From alee at redhat.com Tue Sep 4 14:00:31 2012 From: alee at redhat.com (Ade Lee) Date: Tue, 04 Sep 2012 10:00:31 -0400 Subject: [Pki-devel] [PATCH] 107 Added proxy realm. In-Reply-To: <503FB2CE.4070703@redhat.com> References: <503573E0.7030007@redhat.com> <1346160812.2539.135.camel@aleeredhat.laptop> <503E9245.8050403@redhat.com> <503FB2CE.4070703@redhat.com> Message-ID: <1346767231.24731.3.camel@aleeredhat.laptop> ack On Thu, 2012-08-30 at 13:37 -0500, Endi Sukma Dewata wrote: > On 8/29/2012 5:05 PM, Endi Sukma Dewata wrote: > > On 8/28/2012 8:33 AM, Ade Lee wrote: > >> The changes look ok, although due to the issue in one of the previous > >> patches, I cannot build yet using the compose scripts. > > > > New patch attached. I added allowLinking=true so now it can use links in > > the WEB-INF/lib. > > > >> What effect does this patch have on the patch that mharmsen is currently > >> working on? At the very least, you will need to modify where it is > >> checking for links for the dogtag 10 instance. > > > > I modified the operations and functions to check the pki-*.jars at the > > new location. > > > >> And how does this affect a dogtag 9 instance running under dogtag 10 > >> code? > > > > I tried upgrading Dogtag 9 instance and it seems to be working fine. The > > pki-tomcat.jar link will be added into common/lib so the code in > > CMSStartServlet will still work although it's not used. > > Rebased. No code change. > From alee at redhat.com Tue Sep 4 14:04:09 2012 From: alee at redhat.com (Ade Lee) Date: Tue, 04 Sep 2012 10:04:09 -0400 Subject: [Pki-devel] [PATCH] 108 Fixed conflicting LDIF files. In-Reply-To: <503FB2D9.3040505@redhat.com> References: <503FB2D9.3040505@redhat.com> Message-ID: <1346767449.24731.4.camel@aleeredhat.laptop> ack On Thu, 2012-08-30 at 13:37 -0500, Endi Sukma Dewata wrote: > During subsystem configuration the ConfigurationUtils.importLDIFS() > would generate LDIF files in /conf folder which may conflict > with files belonging to other subsystems. The code has been modified > to generate the files in //conf folder. > > Ticket #89 > > _______________________________________________ > Pki-devel mailing list > Pki-devel at redhat.com > https://www.redhat.com/mailman/listinfo/pki-devel From alee at redhat.com Tue Sep 4 14:26:28 2012 From: alee at redhat.com (Ade Lee) Date: Tue, 04 Sep 2012 10:26:28 -0400 Subject: [Pki-devel] [PATCH] 109 Merged Javadoc packages. In-Reply-To: <503FD6E4.5090309@redhat.com> References: <503FD6E4.5090309@redhat.com> Message-ID: <1346768788.24731.5.camel@aleeredhat.laptop> ack On Thu, 2012-08-30 at 16:11 -0500, Endi Sukma Dewata wrote: > The Javadocs for pki-util, pki-java-tools and pki-common have been > merged and packaged into pki-javadoc RPM. > > Ticket #295 > > _______________________________________________ > Pki-devel mailing list > Pki-devel at redhat.com > https://www.redhat.com/mailman/listinfo/pki-devel From alee at redhat.com Tue Sep 4 14:26:41 2012 From: alee at redhat.com (Ade Lee) Date: Tue, 04 Sep 2012 10:26:41 -0400 Subject: [Pki-devel] [PATCH] 110 Removed duplicate common classes in pki-console.jar. In-Reply-To: <503FFA63.60601@redhat.com> References: <503FFA63.60601@redhat.com> Message-ID: <1346768804.24731.6.camel@aleeredhat.laptop> ack On Thu, 2012-08-30 at 18:42 -0500, Endi Sukma Dewata wrote: > The pki-console has been modified to depend on pki-base. This way > it's no longer necessary to include duplicate common classes in > pki-console. > > Ticket #113 > > I verified installing pki-base, dogtag-pki-console-theme, and > pki-console and running pkiconsole to connect to a remote CA. > > _______________________________________________ > Pki-devel mailing list > Pki-devel at redhat.com > https://www.redhat.com/mailman/listinfo/pki-devel From edewata at redhat.com Tue Sep 4 14:49:21 2012 From: edewata at redhat.com (Endi Sukma Dewata) Date: Tue, 04 Sep 2012 09:49:21 -0500 Subject: [Pki-devel] [PATCH] 108 Fixed conflicting LDIF