| // Copyright 2015 The Go Authors. All rights reserved. | |
| // Use of this source code is governed by a BSD-style | |
| // license that can be found in the LICENSE file. | |
| // Package build contains constants for the Go continuous build system. | |
| package build | |
| import ( | |
| "crypto/tls" | |
| "crypto/x509" | |
| "errors" | |
| "fmt" | |
| "net" | |
| "strings" | |
| ) | |
| // CoordinatorInstance is either "prod", "staging", or "localhost:<port>". | |
| type CoordinatorInstance string | |
| const ( | |
| ProdCoordinator CoordinatorInstance = "prod" | |
| StagingCoordinator CoordinatorInstance = "staging" | |
| ) | |
| func (ci CoordinatorInstance) TLSHostPort() (string, error) { | |
| switch ci { | |
| case ProdCoordinator: | |
| return "farmer.golang.org:443", nil | |
| case StagingCoordinator: | |
| // TODO(cmang): make this project dependent. | |
| return "104.154.113.235:443", nil | |
| } | |
| if ci == "" { | |
| return "", errors.New("build: coordinator instance is empty") | |
| } | |
| if _, _, err := net.SplitHostPort(string(ci)); err == nil { | |
| return string(ci), nil | |
| } | |
| return net.JoinHostPort(string(ci), "443"), nil | |
| } | |
| func (ci CoordinatorInstance) TLSDialer() func(network, addr string) (net.Conn, error) { | |
| if ci == "prod" { | |
| // TODO(bradfitz): once the staging coordinator has a | |
| // DNS name and LetsEncrypt, delete this whole method? | |
| return nil // uses default http.Transport.DialTLS dialer | |
| } | |
| caPool := x509.NewCertPool() | |
| tlsConf := &tls.Config{ | |
| ServerName: "go", // fixed name; see build.go | |
| RootCAs: caPool, | |
| InsecureSkipVerify: ci.isDev(), | |
| } | |
| var err error | |
| ca := ci.CACert() | |
| if ci == "" { | |
| tlsConf.InsecureSkipVerify = true // in localhost dev mode | |
| } else { | |
| if !caPool.AppendCertsFromPEM([]byte(ca)) { | |
| err = fmt.Errorf("Failed to load client's TLS cert for instance %q", string(ci)) | |
| } | |
| } | |
| return func(network, addr string) (net.Conn, error) { | |
| if err != nil { | |
| // sticky error from AppendCertsFromPEM | |
| return nil, err | |
| } | |
| if network != "tcp" { | |
| return nil, fmt.Errorf("unsupported network %q", network) | |
| } | |
| tcpConn, err := net.Dial("tcp", addr) | |
| if err != nil { | |
| return nil, err | |
| } | |
| conn := tls.Client(tcpConn, tlsConf) | |
