Update python scripts to python3 & add option to cert merging tool

Added option allows for removal of expired certificates in one pass.

Change-Id: Ia9dcb895dee2c15a8018aafebb9cfa91bba19c97

diff --git a/scripts/merge-certs-info.py b/scripts/merge-certs-info.py
index 80d7f942cbb9a21bc643106068b004066d5c00fd..e7ab2b8f8108e13edebf945f59031ffe05af98ac 100755 (executable)
--- a/scripts/merge-certs-info.py
+++ b/scripts/merge-certs-info.py
@@ -1,6 +1,6 @@
 ####################################################
 #
-# Copyright (c) 2018 Samsung Electronics Co., Ltd All Rights Reserved
+# Copyright (c) 2018 - 2023 Samsung Electronics Co., Ltd All Rights Reserved
 #
 #    Licensed under the Apache License, Version 2.0 (the "License");
 #    you may not use this file except in compliance with the License.
@@ -20,8 +20,9 @@
 #   description : Generates, on stdout, tab-separated data on certificates from different sources,
 #                 possibly outputting merged list to specified dir;
 #                 the output dir has to exist and preferably, be empty;
-#                 certs are stored with filename being openssl-generated subject hash.
-#   usage: gen-certs-info.py <certs directory path1> ... <certs directory pathN> [--merged=<output merged certs dir>]
+#                 certs are stored with filename being openssl-generated subject hash;
+#                 script can remove expired certs from output dir if option is used.
+#   usage: gen-certs-info.py <certs directory path1> ... <certs directory pathN> [--merged=<output merged certs dir>] [--remove-expired]
 #
 #
 ####################################################
@@ -29,7 +30,8 @@ import subprocess
 import sys
 import os
 import os.path
-
+from time import strptime
+from datetime import datetime
 
 ####################################################
 #   Executes command and returns list of output lines
@@ -41,7 +43,28 @@ def consoleCommand(cmd):
     retcode = process.wait()
     if retcode != 0:
         return []
-    return lines
+    ret = []
+    for l in lines:
+        ret.append(l.decode())
+    return ret
+
+####################################################
+#   Returns certificate start date or empty string on error
+####################################################
+def getStartDate(path):
+    output = consoleCommand("openssl x509 -in " + path + " -startdate -noout | sed -e 's/^notBefore=//g' | sed -e 's/[0-9][0-9]:[0-9][0-9]:[0-9][0-9] //g' | sed -e 's/ GMT$//g'")
+    if len(output) > 0:
+        return output[0].strip()
+    return ""
+
+####################################################
+#   Returns certificate end date or empty string on error
+####################################################
+def getEndDate(path):
+    output = consoleCommand("openssl x509 -in " + path + " -enddate -noout | sed -e 's/^notAfter=//g' | sed -e 's/[0-9][0-9]:[0-9][0-9]:[0-9][0-9] //g' | sed -e 's/ GMT$//g'")
+    if len(output) > 0:
+        return output[0].strip()
+    return ""
 
 ####################################################
 #   Returns true if path points to certificate file
@@ -49,6 +72,13 @@ def consoleCommand(cmd):
 def isCert(path):
     return len(consoleCommand("openssl x509 -in " + path + "  -subject_hash_old -noout")) > 0;
 
+####################################################
+#  Returns true if certificate under path is not expired
+####################################################
+def isCertValid(path):
+    endDate = datetime.strptime(getEndDate(path), "%b %d %Y")
+    return endDate > datetime.now()
+
 ####################################################
 #   Returns sha1 fingerprint of DER or PEM cert, empty string on error
 ####################################################
@@ -92,32 +122,15 @@ def getIssuer(path):
         return output[0].strip()
     return ""
 
