GnuTLS | certool: Skipping unknown options in template ends up with "success" exit status 0 (#1911)
Read-only notification of GnuTLS library development activities <[email protected]> Tue, 23 Jun 2026 10:39:04 +0000
| Newsgroups | gmane.comp.encryption.gpg.gnutls.devel |
|---|---|
| Message-ID | <[email protected]> |
--===============7157822710393041958==
Content-Type: multipart/alternative;
boundary="--==_mimepart_6a3a62484786e_371975a81080e";
charset=UTF-8
Content-Transfer-Encoding: 7bit
----==_mimepart_6a3a62484786e_371975a81080e
Content-Type: text/plain;
charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Issue created by Tim R=C3=BChsen: https://gitlab.com/gnutls/gnutls/-/work=
_items/1911
Opening this as discussion to clarify if we want this change or not.
## Problem
When having a non-matching or wrongly-spelled option in a template file (=
e.g., to create a certificate), `certool` prints a warning but then creat=
es the possibly wrong certificate and exits with status 0.
The danger here is to overlook the warning. On a console, the warning lin=
es easily scrolls out of the window, and from what the user sees all look=
s good.
Scripting / automation that relies on the exit status will just continue,=
potentially creating certificates that are missing necessary KU or EKU e=
xtensions.
## Suggestion
`certtool` should be very strict with malformed input. Unknown template o=
ptions should not be skipped, but lead to an error without creating any c=
ertificate.
The alternative, testing the status code *and* grepping the console outpu=
t for `warning` seems to put too much burden on the user. And it's not ex=
pected or common sense.
This would be a breaking change for anyone who has malformed template fil=
es. But IMO it's better to force people to think about why something brea=
ks in their build pipeline then possibly introducing security issues.
Are there any use cases where a new CLI option to revert to the old behav=
ior is beneficial?
-- =
Reply to this email directly or view it on GitLab: https://gitlab.com/gnu=
tls/gnutls/-/work_items/1911
You're receiving this email because of your account on gitlab.com. Unsubs=
cribe from this thread: https://gitlab.com/-/namespace/17175643/sent_noti=
fications/5-cgr6kvmrhjvrawy8kjr5k15w8-a84t7/unsubscribe | Manage all noti=
fications: https://gitlab.com/-/profile/notifications | Help: https://git=
lab.com/help
----==_mimepart_6a3a62484786e_371975a81080e
Content-Type: text/html;
charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www=
.w3.org/TR/REC-html40/loose.dtd">
<html lang=3D"en" style=3D'--code-editor-font: var(--default-mono-font, "=
GitLab Mono"), JetBrains Mono, Menlo, DejaVu Sans Mono, Liberation Mono, =
Consolas, Ubuntu Mono, Courier New, andale mono, lucida console, monospac=
e;'>
<head>
<meta content=3D"text/html; charset=3Dutf-8" http-equiv=3D"Content-Type">=
<title>
GitLab
</title>
<style data-premailer=3D"ignore" type=3D"text/css">
a { color: #1068bf; }
</style>
<style>img {
max-width: 100%; height: auto;
}
body {
font-size: .875rem;
}
body {
-webkit-text-shadow: hsla(0,0%,100%,.01) 0 0 1px;
}
body {
font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Ro=
boto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Colo=
r Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"; font-size=
: inherit;
}
</style>
</head>
<body style=3D'font-size: inherit; -webkit-text-shadow: hsla(0,0%,100%,.0=
1) 0 0 1px; font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"=
Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif=
,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji=
";'>
<div class=3D"content">
<p class=3D"details" style=3D"font-style: italic; color: #626168;">
Issue created by <a href=3D"https://gitlab.com/rockdaboot">Tim R=C3=BChse=
n</a>: <a href=3D"https://gitlab.com/gnutls/gnutls/-/work_items/1911">#19=
11</a>
</p>
<div class=3D"md" style=3D"position: relative; z-index: 1; color: #3a383f=
; word-wrap: break-word;">
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">Opening this as discussion to clarify if we want this change or =
not.</p>
<h2 id=3D"user-content-problem" dir=3D"auto" style=3D"margin-top: 20px; m=
argin-bottom: 10px;" align=3D"initial">Problem<a href=3D"#problem" aria-l=
abel=3D"Link to heading 'Problem'" data-heading-content=3D"Problem" class=
=3D"anchor" style=3D"margin-top: 0px;"></a>
</h2>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">When having a non-matching or wrongly-spelled option in a templa=
te file (e.g., to create a certificate), <code style=3D'font-size: 90%; c=
olor: #18171d; word-wrap: break-word; background-color: #ececef; border-r=