| if err := conn.Handshake(); err != nil { | |
| return nil, fmt.Errorf("failed to handshake with coordinator: %v", err) | |
| } | |
| return conn, nil | |
| } | |
| } | |
| // CACert returns the public certificate of the CA used to sign | |
| // this coordinator instance's certificate. | |
| func (ci CoordinatorInstance) CACert() string { | |
| if ci == ProdCoordinator { | |
| return ProdCoordinatorCA | |
| } else if ci == StagingCoordinator { | |
| return StagingCoordinatorCA | |
| } else if ci.isDev() { | |
| return DevCoordinatorCA | |
| } | |
| return "" | |
| } | |
| func (ci CoordinatorInstance) isDev() bool { | |
| return strings.HasPrefix(string(ci), "localhost") | |
| } | |
| /* | |
| Certificate authority and the coordinator SSL key were created with: | |
| openssl genrsa -out ca_key.pem 2048 | |
| openssl req -x509 -new -key ca_key.pem -out ca_cert.pem -days 1068 -subj /CN="go" | |
| openssl genrsa -out key.pem 2048 | |
| openssl req -new -out cert_req.pem -key key.pem -subj /CN="go" | |
| openssl x509 -req -in cert_req.pem -out cert.pem -CAkey ca_key.pem -CA ca_cert.pem -days 730 -CAcreateserial -CAserial serial | |
| */ | |
| // ProdCoordinatorCA is the production CA cert for farmer.golang.org. | |
| const ProdCoordinatorCA = `-----BEGIN CERTIFICATE----- | |
| MIIDCzCCAfOgAwIBAgIJANl4KOv9Cj4UMA0GCSqGSIb3DQEBBQUAMA0xCzAJBgNV | |
| BAMTAmdvMB4XDTE1MDQwNTIwMTE0OFoXDTE4MDMwODIwMTE0OFowDTELMAkGA1UE | |
| AxMCZ28wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDJ/oLb+ksvNScl | |
| zIweMGv2ZWRdWW3o9vWIMpOhkiYuBOZjp7zvs89OuKNdC1ylJs3ENnNtD8QOG1Ze | |
| kM3s6MTjCLVZUX4218HAenGifaunTNfbW1/q/tTnZh4Kri00vgq9jFtYnlqFLYhT | |
| PlmDMdpgOY4ligc/1bSPWVsI7CKCbh3fAz67m++opVE0M7LFp8bhkyFv/dnhZFxo | |
| s9ei3ZKFLjYJdZUNRMZ+HcqBzXMQR7HeCOD2pZ1yoHJw1b3Ebe4YOcQCHq4moW7W | |
| DavISKSXl7DKZYX1QlFUmEMkl5aMIEHUJ0oI2wnL9+u5s1NU2/k8sSxbH7Y/cKio | |
| cFPwuMt7AgMBAAGjbjBsMB0GA1UdDgQWBBS5f/j+8YL9B8THnoAXIhQty3vDZjA9 | |
| BgNVHSMENjA0gBS5f/j+8YL9B8THnoAXIhQty3vDZqERpA8wDTELMAkGA1UEAxMC | |
| Z2+CCQDZeCjr/Qo+FDAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQBU | |
| EOOl2ChJyxFg8b4OrG/EC0HMxic2CakRsj6GWQlAwNU8+3o2u2+zYqKhuREDazsZ | |
| 1+0f54iU4TXPgPLiOVLQT8AOM6BDDeZfugAopAf0QaIXW5AmM5hnkhW035aXZgx9 | |
| rYageMGnnkK2H7E7WlcFbGcPjZtbpZyFnGoAvxcUfOzdnm/LLuvFg6YWf1ynXsNI | |
| aOx5LNVDhzcQlHZ26ueOLoyIpTQxqvo+hwmIOVDLlZ9bz2BS6FevFjsciJmcDL8N | |
| cmY1/5cC/4NzpnN95cvZxp3FX8Ka7YFun03ubjXzXttoeyrxP2WFXuc2D2hkTJPE | |
