<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en">
<head>
<meta content="text/html; charset=US-ASCII" http-equiv="Content-Type">
<title>
GitLab
</title>
<style>img {
max-width: 100%; height: auto;
}
</style>
</head>
<body>
<div class="content">
<h3>
Timo Aaltonen pushed to branch master-next
at <a href="https://salsa.debian.org/freeipa-team/dogtag-pki">FreeIPA packaging / dogtag-pki</a>
</h3>
<h4>
Commits:
</h4>
<ul>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/0fa50bb906e47d3b479a70ddc4caac2c8714a44f">0fa50bb9</a></strong>
<div>
<span>by Dinesh Prasanth M K</span>
<i>at 2020-07-13T15:47:32-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">CI: Build custom Fedora image that has systemd installed
With latest Fedora container images (starting from fedora:30) it seems
that the systemd script files have been removed. This patch builds a custom
fedora container image with systemd package installed, giving us the right
systemd-enabled environment to run PKI tests
Signed-off-by: Dinesh Prasanth M K <dmoluguw@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/cdbbb079d2eba050fda8db6ba367f231f09fa322">cdbbb079</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-13T18:30:32-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Removed default max/min LDAP connections
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/43e4cd0fc03a2025036e7fa20d5b9a1bfedb12d1">43e4cd0f</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-13T18:30:32-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Updated pki-server acme-database-show
The pki-server acme-database-show has been modified to support
LDAP database.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/5ce46a35ae85cd637e3c17c6c8c39964242b3365">5ce46a35</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-13T18:30:32-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Updated pki-server acme-database-mod
The pki-server acme-database-mod has been modified to support
LDAP database.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/280c2c3735b449c810aeb18d904406b06af85791">280c2c37</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-13T18:30:32-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Updated pki-server acme-issuer-show
The pki-server acme-issuer-show has been modified to support
NSS issuer.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/6eec2d3ad5cec11c7d80dcea4303d5a54dda8b13">6eec2d3a</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-13T18:30:32-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Updated pki-server acme-issuer-mod
The pki-server acme-issuer-mod has been modified to support
NSS issuer.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/6f94b0d759ac699d5d8095f1298e84fe6e334c4d">6f94b0d7</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-13T20:30:26-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Reorganized CA install docs
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/2bd40bdf148f09884c91b8cf291429bea9e53ff8">2bd40bdf</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-13T20:30:26-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Reorganized KRA install docs
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/b17883dec0bc89d3ef37b13fa064af00c80790cd">b17883de</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-13T20:30:26-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Reorganized OCSP install docs
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/3b6cbc7d937903133efbf68a555a88aa7d2077d8">3b6cbc7d</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-13T20:30:26-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Reorganized TKS install docs
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/3b58dcda5b6359822da693a0ae3d6bbf056eece6">3b58dcda</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-13T20:30:26-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Reorganized TPS install docs
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/f946a3e3c5881e022b830493147539d00051b318">f946a3e3</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-14T15:16:46-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fixed podman deployment doc
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/9170acf282ada448b6218e05a6bf3833e63a371c">9170acf2</a></strong>
<div>
<span>by Christina Fu</span>
<i>at 2020-07-14T16:50:31-07:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Bug1856368- pki cli kra-key-generate request is failing
This patch fixes the issue with failed kra-key-generate from pki cli.
Investigation revealed that the underlying JSS changes where
base64encodeSingleLine call into
Base64.getEncoder().encodeToString(bytes);
does not tolerate null parameter.
Reference: Remove code dependency on Apache Commons Codec
https://github.com/dogtagpki/jss/commit/8de4440c5652f6f1af5b4b923a15730ba84f29e1#diff-b2e907677520a5d671a037de2e60e656L376
in PKI, since the caller for generateAsymmetricKey() in KeyClient.java
deliberately passed in "null" for transWrappedSessionKey, it is
safe to just skip over the following line when transWrappedSessionKey is null:
data.setTransWrappedSessionKey(Utils.base64encode(transWrappedSessionKey, false));
the CRMF issue reported in the same bug is very likley a separate issue
and should be filed in a separate bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1856368
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/9ffb9925d8d0a86059f3ec300526cf5d5b4093d5">9ffb9925</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-14T19:19:49-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fixed error handling in PKIRealm
In commit 9de45c2812e9eaddaeef50dd422117cf57820581 the PKIRealm was
modified to wrap all exceptions that happen during authentication
and rethrow them as RuntimeExceptions in order to preserve the stack
trace for troubleshooting.
However, because of that when a client tries to authenticate with a
revoked certificate the server incorrectly reports it as an internal
server error instead of authentication failure.
To fix the problem, the PKIRealm has been modified to modified to
handle authentication failures (e.g. EInvalidCredentials) differently
from other internal server errors (e.g. LDAP exceptions).
