Formatting and cleanup

Author: breml

embedded/rootcerts_test.go

@@ -12,10 +12,12 @@ import (
 func parsePEM(pemCerts []byte) (certs []*x509.Certificate, err error) {
 	for len(pemCerts) > 0 {
 		var block *pem.Block
+
 		block, pemCerts = pem.Decode(pemCerts)
 		if block == nil {
 			break
 		}
+
 		if block.Type != "CERTIFICATE" || len(block.Headers) != 0 {
 			continue
 		}
@@ -24,14 +26,13 @@ func parsePEM(pemCerts []byte) (certs []*x509.Certificate, err error) {
 		if err != nil {
 			return nil, err
 		}
+
 		certs = append(certs, cert)
 	}
 	return
 }
 
 func checkRootCertsPEM(t *testing.T, pemCerts []byte, whenFail time.Time, whenWarn time.Time) (ok bool) {
-	const warnEmoji = "\u26a0\ufe0f"
-	// t.Logf("%#v %[1]x %x", warnEmoji, []rune(warnEmoji))
 	now := time.Now()
 	t.Logf("Checking certificate validity on %s...", whenFail)
 	certs, err := parsePEM(pemCerts)
@@ -46,6 +47,7 @@ func checkRootCertsPEM(t *testing.T, pemCerts []byte, whenFail time.Time, whenWa
 	}
 
 	var minExpires time.Time
+	var minExpiresName string
 	ok = true
 	for _, cert := range certs {
 		name := cert.Subject.CommonName
@@ -57,42 +59,53 @@ func checkRootCertsPEM(t *testing.T, pemCerts []byte, whenFail time.Time, whenWa
 		}
 
 		if !cert.IsCA {
-			t.Errorf("\u274C %s: not a certificate authority", name)
+			t.Errorf("❌ %s: not a certificate authority", name)
 		}
+
 		const keyUsageExpected = x509.KeyUsageCertSign | x509.KeyUsageCRLSign | x509.KeyUsageDigitalSignature
 		if (cert.KeyUsage &^ keyUsageExpected) != 0 {
-			t.Logf(warnEmoji+" %s: unexpected key usage %#x (expecting %#x, see constants at https://pkg.go.dev/crypto/x509#KeyUsage)", name, cert.KeyUsage, keyUsageExpected)
+			t.Logf("⚠️ %s: unexpected key usage %#x (expecting %#x, see constants at https://pkg.go.dev/crypto/x509#KeyUsage)", name, cert.KeyUsage, keyUsageExpected)
 		}
+
 		if minExpires.IsZero() || cert.NotAfter.Before(minExpires) {
 			minExpires = cert.NotAfter
+			minExpiresName = name
 		}
+
 		// Check that the certificate is valid now
 		if cert.NotBefore.After(now) {
-			t.Errorf("\u274C %s: fails NotBefore check: %s", name, cert.NotBefore)
+			t.Errorf("❌ %s: fails NotBefore check: %s", name, cert.NotBefore)
 			continue
 		}
+
 		// ... and that it will still be valid later
 		if cert.NotAfter.Before(whenFail) {
-			t.Errorf("\u274C %s: fails NotAfter check: %s", name, cert.NotAfter)
+			t.Errorf("❌ %s: fails NotAfter check: %s", name, cert.NotAfter)
 			continue
-		} else if cert.NotAfter.Before(whenWarn) {
-			t.Logf(warnEmoji+" %s: fails NotAfter check: %s", name, cert.NotAfter)
 		}
+
+		if cert.NotAfter.Before(whenWarn) {
+			t.Logf("⚠️ %s: fails NotAfter check: %s", name, cert.NotAfter)
+		}
+
 		_, err := cert.Verify(x509.VerifyOptions{
 			Roots:       roots,
 			CurrentTime: whenFail,
 		})
 		if err != nil {
-			t.Errorf("\u274C %s: %s", name, err)
+			t.Errorf("❌ %s: %s", name, err)
 			ok = false
-		} else {
-			t.Logf("\u2705 %s (expires: %s)", name, cert.NotAfter)
+			continue
 		}
+
+		t.Logf("✅ %s (expires: %s)", name, cert.NotAfter)
 	}
+
 	if ok {
 		t.Log("Success.")
-		t.Logf("MinExpire: %s", minExpires)
+		t.Logf("MinExpire: %s (Certificate: %s)", minExpires, minExpiresName)
 	}
+
 	return
 }
 
@@ -101,5 +114,5 @@ func TestCerts(t *testing.T) {
 	checkRootCertsPEM(t, []byte(embedded.MozillaCACertificatesPEM()), time.Now().AddDate(0, 1, 0), time.Now().AddDate(0, 3, 0))
 
 	// Should fail
-	//checkRootCertsPEM(t, []byte(embedded.MozillaCACertificatesPEM()), time.Now().AddDate(20, 0, 0), time.Now().AddDate(30, 0, 0))
+	// checkRootCertsPEM(t, []byte(embedded.MozillaCACertificatesPEM()), time.Now().AddDate(20, 0, 0), time.Now().AddDate(30, 0, 0))
 }