<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en">
<head>
<meta content="text/html; charset=US-ASCII" http-equiv="Content-Type">
<title>
GitLab
</title>
<style>img {
max-width: 100%; height: auto;
}
</style>
</head>
<body>
<div class="content">
<h3>
Timo Aaltonen pushed to branch upstream
at <a href="https://salsa.debian.org/freeipa-team/dogtag-pki">FreeIPA packaging / dogtag-pki</a>
</h3>
<h4>
Commits:
</h4>
<ul>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/1a5d9024fd0fb76c741e71bf9eeebf551e1ad9c2">1a5d9024</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-02-25T20:32:52-06:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Convert QE test to Docker
Previously the QE test was running on Vagrant which can only
run on macOS runners on GitHub:
https://stackoverflow.com/questions/66261101/using-vagrant-on-github-actions-ideally-incl-virtualbox
However, there is a performance issue with the macOS runners
which is causing the test to fail occasionally:
https://github.com/actions/virtual-environments/issues/1336
To improve the reliability, the QE test has been converted
to run on Docker instead. Some steps for configuring the
machine hostname in configure_common.yml have been removed
since it's no longer necessary.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/d23b75b77bbd88324087c5b1b1da56924f8abed0">d23b75b7</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-03-03T14:49:26-06:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Add test for installing CA with ECC
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/d5ba9b2ddd3b00b2025166e33d920e0e50ac5e77">d5ba9b2d</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-03-03T14:49:26-06:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Update CI Dockerfile
The CI Dockerfile has been modified to install PKI packages
in the container image.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/5262e5980610eec226671cc071e83de51bd14b41">5262e598</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-03-03T14:49:26-06:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Remove redundant PKI package installations
The CI tests have been modified to no longer install PKI
packages since they are already installed in the container
image.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/8420dec87a347a8b1c3b1a36803726e770b4092d">8420dec8</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-03-03T14:49:26-06:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Clean up redundant CI dependencies
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/d33839aeebbc19721248d9db63b2787b824cc52f">d33839ae</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-03-03T14:53:39-06:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Add COPR_REPO argument in CI Dockerfile
The CI Dockerfile has been modified to provide an argument
to override the COPR repository used for building the
container image.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/c3f1afdd7f1adc0b0182a19a7903ea9e221d71df">c3f1afdd</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-03-03T14:53:43-06:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Update CI to use multi-stage builds
The CI has been modified to build PKI packages and the
container image using multi-stage builds.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/5c2d66793cf4532a6e82ca959a1703826fa865b5">5c2d6679</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-03-08T10:40:47-06:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Move CI Dockerfile
The CI Dockerfile has been moved to the top-level folder.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/1c3e0d3966c7bbffc449c8a794afc17ee636a1d8">1c3e0d39</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-03-08T10:41:46-06:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Move list of IPA CI tests
The list of IPA CI tests has been moved into ipa-test.sh.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/a86b28f3b794a5d816d9eded66f8ef156f5c55ac">a86b28f3</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-03-08T10:41:47-06:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Clean up CI build options
The CI BUILD_OPTS have been modified to no longer use timestamps
and commit IDs in PKI package names. The build-push-action has
also been modified to use the default Git context.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/d3ba096fb55017e4ab3a907a0c1b30c676f6b25f">d3ba096f</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-03-08T10:41:47-06:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Rename CI runner container image
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/23853644d0f44c2c339794079a4950c87515d462">23853644</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-03-08T10:44:20-06:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Remove unused CI LOGS variable
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/a279c4ce29fab2aa528b4746b84d778c5ec4842b">a279c4ce</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-03-08T14:36:26-06:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Clean up ACME CI tests
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/0043474386924730d49ba306e3ad8f67aa02b0d2">00434743</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-03-08T20:40:55-06:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Update ACME Dockerfile
The ACME Dockerfile has been updated to work with Quay and
Docker Hub.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/398fedba9f95daca5ba6a3698674add9a1c23577">398fedba</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-03-09T20:43:24-06:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Copy ACME Dockerfile into main Dockerfile
The ACME Dockerfile has been copied from base/acme/Dockerfile
which uses a single build stage into the main Dockerfile which
uses multiple build stages.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/ea30f0a37d6e954c396291894ef4ec3052820228">ea30f0a3</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-03-09T20:44:22-06:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Add test for ACME container
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/739aaf35513b844f4a7b02a775046f5e990f01f7">739aaf35</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-03-10T12:03:06-06:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Restore timestamp and commit ID in CI build options
Commit a86b28f3b794a5d816d9eded66f8ef156f5c55ac has been
reverted to avoid conflicts with COPR builds.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/5f4abfab82dfb4f477dba7b3422b44ceb277df1c">5f4abfab</a></strong>
<div>
<span>by Alexander Bokovoy</span>
<i>at 2021-03-10T20:56:51-06:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Update pki.spec to not depend on esc for s390(x) architectures
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/5f907f09fab562d7f3436c9bac5edb486e901d20">5f907f09</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-03-10T21:03:12-06:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Clean up spec file
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/608e9bbe537aba314b124ceef70f9b606ab7e121">608e9bbe</a></strong>
<div>
<span>by Fraser Tweedale</span>
<i>at 2021-03-15T11:37:57-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fix renewal profile approval process
Due to a recent change in PKI CLI, the CLI now passes along user
authentication with submissions to the renewal endpoint. Unlike the EE
pages, the REST API has passed along this authentication for a while.
