3:09 p.m.
Please review the attached patches with fixes for tickets 1036(man page
for profile CLI commands) and 1037 (issue in request status on
reject/cancel action on a key request).
-- Abhishek
9:44 p.m.
ACK on 107.
On 106 (man page), a few comments:
0. Command-Line Interface for managing profiles in the Certificate
System. ->
Command-Line Interface for managing Certificate System profiles.
1. Is it true that you can leave out the ca- ?
2. You forgot to mention pki <subsystem>-profile in the description.
3. profile-show:
This command is to get a profile. -->
This command is to view the details of a profile.
4. Remove the phrase "in the CA" as it is redundant.
5. enable/disable profile. For disable, you should mention that
a profile needs to be disabled before it can be edited. For
enable, you should mention that a profile needs to be enabled
before it can be used.
6. Authentication -- different commands require different roles to
authenticate. You need to look them up, but enable/disable are
agent operations, add/del/mod are admin operations, find/show
should be both.
7. The options start and stop can be used to specify the beginning and
the size of the list. --> Not very clear, you need to bold the options.
Also, stop is not an option.
8. "view the contents of the profile". It would be nice to mention
some of the things that are in there. eg. These contents include
profile inputs, profile outputs, authenticators, profile policies and
constraints.
9. This output file can be filled with data and used for certificate
enrollment. --> This is true but deceptive. Really the only thing t
matters are the profile inputs. The rest are likely to be ignored.
To get a template suitable for an enrollment, you really want to use
pki cert-request-profile-show. In fact, its a good idea to mention that
fact here.
Where profile-show is useful is for constructing new profiles or
modifying profiles.
10. Modify/Delete -- note that the profile must be disabled before these
operations can occur.
Ade
On Tue, 2014-09-30 at 16:09 -0400, Abhishek Koneru wrote:
Please review the attached patches with fixes for tickets 1036(man
page
for profile CLI commands) and 1037 (issue in request status on
reject/cancel action on a key request).
-- Abhishek
_______________________________________________
Pki-devel mailing list
Pki-devel(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-devel
3:43 p.m.
New subject: [PATCH] 106-2 Fixes for comments on 106 (#1036)
Pushed patch 107 to master.
Please review the patch 106-2 which addresses the below comments.
-- Abhishek
On Tue, 2014-09-30 at 22:44 -0400, Ade Lee wrote:
ACK on 107.
On 106 (man page), a few comments:
0. Command-Line Interface for managing profiles in the Certificate
System. ->
Command-Line Interface for managing Certificate System profiles.
1. Is it true that you can leave out the ca- ?
2. You forgot to mention pki <subsystem>-profile in the description.
3. profile-show:
This command is to get a profile. -->
This command is to view the details of a profile.
4. Remove the phrase "in the CA" as it is redundant.
5. enable/disable profile. For disable, you should mention that
a profile needs to be disabled before it can be edited. For
enable, you should mention that a profile needs to be enabled
before it can be used.
6. Authentication -- different commands require different roles to
authenticate. You need to look them up, but enable/disable are
agent operations, add/del/mod are admin operations, find/show
should be both.
7. The options start and stop can be used to specify the beginning and
the size of the list. --> Not very clear, you need to bold the options.
Also, stop is not an option.
8. "view the contents of the profile". It would be nice to mention
some of the things that are in there. eg. These contents include
profile inputs, profile outputs, authenticators, profile policies and
constraints.
9. This output file can be filled with data and used for certificate
enrollment. --> This is true but deceptive. Really the only thing t
matters are the profile inputs. The rest are likely to be ignored.
To get a template suitable for an enrollment, you really want to use
pki cert-request-profile-show. In fact, its a good idea to mention that
fact here.
Where profile-show is useful is for constructing new profiles or
modifying profiles.
10. Modify/Delete -- note that the profile must be disabled before these
operations can occur.
Ade
On Tue, 2014-09-30 at 16:09 -0400, Abhishek Koneru wrote:
> Please review the attached patches with fixes for tickets 1036(man page
> for profile CLI commands) and 1037 (issue in request status on
> reject/cancel action on a key request).
