Class: Spiffe::Workload::X509SVIDWrapper

Inherits:
Object
  • Object
show all
Defined in:
lib/spiffe/workload/x509_svid.rb

Overview

Represents an X.509 SVID with certificate chain, private key, and trust bundle

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(spiffe_id:, cert_chain:, private_key:, trust_bundle:, hint: nil) ⇒ X509SVIDWrapper

Returns a new instance of X509SVIDWrapper.

Parameters:

  • spiffe_id (String) —

    The SPIFFE ID of this SVID

  • cert_chain (Array<OpenSSL::X509::Certificate>) —

    Certificate chain

  • private_key (OpenSSL::PKey::RSA, OpenSSL::PKey::EC) —

    Private key

  • trust_bundle (OpenSSL::X509::Store) —

    Trust bundle for the trust domain

  • hint (String, nil) (defaults to: nil) —

    Optional hint for SVID usage



16
17
18
19
20
21
22
 
# File 'lib/spiffe/workload/x509_svid.rb', line 16

def initialize(spiffe_id:, cert_chain:, private_key:, trust_bundle:, hint: nil)
  @spiffe_id = spiffe_id
  @cert_chain = cert_chain
  @private_key = private_key
  @trust_bundle = trust_bundle
  @hint = hint
end

Instance Attribute Details

#cert_chain ⇒ Object (readonly)

Returns the value of attribute cert_chain.



9
10
11
 
# File 'lib/spiffe/workload/x509_svid.rb', line 9

def cert_chain
  @cert_chain
end

#hint ⇒ Object (readonly)

Returns the value of attribute hint.



9
10
11
 
# File 'lib/spiffe/workload/x509_svid.rb', line 9

def hint
  @hint
end

#private_key ⇒ Object (readonly)

Returns the value of attribute private_key.



9
10
11
 
# File 'lib/spiffe/workload/x509_svid.rb', line 9

def private_key
  @private_key
end

#spiffe_id ⇒ Object (readonly)

Returns the value of attribute spiffe_id.



9
10
11
 
# File 'lib/spiffe/workload/x509_svid.rb', line 9

def spiffe_id
  @spiffe_id
end

#trust_bundle ⇒ Object (readonly)

Returns the value of attribute trust_bundle.



9
10
11
 
# File 'lib/spiffe/workload/x509_svid.rb', line 9

def trust_bundle
  @trust_bundle
end

Class Method Details

.from_proto(proto_svid) ⇒ X509SVID

Parse X.509 SVID from proto response

Parameters:

Returns:



45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
 
# File 'lib/spiffe/workload/x509_svid.rb', line 45

def self.from_proto(proto_svid)
  # Parse certificate chain
  cert_chain = []
  cert_data = proto_svid.x509_svid
  
  # The cert data may contain multiple certificates
  # We need to extract all of them
  offset = 0
  while offset < cert_data.bytesize
    begin
      cert = OpenSSL::X509::Certificate.new(cert_data[offset..-1])
      cert_chain << cert
      # Move offset forward by the size of the DER-encoded cert
      offset += cert.to_der.bytesize
    rescue OpenSSL::X509::CertificateError
      break
    end
  end

  # Parse private key (PKCS#8 unencrypted)
  private_key = OpenSSL::PKey.read(proto_svid.x509_svid_key)

  # Parse trust bundle
  trust_bundle = OpenSSL::X509::Store.new
  bundle_data = proto_svid.bundle
  
  # Parse all certificates in the bundle
  offset = 0
  while offset < bundle_data.bytesize
    begin
      ca_cert = OpenSSL::X509::Certificate.new(bundle_data[offset..-1])
      trust_bundle.add_cert(ca_cert)
      offset += ca_cert.to_der.bytesize
    rescue OpenSSL::X509::CertificateError
      break
    end
  end

  new(
    spiffe_id: proto_svid.spiffe_id,
    cert_chain: cert_chain,
    private_key: private_key,
    trust_bundle: trust_bundle,
    hint: proto_svid.hint.empty? ? nil : proto_svid.hint
  )
end

Instance Method Details

#expired? ⇒ Boolean

Check if the SVID is expired

Returns:

  • (Boolean) 


32
33
34
 
# File 'lib/spiffe/workload/x509_svid.rb', line 32

def expired?
  leaf_certificate.not_after < Time.now
end

#leaf_certificate ⇒ OpenSSL::X509::Certificate

Get the leaf certificate (first in chain)

Returns:

  • (OpenSSL::X509::Certificate) 


26
27
28
 
# File 'lib/spiffe/workload/x509_svid.rb', line 26

def leaf_certificate
  @cert_chain.first
end

#ttl ⇒ Float

Get time until expiration

Returns:

  • (Float) —

    Seconds until expiration



38
39
40
 
# File 'lib/spiffe/workload/x509_svid.rb', line 38

def ttl
  leaf_certificate.not_after - Time.now
end