Due to a bug in the RenewalProcessor, requests with credentials against
profiles with no authentication method and no ACLs result in the
certificiate automatically being approved. This occurs because, when
an earlier commit (cb9eb967b5e24f5fde8bbf8ae87aa615b7033db7) modified
the code to allow Light-Weight SubCAs to issue certificates, validation
wasn't done on the passed principal, to see if it was a trusted agent.
Because profiles requring Agent approval have an empty ACL list (as, no
user should be able to submit a certificate request and have it
automatically signed without agent approval), authorize allows any user
to approve this request and thus accepts the AuthToken.
Critical analysis: the RenewalProcessor code interprets (authToken
!= null) as evidence that the authenticated user is /authorized/ to
immediately issue the certificate. This mismatch of concerns (authn
vs authz) resulted in a misunderstanding of system behaviour. The
"latent" AuthToken (from the HTTP request) was assigned to authToken
without realising that authorization needed to be performed.
We fix this by splitting the logic on whether the profile defines an
authenticator. If so, we (re)authenticate and authorize the user
according to the profile configuration.
If the profile does not define an authenticator but there is a
principal in the HTTP request, if (and only if) the user has
permission to approve certificate requests *and* the requested
renewal profile is caManualRenewal (which is hardcoded to be used
for LWCA renewal), then we issue the certificate immediately. This
special case ensures that LWCA renewal keeps working.
Otherwise, if there is no principal in the HTTP request or the
principal does not have permission to approve certificate requests,
we leave the authToken unset. The resulting renewal request will be
created with status PENDING, i.e. enqueued for agent review.
Signed-off-by: Fraser Tweedale <ftweedal@redhat.com>
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/9af79a3df00715c0785a74b3dc035f9b22a0bff5">9af79a3d</a></strong>
<div>
<span>by Alexander Scheel</span>
<i>at 2021-03-15T22:11:18-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Remove i686 builds in the future
For Fedora and RHEL-9, we probably should drop i686 builds. This is
partially due to the lack md2man (for converting our man pages) but also
due to the lack of multilib compatible Java packages. Best to ship
64-bit only packages then.
Discussed with Alexander Bokovoy in #freeipa.
Signed-off-by: Alexander Scheel <alexander.m.scheel@gmail.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/f3d7274f1550555c4d81e2668ca1716e6b5ddcd4">f3d7274f</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-03-15T22:11:41-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fix QE tests reliability
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/8f89e5e16d6b9f338742a94af39925fba111763b">8f89e5e1</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-03-15T22:11:53-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Update pki.spec for ELN/RHEL
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/a415a788e983c4d38a0da4bdd510de2cdf217d0f">a415a788</a></strong>
<div>
<span>by Alexander Scheel</span>
<i>at 2021-03-22T14:07:51-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Remove dep on jakarta-commons
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/d7d33622f195f8de2366cdadef5f339d238bfd6b">d7d33622</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-03-22T14:07:51-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fix files listed twice in pki.spec
https://github.com/dogtagpki/pki/issues/3321
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/3ff770464ff0f9f73785ad3226de0dd949a627f5">3ff77046</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-03-22T14:07:51-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Update version number to 10.10.6
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/583a8ca269bd29a17036d3656516f0231af02782">583a8ca2</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-03-23T17:20:10-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Clean up CA test artifacts
The CA tests have been modified to store PKI and DS config files
and log files into a single file.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/873b361170d171cca2ec8fb943e018ba5036cea8">873b3611</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-03-23T17:21:59-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Add test for installing CA with secure DS
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/f67323cf14c7374f2e89a8874e03ade4bfe05d1d">f67323cf</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-03-25T09:28:21-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Add test for installing CA clone with secure DS
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/08cf8da55a030298f8ea122b323f281a2d18fbd0">08cf8da5</a></strong>
<div>
<span>by Pritam Singh</span>
<i>at 2021-03-26T11:51:45-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Added_doc_for_installing_CA_clone_with_secure_DS (#3486)
Signed-off-by: Pritam Singh <prisingh@redhat.com></pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/91d1ae2d93cae23cdd6f7a72b12f80830adeaa37">91d1ae2d</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-03-26T13:36:59-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Clean up KRA test artifacts
The KRA tests have been modified to store PKI and DS config
files and log files into a single file.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/e1934a30664c1603955a61cd2d42feb41563e480">e1934a30</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-03-31T11:59:27-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Clean up tests for PKI tools
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/326a478b91d4b2c3fcb60b3ea5eb73b5903db6df">326a478b</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-03-31T14:46:15-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Add test for creating CA agent
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/96203df2b7f19fafd9a07e3498c2d6402a7b8c00">96203df2</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-03-31T15:13:44-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Add test for issuing SSL server cert using PKI NSS CLI
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/f05d253a478205fb4183345392066edec63062f4">f05d253a</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-04-07T10:26:56-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Add test for generating cert with existing key
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/885121fd88cfd04620039fe00910a74927388e00">885121fd</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-04-07T17:32:43-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Clean up OCSP test artifacts
