Home

Awesome

certificate-transparency: Auditing for TLS certificates

This repository is no longer actively maintained.

The CT log server and client written in Go are available at google/trillian and google/certificate-transparency-go.


Introduction

This repository holds open-source code for functionality related to certificate transparency (CT). The main areas covered are:

The supported platforms are:

C++ Log Server Deprecation Notice

The CT log server implementation which used to be in this repository is no longer under active development. We recommend that new deployments use the new Go based server, which can handle much larger Merkle trees:

CT Personality Generic Backend

For more information on why we recommend this see the Deprecation Notes

N.B. This notice refers to the servers only, not the other client code in this repository.

Build Quick Start

First, ensure that the build machine has all of the required build dependencies. Then use gclient to retrieve and build the other software needed by the Log, and then use (GNU) make to build and test the CT code:

export CXX=clang++ CC=clang
mkdir ct  # or whatever directory you prefer
cd ct
gclient config --name="certificate-transparency" https://github.com/google/certificate-transparency.git
gclient sync --disable-syntax-validation  # retrieve and build dependencies
# substitute gmake or gnumake below if that's what your platform calls it:
make -C certificate-transparency check  # build the CT software & self-test

Code Layout

The source code is generally arranged according to implementation language, in the cpp and python subdirectories. (Java and Go code are in separate repositories.)

The key subdirectories are:

Building the Code

The CT software in this repository relies on a number of other open-source projects, and we recommend that:

The supported build system uses the gclient tool from the Chromium project to handle these requirements and to ensure a reliable, reproducible build. Older build instructions for using Ubuntu or Fedora packages and for manually building dependencies from source are no longer supported.

Within a main top-level directory, gclient handles the process of:

Under the covers, this gclient build process is controlled by:

Build Dependencies

The following tools are needed to build the CT software and its dependencies.

The exact packages required to install these tools depends on the platform. For a Debian-based system, the relevant packages are: autoconf automake libtool shtool cmake clang git make tcl pkg-config python2.7

Software Dependencies

The following collections of additional software are used by the main CT Log codebase.

Build Troubleshooting

Compiler Warnings/Errors

The CT C++ codebase is built with the Clang -Werror flag so that the codebase stays warning-free. However, this can cause build errors when newer/different versions of the C++ compiler are used, as any newly created warnings are treated as errors. To fix this, add the appropriate -Wno-error=<warning-name> option to CXXFLAGS.

For example, on errors involving unused variables try using:

CXXFLAGS="-O2 -Wno-error=unused-variable" gclient sync

If an error about an unused typedef in a glog header file occurs, try this:

CXXFLAGS="-O2 -Wno-error=unused-variable -Wno-error=unused-local-typedefs" gclient sync

When changing CXXFLAGS it's safer to remove the existing build directories in case not all dependencies are properly accounted for and rebuilt. If problems persist, check that the Makefile in certificate-transparency contains the options that were passed in CXXFLAGS.

Working on a Branch

If you're trying to clone from a branch on the CT repository then you'll need to substitute the following command for the gclient config command above, replacing branch as appropriate

gclient config --name="certificate-transparency" https://github.com/google/certificate-transparency.git@branch

Then continue the build process with the gclient sync step.

Testing the Code

Unit Tests

The unit tests for the CT code can be run with the make check target of certificate-transparency/Makefile.

Testing and Logging Options

Note that several tests write files on disk. The default directory for storing temporary testdata is /tmp. You can change this by setting TMPDIR=<tmpdir> for make.

End-to-end tests also create temporary certificate and server files in test/tmp. All these files are cleaned up after a successful test run.

For logging options, see the glog documentation.

By default, unit tests log to stderr, and log only messages with a FATAL level (i.e., those that result in abnormal program termination). You can override the defaults with command-line flags.