From 4f3024555250c59d8b3c0da3f1cf1725c58f809c Mon Sep 17 00:00:00 2001 From: Roland Shoemaker Date: Wed, 18 Oct 2023 14:26:33 -0400 Subject: x509roots: catch the zero-roots case when generating the bundle If the parser returns zero roots, don't attempt to completely remove the bundle. This may happen if, i.e., the HTTP response is 200 but has no content. An example of this may be http://go.dev/cl/535735. Change-Id: I81fc2b49c8ec813cca17fd1c807296bfb053d992 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/536136 Reviewed-by: Damien Neil LUCI-TryBot-Result: Go LUCI Reviewed-by: Dmitri Shuralyov Auto-Submit: Roland Shoemaker --- x509roots/gen_fallback_bundle.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/x509roots/gen_fallback_bundle.go b/x509roots/gen_fallback_bundle.go index ec3014f..ffea49b 100644 --- a/x509roots/gen_fallback_bundle.go +++ b/x509roots/gen_fallback_bundle.go @@ -105,6 +105,10 @@ func main() { log.Fatalf("failed to parse %q: %s", *certDataPath, err) } + if len(certs) == 0 { + log.Fatal("certdata.txt appears to contain zero roots") + } + sort.Slice(certs, func(i, j int) bool { // Sort based on the stringified subject (which may not be unique), and // break any ties by just sorting on the raw DER (which will be unique, -- cgit v1.3