For authentication failures PKIRealm will return null as described
in RealmBase documentation:
https://tomcat.apache.org/tomcat-9.0-doc/api/org/apache/catalina/realm/RealmBase.html
For internal server errors it will log the stack trace and to wrap
the exception and rethrow it as RuntimeException for troubleshooting.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/180d42e9b4a2eb3aa7970448f888fb50d0d14522">180d42e9</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-15T10:18:32-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fixed ACME authorization status
The ACMEChallengeProcessor.processChallenge() has been modified
to set the authorization status to invalid if the client fails
to fulfill the challenge.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/db7b73a44babf55cd9eca864227d49500cff6722">db7b73a4</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-15T10:18:32-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fixed ACME order status
The ACMEChallengeProcessor.processInvalidChallenge() has been
modified to set the order status to invalid if at least one of
the authorizations is invalid.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/8feeea95029e57ea9ba55b1123e7f3ae2ca1e48d">8feeea95</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-15T10:49:40-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fixed LDAPDatabase.getAuthorizationByChallenge()
The LDAPDatabase.getAuthorizationByChallenge() has been
modified to return the complete authorization data such
that if the authorization is updated and saved into the
database it will not unintentionally lose data.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/71fced30e069c143fe9c188523f3fa94ba6c1297">71fced30</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-15T10:49:40-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Removing incomplete ACME challenges
The code that finalizes ACME authorizations has been modified
to retain the completed challenge (either valid or invalid) and
remove the incomplete ones.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/ce689dfa43b4fc5475dfed039d379c1e653a8049">ce689dfa</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-15T11:40:14-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Cleaned up log messages in MessageFormatInterceptor
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/d23240d030e49edae1c76500f378011eab760c07">d23240d0</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-15T11:40:48-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fixed ACMEAuthorization.expirationTime handling
The code that uses ACMEAuthorization.expirationTime has been
modified to handle a possible null value.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/8edae3095a078204a946ec9736c83054b2685532">8edae309</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-15T11:40:48-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fixed ACMEOrder.expirationTime handling
The code that uses ACMEOrder.expirationTime has been modified
to handle a possible null value.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/ec9b44851bab48dd42512473f3e672e95c64a493">ec9b4485</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-15T19:10:37-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Updated ACME database configuration doc
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/885ba3f6cad5f9042bdce65f7b336e912365d882">885ba3f6</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-16T12:30:35-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fixed ACME authorization expiration time
Previously the expirationTime field in ACMEAuthorization is
always set when the object is created. According to RFC 8555
the value is only required when the authorization is valid,
so the code has been updated accordingly.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/2443d08aa0afc8d6fdb5635d6391d194e7e6395a">2443d08a</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-16T12:30:35-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fixed ACME order expiration time
Previously the expirationTime field in ACMEOrder is always set
when the object is created. According to RFC 8555 the value is
only required when the order is valid or pending, so the code
has been updated accordingly.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/91889f162cf64dafaf4bc48666cf958eb1f2efc0">91889f16</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-16T12:30:35-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Added ACMEDatabase.removeExpiredAuthorizations()
The ACMEDatabase.removeExpiredAuthorizations() has been added
to remove expired authorization records from ACME database.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/eec64fc4352305b5054bd06e96a749363ccbfe07">eec64fc4</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-16T12:30:35-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Added ACMEDatabase.removeExpiredOrders()
The ACMEDatabase.removeExpiredOrders() has been added to remove
expired order records from ACME database.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/b2215b72bae20ffc0b1879714a809d519b405022">b2215b72</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-16T12:30:35-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Updated ACME maintenance task
The ACME maintenance task has been updated to periodically remove
expired authorization and order records from ACME database.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/87c0aef6ecb97a23dce0254c5e3efcf6a8430d35">87c0aef6</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-16T17:26:23-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Added silent mode for pki-server acme-database-mod
The pki-server acme-database-mod has been modified to provide
a silent mode for configuring ACME database.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/8cee2f93370d3c102a4808cd5d488dc804be1630">8cee2f93</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-16T17:26:23-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Added silent mode for pki-server acme-issuer-mod
The pki-server acme-issuer-mod has been modified to provide a
silent mode for configuring ACME issuer.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/95e338caf67342face3c42e7e95a8443eabe726a">95e338ca</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-16T17:26:23-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Updated ACME database and issuer configuration docs
The ACME database and issuer configuration docs have
been modified to use the slient mode.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/f1e86ff0494c7541a322d3ed64fad449ea543feb">f1e86ff0</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-20T10:28:50-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Refactored ACMEEngine.loadMetadata()
The ACMEEngine.loadMetadata() has been renamed into
initMetadata().
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/7eb2fc4838d2a0b4ee046aa888032abae8dcc831">7eb2fc48</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-20T10:29:38-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Refactored ACMEEngine.loadDatabaseConfig()
The ACMEEngine.loadDatabaseConfig() has been merged into
initDatabase().
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/6772ba8e9724629ab534cfe24ca9b49959e3850e">6772ba8e</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-20T10:30:22-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Refactored ACMEEngine.loadValidatorsConfig()
The ACMEEngine.loadValidatorsConfig() has been merged into
initValidators().
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/0c1916ea6cab0ab8a1f0eeb7ff61c5dd19c7cc3c">0c1916ea</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-20T10:30:45-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Refactored ACMEEngine.loadIssuerConfig()
The ACMEEngine.loadIssuerConfig() has been merged into
initIssuer().
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/3bda0a4feb7287b717f3d0e0118f93e5e1ac0fdd">3bda0a4f</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-20T10:31:52-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Refactored ACMEEngine.loadSchedulerConfig()
The ACMEEngine.loadSchedulerConfig() has been merged into
initScheduler().
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/87ab6e3c60331fe96c742b14876380172be525bb">87ab6e3c</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-20T10:38:23-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Refactored ACMEEngine.loadEngineConfig()
The ACMEEngine.loadEngineConfig() has been converted into
initMonitors().
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/249fae10d4dd945be9ced6f1713b926b056eacb8">249fae10</a></strong>
<div>
<span>by Alexander Scheel</span>
<i>at 2020-07-20T13:45:59-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fix build with CMake out-of-source build change
Fedora 33 has introduced the following change proposal:
https://fedoraproject.org/wiki/Changes/CMake_to_do_out-of-source_builds
This makes CMake do out-of-source builds by default. However, Fedora has
opted to use the %{_vpath_builddir} macro as the location of the default
build directory, instead of the more standard (in the CMake community)
build/ directory. %{_vpath_builddir} expands to %{_target_platform},
giving a per-architecture build directory.
