Embed issuer certificate in binary

This permits the program to be run from outside the source directory.

3 files changed, 21 insertions, 15 deletions

diff --git a/acme-certify.cabal b/acme-certify.cabal
index 01b0e7d..42c4192 100644
--- a/acme-certify.cabal
+++ b/acme-certify.cabal
@@ -13,12 +13,12 @@ cabal-version:       >=1.10
 
 library
   hs-source-dirs:      src
-  exposed-modules:     Network.ACME, Network.ACME.Encoding
+  exposed-modules:     Network.ACME, Network.ACME.Encoding, Network.ACME.Issuer
   build-depends:       base >= 4.7 && < 5,
                        cryptonite, aeson, bytestring, base64-bytestring, SHA,
                        mtl, text, HsOpenSSL, wreq, lens, lens-aeson, time,
                        email-validate, pipes, directory, network-uri, errors,
-                       resourcet
+                       resourcet, file-embed
   default-language:    Haskell2010
 
 executable acme-certify
diff --git a/acme-certify.hs b/acme-certify.hs
index 219b0c1..98f6711 100644
--- a/acme-certify.hs
+++ b/acme-certify.hs
@@ -16,6 +16,7 @@ import           Network.ACME          (canProvision, certify,
                                         ensureWritableDir, fileProvisioner,
                                         genReq, (</>))
 import           Network.ACME.Encoding (Keys (..), readKeys)
+import           Network.ACME.Issuer   (letsEncryptX1CrossSigned)
 import           Network.URI
 import           OpenSSL
 import           OpenSSL.DH
@@ -29,9 +30,10 @@ import           System.IO
 import           Text.Domain.Validate  hiding (validate)
 import           Text.Email.Validate
 
-stagingDirectoryUrl, liveDirectoryUrl :: URI
-Just liveDirectoryUrl = parseAbsoluteURI "https://acme-v01.api.letsencrypt.org/directory"
+stagingDirectoryUrl, liveDirectoryUrl, defaultTerms :: URI
+Just liveDirectoryUrl    = parseAbsoluteURI "https://acme-v01.api.letsencrypt.org/directory"
 Just stagingDirectoryUrl = parseAbsoluteURI "https://acme-staging.api.letsencrypt.org/directory"
+Just defaultTerms        = parseAbsoluteURI "https://letsencrypt.org/documents/LE-SA-v1.0.1-July-27-2015.pdf"
 
 main :: IO ()
 main = execParser opts >>= go
@@ -54,9 +56,6 @@ data CmdOpts = CmdOpts {
       optSkipProvisionCheck :: Bool
 }
 
-defaultTerms :: URI
-Just defaultTerms = parseAbsoluteURI "https://letsencrypt.org/documents/LE-SA-v1.0.1-July-27-2015.pdf"
-
 cmdopts :: Parser CmdOpts
 cmdopts = CmdOpts <$> strOption (long "key" <> metavar "FILE" <>
                                  help "Filename of your private RSA key")
@@ -111,26 +110,24 @@ go CmdOpts { .. } = do
       domainDir          = fromMaybe (head optDomains) optDomainDir
       privKeyFile        = optKeyFile
       requestDomains     = map domainName' optDomains
+      email              = either (error . ("Error: invalid email address: " ++)) id . validate . fromString <$> optEmail
 
-  doesDirectoryExist domainDir `otherwiseM` createDirectory domainDir
+  issuerCert <- readX509 letsEncryptX1CrossSigned
 
-  let issuerCertFile = "lets-encrypt-x1-cross-signed.pem"
-  issuerCert <- readFile issuerCertFile >>= readX509
+  seq email (return ())
+  doesDirectoryExist domainDir `otherwiseM` createDirectory domainDir
+  challengeDir <- ensureWritableDir optChallengeDir "challenge directory"
+  void $ ensureWritableDir domainDir "domain directory"
 
   Just domainKeys <- getOrCreateKeys domainKeyFile
   Just keys <- getOrCreateKeys privKeyFile
 
-  challengeDir <- ensureWritableDir optChallengeDir "challenge directory"
-  void $ ensureWritableDir domainDir "domain directory"
-
   unless optSkipProvisionCheck $
     forM_ requestDomains $ canProvision challengeDir >=>
       (`unless` error "Error: cannot provision files to web server via challenge directory")
 
   certReq <- genReq domainKeys requestDomains
 
-  let email = either (error . ("Error: invalid email address: " ++)) id . validate . fromString <$> optEmail
-
   dh <- if optSkipDH then return Nothing else Just <$> getOrCreateDH domainDhFile
 
   certificate <- certify directoryUrl keys ((,) terms <$> email) (fileProvisioner challengeDir) certReq
diff --git a/src/Network/ACME/Issuer.hs b/src/Network/ACME/Issuer.hs
new file mode 100644
index 0000000..451aa14
--- /dev/null
+++ b/src/Network/ACME/Issuer.hs
@@ -0,0 +1,9 @@
+{-# LANGUAGE TemplateHaskell #-}
+
+module Network.ACME.Issuer where
+
+import Data.ByteString.Char8
+import Data.FileEmbed
+
+letsEncryptX1CrossSigned :: String
+letsEncryptX1CrossSigned = unpack $(embedFile "lets-encrypt-x1-cross-signed.pem")