented 2026-07-22 11:18:48 +02:00
Author
Owner
Copy link

CA state is anchored to the script directory (safe --force, 0600 keys, path-with-spaces safe), with functional isolation tests.

Implementation: a6ca68d — anchor generated CA state to script directory
Tests: 2e4584b — functionally verify script-anchoring and --force safety
Merged to master in 8616f1c.

(Closed manually: these commits predate the (closes #N) subject convention.)

CA state is anchored to the script directory (safe `--force`, 0600 keys, path-with-spaces safe), with functional isolation tests. Implementation: [`a6ca68d`](https://forgejo.schlittermann.de/heiko/mail-seal/commit/a6ca68d) — anchor generated CA state to script directory Tests: [`2e4584b`](https://forgejo.schlittermann.de/heiko/mail-seal/commit/2e4584b) — functionally verify script-anchoring and --force safety Merged to master in [`8616f1c`](https://forgejo.schlittermann.de/heiko/mail-seal/commit/8616f1c). _(Closed manually: these commits predate the (closes #N) subject convention.)_
heiko closed this issue 2026-07-22 11:18:48 +02:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
nagonag/update-master
svg
dev
No results found.
Labels
Clear labels   
nagonag
Automated dependency scan finding

  
nagonag/ignore
Ignore this nagonag finding

No labels
nagonag
nagonag/ignore
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
heiko/mailseal#5
No description provided.