bin/rollup: Fix offset-by-one year bug.

diff --git a/.gitignore b/.gitignore
index d514496..325c48a 100644 (file)
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,5 @@
 ca.cert
+ca-*.cert
 crl
 private/
 state/

diff --git a/bin/cycle-root-key b/bin/cycle-root-key
new file mode 100755 (executable)
index 0000000..b936ac7
--- /dev/null
+++ b/bin/cycle-root-key
@@ -0,0 +1,62 @@
+#! /usr/bin/tclsh
+### -*-tcl-*-
+###
+### Generate a new root key
+###
+### (c) 2022 Mark Wooding
+###
+
+###----- Licensing notice ---------------------------------------------------
+###
+### This program is free software: you can redistribute it and/or modify
+### it under the terms of the GNU General Public License as published by
+### the Free Software Foundation; either version 2 of the License, or (at
+### your option) any later version.
+###
+### This program is distributed in the hope that it will be useful, but
+### WITHOUT ANY WARRANTY; without even the implied warranty of
+### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+### General Public License for more details.
+###
+### You should have received a copy of the GNU General Public License
+### along with this program.  If not, write to the Free Software
+### Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307,
+### USA.
+
+## Find the common utilities.
+source [file join [file dirname $argv0] "../lib/func.tcl"]
+
+## Open the database
+sqlite3 db "$CERTROOT/state/ca.db"
+db nullvalue nil
+cd "$CERTROOT"
+
+## Refresh the database's idea of request profiles.
+sync-profiles
+
+## Rename the old CA key so we don't lose it.
+set i 0
+while {[file exists private/ca-$i.key]} { set i [expr {$i + 1}] }
+file rename private/ca.key private/ca-$i.key
+file rename ca.cert ca-$i.cert
+
+## Make a new key.
+generate-root-key
+
+## Generate new certificates for all of the live requests.
+set now [now]
+foreach id [db eval { SELECT id FROM request WHERE st = 'active' }] {
+  issue-cert $id $now
+}
+
+## Update OpenSSL's database of things.
+exec openssl ca -config "etc/openssl.conf" -updatedb 2>@1
+
+## Generate a CRL.
+exec openssl ca -config "etc/openssl.conf" -gencrl | \
+    openssl crl -text -out "crl" 2>@1
+
+## Call the user hook.
+update-hook
+
+###----- That's all, folks --------------------------------------------------

diff --git a/bin/rollup b/bin/rollup
new file mode 100755 (executable)
index 0000000..f620bcd
--- /dev/null
+++ b/bin/rollup
@@ -0,0 +1,40 @@
+#! /bin/sh -e
+
+thisyear=$(date +%Y)
+last=nil
+
+flush () {
+  case $last in nil) return ;; esac
+  (cd tmp/rollup/all && tar cfz - .) >tmp/rollup/$last-all.tgz
+  mv tmp/rollup/$last-all.tgz archive/
+  rm -f archive/$last-??-??T??:??:??Z.tgz
+  rm -rf tmp/rollup/all
+}
+
+rm -rf tmp/rollup; mkdir -p tmp/rollup
+for i in archive/????-??-??T??:??:??Z.tgz; do
+  base=${i##*/} year=${base%%-*}
+  case $year in
+    $thisyear) break ;;
+    $last) ;;
+    *) flush; mkdir tmp/rollup/all; last=$year ;;
+  esac
+  mkdir tmp/rollup/cur
+  (cd tmp/rollup/cur && tar xfz -) <$i
+  mv tmp/rollup/cur/cert.* tmp/rollup/all/
+  for j in tmp/rollup/cur/*; do
+    base=${j##*/}
+    case $base in
+      cert.*)
+       mv tmp/rollup/cur/$base tmp/rollup/all/
+       ;;
+      *)
+       cat tmp/rollup/cur/$base >>tmp/rollup/all/$base;
+       rm tmp/rollup/cur/$base
+       ;;
+    esac
+  done
+  rmdir tmp/rollup/cur
+done
+flush
+rmdir tmp/rollup