Replace build/ references with %{_vpath_builddir} in the RPM spec. In
the future, we could move %{__make} to %cmake_build instead.
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/11024cd36f14e99d7a62d4304ce7cfcf43d0c250">11024cd3</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-20T13:42:55-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fixed pki-server acme-metadata/database/issuer-mod commands
The pki-server acme-metadata/database/issuer-mod commands have
been modified to use PKIServer.store_properties() instead of
pki.util.store_properties() to ensure the file permission is
set correctly.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/a3ef1aa885e9a81bd7efa3ef876824842593763f">a3ef1aa8</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-20T13:42:55-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Added default ACME metadata.conf
The ACMEEngine and pki-server acme-metadata commands have
been modified to use the shared metadata.conf by default.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/bc899bec1957f7e338046fc17f4214e5a4d71b25">bc899bec</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-20T14:36:59-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Added runtime dependency on systemd
The pki-server package has been modified to explicitly require
systemd as runtime dependency since systemd is no longer part
of Fedora container image:
https://docs.fedoraproject.org/en-US/minimization/
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/9ddb383239f92e9d738b4b4eb2e1bac24e6abdca">9ddb3832</a></strong>
<div>
<span>by Alexander Scheel</span>
<i>at 2020-07-20T15:45:07-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Support JDK8 and JDK11 RPM builds
Fedora 33 is moving to Java 11 as the default JDK version:
https://fedoraproject.org/wiki/Changes/Java11
This will make JDK11 the default JDK in this release of Fedora.
We need to support a generic JAVA_HOME based on OpenJDK, so move to
/usr/lib/jvm/jre-openjdk as the JRE_HOME path. This is always provided,
regardless of whether or not the JDK or JRE is installed. Additionally,
we set the minimum Java version based on what is available on the
system.
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/1bc74857efc84538a9de6978ceb9a25a9fc0f07f">1bc74857</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-20T19:20:24-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fixed JAVA_OPTS parsing in PKISubsystem.run()
The PKISubsystem.run() parses JAVA_OPTS into a list of strings
and uses it as Java arguments. In some cases the list might
contain empty strings which can cause problems. The code has
been modified to remove empty strings from the list.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/3de067cf33f617c05c9b818080bbef738dd7f862">3de067cf</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-21T09:01:38-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Simplified ACME LDAP database parameters
The LDAPDatabase parameters have been simplified:
- basedn -> baseDN
- internaldb.ldapconn.host,port,secureConn -> url
- internaldb.ldapauth.authtype -> authType
- internaldb.ldapauth.bindDN -> bindDN
- internaldb.ldapauth.clientCertNickname -> nickname
- password.internaldb -> bindPassword
The old basedn parameter will continue to work but it has
been deprecated.
The internaldb.ldapauth.bindPWPrompt is no longer used so
it has been removed.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/ec612dbd04d9d5e4f1263925e9cb3d0a9562456b">ec612dbd</a></strong>
<div>
<span>by Coty Sutherland</span>
<i>at 2020-07-21T16:51:42-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fix HTTP Request formatting in AdminConnection
AdminConnection's processRequest method creates a hand-rolled HTTP
request to the remote server. This is used by PKI Console when
authenticated as an administrator. Because of the recent CVE fix in
Tomcat (CVE-2020-1935), Tomcat will no longer accept \n (Line Feed)
terminated requests and headers, and instead reject them as a bad
request. We fix this by adding the missing and required CR, per HTTP
specification.
This fixes the following exception in PKIConsole:
java.io.IOException: 400
at com.netscape.admin.certsrv.connection.JSSConnection.readHeader(JSSConnection.java:537)
at com.netscape.admin.certsrv.connection.JSSConnection.initReadResponse(JSSConnection.java:497)
at com.netscape.admin.certsrv.connection.JSSConnection.sendRequest(JSSConnection.java:411)
at com.netscape.admin.certsrv.connection.AdminConnection.processRequest(AdminConnection.java:788)
at com.netscape.admin.certsrv.connection.AdminConnection.sendRequest(AdminConnection.java:681)
at com.netscape.admin.certsrv.connection.AdminConnection.sendRequest(AdminConnection.java:646)
at com.netscape.admin.certsrv.connection.AdminConnection.authType(AdminConnection.java:379)
at com.netscape.admin.certsrv.CMSServerInfo.getAuthType(CMSServerInfo.java:128)
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/0c41ac72c47f34b3dc1293768e656a03d3d283b5">0c41ac72</a></strong>
<div>
<span>by Alexander Scheel</span>
<i>at 2020-07-21T16:52:53-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Support exporting CA certificate from HSM installs
When installing an installation with subsystem SSL certificate residing
on the HSM, export will fail because the NSS DB isn't opened with the
specified HSM token. When the subsystem SSL certificate resides on the
HSM, when we go to export the CA certificate, we must explicitly specify
this token.
