feat: cluster addons

vendor/github.com/google/certificate-transparency-go/gossip/minimal/testdata/Makefile

@@ -0,0 +1,37 @@
+all: ca
+
+# The following private keys are never regenerated.
+SERVER_PRIVKEYS=gossiper.privkey.pem
+
+# Server public keys are derived from the corresponding private keys.
+SERVER_PUBKEYS=$(subst .privkey,.pubkey,$(SERVER_PRIVKEYS))
+
+# Build public keys from private keys
+pubkeys: $(SERVER_PUBKEYS)
+gossiper.pubkey.pem: gossiper.privkey.pem
+	openssl ec -in $< -pubout -out $@ -passin pass:$(GOSSIPER_PWD)
+
+ROOT_CA_PRIVKEY=gossiper.privkey.pem
+ROOT_CA_PWD=hissing-sid
+
+ca: root-ca.cert
+
+# Fake Root CA
+root-ca.cert: gossiper.privkey.pem root-ca.cfg
+	openssl req -new -x509 -config root-ca.cfg -set_serial 0x0406cafe -days 3650 -extensions v3_ca -inform pem -key gossiper.privkey.pem -passin pass:$(ROOT_CA_PWD) -out $@
+show-ca: root-ca.cert
+	openssl x509 -inform pem -in $< -text -noout
+
+# clean removes things that regenerate exactly the same.
+clean:
+	rm -f $(SERVER_PUBKEYS)
+# distclean removes things that regenerate with changes (e.g. timestamped, randomized).
+distclean: clean
+	rm -f $(SERVER_PUBKEYS) root-ca.cert
+
+# The newkey target creates a fresh private key; should never be needed.
+newkey: fresh.privkey.pem
+fresh.privkey.pem:
+	openssl ecparam -genkey -name prime256v1 -noout -out $@.unencrypted
+	openssl ec -in $@.unencrypted -out $@ -des  # Prompts for password
+	rm -f $@.unencrypted