Init commit
This commit is contained in:
Zhong Lufan
commit
40a1679bda
|
|
@ -0,0 +1,12 @@
|
||||||
|
root = true
|
||||||
|
|
||||||
|
[*]
|
||||||
|
charset = utf-8
|
||||||
|
end_of_line = lf
|
||||||
|
indent_size = 4
|
||||||
|
indent_style = space
|
||||||
|
insert_final_newline = true
|
||||||
|
trim_trailing_whitespace = true
|
||||||
|
|
||||||
|
[*.md]
|
||||||
|
trim_trailing_whitespace = false
|
||||||
|
|
@ -0,0 +1,3 @@
|
||||||
|
.vscode/
|
||||||
|
.idea/
|
||||||
|
.DS_Store
|
||||||
|
|
@ -0,0 +1,87 @@
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
for c in openssl curl python3; do
|
||||||
|
if ! command -v ${c} > /dev/null; then
|
||||||
|
echo "${c}: command not found"
|
||||||
|
exit 127
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
_AliAccessKeyId=$(printenv AliAccessKeyId)
|
||||||
|
_AliAccessKeySecret=$(printenv AliAccessKeySecret)
|
||||||
|
_Format=JSON
|
||||||
|
_SignatureMethod=HMAC-SHA1
|
||||||
|
_SignatureVersion=1.0
|
||||||
|
_urlencode_pycode="from sys import stdin;from urllib.parse import quote;print(quote(stdin.read(), '-_.~'))"
|
||||||
|
|
||||||
|
# aliapi_rpc <host> <http_method> <api_version> <api_action> <api_custom_key[]> <api_custom_value[]>
|
||||||
|
aliapi_rpc() {
|
||||||
|
[[ $# -lt 6 ]] && return 66
|
||||||
|
# 公共查询参数键
|
||||||
|
local _ali_common_key=(
|
||||||
|
"Format"
|
||||||
|
"AccessKeyId"
|
||||||
|
"SignatureMethod"
|
||||||
|
"Timestamp"
|
||||||
|
"SignatureVersion"
|
||||||
|
"SignatureNonce"
|
||||||
|
"Version"
|
||||||
|
"Action"
|
||||||
|
)
|
||||||
|
# 公共查询参数值
|
||||||
|
local _ali_common_value=(
|
||||||
|
"$_Format"
|
||||||
|
"$_AliAccessKeyId"
|
||||||
|
"$_SignatureMethod"
|
||||||
|
"$(_ali_sign_timestamp)"
|
||||||
|
"$_SignatureVersion"
|
||||||
|
"$(_ali_sign_nonce)"
|
||||||
|
"$3"
|
||||||
|
"$4"
|
||||||
|
)
|
||||||
|
local _ali_custom_key=() _ali_custom_value=() # 自定义查询参数键值
|
||||||
|
read -r -a _ali_custom_key <<< "$5"
|
||||||
|
read -r -a _ali_custom_value <<< "$6"
|
||||||
|
local _ali_key=() _ali_value=() # 合并查询键值
|
||||||
|
read -r -a _ali_key <<< "${_ali_common_key[*]} ${_ali_custom_key[*]}"
|
||||||
|
read -r -a _ali_value <<< "${_ali_common_value[*]} ${_ali_custom_value[*]}"
|
||||||
|
local _http_host=$1 _http_method=$2
|
||||||
|
local _query_str=""
|
||||||
|
local _key _value
|
||||||
|
for (( i = 0; i < ${#_ali_key[@]}; ++i )); do
|
||||||
|
_key=${_ali_key[$i]}
|
||||||
|
_value=${_ali_value[$i]}
|
||||||
|
[[ $(grep -E "^.+\(\)$" <<< "$_value") == "$_value" ]] && _value=$(${_value//()/}) # 参数值如果是以 () 结束，代表需要执行命令获取值。
|
||||||
|
_value=$(_urlencode "$_value")
|
||||||
|
_query_str+="$_key=$_value&"
|
||||||
|
done
|
||||||
|
local _ali_signature
|
||||||
|
_ali_signature=$(_ali_sign "$_http_method" "$_query_str")
|
||||||
|
_query_str+="Signature=$(_urlencode "$_ali_signature")"
|
||||||
|
local _curl_out _result_code _http_url="https://${_http_host}/?${_query_str}"
|
||||||
|
_curl_out=$(mktemp)
|
||||||
|
_result_code=$(curl -L -s -X "$_http_method" -o "$_curl_out" --write-out "%{http_code}" "$_http_url" || echo $?)