Otherwise, subsystem startup will fail with an error like:
systemd[1]: Starting PKI Tomcat Server topology-02-CA...
pki-server[72759]: Enter password for NHSM6000-OCS
pki-server[72759]: ERROR: Certificate not found: NHSM6000-OCS:Server-Cert cert-topology-02-CA
pki-server[72759]: ERROR: Command: pki -d /etc/pki/topology-02-CA/alias -C /tmp/tmpptxlpn4k/password.txt pkcs12-export --pkcs12 /tmp/tmp1idfd1am/sslserver.p12 --password-file /tmp/tmpc5y2bhjo/password.txt --no-key NHSM6000-OCS:Server-Cert cert-topology-02-CA
systemd[1]: pki-tomcatd@topology-02-CA.service: Control process exited, code=exited status=255
systemd[1]: pki-tomcatd@topology-02-CA.service: Failed with result 'exit-code'.
This is related to the earlier PR enforcing certificate verification
in PKIConnection, pr-#443.
Resolves: rh-bz#1857933
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/382de723e216870a1534ebacc51c427ba2f5a0d5">382de723</a></strong>
<div>
<span>by Dinesh Prasanth M K</span>
<i>at 2020-07-22T13:24:25-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fix pylint issue in healthcheck
This patch fixes the pylint issue caught in our CI. This
is a regression of change introduced in freeipa-healthcheck:
https://github.com/freeipa/freeipa-healthcheck/commit/d247c6158169a4ff97cd35ac57fec4e355617c52#diff-3aa64e1b97b8e0bf584a86cbe79986c4
Signed-off-by: Dinesh Prasanth M K <dmoluguw@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/75fed9db697d2e51137cd8cd60d8402a123b4bca">75fed9db</a></strong>
<div>
<span>by Dinesh Prasanth M K</span>
<i>at 2020-07-22T13:48:47-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Print the SD name when executing pki-server status
Signed-off-by: Dinesh Prasanth M K <dmoluguw@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/08370498e120b5f2d880b4fe78cf19a488e8b8eb">08370498</a></strong>
<div>
<span>by Dinesh Prasanth M K</span>
<i>at 2020-07-22T13:48:47-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fix pki-server status CLI to accept nuxwdog enabled service
This patch fixes pki-server to pick up the right systemd unit file
name if the nuxwdog is enabled on the PKI server.
Signed-off-by: Dinesh Prasanth M K <dmoluguw@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/951bad9d0aad4fd249472399e5c8fd2a10cb3ab4">951bad9d</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-22T14:53:53-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Added ACMEEngineConfig
The ACMEEngineConfig has been added to encapsulate ACME engine
configuration such as the enabled flag.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/2a8e25fb2c02d7093bf9565b6bbd379faa5c9897">2a8e25fb</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-22T14:53:53-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Refactored ACMEPolicy
The ACMEPolicy has been moved into org.dogtagpki.acme.server.
The enableWildcardIssuance field has been moved into a new
ACMEPolicyConfig class. The wildcard property in engine.conf
has been renamed into policy.wildcard.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/5cc193e645bd3a24664509760d13a11d445f8c87">5cc193e6</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-22T14:53:53-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Removed hard-coded ACME validity policies
The ACMEValidityConfig has been added to encapsulate the
validity configuration of ACME objects including nonces,
authorizations, and orders.
The hard-coded validity policies for ACME nonces, valid
authorizations, pending and valid orders have been
replaced with configurable properties in engine.conf.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/a93a65be0b1bcf94e004ba59c6a0c8a2c086936f">a93a65be</a></strong>
<div>
<span>by Alexander Scheel</span>
<i>at 2020-07-22T17:02:50-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Re-fix sanitization in CMSTemplate
When fixing CVE-2019-10179 originally in
8884b4344225bd6656876d9e2a58b3268e9a899b,
I had switched to Apache Commons Lang2's
sanitization framework. However, I didn't
enable the HTML sanitization necessary to
fix this CVE.
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/db703d1de043688421e70e0c94d90baae0e92e1c">db703d1d</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-22T18:44:10-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Added sample ACME database URLs
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/6e10833110df629900294b3077158addf624f0b3">6e108331</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-22T19:48:35-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fixed ACME scheduler
The ACMEScheduler has been modified to no longer throw a
RuntimeException if a task execution fails such that the
task will be executed again in the next scheduled time.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/eb213bd09fc2e1191b3aaa5d9f8eeedbd85f3e5f">eb213bd0</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-23T12:58:06-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Add sample PKI issuer URL and profile
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/8c41352aa8d1704b0690704df45b28a8fac03340">8c41352a</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-23T12:58:16-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Updated ACME install doc
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/6f18a954c0b364066ed515ecee8dcb10f75e3310">6f18a954</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-23T12:58:16-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fixed InMemoryDatabase.getOrdersByAuthorizationAndStatus()
The InMemoryDatabase.getOrdersByAuthorizationAndStatus() has
been modified to use String.equals() to compare order status.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/40bd67c353022a4c6391d9e3e2e6ec3b8a1eb862">40bd67c3</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-23T12:58:16-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Updated pki-server acme-database/issuer-mod
The pki-server acme-database/issuer-mod commands have been
modified to load the database.conf/issuer.conf template if
the database/issuer type was changed.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/f2641150a980fb42c290a82eb6a6acb8888068b7">f2641150</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-23T20:35:53-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fixed PKIServerFactory.create()
The PKIServerFactory.create() has been modified to check
whether the /etc/sysconfig/<instance> file exists before
trying to open it.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/28e19202b2c27db69cd1e3e8640976c3a347d900">28e19202</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-23T20:44:00-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Reorganized PKI server install docs
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/41b0226a945f33b986d7bae5a8369ada43ea26d8">41b0226a</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-27T17:12:24-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Updated log messages in PostgreSQLDatabase
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/46a66d65ab423bcd6756ed46bfa7e2ddd1fd67ae">46a66d65</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-27T17:12:33-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Reorganized ACME deployment on OpenShift doc
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/bf22510512870757d4070eac77fd407502683526">bf225105</a></strong>
<div>
<span>by Alexander Scheel</span>
<i>at 2020-07-28T14:52:20-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Add TPS auditor
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/9da92ed353f7466e9f49679b9ab66c8ab6767217">9da92ed3</a></strong>
<div>
<span>by Alexander Scheel</span>
<i>at 2020-07-28T14:54:12-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Move PrettyPrint{Cert,Crl} to PKI_LIB classpath
JDK since v1.6 supports passing a directory with a glob (*) after it to
include all JARs in that given directory on the classpath. That is the
mechanism used by pki_java_command_wrapper.in which we should reuse for
the two CLIs which don't use that wrapper.
