snapshot of https://github.com/grpc/grpc-go.git (master, 2026-09-15; blobs > 131072B omitted)

testdata/spiffe/README.md

@@ -0,0 +1,76 @@
+## File Purposes
+
+*   spiffe_cert.pem - the certificate that is placed in spiffe bundles (copied
+    into the `x5c` field)
+*   server1_spiffe.pem - another certificate placed in spiffe bundles
+*   spiffe_multi_uri_san_cert.pem - another certificate placed in spiffe bundles
+*   spiffe-openssl.cnf - the configuration file passed to the openssl CLI when
+    creating these certificate files
+*   spiffebundle.json - the valid spiffe bundle for happy path testing
+*   spiffebundle2.json - Another valid spiffe bundle that is used in testing
+    file reloading (a different file is needed to ensure changes are picked up).
+    It is just the `example.com` trust domain from spiffebundle.json.
+*   spiffebundle_corrupted_cert.json - manually modifies the `x5c` field and
+    removes a character to create an invalid certificate
+*   spiffebundle_empty_keys.json - the `keys` field is an empty array
+*   spiffebundle_empty_string_keys.json - the `keys` field contains an entry
+*   with an empty string key
+*   spiffebundle_invalid_trustdomain - uses a `#` in the trust domain which is a
+    disallowed character per the spec
+*   spiffebundle_malformed.json - a fully wrong json
+*   spiffebundle_match_client_spiffe.json - a valid spiffe bundle with a trust
+    domain matching the SPIFFE ID in spiffe_cert.pem
+*   spiffebundle_wrong_kid.json - has the `kid` field instead of the `kty` field
+*   spiffebundle_wrong_kty.json - Uses `EC` instead of `RSA` in the `kty` field
+*   spiffebundle_wrong_multi_certs.json - place 2 certificates in the `x5c`
+    field
+*   spiffebundle_wrong_root.json - The top level json string is `trustDomains`
+    instead of `trust_domains`
+*   spiffebundle_wrong_seq_type.json - the `spiffe_sequence` number must be an
+    integer
+*   spiffebundle_wrong_use.json - The `use` field must be `x509-svid` or
+    `jwt-svid` (we are expecting and support `x509-svid` per the gRFC)
+
+## Test File Creation:
+
+The SPIFFE related extensions are listed in spiffe-openssl.cnf config. Both
+client_spiffe.pem and server1_spiffe.pem are generated in the same way as the
+client and server certificates described in the testdata/x509 with the same CAs.
+Specifically they were made with the following commands:
+
+```
+$ openssl req -new -key client.key -out spiffe-cert.csr \
+ -subj /C=US/ST=CA/L=SVL/O=gRPC/CN=testclient/ \
+ -config spiffe-openssl.cnf -reqexts spiffe_client_e2e
+$ openssl x509 -req -CA ca.pem -CAkey ca.key -CAcreateserial \
+ -in spiffe-cert.csr -out client_spiffe.pem -extensions spiffe_client_e2e \
+  -extfile spiffe-openssl.cnf -days 3650 -sha256
+$ openssl req -new -key server1.key -out spiffe-cert.csr \
+ -subj /C=US/ST=CA/L=SVL/O=gRPC/CN=*.test.google.com/ \
+ -config spiffe-openssl.cnf -reqexts spiffe_server_e2e
+$ openssl x509 -req -CA ca.pem -CAkey ca.key -CAcreateserial \
+ -in spiffe-cert.csr -out server1_spiffe.pem -extensions spiffe_server_e2e \
+  -extfile spiffe-openssl.cnf -days 3650 -sha256
+```
+
+Additionally, the SPIFFE trust bundle map files (spiffebundle*.json) are
+manually created for end to end testing. The spiffebundle.json contains the
+"example.com" trust domain (only this entry is used in e2e tests) matching URI
+SAN of server1_spiffe.pem, and the CA certificate there is ca.pem. The
+spiffebundle.json file contains "foo.bar.com" trust domain (only this entry is
+used in e2e tests) matching URI SAN of client_spiffe.pem, and the CA certificate
+there is also ca.pem.
+
+If updating these files, the `x5c` field in the json is the raw PEM certificates
+and can be copy pasted from the certificate file. `n` and `e` are values from
+the public key. `e` should *probably* be `AQAB` as it is the exponent. `n` can
+be fetched from the certificate by getting the RSA key from the cert and
+extracting the value. This can be done in golang with the following codeblock:
+``` func GetBase64ModulusFromPublicKey(key *rsa.PublicKey) string { return
+base64.RawURLEncoding.EncodeToString(key.N.Bytes()) }
+
+block, _ := pem.Decode(rawPemCert) cert, _ := x509.ParseCertificate(block.Bytes)
+publicKey := cert.PublicKey.(*rsa.PublicKey)
+fmt.Println(GetBase64ModulusFromPublicKey(publicKey)) ```
+
+The rest of the files are manually modified as described above.