From 895665dd3196c2c50c9a52d8f8eb8137347a5fae Mon Sep 17 00:00:00 2001 From: Umberto Baldi <34278123+umbynos@users.noreply.github.com> Date: Tue, 26 Apr 2022 17:05:58 +0200 Subject: [PATCH 1/5] Delete GeoTrustGlobalCA_Root.cer This Cert has been removed from the NINA firmware long time ago https://github.com/arduino/nina-fw/commit/53580a082b01b3ead90b6dee736829f54dbd4ddc#diff-88545c89de17b94ff13f555cea95c4971daff07b1e887f1acb0811e7a674347cL545-L572. Furthermore, is about to expire. --- certs/GeoTrustGlobalCA_Root.cer | Bin 856 -> 0 bytes 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 certs/GeoTrustGlobalCA_Root.cer diff --git a/certs/GeoTrustGlobalCA_Root.cer b/certs/GeoTrustGlobalCA_Root.cer deleted file mode 100644 index 4ae42e81b7ab27da185c149c5cfa42e0c7d8ef11..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 856 zcmXqLVh%BAVzODl%*4pV#LQ$8X28qFsnzDu_MMlJk(HIfz{!x?fRl|ml!Z;0DKywn z%s>Rh;S%O`Pt6Z0DlINi@XSlrGn6)v1c@^X3&F+RbMliCa}=B%4dldm4U7y-jSLM; z41gd?oYx4MOBFks7?qHn&dAEZ+{DPwV9>ZE`H0 z6mGAWcxBJR8$Lf)IB#Qq>8r@j(Qzw6Kh08eFKb2jT#Fa1+q3ElmpnU?ux!Koh9{jG z{PR?=y>0%ycG<+^Gfp~5n2O9@JHu^~p8u(j?al|qriSYVyzkU)s0v^E>0NyGC5GOe zB0oe#O>Z7>TU=dqV&eXjq1tCJOt+h(mU8C)xn{}2Q-05`T&-Ryc{cRki8q(xEP|iL z`1k1k3s5%ullJU%-x5nnhV4_CEGKgF{j<=!D9bwQo3C9yKfCOD9l8Dl%SXS=f`u)w z#HnfDwp}5z*XXqbvqlh0;nUT|wht|KvzxUf&8d7PX7DBcfcA^R>?c2&m>C%u7Y7>z z8t?-nN>-SW@jnZz0W**?kOc|wv52vV9H^R+(cAfZHERlwVC|~f)E%eJ_!-E9q?K7D z48$6+D?m*#z+h)&Fnz3<^;ADLq)#(o%KVv9B2W4&w34PQQcs_E;k;Cw`^$rymYl!q zD8=eG+xwkYerV8Um4)V9uT#pj^mIP|wJx2o|5xFS$AFMY+fH zHOmzG^_HFFIkah}E5q?~f`Lj(50<{#ChEbN@+!{1 Date: Wed, 27 Apr 2022 16:53:39 +0200 Subject: [PATCH 2/5] remove old certs not present anymore in the nina-fw --- certs/AddTrustExternalCA_Root.cer | Bin 1514 -> 0 bytes .../GeoTrustPrimaryCertificationAuthority-G3.cer | Bin 1026 -> 0 bytes certs/GoDaddyRootCertificateAuthority-G2.cer | Bin 969 -> 0 bytes 3 files changed, 0 insertions(+), 0 deletions(-) delete mode 100644 certs/AddTrustExternalCA_Root.cer delete mode 100644 certs/GeoTrustPrimaryCertificationAuthority-G3.cer delete mode 100644 certs/GoDaddyRootCertificateAuthority-G2.cer diff --git a/certs/AddTrustExternalCA_Root.cer b/certs/AddTrustExternalCA_Root.cer deleted file mode 100644 index f61f3d57be3edc252b546a8931937369224f38ae..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1514 zcmXqLVtr=N#C&c6GZP~dlYk(@(f#TX2WMvf$#`2d_s?|$UN%mxHjlRNyo`)ItPBQ? z9fsTnoNUaYENsF|p}~g227(|ChcK64YPo_}YEf}&rJ;y{5J-?