Resolves: rh-bz#1854043
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/fd5222105813e100cfb5cb50e6d154d6306480db">fd522210</a></strong>
<div>
<span>by Dinesh Prasanth M K</span>
<i>at 2020-07-29T15:31:10-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">CI: Collect journalctl logs always during IPA tests
Signed-off-by: Dinesh Prasanth M K <dmoluguw@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/c8c55f989ac88e53d08ab39267ee82ba0f0ecb7a">c8c55f98</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-29T16:45:07-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Added openshift-acme deployment doc
A new doc has been added for deploying openshift-acme with
PKI ACME responder as the certificate issuer.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/a0a06387da2f5fa0915a4602bdb4124b250d207a">a0a06387</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-29T17:45:10-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fixed CAInfoService.getKRAInfoClient()
The CAInfoService.getKRAInfoClient() and
CAService.getConnector() have been modified to use the
client certificate specified in the CA's KRA connector to
access KRA. If the client certificate is missing, it will
use the subsystem certificate instead.
The CAInfoService has also been modified to propagate
any exception during the above operation to the caller.
https://bugzilla.redhat.com/show_bug.cgi?id=1861911
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/038012850b303019b454ae3921684d36472c0746">03801285</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-29T22:18:44-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Reorganized ACME user doc
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/7b18448616a64071985cce1ecd50fae3376fc45f">7b184486</a></strong>
<div>
<span>by 06shalini</span>
<i>at 2020-07-30T20:59:57+05:30</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Changes done to run the upstream pytest-ansible tests on Fedora32 and with latest packages (#393)
* Changes done to run the upstream pytest-ansible tests on Fedora32 and with latest packages
- Changes includes:
- Change in .gitlab_ci.yml to spawn instance by using latest osp_provision.py
[with PSI resource issues].
- Change in .gitlab_ci.yml to use Fedora 32 image.
- Addition of post_provision.yml to get latest repo.
Signed-off-by: Shalini Khandelwal <skhandel@redhat.com>
* Code cleanup of osp_provision.py
Signed-off-by: Shalini Khandelwal <skhandel@redhat.com>
Co-authored-by: Shalini Khandelwal <skhandel@redhat.com></pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/23ae8b29a9f6bf2a558eb184f0ed3077150c9bf2">23ae8b29</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-30T10:58:42-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Refactored ACMEPolicyConfig
The retention policies in ACMEPolicyConfig have been moved
into ACMERetentionConfig. The configuration properties have
been renamed into policy.retention.<name>.<param>. The
ACMEValidityConfig has been renamed into ACMERetention.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/64b37227b3d10a7fddebd00c560e355365003ee7">64b37227</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-30T10:58:42-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Added retention policies for ACME authorizations
The ACME responder has been modified to support retention
policies for pending and invalid authorizations.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/769069bb6a2c56f10d7263f1b7d79b560d102b9c">769069bb</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-30T10:58:42-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Added retention policies for ACME orders
The ACME responder has been modified to support retention
policies for invalid, ready, and processing orders.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/64a83f58aeac1ebb3e6c75e52b7eb6cf5176ccf8">64a83f58</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-30T10:58:42-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Added ACMEDatabase.removeExpiredCertificates()
The ACMEDatabase.removeExpiredCertificates() has been added
to remove expired certificates from ACME database.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/0c1cac7270c26c499c0934870b13b3935da358ad">0c1cac72</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-30T10:58:42-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Added ACMECertificate
The ACMECertificate has been added to encapsulate certificate
records in ACME database.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/d3957e6ca257277424ce0599408592a061eadca3">d3957e6c</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-30T10:58:42-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Added retention policy for ACME certificates
The ACME responder has been modified to support retention policy
for certificate records in ACME database.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/4bbb201c5c1874c7c43651f0b02ddfc9b44cc40f">4bbb201c</a></strong>
<div>
<span>by Stanislav Levin</span>
<i>at 2020-07-30T10:59:56-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Add missing required targets for pki-acme-classes target
Parallel build fails because of the races caused by the missing
(not yet built) jars.
Fixes: https://pagure.io/dogtagpki/issue/3196
Signed-off-by: Stanislav Levin <slev@altlinux.org>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/0cff9cd5090320e385acb787c005cba3f92e760a">0cff9cd5</a></strong>
<div>
<span>by Stanislav Levin</span>
<i>at 2020-07-30T13:08:14-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fix instance nssdb directory ownership
There was a typo in code which sets the ownership
of NSSdb directory and its content. This results
in the group with the same gid as pkiuser uid
can control this directory.
