[PATCH] 0105 Add pki-server ca-cert-db-upgrade command
Hi all, The following patch adds a pki-server subcommand for updating certificate records to add the issuerName attribute. It is for #1667 (Database upgrade script to add issuerName attribute to all cert entries). Follow-up question: should I (and if so, how should I) also add an upgrade scriptlet to perform the upgrade for Dogtag CA subsystem on the host? Is there a precedent for invoking pki-server (or subroutines thereof) from pki-server-upgrade scriptlets? Cheers, Fraser
Isn't all this predicated on a schema change that adds the issuer as an optional field for the certRecord? Ade On Mon, 2016-05-09 at 17:15 +1000, Fraser Tweedale wrote:
Hi all,
The following patch adds a pki-server subcommand for updating certificate records to add the issuerName attribute.
It is for #1667 (Database upgrade script to add issuerName attribute to all cert entries).
Follow-up question: should I (and if so, how should I) also add an upgrade scriptlet to perform the upgrade for Dogtag CA subsystem on the host? Is there a precedent for invoking pki-server (or subroutines thereof) from pki-server-upgrade scriptlets?
Cheers, Fraser _______________________________________________ Pki-devel mailing list Pki-devel@redhat.com https://www.redhat.com/mailman/listinfo/pki-devel
On Mon, May 09, 2016 at 04:06:46PM -0400, Ade Lee wrote:
Isn't all this predicated on a schema change that adds the issuer as an optional field for the certRecord?
The schema already exists but was unused.
Ade
On Mon, 2016-05-09 at 17:15 +1000, Fraser Tweedale wrote:
Hi all,
The following patch adds a pki-server subcommand for updating certificate records to add the issuerName attribute.
It is for #1667 (Database upgrade script to add issuerName attribute to all cert entries).
Follow-up question: should I (and if so, how should I) also add an upgrade scriptlet to perform the upgrade for Dogtag CA subsystem on the host? Is there a precedent for invoking pki-server (or subroutines thereof) from pki-server-upgrade scriptlets?
Cheers, Fraser _______________________________________________ Pki-devel mailing list Pki-devel@redhat.com https://www.redhat.com/mailman/listinfo/pki-devel
The patch itself is fine. I'm just struggling with where this script should exist. pki-server ca-cert-db-upgrade seems like an awfully generic description for this operation - which basically provides a very specific db migration. For that matter, why not ca-db-upgrade? What happens the next time someone needs to do a CA DB upgrade? I'm almost wondering if a separate pki-db tool is needed. For that matter though, its possible that the database is quite large so attempting to do this automatically during upgrade is probably not advisable. Opening up for others to chime in .. Ade On Tue, 2016-05-10 at 08:32 +1000, Fraser Tweedale wrote:
On Mon, May 09, 2016 at 04:06:46PM -0400, Ade Lee wrote:
Isn't all this predicated on a schema change that adds the issuer as an optional field for the certRecord?
The schema already exists but was unused.
Ade
On Mon, 2016-05-09 at 17:15 +1000, Fraser Tweedale wrote:
Hi all,
The following patch adds a pki-server subcommand for updating certificate records to add the issuerName attribute.
It is for #1667 (Database upgrade script to add issuerName attribute to all cert entries).
Follow-up question: should I (and if so, how should I) also add an upgrade scriptlet to perform the upgrade for Dogtag CA subsystem on the host? Is there a precedent for invoking pki-server (or subroutines thereof) from pki-server-upgrade scriptlets?
Cheers, Fraser _______________________________________________ Pki-devel mailing list Pki-devel@redhat.com https://www.redhat.com/mailman/listinfo/pki-devel
On Tue, May 10, 2016 at 02:42:52PM -0400, Ade Lee wrote:
The patch itself is fine.
I'm just struggling with where this script should exist.
pki-server ca-cert-db-upgrade seems like an awfully generic description for this operation - which basically provides a very specific db migration. For that matter, why not ca-db-upgrade?
What happens the next time someone needs to do a CA DB upgrade? I'm almost wondering if a separate pki-db tool is needed.
For that matter though, its possible that the database is quite large so attempting to do this automatically during upgrade is probably not advisable.
What's the most certs you could imagine? Perhaps some empirical testing is warranted.
Opening up for others to chime in ..
Ade
On Tue, 2016-05-10 at 08:32 +1000, Fraser Tweedale wrote:
On Mon, May 09, 2016 at 04:06:46PM -0400, Ade Lee wrote:
Isn't all this predicated on a schema change that adds the issuer as an optional field for the certRecord?
