@@ -39,12 +39,21 @@ Terraforming the project can be done by:
39
39
2 . Run ` terragrunt apply `
40
40
41
41
## Run the SCTFE
42
+
42
43
### With fake chains
43
44
44
45
On the VM, run the following command to bring up the SCTFE:
45
46
46
47
``` bash
47
- go run ./cmd/gcp/ --project_id=${GOOGLE_PROJECT} --bucket=${GOOGLE_PROJECT} -${TESSERA_BASE_NAME} -bucket --spanner_db_path=projects/${GOOGLE_PROJECT} /instances/${TESSERA_BASE_NAME} /databases/${TESSERA_BASE_NAME} -db --spanner_dedup_db_path=projects/${GOOGLE_PROJECT} /instances/${TESSERA_BASE_NAME} /databases/${TESSERA_BASE_NAME} -dedup-db --private_key=./testdata/ct-http-server.privkey.pem --password=dirk --roots_pem_file=./testdata/fake-ca.cert --origin=${TESSERA_BASE_NAME}
48
+ go run ./cmd/gcp/ \
49
+ --project_id=${GOOGLE_PROJECT} \
50
+ --bucket=${GOOGLE_PROJECT} -${TESSERA_BASE_NAME} -bucket \
51
+ --spanner_db_path=projects/${GOOGLE_PROJECT} /instances/${TESSERA_BASE_NAME} /databases/${TESSERA_BASE_NAME} -db \
52
+ --spanner_dedup_db_path=projects/${GOOGLE_PROJECT} /instances/${TESSERA_BASE_NAME} /databases/${TESSERA_BASE_NAME} -dedup-db \
53
+ --private_key=./testdata/ct-http-server.privkey.pem \
54
+ --password=dirk \
55
+ --roots_pem_file=./testdata/fake-ca.cert \
56
+ --origin=${TESSERA_BASE_NAME}
48
57
```
49
58
50
59
In a different terminal you can either mint and submit certificates manually, or
@@ -71,6 +80,7 @@ go run github.com/google/certificate-transparency-go/client/ctclient@master uplo
71
80
```
72
81
73
82
#### Automatically generate chains
83
+
74
84
Save the SCTFE repo's path:
75
85
76
86
``` bash
@@ -80,10 +90,26 @@ export SCTFE_REPO=$(pwd)
80
90
Clone the [ certificate-transparency-go] ( https://github.com/google/certificate-transparency-go ) repo, and from there run:
81
91
82
92
``` bash
83
- go run ./trillian/integration/ct_hammer/ --ct_http_servers=localhost:6962/${TESSERA_BASE_NAME} --max_retry=2m --invalid_chance=0 --get_sth=0 --get_sth_consistency=0 --get_proof_by_hash=0 --get_entries=0 --get_roots=0 --get_entry_and_proof=0 --max_parallel_chains=4 --skip_https_verify=true --operations=10000 --rate_limit=150 --log_config=${SCTFE_REPO} /testdata/hammer.cfg --testdata_dir=./trillian/testdata/
93
+ go run ./trillian/integration/ct_hammer/ \
94
+ --ct_http_servers=localhost:6962/${TESSERA_BASE_NAME} \
95
+ --max_retry=2m \
96
+ --invalid_chance=0 \
97
+ --get_sth=0 \
98
+ --get_sth_consistency=0 \
99
+ --get_proof_by_hash=0 \
100
+ --get_entries=0 \
101
+ --get_roots=0 \
102
+ --get_entry_and_proof=0 \
103
+ --max_parallel_chains=4 \
104
+ --skip_https_verify=true \
105
+ --operations=10000 \
106
+ --rate_limit=150 \
107
+ --log_config=${SCTFE_REPO} /testdata/hammer.cfg \
108
+ --testdata_dir=./trillian/testdata/
84
109
```
85
110
86
111
### With real HTTPS certificates
112
+
87
113
We'll run a SCTFE and copy certificates from an existing RFC6962 log to it.
88
114
It uses the [ ct_hammer tool from certificate-transparency-go] ( https://github.com/google/certificate-transparency-go/tree/aceb1d4481907b00c087020a3930c7bd691a0110/trillian/integration/ct_hammer ) .
89
115
@@ -110,13 +136,36 @@ Run the SCTFE with the same roots:
110
136
111
137
``` bash
112
138
cd ${SCTFE_REPO}
113
- go run ./cmd/gcp/ --project_id=${GOOGLE_PROJECT} --bucket=${GOOGLE_PROJECT} -${TESSERA_BASE_NAME} -bucket --spanner_db_path=projects/${GOOGLE_PROJECT} /instances/${TESSERA_BASE_NAME} /databases/${TESSERA_BASE_NAME} -db --private_key=./testdata/ct-http-server.privkey.pem --password=dirk --roots_pem_file=/tmp/hammercfg/roots.pem --origin=${TESSERA_BASE_NAME} --spanner_dedup_db_path=projects/${GOOGLE_PROJECT} /instances/${TESSERA_BASE_NAME} /databases/${TESSERA_BASE_NAME} -dedup-db -v=3
139
+ go run ./cmd/gcp/ \
140
+ --project_id=${GOOGLE_PROJECT} \
141
+ --bucket=${GOOGLE_PROJECT} -${TESSERA_BASE_NAME} -bucket \
142
+ --spanner_db_path=projects/${GOOGLE_PROJECT} /instances/${TESSERA_BASE_NAME} /databases/${TESSERA_BASE_NAME} -db \
143
+ --private_key=./testdata/ct-http-server.privkey.pem \
144
+ --password=dirk \
145
+ --roots_pem_file=/tmp/hammercfg/roots.pem \
146
+ --origin=${TESSERA_BASE_NAME} \
147
+ --spanner_dedup_db_path=projects/${GOOGLE_PROJECT} /instances/${TESSERA_BASE_NAME} /databases/${TESSERA_BASE_NAME} -dedup-db \
148
+ -v=3
114
149
```
115
150
116
151
Run ` ct_hammer ` in a different terminal:
117
152
118
153
``` bash
119
154
cd ${CTGO_REPO}
120
- go run ./trillian/integration/ct_hammer/ --ct_http_servers=localhost:6962/${TESSERA_BASE_NAME} --max_retry=2m --invalid_chance=0 --get_sth=0 --get_sth_consistency=0 --get_proof_by_hash=0 --get_entries=0 --get_roots=0 --get_entry_and_proof=0 --max_parallel_chains=4 --skip_https_verify=true --operations=10000 --rate_limit=150 --log_config=/tmp/hammercfg/hammer.cfg --src_log_uri=${SRC_LOG_URI}
155
+ go run ./trillian/integration/ct_hammer/ \
156
+ --ct_http_servers=localhost:6962/${TESSERA_BASE_NAME} \
157
+ --max_retry=2m \
158
+ --invalid_chance=0 \
159
+ --get_sth=0 \
160
+ --get_sth_consistency=0 \
161
+ --get_proof_by_hash=0 \
162
+ --get_entries=0 \
163
+ --get_roots=0 \
164
+ --get_entry_and_proof=0 \
165
+ --max_parallel_chains=4 \
166
+ --skip_https_verify=true \
167
+ --operations=10000 \
168
+ --rate_limit=150 \
169
+ --log_config=/tmp/hammercfg/hammer.cfg \
170
+ --src_log_uri=${SRC_LOG_URI}
121
171
```
122
-
0 commit comments