Feature/pure ruby ssl implementation for root certificate issuer check

[jspaleta]

Pull Request Checklist

This is to address use of openssl command line tool in the check-ssl-anchor with an alternative implementation of the same logic using pure base ruby packages.

This is an outgrowth of the clean up done in PR #70

Probably should merge PR #70 first.

General

• Update Changelog

• RuboCop passes

• Existing tests pass

New Plugins

• Tests

• Add the plugin to the README

Purpose

Provide full ruby implementation of similar logic to check-ssl-anchor.rb without requireing openssl cmdline tool.

Known Compatibility Issues

[jspaleta]

I've addressed the review items with latest commits.

I've also updated this branch to remove the files changed in PR #70 associated with the failing check-ssl-anchor test.

Pr #70 should be merged first to clean up the failing anchor test, and then I'll rebase this PR off master

[majormoses]

Overall looks good, needs a rebase.

[majormoses]

A couple thoughts:

• I think we should we still add validation to the options passed in themselves. if I pass in an invalid value I see no reason to run this code here
• I think we should add conditional logic, if I specify something other than those two options the way the code is written it will attempt to validate with RFC2253 regardless of what is passed in
• should we add a qualifier here that this is specific to format or do you intend that we would keep adding more validation to this?

Maybe that should be something we pass in and can try something like this? (not sure if this is valid)

def validate_format_opts(config[:format])
  OpenSSL::X509::Name::config[:format]
end


# I am pretty sure this will work but is dangerous and could lead easily to code injection
# that being said if we validate the options beforehand I think that is sufficient mitigation
# (which I would call out in a comment) and will make sense right before the rubocop
# disable as I am sure it will (rightly so) yell at us as its incredibly dangerous but powerful
# if wielded properly
def validate_format_opts(config[:format])
  eval "OpenSSL::X509::Name::#{config[:format]}"
end

if we cant specify it like that then we could always use if, elif, else or case statements to handle.

[jspaleta]

Okay I've updated the logic to use mixin's cli option value validation method.

[majormoses]

@jspaleta let me know if you need any help appeasing the cops, in the case of the eval please do indicate in a comment that the validation is done at user input so should be safe in this case.

[jspaleta]

Rubocop fixed.
Eval rubocop override commented.

[majormoses]

LGTM

One minor fixup in the changelog.

[majormoses]

LGTM

[majormoses]

@jspaleta do you want to merge this and prep a release or do you want me to? I can probably get to it this evening if you don't get to it sooner.