>
> -- Abhishek
> _______________________________________________
> Pki-devel mailing list
> Pki-devel(a)redhat.com
> https://www.redhat.com/mailman/listinfo/pki-devel
9:35 a.m.
New subject: [PATCH] 106-2 Fixes for comments on 106 (#1036)
1. mod to pki.1 man page -- says "User management commands" -> should
be "Profile management commands".
2. It is usual to bump the version (and add a changelog statement) when
the spec file is modified, even on master.
3. The pki-profile page looks much better. I think that it needs a note
to make the authentication picture a little clearer. Something like
this:
Note: Modifying or deleting a profile requires user(s) that have two
roles (admin and agent). The same user may be in both roles. An agent
is need to first disable the profile. Once the profile is disabled, it
can be modified/deleted by an admin user. Then, an agent is needed to
enable the profile for use by the CA.
Once the above changes are made, ACK.
4-10-01 at 16:43 -0400, Abhishek Koneru wrote:
Pushed patch 107 to master.
Please review the patch 106-2 which addresses the below comments.
-- Abhishek
On Tue, 2014-09-30 at 22:44 -0400, Ade Lee wrote:
> ACK on 107.
>
> On 106 (man page), a few comments:
> 0. Command-Line Interface for managing profiles in the Certificate
> System. ->
> Command-Line Interface for managing Certificate System profiles.
> 1. Is it true that you can leave out the ca- ?
> 2. You forgot to mention pki <subsystem>-profile in the description.
> 3. profile-show:
> This command is to get a profile. -->
> This command is to view the details of a profile.
> 4. Remove the phrase "in the CA" as it is redundant.
> 5. enable/disable profile. For disable, you should mention that
> a profile needs to be disabled before it can be edited. For
> enable, you should mention that a profile needs to be enabled
> before it can be used.
> 6. Authentication -- different commands require different roles to
> authenticate. You need to look them up, but enable/disable are
> agent operations, add/del/mod are admin operations, find/show
> should be both.
>
> 7. The options start and stop can be used to specify the beginning and
> the size of the list. --> Not very clear, you need to bold the options.
> Also, stop is not an option.
>
> 8. "view the contents of the profile". It would be nice to mention
> some of the things that are in there. eg. These contents include
> profile inputs, profile outputs, authenticators, profile policies and
> constraints.
>
> 9. This output file can be filled with data and used for certificate
> enrollment. --> This is true but deceptive. Really the only thing t
> matters are the profile inputs. The rest are likely to be ignored.
>
> To get a template suitable for an enrollment, you really want to use
> pki cert-request-profile-show. In fact, its a good idea to mention that
> fact here.
>
> Where profile-show is useful is for constructing new profiles or
> modifying profiles.
>
> 10. Modify/Delete -- note that the profile must be disabled before these
> operations can occur.
>
> Ade
>
> On Tue, 2014-09-30 at 16:09 -0400, Abhishek Koneru wrote:
> > Please review the attached patches with fixes for tickets 1036(man page
> > for profile CLI commands) and 1037 (issue in request status on
> > reject/cancel action on a key request).
> >
> > -- Abhishek
> > _______________________________________________
> > Pki-devel mailing list
> > Pki-devel(a)redhat.com
> > https://www.redhat.com/mailman/listinfo/pki-devel
>
>
10:13 a.m.
New subject: [PATCH] 106-2 Fixes for comments on 106 (#1036)
On 10/1/2014 3:43 PM, Abhishek Koneru wrote:
Pushed patch 107 to master.
Please review the patch 106-2 which addresses the below comments.
In addition to Ade's comments:
1. The cert profile commands are specific to CA, so the man page should
be called pki-ca-profile.1. We may have pki-tps-profile.1 later.
2. The cert profile commands are prefixed with ca-, not with generic
<subsystem>-. So in the man page all <subsystem>- should be replaced
with ca-.
3. In the example there are profile-* commands. They are missing the ca-
prefix.
4. In the example there is a profile-delete. It should be ca-profile-del.
--
Endi S. Dewata
3487
days inactive
3496
days old
4 comments
3 participants
participants (3)
-
Abhishek Koneru -
Ade Lee -
Endi Sukma Dewata