• Quentin Smith's avatar
    [release-branch.go1.7] crypto/x509: read Darwin trust settings for root CAs · 26741a15
    Quentin Smith authored
    Darwin separately stores bits indicating whether a root certificate
    should be trusted; this changes Go to read and use those when
    initializing SystemCertPool.
    
    Unfortunately, the trust API is very slow. To avoid a delay of up to
    0.5s in initializing the system cert pool, we assume that
    the trust settings found in kSecTrustSettingsDomainSystem will always
    indicate trust. (That is, all root certs Apple distributes are trusted.)
    This is not guaranteed by the API but is true in practice.
    
    In the non-cgo codepath, we do not have that benefit, so we must check
    the trust status of every certificate. This causes about 0.5s of delay
    in initializing the SystemCertPool.
    
    On OS X 10.11 and older, the "security" command requires a certificate
    to be provided in a file and not on stdin, so the non-cgo codepath
    creates temporary files for each certificate, further slowing initialization.
    
    Updates #18141.
    
    Change-Id: If681c514047afe5e1a68de6c9d40ceabbce54755
    Reviewed-on: https://go-review.googlesource.com/33721
    Run-TryBot: Quentin Smith <quentin@golang.org>
    TryBot-Result: Gobot Gobot <gobot@golang.org>
    Reviewed-by: 's avatarRuss Cox <rsc@golang.org>
    Reviewed-on: https://go-review.googlesource.com/33727
    26741a15
Name
Last commit
Last update
..
aes Loading commit data...
cipher Loading commit data...
des Loading commit data...
dsa Loading commit data...
ecdsa Loading commit data...
elliptic Loading commit data...
hmac Loading commit data...
md5 Loading commit data...
rand Loading commit data...
rc4 Loading commit data...
rsa Loading commit data...
sha1 Loading commit data...
sha256 Loading commit data...
sha512 Loading commit data...
subtle Loading commit data...
tls Loading commit data...
x509 Loading commit data...
crypto.go Loading commit data...