[PATCH proxmox-acme 1/3] fix #7851: acme: add missing _mktemp and restore _dbase64 default

[Mathias Bartmann <mathias.bartmann@gmail.com>]

The dns_oci.sh plugin cannot complete a DNS-01 challenge, because of two
helpers in the proxmox-acme shim that differ from upstream acme.sh:

_dbase64() only implements upstream's multiline branch and ignores its
argument. Upstream decodes with '-A' by default and only drops it when
called as '_dbase64 multiline'. dns_oci.sh calls it without argument to
decode the single-line base64 private key, so the key decodes to an
empty string ("Usage: _fingerprint privkey"). Restore the upstream
conditional; dns_cyon.sh, dns_nic.sh and dns_yc.sh pass 'multiline' and
keep their current behaviour.

_mktemp() is not defined at all. dns_oci.sh writes the key to a
temporary file to sign its requests, so every request goes out
unsigned, and OCI's 404 then surfaces as the misleading
"DNS Zone not found". dns_transip.sh uses _mktemp the same way.

Add a test that runs these helpers through the shim and compares them
with upstream semantics.

Signed-off-by: Mathias Bartmann <mathias.bartmann@gmail.com>
---
 src/proxmox-acme           | 11 ++++++++++-
 src/test/Makefile          |  2 +-
 src/test/test-shim-helpers | 34 ++++++++++++++++++++++++++++++++++
 3 files changed, 45 insertions(+), 2 deletions(-)
 create mode 100755 src/test/test-shim-helpers

diff --git a/src/proxmox-acme b/src/proxmox-acme
index 705f7df..00f4c06 100644
--- a/src/proxmox-acme
+++ b/src/proxmox-acme
@@ -15,8 +15,17 @@ _base64() {
   openssl base64 -e | tr -d '\r\n'
 }
 
+#Usage: multiline
 _dbase64() {
-  openssl base64 -d
+  if [ "$1" ]; then
+    openssl base64 -d
+  else
+    openssl base64 -d -A
+  fi
+}
+
+_mktemp() {
+  mktemp
 }
 
 # Usage: hashalg  [outputhex]
diff --git a/src/test/Makefile b/src/test/Makefile
index bfa8991..b6044c6 100644
--- a/src/test/Makefile
+++ b/src/test/Makefile
@@ -1,6 +1,6 @@
 
 .PHONY: test test-missing-functions
-test: verify-dnsapi-plugins-in-schema.pl.t verify-acme-sources-in-makefile.pl.t test-missing-functions
+test: verify-dnsapi-plugins-in-schema.pl.t verify-acme-sources-in-makefile.pl.t test-shim-helpers.t test-missing-functions
 
 %.t: %
 	./$<
diff --git a/src/test/test-shim-helpers b/src/test/test-shim-helpers
new file mode 100755
index 0000000..b625a53
--- /dev/null
+++ b/src/test/test-shim-helpers
@@ -0,0 +1,34 @@
+#!/bin/sh
+
+# Check that helpers in src/proxmox-acme behave like their acme.sh upstream
+# counterparts, as the dnsapi plugins are synced unmodified from there.
+
+SHIM="bash ../proxmox-acme"
+FAILED=0
+
+fail() {
+    echo "FAIL: $1" >&2
+    FAILED=1
+}
+
+# a single base64 line longer than openssl's 64 character line limit, like
+# the base64-encoded private key dns_oci.sh decodes with a plain _dbase64
+PLAIN=$(head -c 1500 /dev/zero | tr '\0' 'x')
+SINGLE_LINE=$(printf '%s' "$PLAIN" | openssl base64 -e | tr -d '\n')
+WRAPPED=$(printf '%s' "$PLAIN" | openssl base64 -e)
+
+[ "$(printf '%s' "$SINGLE_LINE" | $SHIM _dbase64)" = "$PLAIN" ] ||
+    fail "_dbase64 without argument does not decode a single long line"
+
+[ "$(printf '%s\n' "$WRAPPED" | $SHIM _dbase64 multiline)" = "$PLAIN" ] ||
+    fail "_dbase64 multiline does not decode line-wrapped input"
+
+TMP_FILE=$($SHIM _mktemp)
+if [ -f "$TMP_FILE" ] && [ -w "$TMP_FILE" ]; then
+    rm -f "$TMP_FILE"
+else
+    fail "_mktemp does not create a writable temporary file"
+fi
+
+[ "$FAILED" -eq 0 ] || exit 1
+echo "OK: proxmox-acme helpers behave like upstream acme.sh."
-- 
2.55.0