| Co9z2+Nue1JHG9JcDaeW | |
| -----END CERTIFICATE-----` | |
| // StagingCoordinatorCA is the cert used on GCE for the | |
| // go-dashboard-dev project. | |
| const StagingCoordinatorCA = `-----BEGIN CERTIFICATE----- | |
| MIIC7TCCAdWgAwIBAgIJAOfawne6V7F1MA0GCSqGSIb3DQEBCwUAMA0xCzAJBgNV | |
| BAMMAmdvMB4XDTE1MDcwNjE5MTAyMloXDTE4MDYwODE5MTAyMlowDTELMAkGA1UE | |
| AwwCZ28wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDBnRAfwDXJzRDf | |
| RBolwbQHi/iQ8h70FuQCYKNpjTQWjmWX+8zT7f0C+6q3hEqaEt6gL8Ch9sTiDxOj | |
| MeaczdXVUGGvtKMB/e4CLrpswfTZNR9Fx0BbtdcdyyNAgobphcR81CgzQgokr7FS | |
| M6E1HsjxqBUwCQGZWnkjVxPSd2VnS7Lnz1+DCSPqAboIXyIwQXnu+OjecnrB6/Fp | |
| WOUI0Z5PgEh8vBKhPNptCeX5o8Cl1NVdmvMw2nGIxo6M0swbzDrELfJ1LD9UtGiE | |
| 4a2dTttqGYGF0KtBUM3VsX93zPjHix6h9YEzU9zffCOZWIizAXOGMPe/jwPAdAeM | |
| FCxJJzkfAgMBAAGjUDBOMB0GA1UdDgQWBBQGMc6uZVoT12xX2BJUESJXz1KgXzAf | |
| BgNVHSMEGDAWgBQGMc6uZVoT12xX2BJUESJXz1KgXzAMBgNVHRMEBTADAQH/MA0G | |
| CSqGSIb3DQEBCwUAA4IBAQCmx74P6MVgl+atDFiMxhLiDp7CiLMZXrnmgBVz9VQ6 | |
| NwDbN/kHXDCeJr1D175T7mQVEkTS4dDDP6LqCNdyP1o+xzJQd7J87jSMlWyDUtG6 | |
| Wa2n03q1mzEb6fveFs3c08mXPMZ20LE2ApMbFJUhKStuBaQFN601S/ixS37kiefZ | |
| c2G8sF0KryoHCIlNaCSG+OdztoBg7HJ3XLPN6uO10jf9Dk+iY1QdbYN98WWljL/A | |
| QJOrbUZeZsUJ0KnxVMNN0CgB6T0DE9qzewoiNknieXtq2vl/Nxa1AD+qAzWck/bb | |
| yHd17CDY55cj4fworr/PayJuB7JJOrLk68yx2eUlK0Np | |
| -----END CERTIFICATE-----` | |
| // DevCoordinatorCA is the cert used by the coordinator and buildlet in | |
| // development mode. (Not to be confused with the staging "dev" instance | |
| // under GCE project "go-dashboard-dev") | |
| const DevCoordinatorCA = `-----BEGIN CERTIFICATE----- | |
| MIICljCCAX4CCQDN22+A+3+WjjANBgkqhkiG9w0BAQUFADANMQswCQYDVQQDEwJn | |
| bzAeFw0xNTA3MTUwMzIzMDhaFw0xNzA3MTQwMzIzMDhaMA0xCzAJBgNVBAMTAmdv | |
| MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlj8cK93O6klUVcAn3eC1 | |
| za5khnTe/dLPaErrVcymJvdFKEedzNOA6aI9eB2F21KafKcQCaMR+aWBuWzHf4cR | |
| p39oQwIi3h1rCpTCq4tMJB2cXarl3ygj5U/VcFLwPcHl0EYFMxHEF4MM2qiPQvpr | |
| 5mt/DTwFtkg+Wb3gHylDqtaOqHwta/wTFfGoI03P2OXRgi8a0UkgPpVXlaiamqfb | |
| kpId7cRLUPp+dJWvvvbHtkSkIo1k+z3UAluHEhF5j5jBqTQM9A+7otFMkO5QUjJS | |
| 9E25/cQuaPOnu+xqkxnPPXkABIHvnmLK3pxPJ2CaEFPVpzqe+98Bmqxi3ll9vMUS | |
| dwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQA/ZZdBMuJUwzitfrcIF3Jtx+ujuNkw | |
| Jc7eCKATu/ylyfS/ORBk+9GjTRlRDomngz4SojuqR+au92sU4OrLnuEE1hK18TBy | |