+m>VLX;G9`fX((qP z0}|yD77fWrRR|4s4GIYg4GvN8OD!qSFUmI5GtdFaGYhMN<%&v+OB8~F9Tl8Yi%K%n zGLsWaGV}8k97{_w@{54x8OVwA8k!iG8<-e?L6kVJ5r}JSWNd0_Y8hqVi|SGV13rlL z?7_i4ddc~@FlTZLbC;Kw>lGL0fJMa&L?F)Kg{o6<2~%)(G-zT}LJkZ@RtDxKMt%mM zI2ThBBO}8B6?f6(&4IU8PBhqa==yHIoK^aFrhjE*I#)X-o=bO^$~o0!qm1a?J=RNt z4hY5BuL@%APV`K=Kfj(aUnP=b$QN$^ zi6=eI(b6YNQZ)3<%|k4rF>6y3*LY1z-E6gZZK{E&`9>Di#8>r-Zx2;3m-^H?KYm6< z+t#(mo;Y;~R0!Gluuqy{u_)bfakpUE#5S%!1s5NlvnJYxQLD7Q&WAKS zyfOR0+)taB(@q=6f)wzvh_Q&c&HDQ%Fs>#fIOx&L$D57bPnN0=1ILvtKO^IR78YQ_ zYy&4KSz!>L!+;G)F)=bgj8J6(MHq)R8zU<#J2NAk#blrevO$4G%0R+^hm8xUfQ7MX zr2!+O0S6mfdLs`b6Qe;WNQpd)pMj5o*8-0PZf!0ZB_#z``ufR5IeI0a6sTKJlwX#a zl3D~x8~X5s2~3wL$r7F_^?*7J8XI8FU}R(|F(@){f$D-N9B_7BgE;3MK`_%A!9fO+vRl%RZZi{ZdFNmyGVz4;4rR- z)zr4&s=pO?w}owfU{%Ty&NEfu?3eX+M}+L&U%Shoa=80l`n_jiKa8~}J>t#ExpCk1 z@U@>p_xP4S*E^ke;_>lgcel7-yyB{%#YG;De@65C6}ciPmKI=_2u@+w>eGH0AzMK AHvj+t diff --git a/certs/GeoTrustPrimaryCertificationAuthority-G3.cer b/certs/GeoTrustPrimaryCertificationAuthority-G3.cer deleted file mode 100644 index 94c5cdad7ad74cc4da60ef1f5edb594610b883e2..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1026 zcmXqLV*Y2)#PnBg36XaY+%f#^IJm#=l;lZtq!s#p^Cx$E%b+!x>90 zCdkb=ua~U-!EKMrrp|>2GkP6iGJ{J^9kE6m9FpM}+c z8AuuMfdu$L0xZB3%w`}9;`6bHv4|Y0Jk__*k6BjcPWElX=qYyg2KBngp$tsUz))sn z&^;=AKCGd-s$%c_bviSjzrS^VN*rhA^5=OOJ$sAxxv%7#F0{kzW6EXA`>G~a4xaUE z{J_t0L}jzdv}4Ow8QjlEEWZA;ueI|%U))p;FD>%wADMaQ>iG9Ibg*vyzw+v~V+ zio`+Hm_Hx>H8Zu>@baG5ES``<8yv| Nj$hFv^jcC-7XYbpb2$J2 diff --git a/certs/GoDaddyRootCertificateAuthority-G2.cer b/certs/GoDaddyRootCertificateAuthority-G2.cer deleted file mode 100644 index 3cdad66612f4e8cc4818c314745d0fd7e5429ef7..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 969 zcmXqLVm@ln#I$w+GZP~d6C;BGFB_*;n@8JsUPeZ4RtAH{WoRXN6YA9tO0TSdA7Ie>dNlZzp)Jx9K z)lu-wOV%?qG|&ghF$-(B=PQ6E6@v2fOB9?_i%K%nGLsWaQWYFaOEU6{GD|8IbQRo< z4CKUl4J?7s&;Sgg#CeU)4ULR}$kfu*GHQ^xvWZa%Irtb^8JL?G`56qF7`d357#SJ% z7bbCh{1s{PUHYWN;_nTf5igaRg_j*waAve_`S`5WbH4hkZ!OY(3%1-Ym~q^QaU-i8 zyWhJnzx?$h4V0d*mJG{&)WH7dvsh_^WnlHwpQhVN{8sih2|w9pzmmE6*P?x0qFMF# zxDRiW6k$E}>hKDdDb{W^M!cUH(v(j0X6Bmp2uf_fyh$cui^VUdo^zM)y0PEmvU?p{ zbE4+=2JPS_laew6Raq0ITpD|HRyt2pzQ4w*aTcHEQJIx5W97EZn`gjfdG2FJ!*B1{ zGe&P(lblsen8MTpk~+x)X@f+aLO(Id&r>-Or*e2W@MOoJGS!b&*_or%!wcCtl11pbr&l1 z`KPvT`Mzwjc#DP8E!OHEOr<;iF5P&2-M8!agii+x)OERCoc?RO zp0?oX2^-WKe!iF=_0oL)>L>SeHn)n;wY{n0UpdkAT0G0^hUV3?m~^)ae7P~m>;X85swAuG-$dtLsriJBjr{lsYTTZD}?Q6 ueeG2a{zo$Z>cn@fiTid%Y?Cu5kMFnT*;{6|q@Jqkc=X6+U(EMcGG75Um}y7= From 847e0076d9f4da006508dbd997b1e3b5355e189b Mon Sep 17 00:00:00 2001 From: Umberto Baldi Date: Wed, 27 Apr 2022 16:54:26 +0200 Subject: [PATCH 3/5] remove certs already bundled in the nina-fw --- certs/BaltimoreCyberTrust_Root.cer | Bin 891 -> 0 bytes certs/Digicert_Root.cer | Bin 969 -> 0 bytes ...ss3PublicPrimaryCertificationAuthority-G5.cer | Bin 1239 -> 0 bytes 3 files changed, 0 insertions(+), 0 deletions(-) delete mode 100644 certs/BaltimoreCyberTrust_Root.cer delete mode 100644 certs/Digicert_Root.cer delete mode 100644 certs/VeriSignClass3PublicPrimaryCertificationAuthority-G5.cer diff --git a/certs/BaltimoreCyberTrust_Root.cer b/certs/BaltimoreCyberTrust_Root.cer deleted file mode 100644 index da96dbb2c93d063581e5a96ebb4e258c37923087..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 891 zcmXqLVlFpmVv1kD%*4pV#KOeDu+xB-jZ>@5qwPB{BO@y-gF%!bw*e;`b0`a&Fq5aN zp^$+9h{Gk!>6DmLl9`)dlxiq!AP5rU7UpuUOiC>ZDJm^4F;p^800}Y+OTrZ@Afy$7 z^7Bg!!|F<^IChw;MQFb8lbttNLc@n^wolb5B&#(PO+Vy_3-8?#l#`0j4ZA-VJ!F6KYLwB<*Txh2chm4;Ok`xj_^5t{jZv1`*~o4BuY=WRVPuSW00l6ig{BHp=w z3v#oilJ}-Oliz;s!>9RryQQ~(3g{@Fbm-AzvEErmOso4O?!FWdd{<|>dct};gDF)P zjBS^v@_+r)H!tbDyNeEE>~7huMwi?#S?FE(*LcS$OK$5so2!4GH_A#LR&jcjY`GEu Dq-#{f diff --git a/certs/Digicert_Root.cer b/certs/Digicert_Root.cer deleted file mode 100644 index dae0196507d9166bbf9de6ed93ed5bd91d2a6f7c..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 969 zcmXqLVm@ln#I$w+GZP~dlK|727_}^JhuQtym7mtRsg@h?vTHrk&& ztLnL}Q0ws3DJJQQxMViOXD)Ntcx3yg{tGjftaOaDx_oEKHJjTd7E8R&_^LL2_gWe( zWby8^XKvxdy5w!Em&G4m((=PUDRAG9qi=3oOnS`rlw%^#5e>)C->0KGMe7P*nC|y2 z;KS3U1MC5c*hY*|CU8utq&? zd&l;QPp7z6SghtsIkZ15c52JPg{pGxu~Grt3PNWbcjs{jTI}#X&BV;ez_>WsAklyi z7{#*ujEw(TSb)i@&43@o7Y6ZJ4VZzHfh)yU1V#fRgNzj0^gGw*%(v-CW8(-{yshZ|Lo0pNehH&82Z8W| zU7xFN3a0j%{+jp4b?dyFK8D^qCcbdi>Dyd!?)Ky0%ED_;6{j%X3T>aIlJc!9?aaM7 z=4V%!Y|Nakd}3aOl6Haf<4||QM9KFNM_cv%48AQe6jMI&{86fy@#+0i(hF>VoQmr< z>`vh5)a7A|3EF<-C)bRNqVe;E_SKjrTkLgNQvXCvo9oE*Ox~A0j}8cg?>JE=G%@s( zN9K(^T1?UWE>{!`Z-3cUpcXqJVcs5ZaZdd$r{$b8PO_^XycF~OmEz6}p*c2l_Rss% i5HmaZ>>Kx0s_N+r%s(?U)rMSO`QxRY@Z$0p@?HQubYDLJ diff --git a/certs/VeriSignClass3PublicPrimaryCertificationAuthority-G5.cer b/certs/VeriSignClass3PublicPrimaryCertificationAuthority-G5.cer deleted file mode 100644 index 9818d19d00739f1370bbde9759f98e7294c6e503..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1239 zcmXqLV!3S4#Jqa}GZP~dlYqpni}TcKU+nf$j5vEH+uF;3myJ`a&7D}zDf zDMM}pPB!LH7B*p~&|pJx15pr%OPDV#wJ0+ZAHEh*10$~Lqzuz)Bq)JWD;FfuSOQ-G<27@?r6;Fe#ckXTxhkzbTqm71bZTAZqo zpO;f<=xX2$(#tGt1Jk15oRe5wtYEAVP@0sJnXC{{l$o1YRH@*cT2zvmmYJMbl9`{U z;0Q6Rq!MVhyQzVkIIn@3p`n3=0T@Jy^BS8Om>ZfI8Jk*~T1E{o&o(hCAx9=7D+6;A zBR_*d6C)Q>6C)$TdKC^1%_`G*2|TNwdt3Y6so7)WDzjVr!9Pu=pWz&fQ(8sUzkXbM z!mu+|>4ny+Wlo#>f9wq1zHz(v=70Tl?BQ?TJKs)A5=}gxz`Nwey&n$_Cvn(@2*36` z6&cd1_EfuHdj9LL3nv~j_PpVooE7AKssBYmpzp=b%-!