Repository: istio/istio
File: security/pkg/nodeagent/cache/secretcache.go (Go)

Code before:
	b, err := os.ReadFile(filePath)
	if err != nil || len(b) == 0 {
		return false
	}
	return true
}

// If there is an existing private key and certificate under a well known path, return true.
// Otherwise, return false.
func (sc *SecretManagerClient) keyCertificateExist(certPath, keyPath string) bool {
	b, err := os.ReadFile(certPath)
	if err != nil || len(b) == 0 {
		return false
	}
	b, err = os.ReadFile(keyPath)
	if err != nil || len(b) == 0 {
		return false
	}

	return true
}

// Generate a root certificate item from the passed in rootCertPath
func (sc *SecretManagerClient) generateRootCertFromExistingFile(rootCertPath, resourceName string, workload bool) (*security.SecretItem, error) {
	var rootCert []byte
	var err error
	o := backoff.DefaultOption()
	o.InitialInterval = sc.configOptions.FileDebounceDuration
	b := backoff.NewExponentialBackOff(o)
	certValid := func() error {
		rootCert, err = os.ReadFile(rootCertPath)
		if err != nil {
			return err
		}
		_, _, err := pkiutil.ParsePemEncodedCertificateChain(rootCert)
		if err != nil {
			return err
		}
		return nil
	}
	ctx, cancel := context.WithTimeout(context.Background(), totalTimeout)
	defer cancel()
	if err := b.RetryWithContext(ctx, certValid); err != nil {
		return nil, err
	}

	// Set the rootCert only if it is workload root cert.
	if workload {
		sc.cache.SetRoot(rootCert)
	}
	return &security.SecretItem{

Review comment (suggestion):
nit 
```suggestion
// Although rfc5280 does not allow negative serial numbers it require graceful handling
```

Code after:
	b, err := os.ReadFile(filePath)
	if err != nil || len(b) == 0 {
		return false
	}
	return true
}

// If there is an existing private key and certificate under a well known path, return true.
// Otherwise, return false.
func (sc *SecretManagerClient) keyCertificateExist(certPath, keyPath string) bool {
	b, err := os.ReadFile(certPath)
	if err != nil || len(b) == 0 {
		return false
	}
	b, err = os.ReadFile(keyPath)
	if err != nil || len(b) == 0 {
		return false
	}

	return true
}

// Generate a root certificates item from the passed in rootCertPath,
// but ignore certificates that are not valid.
// This might happen if a root certificate has a negativeSerialNumber.
// Although rfc5280 does not allow negative serial numbers, but does require graceful handling
// (https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.2)
// If there is an invalid cert, we ignore it and only error if there are no valid certs.
func (sc *SecretManagerClient) generateRootCertFromExistingFile(rootCertPath, resourceName string, workload bool) (*security.SecretItem, error) {
	var validRootCertBytes []byte
	o := backoff.DefaultOption()
	o.InitialInterval = sc.configOptions.FileDebounceDuration
	b := backoff.NewExponentialBackOff(o)
	parseCerts := func() error {
		rootCert, err := os.ReadFile(rootCertPath)
		if err != nil {
			return err
		}

		var errs []error
		validRootCertBytes, errs = pkiutil.ParseRootCerts(rootCert)
		if len(validRootCertBytes) == 0 {
			return fmt.Errorf("failed to parse root certs from file %s: %v", rootCertPath, errs)
		}
		if len(errs) > 0 {
			cacheLog.Errorf("failed to parse some certs from file %s: %v", rootCertPath, errs)
		}
		return nil
	}
	ctx, cancel := context.WithTimeout(context.Background(), totalTimeout)
	defer cancel()