|
||||||
|
cat "$_curl_out" && echo
|
||||||
|
rm -f "$_curl_out"
|
||||||
|
[[ ${_result_code} -eq 200 ]] && return 0 || return 1
|
||||||
|
}
|
||||||
|
|
||||||
|
_ali_sign() {
|
||||||
|
local _http_method _str _query_str _sign_str
|
||||||
|
_http_method=$1
|
||||||
|
_str=$(echo -n "$2" | tr "&" "\n" | sort)
|
||||||
|
_query_str=$(echo -n "$_str" | tr "\n" "&")
|
||||||
|
_sign_str="${_http_method}&$(_urlencode "/")&$(_urlencode "$_query_str")"
|
||||||
|
echo -n "$_sign_str" | openssl sha1 -hmac "${_AliAccessKeySecret}&" -binary | openssl base64 -e
|
||||||
|
}
|
||||||
|
|
||||||
|
_ali_sign_timestamp() {
|
||||||
|
TZ="UTC" date "+%FT%TZ"
|
||||||
|
}
|
||||||
|
|
||||||
|
_ali_sign_nonce() {
|
||||||
|
date "+%s%N"
|
||||||
|
}
|
||||||
|
|
||||||
|
_urlencode() {
|
||||||
|
echo -n "$1" | python3 -c "$_urlencode_pycode"
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,21 @@
|
||||||
|
MIT License
|
||||||
|
|
||||||
|
Copyright (c) 2019-2020 Zhong Lufan
|
||||||
|
|
||||||
|
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||||
|
of this software and associated documentation files (the "Software"), to deal
|
||||||
|
in the Software without restriction, including without limitation the rights
|
||||||
|
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||||
|
copies of the Software, and to permit persons to whom the Software is
|
||||||
|
furnished to do so, subject to the following conditions:
|
||||||
|
|
||||||
|
The above copyright notice and this permission notice shall be included in all
|
||||||
|
copies or substantial portions of the Software.
|
||||||
|
|
||||||
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||||
|
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||||
|
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||||
|
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||||
|
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||||
|
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||||
|
SOFTWARE.
|
||||||
|
|
@ -0,0 +1,65 @@
|
||||||
|
Aliyun OpenAPI Shell SDK
|
||||||
|
--
|
||||||
|
# 介绍
|
||||||
|
|
||||||
|
这是一个非官方的阿里云 OpenAPI Shell SDK，目的是方便 Shell 脚本直接调用阿里云 OpenAPI，主要是实现了自动计算签名。
|
||||||
|
|
||||||
|
虽然阿里云官方有 [AliyunCLI](https://github.com/aliyun/aliyun-cli)，可以方便的在 Shell 环境下调用阿里云 OpenAPI。不过某些 API (比如 SSL 证书) 它并不支持，所以我就想写一个可能是最好用的 Shell SDK。
|
||||||
|
|
||||||
|
这个 SDK 理论上支持所有阿里云 RPC OpenAPI，RESTful OpenAPI 暂不支持，因为我暂时没用到，以后可能会考虑支持。
|
||||||
|
|
||||||
|
# 依赖
|
||||||
|
|
||||||
|
SDK 主要依赖于 `curl`, `openssl`, `python3`
|
||||||
|
|
||||||
|