Fixes: https://pagure.io/dogtagpki/issue/3195
Signed-off-by: Stanislav Levin <slev@altlinux.org>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/34807cb77039b240701f527d037a1b32ebe7ed36">34807cb7</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-30T16:33:20-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Refactored PKI_DEPLOYMENT_DEFAULT_SYMLINK_PERMISSIONS
The PKI_DEPLOYMENT_DEFAULT_SYMLINK_PERMISSIONS has been
replaced with pki.server.DEFAULT_LINK_MODE.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/0aeacb09911623f79d20108ce96b2714095bdbf3">0aeacb09</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-30T16:33:20-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Updated log messages in PKIInstance
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/268c08ea4c07206bcd22a6c958ad395a00cd9842">268c08ea</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-30T16:33:20-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Reorganized ACME Podman doc
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/a287c3a02e3d812db231303c76f78a6cb82ab556">a287c3a0</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-30T16:33:20-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Reorganized ACME install doc
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/e4c35cbc1e943801eec635114f9d6296113878f3">e4c35cbc</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-30T16:33:20-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Updated links to ACME config doc
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/fc95262d8e42e02fb5f02b3d1380c81d729b192d">fc95262d</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-30T16:33:20-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Restored ACME tech preview notification
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/bedf1adc9c618b372885b4ef288685684872f87b">bedf1adc</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-30T22:06:05-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Renamed value field in ACMENonce
The value field in ACMENonce has been renamed to id
for consistency.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/183558fa9df101442c27201f6c7fbd3fdfdd6044">183558fa</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-30T22:11:52-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Renamed nonce value variables in ACMEDatabase
The nonce value variables in ACMEDatabase have been renamed
to nonceID for consistency.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/63368b0f492e50f5a6fb0cb4778da8fed5a604bc">63368b0f</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-30T22:11:57-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Renamed nonce value column/attribute in ACME database
The nonce value column/attribute in ACME database
has been renamed to id for consistency.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/a1235c3e22867605a816c1ae844d2e2a8b645f50">a1235c3e</a></strong>
<div>
<span>by jmagne</span>
<i>at 2020-07-31T10:20:48-07:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Address Bug 1462291 - CRL autoupdate from CS.cfg (#503)
This fix allows the admin to request that a change to this crl CS.cfg setting:
ca.crl.MasterCRL.autoUpdateInterval=xxx
This fix will allow the system to attempt to use the new value of auto update
immediately. The previous longstanding behavior was to have the new interval take affect,
AFTER the currently scheduled nextUpdate time.
What this fix does is allow the use of a new CS.cfg parameter:
ca.crl.MasterCRL.autoUpdateInterval.effectiveAtStart=true
This parameter must be inserted before a restart to allow this behavior to take place at all.
Without the param everything should be working as normal.
After changing the CS.cfg value, the server must be restarted.
At this point the delay time for the next update will be calculated based on the new auto update interval.
Previously the code would simply ignore the new calculated value and take whatever is already encoded into the
"nextUpdate" field of the crl.
This fix allows the new value to be accepted. Here are some caveats on how this thing behaves:
1. If the autoUpdate interval is made smaller , this thing works as expected, having the next update take place
in roughly the amount of time in the new interval.
2. If making the interval smaller, makes the calculated next update in the past, the update will occur now and then the
nextUpdate will be calculated with the new schedule..
3. If the admin makes the autoUpdate interval larger, the behavior is a little different.
Due to the fact that the calculations made with the new interval, is based off of starting with the time stamp
for "yesterday" or the very first daily update from yesterday, the new nextUPdate time calculated may be less
than simply adding the the new interval to the last update.
This fix was coded by allowing the current very comnplicated algorithm to calculate the nextUpdate do it's thing
while at the end of the process, this code simply chooses what is calculated instead of what is already encoded within
the crl's nextUpdate field.
Therefore if the new param is never set, nothing changes. This param should be used with care.
If the agent goes to the display crl page, the new value can easily be viewed as well as the debug log.
4. After the operation takes place the flag inside the server will be cleared and this feature will no longer
be attempted while the server is running.
5. The admin must clear the schedulUpdated setting before the restart to assure normal operation after the next restart.
Co-authored-by: Jack Magne <jmagne@localhost.localdomain></pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/607407e2641cf7f27009cf4ac2059043551ef53c">607407e2</a></strong>
<div>
<span>by Christina Fu</span>
<i>at 2020-07-31T11:40:54-07:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Bug1805541 Doc for Certificate Transparency with embedded SCT
Created CertificateTransparency.adoc which provides documentation for
the Certificate Transparency feature for the RHCS Administrator's guide.
https://bugzilla.redhat.com/show_bug.cgi?id=1805541
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/7b6b6aa8fc8e8596b3065ee149bdc5fbbe06704e">7b6b6aa8</a></strong>
<div>
<span>by Christina Fu</span>
<i>at 2020-07-31T16:39:21-07:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">CertificateTransparency.adoc default mode is "disabled" instead of "enabled"
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/0932b0eabfc77210492dc44927a3560c85b8c02f">0932b0ea</a></strong>
<div>
<span>by jmagne</span>
<i>at 2020-07-31T17:02:54-07:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Resolve: Bug 1454922 - [RFE] Need Ability to set the CRL This Update to be a Future Date when Generating a CRL. (#504)
This fix allows the admin to request this feature only by using the command line sslget utility to make such a request.
The result will be haviing the "thisUpdate" field of the generated crl set to some arbitrary date in the future.
The nextUpdate field will be calculated as normal by calculating that as an offset to the future thisUpdate value requested.
There is also a new CS.cfg value designed to simply disallow the use of the feature whateover:
ca.crl.MasterCRL=forbidFutureThisUpdateValue=true (which is by default) will ignore any attempts to use this feature.
