Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

crypto/x509: Apple edited HT204132, breaking iOS CA roots updater #22181

Closed
acohn opened this issue Oct 8, 2017 · 2 comments
Closed

crypto/x509: Apple edited HT204132, breaking iOS CA roots updater #22181

acohn opened this issue Oct 8, 2017 · 2 comments
Labels
FrozenDueToAge NeedsFix The path to resolution is known, but the work has not been done. OS-Darwin
Milestone

Comments

@acohn
Copy link

acohn commented Oct 8, 2017

What version of Go are you using (go version)?

go version go1.9 darwin/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

darwin/amd64, macOS 10.12.6
uname -a: Darwin tungsten.local 16.7.0 Darwin Kernel Version 16.7.0: Thu Jun 15 17:36:27 PDT 2017; root:xnu-3789.70.16~2/RELEASE_X86_64 x86_64

What did you do?

cd $(go env GOROOT)/src/crypto/x509 && go generate 

Can't be replicated except on macOS, so no play.golang.org link :(

What did you expect to see?

The $GOROOT/src/crypto/x509/root_darwin_armx.go file should be updated to match the iOS 11 root store.

What did you see instead?

It panics with this error:

panic: runtime error: slice bounds out of range

goroutine 1 [running]:
main.fetchCertIDs(0x0, 0x0, 0x0, 0x0, 0x0)
	[elided]/go/src/crypto/x509/root_darwin_arm_gen.go:147 +0x89c
main.selectCerts(0x1156f6b, 0xc420066060, 0x1409f80, 0xc420046af0, 0x12c992f)
	[elided]/go/src/crypto/x509/root_darwin_arm_gen.go:69 +0x37
main.main()
	[elided]/go/src/crypto/x509/root_darwin_arm_gen.go:37 +0x52
exit status 2
root_darwin.go:5: running "go": exit status 1

Looks like Apple changed the format of the support article that root_darwin_arm_gen.go pulls iOS's root certificate list from. The list of CAs is now on a separate page.

@odeke-em odeke-em changed the title Apple edited HT204132, breaking iOS CA roots updater crypto/x509: Apple edited HT204132, breaking iOS CA roots updater Oct 9, 2017
@odeke-em
Copy link
Member

odeke-em commented Oct 9, 2017

Thank you for the report @acohn, I can reproduce and in deed, now the page contains a listing to different lists by iOS version
screen shot 2017-10-08 at 7 15 00 pm

screen shot 2017-10-08 at 7 15 12 pm

/cc @agl @rsc @ianlancetaylor

@odeke-em odeke-em added this to the Go1.10 milestone Oct 9, 2017
@ianlancetaylor ianlancetaylor added NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. OS-Darwin labels Oct 9, 2017
@titanous titanous added NeedsFix The path to resolution is known, but the work has not been done. and removed NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. labels Nov 7, 2017
@gopherbot
Copy link

Change https://golang.org/cl/77252 mentions this issue: crypto/x509: update iOS root certs.

@golang golang locked and limited conversation to collaborators Jan 6, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
FrozenDueToAge NeedsFix The path to resolution is known, but the work has not been done. OS-Darwin
Projects
None yet
Development

No branches or pull requests

5 participants