其中 `python3` 用于 `urlencode`，因为纯 Shell 实现的 `urlencode` 可用性较低，索性就直接调用 Python 实现，内部的 Python 代码不兼容 Python2，只能运行于 Python3。
|
||||||
|
|
||||||
|
# 使用
|
||||||
|
|
||||||
|
使用起来非常简单，只需要在你的 Shell 脚本顶部导出`AliAccessKeyId` 和 `AliAccessKeySecret` 环境变量，然后引用 `AliyunOpenAPI.sh` 即可。
|
||||||
|
|
||||||
|
```bash
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
# 务必使用 export 导出
|
||||||
|
export AliAccessKeyId="<AliAccessKeyId>" # 此处替换为你的阿里云 AliAccessKeyId
|
||||||
|
export AliAccessKeySecret="<AliAccessKeySecret>" # 此处替换为你的阿里云 AliAccessKeySecret
|
||||||
|
|
||||||
|
. AliyunOpenAPI.sh
|
||||||
|
|
||||||
|
# 自定义 GET 参数的键值顺序要一一对应，而且不能包含空格。
|
||||||
|
# 自定义值支持自定义函数，如果你需要包含空格或者读取文件等操作，可以声明一个自定义函数，然后按照此格式填写：函数名()，就比如下面这样。
|
||||||
|
# SDK 在处理值的时候会自动执行自定义函数，但是如果自定义函数不存在则会导致获取值失败。
|
||||||
|
|
||||||
|
get_show_size() {
|
||||||
|
echo 50
|
||||||
|
}
|
||||||
|
|
||||||
|
# 自定义 GET 参数的键
|
||||||
|
ali_custom_key=(
|
||||||
|
"CurrentPage"
|
||||||
|
"ShowSize"
|
||||||
|
)
|
||||||
|
# 自定义 GET 参数的值
|
||||||
|
ali_custom_value=(
|
||||||
|
"1"
|
||||||
|
"get_show_size()"
|
||||||
|
)
|
||||||
|
# 获取阿里云 SSL 证书列表
|
||||||
|
# aliapi_rpc 的函数签名如下
|
||||||
|
# aliapi_rpc <host> <http_method> <api_version> <api_action> <api_custom_key[]> <api_custom_value[]>
|
||||||
|
aliapi_rpc "cas.aliyuncs.com" "GET" "2018-07-13" "DescribeUserCertificateList" "${ali_custom_key[*]}" "${ali_custom_value[*]}"
|
||||||
|
# 可以通过 $? 是否等于 0 来判断是否执行成功（HTTP CODE == 200）
|
||||||
|
# 执行成功返回 JSON 格式的结果，执行失败返回 HTTP CODE 或 curl 的退出代码。
|
||||||
|
if [[ $? -eq 0 ]]; then
|
||||||
|
# 执行成功
|
||||||
|
else
|
||||||
|
# 执行失败
|
||||||
|
fi
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
更多使用方法可以参考 `example` 下的示例
|
||||||
|
|
||||||
|
如果你有好的示例，欢迎提交 [PR](https://github.com/Hill-98/aliyun-openapi-shell-sdk/pulls)
|
||||||
|
|
||||||
|
如果你有问题 / BUG 要反馈，也欢迎提交 [Issue](https://github.com/Hill-98/aliyun-openapi-shell-sdk/issues)
|
||||||
|
|
@ -0,0 +1,92 @@
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
# 可用于 acme.sh 的 renewHook 脚本，可以自动更新阿里云 SSL 证书并更新对应 CDN 域名，然后删除对应域名旧的证书。
|
||||||
|
# 每次 API 的执行都会检测是否失败，如果失败，会中断脚本执行并返回自定义错误代码
|
||||||
|
|
||||||
|
# acme.sh 导出的环境变量
|
||||||
|
ENV_NAME=(
|
||||||
|
"CERT_PATH"
|
||||||
|
"CERT_KEY_PATH"
|
||||||
|
"CA_CERT_PATH"
|
||||||
|
"CERT_FULLCHAIN_PATH"
|
||||||
|
"Le_Domain"
|
||||||
|
)
|
||||||
|
# 检查环境变量是否存在
|
||||||
|
for value in "${ENV_NAME[@]}" ; do
|
||||||
|
printenv "$value" > /dev/null || exit 1
|
||||||
|
done
|
||||||
|
|
||||||
|
# 获取证书自定义函数
|
||||||
|
get_cert() {
|
||||||
|
sed -e "/^$/d" "$(printenv CERT_FULLCHAIN_PATH)" # 使用 sed 删除掉证书文件的空行
