Expiration warning

[hboetes]

Now that we are on the topic of expiration:

han@it1notebook ~ %  sudo openssl x509 -in /var/lib/sbctl/keys/db/db.pem -noout -dates
notBefore=Feb  8 06:26:59 2025 GMT
notAfter=Feb  8 06:26:59 2030 GMT

Is there an automated warning if your keys are about to expire? If not, I'd like to make a feature request.

[Foxboron]

There is no expiration warnings in sbctl. How would you want this to look?

[hboetes]

I guess something like:

#!/bin/bash
WARN_DAYS=90
for key in /var/lib/sbctl/keys/*/; do
    pem="${key}$(basename ${key}).pem"
    expiry=$(openssl x509 -in "$pem" -noout -enddate | cut -d= -f2)
    expiry_epoch=$(date -d "$expiry" +%s)
    now_epoch=$(date +%s)
    days_left=$(( (expiry_epoch - now_epoch) / 86400 ))
    if [ $days_left -le $WARN_DAYS ]; then
        printf '\e[31m+----------\n| WARNING: Your sbctl signing key %s is about to expire (%d days)\n+----------\e[0m\n' "$pem" "$days_left"
    fi
done

[Foxboron]

Posting bash scripts is not super helpful. It's better if you explain how you expect to get this information.

[hboetes]

It was meant as pseudocode, the things to run when sbctl is triggered by a kernel upgrade, or when you run sbctl in general to request for example the status.