The OCSP tests have been modified to store PKI and DS config
files and log files into a single file.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/ac3ca064b0a264c10f6377fca415beab9908750a">ac3ca064</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-04-08T12:11:38-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Update docs for deploying ACME with DS on OpenShift
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/a6193955eedc5e8b03c865aeeeda922ef29d051e">a6193955</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-04-08T13:38:06-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Add test for PKI NSS CLI with ECC
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/328c0643231e49c2231c1859b5c6aac6f1a1a3e2">328c0643</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-04-12T15:28:16-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Add scripts to save test artifacts
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/439208810a1109385595d09f3355a8cdb7470ca1">43920881</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-04-12T15:28:16-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Clean up TKS test artifacts
The TKS tests have been modified to store PKI and DS config
and log files into a single tarball.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/216e749f9439837f20ca6355b34453b118850846">216e749f</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-04-12T15:28:16-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Clean up TPS test artifacts
The TPS tests have been modified to store PKI and DS config
and log files into a single tarball.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/e0646e84922ae93616ad3e98d514e768d5e2e9c1">e0646e84</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-04-12T15:28:16-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Clean up ACME test artifacts
The ACME tests have been modified to store PKI and DS config
and log files into a single tarball.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/bbf31086b5ec7efb6c0e0cdee6af7cd476407593">bbf31086</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-04-12T15:28:16-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Clean up IPA test artifacts
The IPA tests have been modified to store IPA, PKI, and DS
config and log files into a single tarball.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/0d41ea57166fa910e5f66e7162a000fa6cdaded9">0d41ea57</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-04-12T15:28:17-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Clean up QE test artifacts
The QE tests have been modified to store PKI and DS config
and log files into a single tarball.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/542d0333400fe01642e75ee64035b585c4237c54">542d0333</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-04-26T13:14:10-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Remove unused SecurityDomainLogin servlet
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/6a9e9aa90a14e3dcc374f6fe2703020e34e0ef2a">6a9e9aa9</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-04-26T13:14:10-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Remove unused LoginServlet
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/f04dd958eaaf0058561b0be81f949d8f84427146">f04dd958</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-04-26T13:14:10-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Remove unused BaseServlet
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/624223b245c93feb76e7dfb054c3edde7d6470d9">624223b2</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-04-26T13:14:10-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Remove velocity dependency
The remaining servlets that use velocity have been removed
since they are no longer used so the velocity dependency
can be removed as well.
Resolves: #1952969
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/01d485aca3d483065932f372a64716625f0c538f">01d485ac</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-04-26T14:05:21-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fix cert file loading in CryptographyCryptoProvider
As suggested by cheimes, the CryptographyCryptoProvider
has been modified to load the cert file as binary.
Resolves: https://github.com/dogtagpki/pki/issues/3499
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/c8a7cb4a9ecdac91b3fe0aed5c644e4885b3ed1b">c8a7cb4a</a></strong>
<div>
<span>by Christian Heimes</span>
<i>at 2021-04-26T14:05:21-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Make python-nss optional
Signed-off-by: Christian Heimes <cheimes@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/3a5e8262bec1e7ead58250eb028f0582c9af78cb">3a5e8262</a></strong>
<div>
<span>by Christian Heimes</span>
<i>at 2021-04-26T14:05:21-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Remove deprecated DRM client
The code was marked as deprecated in commit f4aafb999e from 2014.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/07511637895208c9d157e71fd398ddc8db06c206">07511637</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-04-27T12:39:47-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Reorganized ACME database configuration docs
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/dc4776f75d94790476f897e17dddfbdc3166d1d3">dc4776f7</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-05-07T14:58:35-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Reorganize ACME issuer doc
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/509c9e854bb064d5d9d3056241db1aeb033c661b">509c9e85</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-05-07T14:58:36-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Reorganize ACME realm doc
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/7e4d2e2798314ff732e0a0b670d7913017824e4e">7e4d2e27</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-05-07T14:58:36-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Add ACME metadata doc
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/1fbba7fb902fea67cd1efac92067a2bc9d1cfaf4">1fbba7fb</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-05-07T15:34:24-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Clean up unused classpaths
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/6bb7004d2fead2e8d8641d664c6032c33e76e4c1">6bb7004d</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-05-07T15:34:24-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Remove JNA dependency
The SystemdStartupNotifier has been renamed to SystemdNotifier
and modified to use systemd-notify instead of JNA to notify
other systems when the subsystem is ready.