|
||||||
|
}
|
||||||
|
# 获取密钥自定义函数
|
||||||
|
get_key() {
|
||||||
|
cat "$(printenv CERT_KEY_PATH)"
|
||||||
|
}
|
||||||
|
|
||||||
|
# 导出 AliAccessKeyId 和 AliAccessKeySecret
|
||||||
|
export AliAccessKeyId="<AliAccessKeyId>"
|
||||||
|
export AliAccessKeySecret="<AliAccessKeySecret>"
|
||||||
|
|
||||||
|
DOMAIN=$(printenv Le_Domain)
|
||||||
|
CERT_NAME="${DOMAIN}-$(date +%s)" # 证书名称
|
||||||
|
# 需要更新证书的 CDN 域名列表
|
||||||
|
DOMAIN_LIST=(
|
||||||
|
"example.example.com"
|
||||||
|
)
|
||||||
|
# shellcheck disable=SC1091
|
||||||
|
. ../AliyunOpenAPI.sh
|
||||||
|
|
||||||
|
ali_custom_name=(
|
||||||
|
"CurrentPage"
|
||||||
|
"ShowSize"
|
||||||
|
)
|
||||||
|
# 获取第一页的 50 个结果，如果你的证书列表条目较多，可以考虑增加获取数量。
|
||||||
|
ali_custom_value=(
|
||||||
|
"1"
|
||||||
|
"50"
|
||||||
|
)
|
||||||
|
# 获取证书列表
|
||||||
|
result=$(aliapi_rpc "cas.aliyuncs.com" "GET" "2018-07-13" "DescribeUserCertificateList" "${ali_custom_name[*]}" "${ali_custom_value[*]}" || exit 101)
|
||||||
|
# 使用 jq 处理返回的 JSON 数据并提取出匹配当前证书域名的证书列表的 ID，用于稍后的删除旧证书操作。
|
||||||
|
cert_list=$(echo "$result" | jq -cr ".CertificateList|map(select(.common == \"${DOMAIN}\"))|map(.id)|.[]")
|
||||||
|
ali_custom_name=(
|
||||||
|
"Cert"
|
||||||
|
"Key"
|
||||||
|
"Name"
|
||||||
|
)
|
||||||
|
# 使用自定义函数获取证书和密钥，保证内容可以被安全的传递过去
|
||||||
|
ali_custom_value=(
|
||||||
|
"get_cert()"
|
||||||
|
"get_key()"
|
||||||
|
"$CERT_NAME"
|
||||||
|
)
|
||||||
|
# 上传新的证书
|
||||||
|
aliapi_rpc "cas.aliyuncs.com" "GET" "2018-07-13" "CreateUserCertificate" "${ali_custom_name[*]}" "${ali_custom_value[*]}" || exit 102
|
||||||
|
# 设置 CDN 域名列表使用新的证书
|
||||||
|
for domain in "${DOMAIN_LIST[@]}"; do
|
||||||
|
ali_custom_name=(
|
||||||
|
"DomainName"
|
||||||
|
"ServerCertificateStatus"
|
||||||
|
"CertName"
|
||||||
|
"CertType"
|
||||||
|
)
|
||||||
|
ali_custom_value=(
|
||||||
|
"$domain"
|
||||||
|
"on"
|
||||||
|
"$CERT_NAME"
|
||||||
|
"cas"
|
||||||
|
)
|
||||||
|
aliapi_rpc "cdn.aliyuncs.com" "GET" "2018-05-10" "SetDomainServerCertificate" "${ali_custom_name[*]}" "${ali_custom_value[*]}" || _exit 103 "Set cdn domain cert fail: $domain"
|
||||||
|
done
|
||||||
|
# 删除旧的证书
|
||||||
|
for id in ${cert_list}; do
|
||||||
|
ali_custom_name=(
|
||||||
|
"CertId"
|
||||||
|
)
|
||||||
|
ali_custom_value=(
|
||||||
|
"$id"
|
||||||
|
)
|
||||||
|
aliapi_rpc "cas.aliyuncs.com" "GET" "2018-07-13" "DeleteUserCertificate" "${ali_custom_name[*]}" "${ali_custom_value[*]}" || _exit 104 "Delete old cert fail: $id"
|
||||||
|
done
|
||||||
Loading…
Reference in New Issue