In TestHybridPool attempt to prime to the windows root pool before
the real test actually happens. This is a bit of a band-aid, with
a better long term solution discussed in #52108.

Updates #51599

Change-Id: I406add8d9cd9e3fae37bfc20b97f5479c10a52c2
Reviewed-on: https://go-review.googlesource.com/c/go/+/405914
Reviewed-by: Bryan Mills <bcmills@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Run-TryBot: Roland Shoemaker <roland@golang.org>

Rather than using the external network and real-world chains for testing
the integrations with platform verifiers, use a synthetic test root.

This changes adds a constrained root and key pair to the tree, and adds
a test suite that verifies certificates issued from that root. These
tests are only executed if the root is detected in the trust store. For
reference, the script used to generate the root and key is attached to
the bottom of this commit message.

This change leaves the existing windows/darwin TestPlatformVerifier
tests in place, since the trybots do not currently have the test root in
place, and as such cannot run the suite. Once the builder images have
the root integrated, we can remove the old flaky tests, and the trybots
will begin running the new suite automatically.

Updates #52108

-- gen.go --
package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/pem"
	"flag"
	"log"
	"math/big"
	"net"
	"os"
	"time"
)

func writePEM(pemType string, der []byte, path string) error {
	enc := pem.EncodeToMemory(&pem.Block{
		Type:  pemType,
		Bytes: der,
	})
	return os.WriteFile(path, enc, 0666)
}

func main() {
	certPath := flag.String("cert-path", "platform_root_cert.pem", "Path to write certificate PEM")
	keyPath := flag.String("key-path", "platform_root_key.pem", "Path to write key PEM")
	flag.Parse()

	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		log.Fatalf("ecdsa.GenerateKey failed: %s", err)
	}

	now := time.Now()
	tmpl := &x509.Certificate{
		SerialNumber: big.NewInt(9009),
		Subject: pkix.Name{
			CommonName: "Go platform verifier testing root",
		},
		NotBefore:                   now.Add(-time.Hour),
		NotAfter:                    now.Add(time.Hour * 24 * 365 * 5),
		IsCA:                        true,
		BasicConstraintsValid:       true,
		PermittedDNSDomainsCritical: true,
		// PermittedDNSDomains restricts the names in certificates issued from this root to *.testing.golang.invalid.
		// The .invalid TLD is, per RFC 2606, reserved for testing, and as such anything issued for this certificate
		// should never be valid in the real world.
		PermittedDNSDomains: []string{"testing.golang.invalid"},
		// ExcludedIPRanges prevents any certificate issued from this root that contains an IP address in both the full
		// IPv4 and IPv6 ranges from being considered valid.
		ExcludedIPRanges: []*net.IPNet{{IP: make([]byte, 4), Mask: make([]byte, 4)}, {IP: make([]byte, 16), Mask: make([]byte, 16)}},
		KeyUsage:         x509.KeyUsageCertSign,
		ExtKeyUsage:      []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
	}

	certDER, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, key.Public(), key)
	if err != nil {
		log.Fatalf("x509.CreateCertificate failed: %s", err)
	}

	keyDER, err := x509.MarshalECPrivateKey(key)
	if err != nil {
		log.Fatalf("x509.MarshalECPrivateKey failed: %s", err)
	}

	if err := writePEM("CERTIFICATE", certDER, *certPath); err != nil {
		log.Fatalf("failed to write certificate PEM: %s", err)
	}
	if err := writePEM("EC PRIVATE KEY", keyDER, *keyPath); err != nil {
		log.Fatalf("failed to write key PEM: %s", err)
	}
}

Change-Id: If7c4a9f18466662a60fea5443e603232a9260026
Reviewed-on: https://go-review.googlesource.com/c/go/+/488855
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Auto-Submit: Roland Shoemaker <roland@golang.org>
Reviewed-by: Bryan Mills <bcmills@google.com>
Run-TryBot: Roland Shoemaker <roland@golang.org>
TryBot-Result: Gopher Robot <gobot@golang.org>

Rename the old TestPlatformVerifier to TestPlatformVerifierLegacy, and
add TODO about removing it once the synthetic root is widely deployed on
builders.

Updates #52108

Change-Id: I6cdba268e4738804c7f76ea18c354470b3e0318c
Reviewed-on: https://go-review.googlesource.com/c/go/+/505755
Run-TryBot: Roland Shoemaker <roland@golang.org>
Auto-Submit: Roland Shoemaker <roland@golang.org>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Bryan Mills <bcmills@google.com>

This change updates the image used by the host-windows-amd64-2016
variants. The startup.ps1 was updated with the changes introduced
in CL 503836.

Updates golang/go#52108

Change-Id: I96d5b09309bb33b8c0181e189e6c0c36cad333ce
Reviewed-on: https://go-review.googlesource.com/c/build/+/506895
Run-TryBot: Carlos Amedee <carlos@golang.org>
Reviewed-by: Heschi Kreinick <heschi@google.com>
Auto-Submit: Carlos Amedee <carlos@golang.org>
TryBot-Result: Gopher Robot <gobot@golang.org>

Adds notes to env/darwin/setup-notes.md on how to install the
crypto/x509 testing root, and adds a stanza to env/windows/startup.ps1
to do the same thing.

This change assumes that the platform root has been added to the
go-builder-data GCS bucket.

Updates golang/go#52108

Change-Id: Ieb4d6461c4ee96ddc6c00c18213e5447ba9ab273
Reviewed-on: https://go-review.googlesource.com/c/build/+/503836
TryBot-Bypass: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Heschi Kreinick <heschi@google.com>

Rename the old TestPlatformVerifier to TestPlatformVerifierLegacy, and
add TODO about removing it once the synthetic root is widely deployed on
builders.

Updates golang#52108

Change-Id: I6cdba268e4738804c7f76ea18c354470b3e0318c
Reviewed-on: https://go-review.googlesource.com/c/go/+/505755
Run-TryBot: Roland Shoemaker <roland@golang.org>
Auto-Submit: Roland Shoemaker <roland@golang.org>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Bryan Mills <bcmills@google.com>

They are no longer necessary, woohoo!

Updates #52108
Fixes #56791

Change-Id: I11a4c17162da4295309f74f2f8362bab0f506f78
Reviewed-on: https://go-review.googlesource.com/c/go/+/548976
Run-TryBot: Roland Shoemaker <roland@golang.org>
Reviewed-by: Bryan Mills <bcmills@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Auto-Submit: Roland Shoemaker <roland@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>