Since the SystemdNotifier is no longer dependent on JNA, it
has been moved into pki-server.jar and the JNA dependency has
been dropped.
The StartupNotifier has been renamed into SubsystemListener
such that it can be expanded to listen to other subsystem
events (e.g. shutdown).
Resolves: #1953671
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/e787719b190edb6d9aecd06f1df463e392576cce">e787719b</a></strong>
<div>
<span>by Fraser Tweedale</span>
<i>at 2021-05-07T15:34:24-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">SystemdNotifier: document how to configure systemd unit
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/6945b57aee52d72063a91242cea352b70e793b4c">6945b57a</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-05-18T15:31:33-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Update ACME install doc
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/b2bd603c0ed817261e57b6b45bfbee527b1dd6c1">b2bd603c</a></strong>
<div>
<span>by fdelehay</span>
<i>at 2021-05-18T15:32:06-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Update Nuxwdog.md
typo in command</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/a47f76a0f54333b67332c1232c3aa2bc46a098eb">a47f76a0</a></strong>
<div>
<span>by Tomasz Torcz</span>
<i>at 2021-05-18T15:32:35-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">acme: don't fail on resubmitted valid challenges
Some acme clients, like cert-manager, happen to resubmit already
valid challenges. This is not 100% in line with RFC8555, but it is
not a reason to throw Exception.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/75bdbbc2b95a8b3946b348d77279fa63cf460092">75bdbbc2</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-06-09T11:20:21-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Use password file when creating admin user
The pki-server <subsystem>-user-add has been updated to
provide a --password-file option. The deployment tool
has been modified to use this option when creating the
admin user to avoid the password from getting logged in
the debug mode.
Resolves: CVE-2021-3551
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/e60ca102c930ddedcd8a30ee5ebfa71a45df0785">e60ca102</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-06-09T11:20:21-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fix permission for new installation logs
The enable_pki_logger() has been updated to disable
world access for new installation logs to be created
in /var/log/pki.
Resolves: CVE-2021-3551
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/commit/1c0a7b45225aadc6efde21f92b0103937ae99d6d">1c0a7b45</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2021-06-09T11:20:21-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fix permission for existing installation logs
The spec file has been updated to remove world access
from existing installation logs in /var/log/pki.
Resolves: CVE-2021-3551
</pre>
</li>
</ul>
<h4>9 changed files:</h4>
<ul>
<li class="file-stats">
<a href="#354079a72b91a4280407c16a36f47d1986fd85a5">
.classpath
</a>
</li>
<li class="file-stats">
<a href="#ecae19c77a082e8b0487ab1eb8428f56f72e4341">
.github/workflows/acme-tests.yml
</a>
</li>
<li class="file-stats">
<a href="#59aa675277e0d680e6ce78ba8f1b1e1d9918a617">
.github/workflows/ca-tests.yml
</a>
</li>
<li class="file-stats">
<a href="#1ef4ca516abc68d9dded3e330ec5c9a546d313f4">
.github/workflows/ipa-tests.yml
</a>
</li>
<li class="file-stats">
<a href="#1f5479b96d388bf5ea248b689c8d27f6e6565a4f">
.github/workflows/kra-tests.yml
</a>
</li>
<li class="file-stats">
<a href="#b0c8c439fb8797a70835207888b7917a361db129">
.github/workflows/ocsp-tests.yml
</a>
</li>
<li class="file-stats">
<a href="#e917c7a1acef149c48724bffc3c116280232a0f3">
.github/workflows/python-tests.yml
</a>
</li>
<li class="file-stats">
<a href="#366cdbd6e405218760f06f85df3039b2809dcb64">
.github/workflows/qe-tests.yml
</a>
</li>
<li class="file-stats">
<a href="#c7c6f24a599351c849a0dc534d96050b8134603a">
.github/workflows/tks-tests.yml
</a>
</li>
</ul>
<h5>The diff was not included because it is too large.</h5>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #666;">
—
<br>
<a href="https://salsa.debian.org/freeipa-team/dogtag-pki/-/compare/5b5ddd5d736fd719cc94a159af392fff91a734c7...1c0a7b45225aadc6efde21f92b0103937ae99d6d">View it on GitLab</a>.
<br>
You're receiving this email because of your account on salsa.debian.org.
If you'd like to receive fewer emails, you can
adjust your notification settings.
</p>
</div>
</body>
</html>