| FIiU7CFBG1qj08Ijb812SYAxNr7uKCPfYfM9qbhBLEvQyHrTi9exEey27yWZxy9C | |
| H123Rv8mpI8rGa39k5M9tqtPfXXRChHhXHaU5B0jpk0NWXTDsTTJxqDZqS3NiUPS | |
| I2cBKSy6qTfqEwvxAmcu0tDWzDo2N4Ol1yUy6des7hOHuS9mO5W4qk5D6Yr58+H/ | |
| hdFnZur+fHY+hgulEWZjcg1JMzEDhiIYGUbXJrErRIRhxnCksus3tkWD | |
| -----END CERTIFICATE-----` | |
| // DevCoordinatorKey is the key used by the coordinator and buildlet in | |
| // development mode. (Not to be confused with the staging "dev" instance | |
| // under GCE project "go-dashboard-dev") | |
| const DevCoordinatorKey = `-----BEGIN RSA PRIVATE KEY----- | |
| MIIEogIBAAKCAQEAlj8cK93O6klUVcAn3eC1za5khnTe/dLPaErrVcymJvdFKEed | |
| zNOA6aI9eB2F21KafKcQCaMR+aWBuWzHf4cRp39oQwIi3h1rCpTCq4tMJB2cXarl | |
| 3ygj5U/VcFLwPcHl0EYFMxHEF4MM2qiPQvpr5mt/DTwFtkg+Wb3gHylDqtaOqHwt | |
| a/wTFfGoI03P2OXRgi8a0UkgPpVXlaiamqfbkpId7cRLUPp+dJWvvvbHtkSkIo1k | |
| +z3UAluHEhF5j5jBqTQM9A+7otFMkO5QUjJS9E25/cQuaPOnu+xqkxnPPXkABIHv | |
| nmLK3pxPJ2CaEFPVpzqe+98Bmqxi3ll9vMUSdwIDAQABAoIBAADPLDasRi4K4RJp | |
| K43NZQ1LkC0NOhpB5W4ZYTUgGhEBqfSylg4BYaNghVY9SnhI9J4RREvY/gLLOmym | |
| QljUgGrXi9c4jrmFjQsMjBPidzGGm04B2qUeETtt96dYOwUKI1PA3MxOnzDFOu9+ | |
| ku74bFZcY93NYfZ+Yx+WnztrvHqSFSvEVIqbY6y1JamZQg4MhypoflCPbSdQAn83 | |
| eG+9eU4tlpisv84iNQ65BDg+OYpVu8DOe+qXcfmcynn75YBSBaPk0Y5dhYoyWs9P | |
| UxLaxwX01Y/YAtsdx9N9XZ4Pjaji0y4tmZmu/O328fk/Ytul26MJtNNNDsyPmidQ | |
| wLJf0UkCgYEAxCpyyzzOeIUxKJzb4FZDCkepEp3SNLsh0L7D9vH28nxWhfr0y+IM | |
| ncME8xCxhwAhNkn3ksnSSV1eyoyhw0O/IY2jBeZdfp/Wn98W+Q2WRxUwt/aOpVx+ | |
| RBuokq021yisam2+wCxyhTcVNnhNPGhyrhNaC7JqYvd6mWyBLbT7brsCgYEAxBMR | |
| IyLmVCZGZOBt1ee+LkFMN00I5S0IVVxbGbdCpStXUK/XIIPzinGxadF7zP8vsZ/Y | |
| vdUOTa9PWJrsGMSUwkDx4TWGy1uIFhf/rLaTbrGHPQD96WjS+7mCIkkd6fvKXEt/ | |
| 5rfbhYHoUdX56CWMGSYfCvEQd8CjIIerVzDAdXUCgYBSTRzseA6IMhl12JnHfWmT | |
| Ho2o6d4PkZOWaPL+4HWjNtd2Ttv1zllMt02UTSSuZzeH93CPfW1kqm/iuy4DJqFC | |
| CpKjHwuK3LTHTmntA+5Q1GskQ6WFa1Duckw/fbzMeJwd6v1k00EY8wtLVx3QgmHa | |
| 9vOIhMptyzb8t7Fa49u5kQKBgGygc5oXt6tfGRjCDZe4L/DIVEU+9HKjJD7GT+JL | |
| WSzQeitFf9WPxNkqa7PITuIfbnjlqdphsu7u9PKNwcdnAVMtT9QJJ4h6SUaUPR2e | |
| eMeWquntJr6tSFYVTDdacqwyxsWjPlS//2pTsjXEahNm2dsE96XEL+9oVfersg04 | |
| ASgRAoGAH5kbPiadxpk+escKawGcnvCeE1ipJIJ7TzewtN2B5IbnDkzt7F415Mxj | |
| KCPN0NJXQ5vfURRbbXgP2g6dS6WEQMtpaxo0M4v14kRPK9VhlqrUNvtWoBh4fcgv | |
| Jg5yzK4PwNJehAbCb1sVnsI96joHe685u8c8BcuJVE5LMX8ujFE= | |
| -----END RSA PRIVATE KEY-----` |