September 2016 - Pki-devel - Dogtag PKI List Archives

Replacing PKI logging framework
by Endi Sukma Dewata 24 Sep '16

24 Sep '16

Hi, This is a preliminary work for PKI 10.4. In ticket #195 we are planning to replace the current logging framework. This is needed to simplify writing unit tests and also provide debug log rotation. Here is the initial investigation to determine which framework to use: http://pki.fedoraproject.org/wiki/Logging_Frameworks I've also posted patch #834 that shows how it will be implemented. Please let me know if you have any comment/question. Thanks. -- Endi S. Dewata

1 0

[PATCH] 0134 Block reads during reload of LDAP-based profiles
by Fraser Tweedale 23 Sep '16

23 Sep '16

Hi team, The attached patch fixes (yet another) race condition in LDAPProfileSubsystem. https://fedorahosted.org/pki/ticket/2453 Additional context: https://fedorahosted.org/freeipa/ticket/6274 Thanks, Fraser

2 3

[PATCH] 0136 Compare serialised DNs in host authority check
by Fraser Tweedale 23 Sep '16

23 Sep '16

Hi team, The attached patch fixes a bug in lightweight CAs' host authority detection, when CA cert Subject DN contains PrintableString-encoded attributes. https://fedorahosted.org/pki/ticket/2475 Thanks, Fraser

2 2

[PATCH] 0135 Do not attempt LWCA key retrieval for host authority
by Fraser Tweedale 23 Sep '16

23 Sep '16

Hi team, Please review the attached patch which fixes a regression in two-step externally-signed CA installation. It is destined for 10.3 branch as well as master. https://fedorahosted.org/pki/ticket/2466 Cheers, Fraser

2 2

Announcing: External COPR Builds of CentOS 7 PKI EPEL Packages
by Matthew Harmsen 22 Sep '16

22 Sep '16

Everyone, The Dogtag PKI team is proud to announce the availability of new external COPR builds of PKI EPEL packages for the following two platforms: * CentOS 7.2: o https://copr.fedorainfracloud.org/coprs/g/pki/epel-7.2/repo/epel-7/group_pk… * CentOS 7.3: o https://copr.fedorainfracloud.org/coprs/g/pki/epel-7.3/repo/epel-7/group_pk… The CentOS 7.2 builds are based upon the Dogtag 10.2.6 release, while the CentOS 7.3 builds are based upon the Dogtag 10.3.3 release. Details on obtaining and using these new builds are available on the following Dogtag Wiki page: * External COPR Builds of CentOS PKI EPEL Packages <http://pki.fedoraproject.org/wiki/External_COPR_Builds_of_CentOS_PKI_EPEL_P…> Enjoy, Dogtag Team

1 0

[PATCH] 834 Updated PKI server logging service.
by Endi Sukma Dewata 21 Sep '16

21 Sep '16

The PKI server logging service has been modified to utilize Java Logging API. This will allow PKI code to be refactored into smaller modules which can run outside the server (e.g. for unit testing). The common logging.properties file has been updated to define the debug log handlers for each subsystem. New logging.properties files have been added for each subsystem to specify the PKI packages to be logged. The deployment tool has been modified to create a link to the default logging.properties instead of creating a copy. The unused log4j.properties has been removed. The pki.policy has been modified to allow Tomcat to read the default logging.properties files in /usr/share/pki and to generate debug logs in subfolders under <instance>/logs. https://fedorahosted.org/pki/ticket/195 -- Endi S. Dewata

1 0

[PATCH] 833 Additional improvements for SigningUnit.
by Endi Sukma Dewata 21 Sep '16

21 Sep '16

To help troubleshooting the SigningUnit for CA have been modified to show additional log messages. https://fedorahosted.org/pki/ticket/2463 Pushed to master (10.4) under one-liner/trivial rule. -- Endi S. Dewata

1 0

[PATCH] 832 Troubleshooting improvements for ConfigurationUtils.
by Endi Sukma Dewata 20 Sep '16

20 Sep '16

To help troubleshooting the ConfigurationUtils has been modified to chain the original exceptions and to show additional log messages. https://fedorahosted.org/pki/ticket/2463 Pushed to master (10.4) under one-line/trivial rule. -- Endi S. Dewata

1 0

[PATCH] 831 Troubleshooting improvements for SigningUnit.
by Endi Sukma Dewata 20 Sep '16

20 Sep '16

To help troubleshooting the SigningUnit for CA and OCSP have been modified to chain the original exceptions. https://fedorahosted.org/pki/ticket/2463 Pushed master (10.4) under one-line/trivial rule. -- Endi S. Dewata

1 0

Karma Requests for pki-core-10.3.5-5
by Matthew Harmsen 13 Sep '16

13 Sep '16

*The following updated candidate builds of pki-core 10.3.5 on Fedora 24, 25, and 26 (rawhide) consist of the following: * * *Fedora 24* o *pki-core-10.3.5-5.fc24 <http://koji.fedoraproject.org/koji/buildinfo?buildID=798415> * * *Fedora 25* o *pki-core-10.3.5-5.fc25 <http://koji.fedoraproject.org/koji/buildinfo?buildID=798417> * * *Fedora 26* o *pki-core-10.3.5-5.fc26 <http://koji.fedoraproject.org/koji/buildinfo?buildID=798418>* *Additionally, the CentOS 7 COPR EPEL Builds of Dogtag 10.3.3 were also updated:* * *https://copr.fedorainfracloud.org/coprs/g/pki/10.3.3/repo/epel-7/group_pki-10.3.3-epel-7.repo* <https://copr.fedorainfracloud.org/coprs/g/pki/10.3.3/repo/epel-7/group_pki-…> [group_pki-10.3.3] name=Copr repo for 10.3.3 owned by @pki baseurl=https://copr-be.cloud.fedoraproject.org/results/@pki/10.3.3/epel-7-… skip_if_unavailable=True gpgcheck=1 gpgkey=https://copr-be.cloud.fedoraproject.org/results/@pki/10.3.3/pubkey.g… enabled=1 enabled_metadata=1 *These builds address the following PKI tickets: * * PKI TRAC Ticket #1638 - Lightweight CAs: revoke certificate on CA deletion <https://fedorahosted.org/pki/ticket/1638> * PKI TRAC Ticket #2346 - Dogtag 10.3.6: Miscellaneous Enhancements <https://fedorahosted.org/pki/ticket/2436> * PKI TRAC Ticket #2443 - Prevent deletion of host CA's keys if LWCA entry deleted <https://fedorahosted.org/pki/ticket/2443> * PKI TRAC Ticket #2444 - Authority entry without entryUSN is skipped even if USN plugin enabled <vhttps://fedorahosted.org/pki/ticket/2444> * PKI TRAC Ticket #2446 - pkispawn: make subject_dn defaults unique per instance name (for shared HSM) <https://fedorahosted.org/pki/ticket/2446> * PKI TRAC Ticket #2447 - CertRequestInfo has incorrect URLs <https://fedorahosted.org/pki/ticket/2447> * PKI TRAC Ticket #2449 - Unable to create system certificates in different tokens <https://fedorahosted.org/pki/ticket/2449> *Please provide Karma for the following builds: * * *Fedora 24* o *https://bodhi.fedoraproject.org/updates/FEDORA-2016-994f943797 pki-core-10.3.5-5.fc24* * *Fedora 25* o *https://bodhi.fedoraproject.org/updates/FEDORA-2016-d363d36e22 pki-core-10.3.5-5.fc25 *

1 1