This feature does not as of yet support the GUI and will ONLY be available when ussing sslget to request a CRL update on demand.
Also there is a parameter to sslget that will allow the user to erase or cancel the whole custom future thisUpdate and
return crl processing to normal. Examples to follow:
Example 1, request an updated CRL with a custom future thisUpdateValue:
sslget -n "PKI Administrator for localhost.localdomain" -e "crlIssuingPoint=MasterCRL&signatureAlgorithm&waitForUpdate=true&clearCRLCache=true&customFutureThisUpdateDateValue=2020:9:22:13:0:0" -v -d . -p "" -r /ca/agent/ca/updateCRL localhost.localdomain:8443
Note the param for this feature is customFutureThisUpdateDateValue=<date>
The date format is this: 2020:9:22:13:0:0
The linux date utility can be used to make a date in this format. It's simply
year,month,day, hour, min ,sec, with min and sec optional.
The month is based on 1, with Jan = 1.
Example 2: clear the whole future thisUpdate an get back to normal:
sslget -n "PKI Administrator for localhost.localdomain" -e "crlIssuingPoint=MasterCRL&signatureAlgorithm&waitForUpdate=true&clearCRLCache=true&cancelCurCustomFutureThisUpdateValue=true" -v -d . -p "" -r /ca/agent/ca/updateCRL localhost.localdomain:8443
This will erase the current custom future thisUpdate and calculate the nextUpdate based on the actual current time.
This fix was done without affecting the complex calculations made to calculate update frequency. This only allows one, if they desire, to set thisUpdate to some futuristic time.
If a future thisUpdate time is chosen as in Ex 1, the nextUpdate time will be chosen based on that future date.
The Agent GUI can be used to display the CRL will reflect the new thisUpdate and nextUpdate values.
Co-authored-by: Jack Magne <jmagne@localhost.localdomain></pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/55d8a652eaf698d017c98b9d322c9e41cba723a0">55d8a652</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-31T19:46:29-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fixed PostgreSQL ACME database time zone (part 1)
The PostgreSQLDatabase has been modified to store timestamps
in UTC time zone.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/880a02d9bb2547e0f1b8f37e034888ee81fb5347">880a02d9</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-31T19:46:29-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fixed PostgreSQL ACME database time zone (part 2)
The PostgreSQL ACME database has been modified to use
timestamps with time zone.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/2a0a2fceeac4b0fba41086422dec7b8a9ae93b36">2a0a2fce</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-31T19:46:29-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fixed LDAP ACME database time zone
The LDAPDatabase ACME has been modified to store timestamps
in UTC time zone.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/4cfd4cc115598aa15f825ed2f31932b6cc95ab76">4cfd4cc1</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-31T19:46:29-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Cleaned up PostgreSQLDatabase
The PostgreSQLDatabase has been modified to call connect()
only in public methods implementing LDAPDatabase.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/b047c13247fbc7a0d330b598ed87dfec0bb26cb7">b047c132</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-07-31T21:16:44-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Updated version number to 10.9.0-1
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/c5db17c86c84a565e21d729fc714bc475e0786ee">c5db17c8</a></strong>
<div>
<span>by Dinesh Prasanth M K</span>
<i>at 2020-08-06T12:38:16-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fix Secure connection issue when server is down
When the PKI server is down, the server is temporarily
brought up using a temporary SSL server cert. This cert
needs to be trusted to enable secure connection.
This patch:
* allows passes instance's nssdb as the client nssdb to
trust the SSL server created during cert-fix (offline
cert renewal process).
* Gets the hostname using socket instead of from env
variable
Signed-off-by: Dinesh Prasanth M K <dmoluguw@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/f4b72edb5c703c0a8aae64ae07970407c83f656c">f4b72edb</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-08-06T11:55:45-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Updated version number to 10.9.1
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/0522193e325f2ac5cd93c2a5e9cdf8a45d6a7a4f">0522193e</a></strong>
<div>
<span>by Timo Aaltonen</span>
<i>at 2020-08-13T13:35:38+03:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Merge branch 'upstream-next' into master-next
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/fbf3dcc4a57dd052b15b805597baec05af07ef23">fbf3dcc4</a></strong>
<div>
<span>by Timo Aaltonen</span>
<i>at 2020-08-13T13:38:10+03:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">bump the release
</pre>
</li>
</ul>
<h4>30 changed files:</h4>
<ul>
<li class="file-stats">