adius: .25rem; margin-top: 0px; font-weight: inherit; overflow-wrap: brea=
k-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBrains=
Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubun=
tu Mono", "Courier New", "andale mono", "lucida console", monospace; font=
-variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25rem=
;'>certool</code> prints a warning but then creates the possibly wrong ce=
rtificate and exits with status 0.</p>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">The danger here is to overlook the warning. On a console, the wa=
rning lines easily scrolls out of the window, and from what the user sees=
all looks good.</p>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">Scripting / automation that relies on the exit status will just =
continue, potentially creating certificates that are missing necessary KU=
or EKU extensions.</p>
<h2 id=3D"user-content-suggestion" dir=3D"auto" style=3D"margin-top: 20px=
; margin-bottom: 10px;" align=3D"initial">Suggestion<a href=3D"#suggestio=
n" aria-label=3D"Link to heading 'Suggestion'" data-heading-content=3D"Su=
ggestion" class=3D"anchor" style=3D"margin-top: 0px;"></a>
</h2>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial"><code style=3D'font-size: 90%; color: #18171d; word-wrap: break-=
word; background-color: #ececef; border-radius: .25rem; margin-top: 0px; =
font-weight: inherit; overflow-wrap: break-word; white-space: break-space=
s; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mo=
no", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale=
mono", "lucida console", monospace; font-variant-ligatures: none; word-b=
reak: keep-all; padding: 0.125rem 0.25rem;'>certtool</code> should be ver=
y strict with malformed input. Unknown template options should not be ski=
pped, but lead to an error without creating any certificate.</p>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">The alternative, testing the status code <em style=3D"margin-top=
: 0px;">and</em> grepping the console output for <code style=3D'font-size=
: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; =
border-radius: .25rem; font-weight: inherit; overflow-wrap: break-word; w=
hite-space: break-spaces; font-family: "GitLab Mono", "JetBrains Mono", "=
Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono",=
"Courier New", "andale mono", "lucida console", monospace; font-variant-=
ligatures: none; word-break: keep-all; padding: 0.125rem 0.25rem;'>warnin=
g</code> seems to put too much burden on the user. And it's not expected =
or common sense.</p>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">This would be a breaking change for anyone who has malformed tem=
plate files. But IMO it's better to force people to think about why somet=
hing breaks in their build pipeline then possibly introducing security is=
sues.</p>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px;" align=3D"initial">=
Are there any use cases where a new CLI option to revert to the old behav=
ior is beneficial?</p>
</div>
</div>
<div class=3D"footer" style=3D"margin-top: 10px;">
<p style=3D"font-size: small; color: #626168;">
=E2=80=94
<br>
Reply to this email directly or <a href=3D"https://gitlab.com/gnutls/gnut=
ls/-/work_items/1911">view it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target=3D"_blan=
k" rel=3D"noopener noreferrer" href=3D"https://gitlab.com">gitlab.com</a>=
. <a href=3D"https://gitlab.com/-/namespace/17175643/sent_notifications/5=
-cgr6kvmrhjvrawy8kjr5k15w8-a84t7/unsubscribe" target=3D"_blank" rel=3D"no=
opener noreferrer">Unsubscribe</a> from this thread =C2=B7 <a href=3D"htt=
ps://gitlab.com/-/profile/notifications" target=3D"_blank" rel=3D"noopene=
r noreferrer" class=3D"mng-notif-link">Manage all notifications</a> =C2=B7=
<a href=3D"https://gitlab.com/help" target=3D"_blank" rel=3D"noopener no=
referrer" class=3D"help-link">Help</a>
<span style=3D"color: transparent; font-size: 0; display: none; overflow:=
hidden; opacity: 0; width: 0; height: 0; max-width: 0; max-height: 0;">
Notification message regarding https://gitlab.com/gnutls/gnutls/-/work_it=
ems/1911 at 1782211144
</span>
<script type=3D"application/ld+json">{"@context":"http://schema.org","@ty=
pe":"EmailMessage","action":{"@type":"ViewAction","name":"View Work item"=
,"url":"https://gitlab.com/gnutls/gnutls/-/work_items/1911"}}</script>
</p>
</div>
</body>
</html>
----==_mimepart_6a3a62484786e_371975a81080e--
--===============7157822710393041958==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Gnutls-devel mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnutls-devel
--===============7157822710393041958==--