mirror of
https://github.com/pgsty/minio.git
synced 2026-09-16 15:34:06 +03:00
Feng Ruohang
48e1846525
Remove the eight explicit curve overrides so Go 1.27 honors tlsmlkem=0 across Server listeners, node links and outbound transports. Remove the unused shared curve option and add wire-level regression coverage. Document CA trust and TLS upgrade behavior, retain the investigation artifacts, and exclude their synthetic routes from the rebrand guard. The product compatibility baseline remains unchanged. Validation: focused race tests, HTTP tests, lint, compatibility guard positive/negative controls, and a fresh Linux build with three isolated OIDC integration scenarios all pass. Adversarial review: Claude Code Fable 5.1, max effort. Final verdict: APPROVE FOR COMMIT. Signed-off-by: Feng Ruohang <rh@vonng.com>
42 lines
912 B
Go
42 lines
912 B
Go
//go:build ignore
|
|
|
|
// Run only with the public, synthetic CA made by fixture.go.
|
|
package main
|
|
|
|
import (
|
|
"crypto/x509"
|
|
"encoding/json"
|
|
"encoding/pem"
|
|
"os"
|
|
"runtime"
|
|
|
|
"github.com/pgsty/silo-pkg/v3/certs"
|
|
)
|
|
|
|
func main() {
|
|
if len(os.Args) != 3 {
|
|
panic("usage: cert-roots synthetic-ca.pem explicit-ca-path-or-empty")
|
|
}
|
|
data, err := os.ReadFile(os.Args[1])
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
block, _ := pem.Decode(data)
|
|
if block == nil || block.Type != "CERTIFICATE" {
|
|
panic("expected public certificate")
|
|
}
|
|
certificate, err := x509.ParseCertificate(block.Bytes)
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
roots, err := certs.GetRootCAs(os.Args[2])
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
_, err = certificate.Verify(x509.VerifyOptions{Roots: roots})
|
|
_ = json.NewEncoder(os.Stdout).Encode(map[string]any{
|
|
"go": runtime.Version(), "os": runtime.GOOS,
|
|
"explicit_ca": os.Args[2] != "", "trusted": err == nil,
|
|
})
|
|
}
|