EASYRSA_NO_PASS conflict with --passin and --passout

[seblu]

In the current master, we can define EASYRSA_NO_PASS in the vars file to enable globally --nopass.

# Set no password mode - This will create the entire PKI without passwords.
# This can be better managed by choosing which entity private keys should be
# encrypted with the following command line options:
# Global option '--no-pass' or command option 'nopass'.
#
set_var EASYRSA_NO_PASS	1

but the code checking for mutual exclusions is before loading variables from the vars file.

# Mutual exclusions
# --nopass cannot be used with --passin and --passout
if [ "$EASYRSA_NO_PASS" ] && \
        { [ "$EASYRSA_PASSIN" ] || [ "$EASYRSA_PASSOUT" ]; }
then
        die "* Cannot use --nopass with --passin or --passout"
fi

# Intelligent env-var detection and auto-loading:
vars_setup

As a consequence, a command exporting a pkcs12 file is generated with blank password with no warning.

./easyrsa --passout=file:<(echo iloveseblu) export-p12 "$cn"

In this case of exporting a p12, most UI do not accept empty password, and the best UX for easyrsa would be to let the global variable EASYRSA_NO_PASS to be overrided by command line when needed.

[TinCanTech]

@seblu Thank you for reporting this issue.

I understand the issue and think your proposal is a good approach:

• Remove the mutual exlusion and allow global options --passin/--passout to take priority over --no-pass.

[TinCanTech]

Here is a draft patch to test:

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index eff4b7b..40914e8 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -5316,17 +5316,19 @@ case "$cmd" in
                unset -v no_pki_required
 esac
 
+# Intelligent env-var detection and auto-loading:
+vars_setup
+
 # Mutual exclusions
 # --nopass cannot be used with --passin and --passout
 if [ "$EASYRSA_NO_PASS" ] && \
        { [ "$EASYRSA_PASSIN" ] || [ "$EASYRSA_PASSOUT" ]; }
 then
-       die "* Cannot use --nopass with --passin or --passout"
+       # Allow --passin/--passout to take priority over --nopass
+       unset -v EASYRSA_NO_PASS
+       #die "* Cannot use --nopass with --passin or --passout"
 fi
 
-# Intelligent env-var detection and auto-loading:
-vars_setup
-
 # determine how we were called, then hand off to the function responsible
 case "$cmd" in
        init-pki|clean-all)

[TinCanTech]

Testing #839 welcome.

[TinCanTech]

Linking #733