ca-bundle-for-firefox

#! /usr/bin/perl

use strict;
use warnings;
use Getopt::Long qw(:config bundling);
use English qw( -no_match_vars );
use Firefox::Marionette();
use FileHandle();
use Encode();

our $VERSION = '1.62';

my %options;

MAIN: {
    Getopt::Long::GetOptions(
        \%options,        'help|h',
        'version|v',      'binary|b:s',
        'file|f:s',       'issuer-organization|i',
        'trusted-only|t', 'profile-name|p:s',
        'default-profile|d',
    );
    my %parameters = _validate_options_and_parse_parameters();
    my $firefox    = Firefox::Marionette->new(%parameters);

    my $handle      = *{STDOUT};
    my $output_name = 'STDOUT';
    if ( $options{file} ) {
        $handle = FileHandle->new(
            $options{file},
            Fcntl::O_CREAT() | Fcntl::O_WRONLY() | Fcntl::O_EXCL(),
            Fcntl::S_IRUSR() | Fcntl::S_IWUSR() | Fcntl::S_IRGRP() |
              Fcntl::S_IROTH()
          )
          or die
          "Failed to open $options{file} for writing:$EXTENDED_OS_ERROR\n";
        $output_name = $options{file};
    }
    my %sort_name;
    foreach my $certificate (
        sort {
            ( $sort_name{$a} ||=
                     $options{'issuer-organization'} ? $a->issuer_organization()
                  || $a->display_name() : $a->display_name() )
              cmp( $sort_name{$b} ||=
                     $options{'issuer-organization'} ? $b->issuer_organization()
                  || $b->display_name() : $b->display_name() )
        } $firefox->certificates()
      )
    {
        if ( $certificate->is_ca_cert() ) {
            if (   ( $options{'trusted-only'} )
                && ( !$firefox->is_trusted($certificate) ) )
            {
                next;
            }
            my $output_line = q[# ]
              . (
                $options{'issuer-organization'}
                ? ( $certificate->issuer_organization()
                      || $certificate->display_name() )
                  . q[ -- ]
                : q[]
              )
              . $certificate->display_name() . "\n"
              . $firefox->certificate_as_pem($certificate) . "\n";
            $handle->print( Encode::encode( 'UTF-8', $output_line, 1 ) )
              or die "Failed to print to $output_name:$EXTENDED_OS_ERROR\n";
        }
    }
    if ( $options{file} ) {
        $handle->close()
          or die "Failed to close $output_name:$EXTENDED_OS_ERROR\n";
    }
}

sub _validate_options_and_parse_parameters {
    if ( $options{help} ) {
        require Pod::Simple::Text;
        my $parser = Pod::Simple::Text->new();
        $parser->parse_from_file($PROGRAM_NAME);
        exit 0;
    }
    elsif ( $options{version} ) {
        print "$VERSION\n"
          or die "Failed to print to STDOUT:$EXTENDED_OS_ERROR\n";
        exit 0;
    }
    my %mapping = (
        'profile-name' => 'profile_name',
        binary         => 'binary',
    );
    my %parameters;
    foreach my $key_name (qw( binary profile-name )) {
        if ( defined $options{$key_name} ) {
            $parameters{ $mapping{$key_name} } = $options{$key_name};
        }
    }
    if ( ( $parameters{profile_name} ) || ( $options{'default-profile'} ) ) {
        my $profile_name = delete $parameters{profile_name}
          || Firefox::Marionette::Profile->default_name();
        my $profile_directory =
          Firefox::Marionette::Profile->directory($profile_name);
        my $cert_db_path =
          File::Spec->catfile( $profile_directory, 'cert9.db' );
        $parameters{import_profile_paths} = [$cert_db_path];
    }
    return %parameters;
}

__END__
=head1 NAME

ca-bundle-for-firefox - generate the ca-bundle.crt for the current firefox instance

=head1 VERSION

Version 1.62

=head1 USAGE

  $ ca-bundle-for-firefox >/etc/pki/tls/certs/ca-bundle.crt
  $ ca-bundle-for-firefox --file current.crt
  $ ca-bundle-for-firefox --binary=/path/to/old/firefox --file old.crt
  $ diff -Naur old.crt current.crt
  $ ca-bundle-for-firefox --issuer-organization --trusted-only --profile-name default
  $ ca-bundle-for-firefox --issuer-organization --trusted-only --default-profile
  $ ca-bundle-for-firefox -dit

=head1 DESCRIPTION

This program is intended to generate the ca-bundle.crt file from the Certificate Authorities maintained in firefox.

By default, the only firefox version that may be used will be present in the PATH environment variable.  However, the user may specify a different path with
the --binary parameter.

=head1 REQUIRED ARGUMENTS

None

=head1 OPTIONS

Option names can be abbreviated to uniqueness and can be stated with singe or double dashes, and option values can be separated from the option name by a space or '=' (as with Getopt::Long). Option names are also case-
sensitive.

=over 4

=item * --help - This page.

=item * --binary - Use this firefox binary instead of the default firefox instance

=item * --default-profile - Use the certificate database from the default profile

=item * --issuer-organization - Print the Issuer Organisation as well as the Display Name in the comment line.  The Issuer Organisation is used in Firefox's Certificate Manager.

=item * --trusted-only - Only output certificates that are trusted in the current profile

=item * --profile-name - Use the certificate database for a particular profile

=item * --file - Write the Certificate Authority bundle out to this file

=back

=head1 CONFIGURATION

ca-bundle-for-firefox requires no configuration files or environment variables.

=head1 DEPENDENCIES

ca-bundle-for-firefox requires the following non-core Perl modules
 
=over
 
=item *
L<Pod::Simple::Text|Pod::Simple::Text>
 
=back

=head1 DIAGNOSTICS

None.

=head1 INCOMPATIBILITIES

None known.

=head1 EXIT STATUS

This program will exit with a zero after successfully completing.

=head1 BUGS AND LIMITATIONS

To report a bug, or view the current list of bugs, please visit L<https://github.com/david-dick/firefox-marionette/issues>

=head1 AUTHOR

David Dick  C<< <ddick@cpan.org> >>

=head1 LICENSE AND COPYRIGHT

Copyright (c) 2024, David Dick C<< <ddick@cpan.org> >>. All rights reserved.

This module is free software; you can redistribute it and/or
modify it under the same terms as Perl itself. See L<perlartistic/perlartistic>.

=head1 DISCLAIMER OF WARRANTY

BECAUSE THIS SOFTWARE IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
FOR THE SOFTWARE, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
PROVIDE THE SOFTWARE "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER
EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE
ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE SOFTWARE IS WITH
YOU. SHOULD THE SOFTWARE PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL
NECESSARY SERVICING, REPAIR, OR CORRECTION.

IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
REDISTRIBUTE THE SOFTWARE AS PERMITTED BY THE ABOVE LICENCE, BE
LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL,
OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE
THE SOFTWARE (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
FAILURE OF THE SOFTWARE TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
SUCH DAMAGES.