|V7D!E-9>m7D^+J4dU zg&V#sQvI}EW>UJu(=Ti+?OuN3=ynE37+PwSCm+Najefwa${%+|+ zV@X*Vhtnl0l8TdWiu_xn6?DA+DvRfn-emUZfO>87Laa8?dvn zYV$EONwJ9ZKfNr~wx+i)`|$aOtScT8I@OYT2C8Dp86_nJR{Hum`RVz3WxzaC49r7% z$@#hZWyN4IkV&AdB+JJl#v)RGId%D=yKi=XFyQ>`Z2606y|JM&aE$6CEUW{y6yd{%yxq52h)cJewkF(RgyoyG1RU z+`{>Nw|VZWGTmO%E$MQ}v5Ga*E5bkFR9#aRH`6Lram%f@>z}uzYEA9h+jcLmQLI^4 z;LN?hE1I-&HRO4@k34-Yr6&3Ci(tOM)~SD+*A#(ax4;xJwkvQ5H1Bj%HnSF1%xbNs~@I-k}E KUR&`tIST-5H^c1! From a9d1ebc830fd7b3877206c185e00bd622ad3717c Mon Sep 17 00:00:00 2001 From: umbynos Date: Thu, 28 Apr 2022 13:13:01 +0200 Subject: [PATCH 4/5] update documentation --- docs/usage.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs/usage.md b/docs/usage.md index 2da6cb42..26d8f98d 100644 --- a/docs/usage.md +++ b/docs/usage.md @@ -83,6 +83,9 @@ previous certificates are going to be erased. To overcome this it's required to ./arduino-fwuploader certificates flash --url arduino.cc:443,google.com:443 --file ~/Downloads/my_self_signed_.der -b arduino:mbed_nano:nanorp2040connect -a /dev/ttyACM0 ``` +You can find the certificates that are preflashed on the NINA module +[here](https://github.com/arduino/nina-fw/blob/master/data/roots.pem). + ### Command line options The full list of command line options can be obtained with the `-h` option: `./arduino-fwuploader -h` From e629475cff304868d2b149d4c3266d6f0e67dac5 Mon Sep 17 00:00:00 2001 From: umbynos Date: Thu, 28 Apr 2022 13:37:28 +0200 Subject: [PATCH 5/5] remove workflow that checks for the certificates expire date: there are no more certs in this repo --- .github/workflows/check-certificates.yml | 105 ----------------------- 1 file changed, 105 deletions(-) delete mode 100644 .github/workflows/check-certificates.yml diff --git a/.github/workflows/check-certificates.yml b/.github/workflows/check-certificates.yml deleted file mode 100644 index fdb6d2c9..00000000 --- a/.github/workflows/check-certificates.yml +++ /dev/null @@ -1,105 +0,0 @@ -# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-certificates.md -name: Check Signing Certificates - -# See: https://docs.github.com/en/actions/reference/events-that-trigger-workflows -on: - push: - paths: - - ".github/workflows/check-certificates.ya?ml" - - "certs/**" - pull_request: - paths: - - ".github/workflows/check-certificates.ya?ml" - - "certs/**" - schedule: - # Run every 10 hours. - - cron: "0 */10 * * *" - workflow_dispatch: - repository_dispatch: - -env: - # Begin notifications when there are less than this many