The schema already exists but was unused.
Ade
On Mon, 2016-05-09 at 17:15 +1000, Fraser Tweedale wrote:
Hi all,
The following patch adds a pki-server subcommand for updating certificate records to add the issuerName attribute.
It is for #1667 (Database upgrade script to add issuerName attribute to all cert entries).
Follow-up question: should I (and if so, how should I) also add an upgrade scriptlet to perform the upgrade for Dogtag CA subsystem on the host? Is there a precedent for invoking pki-server (or subroutines thereof) from pki-server-upgrade scriptlets?
Cheers, Fraser _______________________________________________ Pki-devel mailing list Pki-devel@redhat.com https://www.redhat.com/mailman/listinfo/pki-devel
On Tue, May 10, 2016 at 02:42:52PM -0400, Ade Lee wrote:
The patch itself is fine.
I'm just struggling with where this script should exist.
pki-server ca-cert-db-upgrade seems like an awfully generic description for this operation - which basically provides a very specific db migration. For that matter, why not ca-db-upgrade?
My thinking was that, in the future, whatever DB upgrades are needed for a subsystem could be added to the command. So on that, I take your point re "ca-db-upgrade" and will cut a new patch with that command name.
What happens the next time someone needs to do a CA DB upgrade? I'm almost wondering if a separate pki-db tool is needed.
I think having it as part of pki-server(1) is a satisfactory fit.
For that matter though, its possible that the database is quite large so attempting to do this automatically during upgrade is probably not advisable.
We can leave it as a manual step for now (for Dogtag itself). ipa-server-install may need to run it. In the future, to avoid unnecessary work, we can track which "steps" have been run (either on disk or, preferably, in LDAP itself). Updates themselves should be idempotent.
Opening up for others to chime in ..
Ade
On Tue, 2016-05-10 at 08:32 +1000, Fraser Tweedale wrote:
On Mon, May 09, 2016 at 04:06:46PM -0400, Ade Lee wrote:
Isn't all this predicated on a schema change that adds the issuer as an optional field for the certRecord?
The schema already exists but was unused.
Ade
On Mon, 2016-05-09 at 17:15 +1000, Fraser Tweedale wrote:
Hi all,
The following patch adds a pki-server subcommand for updating certificate records to add the issuerName attribute.
It is for #1667 (Database upgrade script to add issuerName attribute to all cert entries).
Follow-up question: should I (and if so, how should I) also add an upgrade scriptlet to perform the upgrade for Dogtag CA subsystem on the host? Is there a precedent for invoking pki-server (or subroutines thereof) from pki-server-upgrade scriptlets?
Cheers, Fraser _______________________________________________ Pki-devel mailing list Pki-devel@redhat.com https://www.redhat.com/mailman/listinfo/pki-devel
On Fri, May 13, 2016 at 02:48:41PM +1000, Fraser Tweedale wrote:
On Tue, May 10, 2016 at 02:42:52PM -0400, Ade Lee wrote:
The patch itself is fine.
I'm just struggling with where this script should exist.
pki-server ca-cert-db-upgrade seems like an awfully generic description for this operation - which basically provides a very specific db migration. For that matter, why not ca-db-upgrade?
My thinking was that, in the future, whatever DB upgrades are needed for a subsystem could be added to the command.
So on that, I take your point re "ca-db-upgrade" and will cut a new patch with that command name.
New patch attached. Cheers, Fraser
On 5/13/2016 12:06 AM, Fraser Tweedale wrote:
The patch itself is fine.
I'm just struggling with where this script should exist.
pki-server ca-cert-db-upgrade seems like an awfully generic description for this operation - which basically provides a very specific db migration. For that matter, why not ca-db-upgrade?
My thinking was that, in the future, whatever DB upgrades are needed for a subsystem could be added to the command.
So on that, I take your point re "ca-db-upgrade" and will cut a new patch with that command name.
New patch attached.
ACK. As discussed with alee I've renamed the command to "db-upgrade" in the attached patch. This will be the primary command to do database upgrade. Later if we have more upgrade scripts we can refactor the command to execute multiple scripts, but the primary command name stays the same. I also added some log messages so we can see the upgrade progress. I pushed both patches to master. We're also planning to implement a proper database upgrade framework in 10.3.1: https://fedorahosted.org/pki/ticket/710 -- Endi S. Dewata
participants (3)
-
Ade Lee -
Endi Sukma Dewata -
Fraser Tweedale