<a href="#4b905b3ce8db4f70f4829d47fb4b4f852ff810a2">
.github/workflows/required-tests.yml
</a>
</li>
<li class="file-stats">
<a href="#9a2aa4db38d3115ed60da621e012c0efc0172aae">
CMakeLists.txt
</a>
</li>
<li class="file-stats">
<a href="#0b3cc8b828fd333d07b22c8f8cd7923f0bf75ea9">
base/acme/CMakeLists.txt
</a>
</li>
<li class="file-stats">
<a href="#45680823c211c17f33667b72b24512d2eae61bca">
base/acme/conf/engine.conf
</a>
</li>
<li class="file-stats">
<a href="#770f6efce9770f3dcdc8ff0655313bca2334f7a0">
base/acme/database/ldap/database.conf
</a>
</li>
<li class="file-stats">
<a href="#2b90e8da42abde5c1605767936beb0e202a3e02f">
base/acme/database/ldap/schema.ldif
</a>
</li>
<li class="file-stats">
<a href="#09e2e7949ea81561c8eec8bd61d7b74d4a27392a">
base/acme/database/postgresql/create.sql
</a>
</li>
<li class="file-stats">
<a href="#f88eee053fb2ebc8ec64730ea2a26bf82714ecc3">
base/acme/database/postgresql/statements.conf
</a>
</li>
<li class="file-stats">
<a href="#498f86c52b24f5138ab789b97583252a188ec87e">
<span class="new-file">
+
base/acme/src/main/java/org/dogtagpki/acme/ACMECertificate.java
</span>
</a>
</li>
<li class="file-stats">
<a href="#ea9353d1648a7cbe3c07a3aa7c3955089f131c3b">
base/acme/src/main/java/org/dogtagpki/acme/ACMENonce.java
</a>
</li>
<li class="file-stats">
<a href="#a17a3cb8539654ed6e9c2adef3123ca576f48261">
base/acme/src/main/java/org/dogtagpki/acme/database/ACMEDatabase.java
</a>
</li>
<li class="file-stats">
<a href="#5e831ad71af50ecaf98a689edf14db289c23c195">
base/acme/src/main/java/org/dogtagpki/acme/database/InMemoryDatabase.java
</a>
</li>
<li class="file-stats">
<a href="#7e3c3d62d988f7e26b4abd3137c39eb978a8511d">
base/acme/src/main/java/org/dogtagpki/acme/database/LDAPDatabase.java
</a>
</li>
<li class="file-stats">
<a href="#1acf49d2a16e773f07e9d9851ade895587a365c1">
base/acme/src/main/java/org/dogtagpki/acme/database/PostgreSQLDatabase.java
</a>
</li>
<li class="file-stats">
<a href="#25caf75bac59a0d20e46aeeb21a86c11f882bb9f">
base/acme/src/main/java/org/dogtagpki/acme/issuer/NSSIssuer.java
</a>
</li>
<li class="file-stats">
<a href="#8a7a1bbafa5e4fc05eaa7b3197f09cd3f565fec6">
base/acme/src/main/java/org/dogtagpki/acme/scheduler/ACMEMaintenanceTask.java
</a>
</li>
<li class="file-stats">
<a href="#e52719a0261b5d9a97b52002b812ebeb0895c3cf">
base/acme/src/main/java/org/dogtagpki/acme/scheduler/ACMEScheduler.java
</a>
</li>
<li class="file-stats">
<a href="#0342c699f443b1f87dd0fb0d041a663998c61f5e">
base/acme/src/main/java/org/dogtagpki/acme/server/ACMEAccountService.java
</a>
</li>
<li class="file-stats">
<a href="#9082578c65f37485d6743f82a263b2e31a202373">
base/acme/src/main/java/org/dogtagpki/acme/server/ACMEAuthorizationService.java
</a>
</li>
<li class="file-stats">
<a href="#2b31fa74bb89c80d600251867f56d66b8b96c214">
base/acme/src/main/java/org/dogtagpki/acme/server/ACMECertificateService.java
</a>
</li>
<li class="file-stats">
<a href="#47f0196da5cce6d2949a2454bc8a860fc56548f5">
base/acme/src/main/java/org/dogtagpki/acme/server/ACMEChallengeProcessor.java
</a>
</li>
<li class="file-stats">
<a href="#243d352362007c885d71fbb517bd385f2e565fdf">
base/acme/src/main/java/org/dogtagpki/acme/server/ACMEChallengeService.java
</a>
</li>
<li class="file-stats">
<a href="#fe30397906f164c11d263718ee3bd1effb2e004d">
base/acme/src/main/java/org/dogtagpki/acme/server/ACMEEngine.java
</a>
</li>
<li class="file-stats">
<a href="#41f570b93000f9cc263acf77fb54f1967bf879fb">
<span class="new-file">
+
base/acme/src/main/java/org/dogtagpki/acme/server/ACMEEngineConfig.java
</span>
</a>
</li>
<li class="file-stats">
<a href="#aa01fd5b6be0ed85090c49a4ae7fe5e122a68fa8">
base/acme/src/main/java/org/dogtagpki/acme/server/ACMEEngineConfigFileSource.java
</a>
</li>
<li class="file-stats">
<a href="#b06f3d028cc02923da8933796dd97c18947e876f">
base/acme/src/main/java/org/dogtagpki/acme/server/ACMEFinalizeOrderService.java
</a>
</li>
<li class="file-stats">
<a href="#0655ce8afb94931837a8c24b7b1a0553f54d0c5b">
base/acme/src/main/java/org/dogtagpki/acme/server/ACMENewAccountService.java
</a>
</li>
<li class="file-stats">
<a href="#10dcec8c792934cbde3f02881205afb42755226c">
base/acme/src/main/java/org/dogtagpki/acme/server/ACMENewNonceService.java
</a>
</li>
<li class="file-stats">
<a href="#ec94f8b2652404aa1801c59f60d3789221613f21">
base/acme/src/main/java/org/dogtagpki/acme/server/ACMENewOrderService.java
</a>
</li>
<li class="file-stats">
<a href="#76c670a1879890082b873e958f592bb88ebade98">
base/acme/src/main/java/org/dogtagpki/acme/server/ACMEOrderService.java
</a>
</li>
</ul>
<h5>The diff was not included because it is too large.</h5>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #777;">
—
<br>
<a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/compare/1adc82257e6015af3ace7de8faa868db8ccc6310...fbf3dcc4a57dd052b15b805597baec05af07ef23">View it on GitLab</a>.
<br>
You're receiving this email because of your account on salsa.debian.org.
If you'd like to receive fewer emails, you can
adjust your notification settings.
</p>
</div>
</body>
</html>