/* Provenance: openssl/openssl link_hash_cert (fixed).
 * repo: openssl/openssl
 * commit: 1ad73b4d27bd8c1b369a3cd453681d3a4f1bb9b2
 * parent: 7d56a74a96828985db7354a55227a511615f732b
 * commit_url: https://github.com/openssl/openssl/commit/1ad73b4d27bd8c1b369a3cd453681d3a4f1bb9b2
 * cve: CVE-2022-1292
 * license: Apache-2.0
 * function: link_hash_cert
 * relpath: tools/c_rehash.in
 */

sub link_hash_cert {
    my $fname = $_[0];
    my ($hash, $fprint) = compute_hash($openssl, "x509", $x509hash,
                                       "-fingerprint", "-noout",
                                       "-in", $fname);
    chomp $hash;
    chomp $fprint;
    return if !$hash;
    $fprint =~ s/^.*=//;
    $fprint =~ tr/://d;
    my $suffix = 0;
    # Search for an unused hash filename
    while(exists $hashlist{"$hash.$suffix"}) {
        # Hash matches: if fingerprint matches its a duplicate cert
        if ($hashlist{"$hash.$suffix"} eq $fprint) {
            print STDERR "WARNING: Skipping duplicate certificate $fname\n";
            return;
        }
        $suffix++;
    }
    $hash .= ".$suffix";
    if ($symlink_exists) {
        print "link $fname -> $hash\n" if $verbose;
        symlink $fname, $hash || warn "Can't symlink, $!";
    } else {
        print "copy $fname -> $hash\n" if $verbose;
        if (open($in, "<", $fname)) {
            if (open($out,">", $hash)) {
                print $out $_ while (<$in>);
                close $out;
            } else {
                warn "can't open $hash for write, $!";
            }
            close $in;
        } else {
            warn "can't open $fname for read, $!";
        }
    }
    $hashlist{$hash} = $fprint;
}