cloudflare / cloudflare/cfssl

Different certinfo output for versions from `brew` and released binary

Open
#1,307 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
9.5k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

**Problem:**
- Two different output for `certinfo` using `cfssl` installed from `brew` and downloaded from Release page on GitHub.
- `Public.Curve.Name` part of the output is empty in case `cfssl` is installed using `brew`.

**Tested environment:**
- M1 Pro Macbook,
- OS version - Ventura 13.3.1 (a)

**Examples of results:**

Result for the version installed via brew

```bash
>>> cfssl certinfo -csr some.csr.pem
{
"Raw": ,
"RawTBSCertificateRequest": ,
"RawSubjectPublicKeyInfo": ,
"RawSubject": ,
"Version": 0,
"Signature": ,
"SignatureAlgorithm": 10,
"PublicKeyAlgorithm": 3,
"PublicKey": {
"Curve": {},
"X":,
"Y":
},
"Subject": {
"Country": null,
"Organization": null,
"OrganizationalUnit": null,
"Locality": null,
"Province": null,
"StreetAddress": null,
"PostalCode": null,
"SerialNumber": "",
"CommonName": ,
"Names": [
{
"Type": [
2,
5,
4,
3
],
"Value":
}
],
"ExtraNames": null
},
"Attributes": null,
"Extensions": null,
"ExtraExtensions": null,
"DNSNames": null,
"EmailAddresses": null,
"IPAddresses": null,
"URIs": null
}

>>> cfssl version
Version: 1.6.4
Runtime: go1.20.3

>>> brew --version
Homebrew 4.0.21
Homebrew/homebrew-core (git revision 9d0b7361d; last commit 2023-06-06)

```

Result for the version downloaded via curl from release page for darwin arm 64, version 1.6.4

```bash
>>> ./cfssl_1.6.4_darwin_arm64 certinfo -csr some.csr.pem
{
"Raw": ,
"RawTBSCertificateRequest": ,
"RawSubjectPublicKeyInfo": ,
"RawSubject": ,
"Version": 0,
"Signature": ,
"SignatureAlgorithm": 10,
"PublicKeyAlgorithm": 3,
"PublicKey": {
"Curve": {
"P": ,
"N": ,
"B": ,
"Gx": ,
"Gy": ,
"BitSize": 256,
"Name": "P-256"
},
"X": ,
"Y":
},
"Subject": {
"Country": null,
"Organization": null,
"OrganizationalUnit": null,
"Locality": null,
"Province": null,
"StreetAddress": null,
"PostalCode": null,
"SerialNumber": "",
"CommonName": ,
"Names": [
{
"Type": [
2,
5,
4,
3
],
"Value":
}
],
"ExtraNames": null
},
"Attributes": null,
"Extensions": null,
"ExtraExtensions": null,
"DNSNames": null,
"EmailAddresses": null,
"IPAddresses": null,
"URIs": null
}
>>> ./cfssl_1.6.4_darwin_arm64 version
Version: 1.6.4
Runtime: go1.18

```

I can see that Runtime version is different, but not sure if it matters in this situation.
Also I tried to find a template for issue that is mentioned in [contributing guidelines](https://github.com/cloudflare/.github/blob/26b37ca2ba7ab3d91050ead9f2c0e30674d3b91e/CONTRIBUTING.md), but couldn't find it. So my apologies in advance.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing `cfssl certinfo -csr some.csr.pem` with the Homebrew and release 1.6.4 binaries on the reported macOS environment, then compare their Go runtimes and certificate parsing behavior. Trace the `certinfo` output path to determine why the Homebrew result has an empty `PublicKey.Curve.Name`; done means the outputs consistently report the curve information.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cryptography, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.