-####################################################
-#   Returns certificate start date or emtpy string on error
-####################################################
-def getStartDate(path):
-    output = consoleCommand("openssl x509 -in " + path + " -startdate -noout | sed -e 's/^notBefore=//g' | sed -e 's/[0-9][0-9]:[0-9][0-9]:[0-9][0-9] //g' | sed -e 's/ GMT$//g'")
-    if len(output) > 0:
-        return output[0].strip()
-    return ""
-
-####################################################
-#   Returns certificate end date or emtpy string on error
-####################################################
-def getEndDate(path):
-    output = consoleCommand("openssl x509 -in " + path + " -enddate -noout | sed -e 's/^notAfter=//g' | sed -e 's/[0-9][0-9]:[0-9][0-9]:[0-9][0-9] //g' | sed -e 's/ GMT$//g'")
-    if len(output) > 0:
-        return output[0].strip()
-    return ""
-
 
 ####################################################
 # Main
 ####################################################
 if len(sys.argv) == 1:
-    print "Usage: gen-certs-info.py <certs directory path1> ... <certs directory pathN> [--merged=<output merged certs dir>]"
+    print ("Usage: merge-certs-info.py <certs directory path1> ... <certs directory pathN> [--merged=<output merged certs dir>] [--remove-expired]")
     sys.exit(1)
 
+removeExpired = False
 outputDir = ""
 directories = []
 
@@ -125,6 +138,8 @@ for i in range(1, len(sys.argv)):
     arg = sys.argv[i]
     if arg.find("--merged=") == 0:
         outputDir = arg.split("=")[1].strip()
+    elif arg.strip() == "--remove-expired":
+        removeExpired = True
     else:
         directories.append(arg.strip());
 
@@ -154,7 +169,8 @@ if outputDir != "":
         while os.path.exists(outputDir + "/" + newName + "." + str(i)):
             i = i + 1
         newName = newName + "." + str(i)
-        consoleCommand("cp " + path + " " + outputDir + "/" + newName)
+        if not removeExpired or isCertValid(path):
+            consoleCommand("cp " + path + " " + outputDir + "/" + newName)
         allSha1ToNewName[sha1] = newName
 
 line = ""
@@ -163,7 +179,7 @@ for directory in dirToSha1ToName:
 if outputDir != "":
     line = line + outputDir + "\t"
 line = line + "SUBJECT\tISSUER\tFINGERPRINT\tFINGERPRINT SHA256\tSTART DATE\tEND DATE"
-print line
+print (line)
 
 for sha1 in allSha1ToAnyPath:
     line = ""
@@ -180,5 +196,5 @@ for sha1 in allSha1ToAnyPath:
     startDate = getStartDate(allSha1ToAnyPath[sha1])
     endDate = getEndDate(allSha1ToAnyPath[sha1])
     line = line + subject + "\t" + issuer + "\t" + sha1 + "\t" + sha256 + "\t" + startDate + "\t" + endDate
-    print line
+    print (line)
 

diff --git a/scripts/parse-mozilla-certificates.py b/scripts/parse-mozilla-certificates.py
index 79406af8087898242179ffda1a4b1713d8c32bcb..2d86850e50097a0237fa03798eb42fce0231382c 100755 (executable)
--- a/scripts/parse-mozilla-certificates.py
+++ b/scripts/parse-mozilla-certificates.py
@@ -1,6 +1,6 @@
 ####################################################
 #
-# Copyright (c) 2022 Samsung Electronics Co., Ltd All Rights Reserved
+# Copyright (c) 2022 - 2023 Samsung Electronics Co., Ltd All Rights Reserved
 #
 #    Licensed under the Apache License, Version 2.0 (the "License");
 #    you may not use this file except in compliance with the License.
@@ -36,7 +36,7 @@ def writeSingleCert(path, contents):
 # Main
 ####################################################
 if len(sys.argv) != 2:
-    print "Usage: cat mozilla-cert-list.txt | parse-mozilla-certificates.py --certs=<path-to-where-certs-will-be-extracted>"
+    print ("Usage: cat mozilla-cert-list.txt | parse-mozilla-certificates.py --certs=<path-to-where-certs-will-be-extracted>")
     sys.exit(1)
 
 outputDir = ""
@@ -46,7 +46,7 @@ for i in range(1, len(sys.argv)):
     if arg.find("--certs=") == 0:
         outputDir = arg.split("=")[1].strip()
     else:
-        print "Invalid input"
+        print ("Invalid input")
         sys.exit(1)
 
 certName = 0