[PATCH] pki-cfu-0153-Ticket-2496-Cert-Key-recovery-is-successful-when-the.patch
Attached please find the patch for https://fedorahosted.org/pki/ticket/2496 Cert/Key recovery is successful when the cert serial number and key id on the ldap user mismatches Description is in patch summary. thanks, Christina
ACK One minor issue: The explaining text in the CS.cfg is incorrect. It has the meaning of the new flag reverse to what is intended: When recovering by keyid: externalReg.recover.byKeyID=false +externalReg._024=# - keyid in record indicates actual recovery; +externalReg._025=# e.g. (certstoadd: 36,ca1,5,kra1) +externalReg._026=# - missing of which means retention; +externalReg._027=# e.g. (certstoadd: 36,ca1) +externalReg._028=# When recovering by cert: externalReg.recover.byKeyID=true +externalReg._029=# - keyid field needs to be present +externalReg._030=# but the value is not relevant and will be ignored +externalReg._031=# (a "0" would be fine) +externalReg._032=# e.g. (certstoadd: 36,ca1,0,kra1) +externalReg._033=# - missing of keyid still means retention; +externalReg._034=# e.g. (certstoadd: 36,ca1) false and true for byKeID is switched. Also, since there is a small chance of impact to certain external reg features, such as retention, it might make sense to recommend a quick sanity test of the external reg feature after this. In the future we might want to more strongly discourage the keyid pathway. ----- Original Message -----
From: "Christina Fu" <cfu@redhat.com> To: pki-devel@redhat.com Sent: Thursday, October 6, 2016 2:18:49 PM Subject: [Pki-devel] [PATCH] pki-cfu-0153-Ticket-2496-Cert-Key-recovery-is-successful-when-the.patch
Attached please find the patch for
https://fedorahosted.org/pki/ticket/2496 Cert/Key recovery is successful when the cert serial number and key id on the ldap user mismatches
Description is in patch summary.
thanks,
Christina
_______________________________________________ Pki-devel mailing list Pki-devel@redhat.com https://www.redhat.com/mailman/listinfo/pki-devel
pushed to master: commit e00a28fcdc3e8fea920c85563a3ab26b123dda2d <https://fedorahosted.org/pki/changeset/e00a28fcdc3e8fea920c85563a3ab26b123dda2d/> thanks! Christina On 10/07/2016 11:19 AM, John Magne wrote:
ACK
One minor issue:
The explaining text in the CS.cfg is incorrect. It has the meaning of the new flag reverse to what is intended:
When recovering by keyid: externalReg.recover.byKeyID=false +externalReg._024=# - keyid in record indicates actual recovery; +externalReg._025=# e.g. (certstoadd: 36,ca1,5,kra1) +externalReg._026=# - missing of which means retention; +externalReg._027=# e.g. (certstoadd: 36,ca1) +externalReg._028=# When recovering by cert: externalReg.recover.byKeyID=true +externalReg._029=# - keyid field needs to be present +externalReg._030=# but the value is not relevant and will be ignored +externalReg._031=# (a "0" would be fine) +externalReg._032=# e.g. (certstoadd: 36,ca1,0,kra1) +externalReg._033=# - missing of keyid still means retention; +externalReg._034=# e.g. (certstoadd: 36,ca1)
false and true for byKeID is switched.
Also, since there is a small chance of impact to certain external reg features, such as retention, it might make sense to recommend a quick sanity test of the external reg feature after this.
In the future we might want to more strongly discourage the keyid pathway.
----- Original Message -----
From: "Christina Fu" <cfu@redhat.com> To: pki-devel@redhat.com Sent: Thursday, October 6, 2016 2:18:49 PM Subject: [Pki-devel] [PATCH] pki-cfu-0153-Ticket-2496-Cert-Key-recovery-is-successful-when-the.patch
Attached please find the patch for
https://fedorahosted.org/pki/ticket/2496 Cert/Key recovery is successful when the cert serial number and key id on the ldap user mismatches
Description is in patch summary.
thanks,
Christina
_______________________________________________ Pki-devel mailing list Pki-devel@redhat.com https://www.redhat.com/mailman/listinfo/pki-devel
participants (2)
-
Christina Fu -
John Magne