Running subprocesses command with two string inputs

Question

I'm trying to validate a certificate with a CA bundle file. The original Bash command takes two file arguments like this;

openssl verify -CAfile ca-ssl.ca cert-ssl.crt

I'm trying to figure out how to run the above command in python subprocess whilst having ca-ssl.ca and cert-ssl.crt as variable strings (as opposed to files).

If I ran the command with variables (instead of files) in bash then this would work;

ca_value=$(<ca-ssl.ca)
cert_value=$(<cert-ssl.crt)

openssl verify -CAfile <(echo "$ca_value") <(echo "$cert_value")

However, I'm struggling to figure out how to do the above with Python, preferably without needing to use shell=True. I have tried the following but doesn't work and instead prints 'help' commands for openssl;

certificate = ''' cert string '''
ca_bundle = ''' ca bundle string '''

def ca_valid(cert, ca):
    ca_validation = subprocess.Popen(['openssl', 'verify', '-CAfile', ca, cert], stdin=subprocess.PIPE, stdout=subprocess.PIPE,  bufsize=1)
    ca_validation_output = ca_validation.communicate()[0].strip()
    ca_validation.wait()

ca_valid(certificate, ca_bundle)

Any guidance/clues on what I need to look further into would be appreciated.

Answer 1

Bash process substitution <(...) in the end is supplying a file path as an argument to openssl.

You will need to make a helper function to create this functionality since Python doesn't have any operators that allow you to inline pipe data into a file and present its path:

import subprocess
def validate_ca(cert, ca):
    with filearg(ca) as ca_path, filearg(cert) as cert_path:
        ca_validation = subprocess.Popen(
            ['openssl', 'verify', '-CAfile', ca_path, cert_path],
            stdout=subprocess.PIPE,
        )
        return ca_validation.communicate()[0].strip()

Where filearg is a context manager which creates a named temporary file with your desired text, closes it, hands the path to you, and then removes it after the with scope ends.

import os
import tempfile
from contextlib import contextmanager

@contextmanger
def filearg(txt):
    with tempfile.NamedTemporaryFile('w', delete=False) as fh:
        fh.write(txt)
    try:
        yield fh.name
    finally:
        os.remove(fh.name)

Anything accessing this temporary file(like the subprocess) needs to work inside the context manager.

By the way, the Popen.wait(self) is redundant since Popen.communicate(self) waits for termination.