days remaining before expiration. - EXPIRATION_WARNING_PERIOD: 30 - -jobs: - get-certificates-list: - runs-on: ubuntu-latest - outputs: - certificates: ${{ steps.get-files.outputs.certificates }} - - steps: - - name: Checkout repository - uses: actions/checkout@v2 - - - name: Set certificates path environment variable - run: | - # See: https://docs.github.com/en/actions/reference/workflow-commands-for-github-actions#setting-an-environment-variable - echo "FILES=\"$(ls ${{ github.workspace }}/certs/* | xargs | sed 's/ /","/g')\"" >> $GITHUB_ENV - - - name: Get files list - id: get-files - run: | - JSON=$(echo '[${{ join(env.FILES) }}]' | jq -c '{"cert_file": .}') - echo "::set-output name=certificates::$JSON" - - check-certificates: - name: ${{ matrix.cert_file }} - needs: get-certificates-list - runs-on: ubuntu-latest - strategy: - fail-fast: false - matrix: ${{fromJSON(needs.get-certificates-list.outputs.certificates)}} - - steps: - - name: Checkout repository - uses: actions/checkout@v2 - - - name: Get days remaining before certificate expiration date - id: get-days-before-expiration - run: | - EXPIRATION_DATE="$( - ( - openssl x509 \ - -inform der \ - -in ${{ matrix.cert_file }} \ - -enddate -noout - ) | ( - grep \ - --max-count=1 \ - --only-matching \ - --perl-regexp \ - 'notAfter=(\K.*)' - ) - )" - - DAYS_BEFORE_EXPIRATION="$((($(date --utc --date="$EXPIRATION_DATE" +%s) - $(date --utc +%s)) / 60 / 60 / 24))" - - # Display the expiration information in the log. - echo "Certificate expiration date: $EXPIRATION_DATE" - echo "Days remaining before expiration: $DAYS_BEFORE_EXPIRATION" - - echo "::set-output name=days::$DAYS_BEFORE_EXPIRATION" - - - name: Check if expiration notification period has been reached - id: check-expiration - run: | - DAYS=${{ steps.get-days-before-expiration.outputs.days }} - if [[ $DAYS -lt ${{ env.EXPIRATION_WARNING_PERIOD }} ]]; then - echo "::error::${{ matrix.cert_file }} will expire in $DAYS days!!!" - exit 1 - fi - - - name: Slack notification of pending certificate expiration - # Only run when the workflow will have access to the certificate secrets. - if: > - failure() && - github.event_name == 'schedule' - env: - SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }} - SLACK_MESSAGE: | - :warning::warning::warning::warning: - WARNING: ${{ github.repository }} ${{ matrix.cert_file }} will expire in ${{ steps.get-days-before-expiration.outputs.days }} days!!! - :warning::warning::warning::warning: - SLACK_COLOR: danger - MSG_MINIMAL: true - uses: rtCamp/action-slack-notify@v2