files. In-Reply-To: <1346767449.24731.4.camel@aleeredhat.laptop> References: <503FB2D9.3040505@redhat.com> <1346767449.24731.4.camel@aleeredhat.laptop> Message-ID: <504614F1.8080600@redhat.com> On 9/4/2012 9:04 AM, Ade Lee wrote: > ack Pushed to master. -- Endi S. Dewata From edewata at redhat.com Tue Sep 4 14:49:29 2012 From: edewata at redhat.com (Endi Sukma Dewata) Date: Tue, 04 Sep 2012 09:49:29 -0500 Subject: [Pki-devel] [PATCH] 110 Removed duplicate common classes in pki-console.jar. In-Reply-To: <1346768804.24731.6.camel@aleeredhat.laptop> References: <503FFA63.60601@redhat.com> <1346768804.24731.6.camel@aleeredhat.laptop> Message-ID: <504614F9.7060000@redhat.com> On 9/4/2012 9:26 AM, Ade Lee wrote: > ack Pushed to master. -- Endi S. Dewata From edewata at redhat.com Tue Sep 4 21:46:05 2012 From: edewata at redhat.com (Endi Sukma Dewata) Date: Tue, 04 Sep 2012 16:46:05 -0500 Subject: [Pki-devel] [PATCH] 111 Added common theme webapp. Message-ID: <5046769D.5060507@redhat.com> A new theme webapp has been added to store the theme files for all PKI webapps. In the future the subsystem webapps can be modified to use the theme files provided by this common webapp instead of having to include duplicate files in each webapp. Ticket #89 -- Endi S. Dewata -------------- next part -------------- A non-text attachment was scrubbed... Name: pki-edewata-0111-Added-common-theme-webapp.patch Type: text/x-patch Size: 3774 bytes Desc: not available URL: From edewata at redhat.com Tue Sep 4 21:46:24 2012 From: edewata at redhat.com (Endi Sukma Dewata) Date: Tue, 04 Sep 2012 16:46:24 -0500 Subject: [Pki-devel] [PATCH] 112 Added common ROOT webapp. Message-ID: <504676B0.3050209@redhat.com> The current ROOT webapp will redirect users coming to the root URL path to the proper path of the subsystem's webapp. Since now a single Tomcat instance may have multiple subsystems, a new ROOT webapp has been added to present the user with a menu of all available webapps from all subsystems in the instance. Ticket #89 -- Endi S. Dewata -------------- next part -------------- A non-text attachment was scrubbed... Name: pki-edewata-0112-Added-common-ROOT-webapp.patch Type: text/x-patch Size: 21644 bytes Desc: not available URL: From edewata at redhat.com Tue Sep 4 21:46:29 2012 From: edewata at redhat.com (Endi Sukma Dewata) Date: Tue, 04 Sep 2012 16:46:29 -0500 Subject: [Pki-devel] [PATCH] 113 Fixed SELinux error during pkidestroy. Message-ID: <504676B5.8040501@redhat.com> When removing a subsystem the pkidestroy would also remove the SELinux contexts for the instance regardless of whether there are still other subsystems in the instance. The code has been fixed such that it's removing the SELinux contexts when deleting the last subsystem only. Ticket #89 -- Endi S. Dewata -------------- next part -------------- A non-text attachment was scrubbed... Name: pki-edewata-0113-Fixed-SELinux-error-during-pkidestroy.patch Type: text/x-patch Size: 5042 bytes Desc: not available URL: From cfu at redhat.com Tue Sep 4 22:27:57 2012 From: cfu at redhat.com (Christina Fu) Date: Tue, 04 Sep 2012 15:27:57 -0700 Subject: [Pki-devel] [PATCH] spec file version adjustment Message-ID: <5046806D.3090807@redhat.com> when code is changed in a package, the version number in each corresponding spec file needs to be bumped up by one. This patch adjusts what had been missed for the code *Bug 745278* -[RFE] ECC encryption keys cannot be archived Please review. thanks, Christina -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- An embedded and charset-unspecified text was scrubbed... Name: 0001-version-number-adjustment.patch URL: From mharmsen at redhat.com Tue Sep 4 22:30:24 2012 From: mharmsen at redhat.com (Matthew Harmsen) Date: Tue, 04 Sep 2012 15:30:24 -0700 Subject: [Pki-devel] [PATCH] spec file version adjustment In-Reply-To: <5046806D.3090807@redhat.com> References: <5046806D.3090807@redhat.com> Message-ID: <50468100.2040702@redhat.com> On 09/04/12 15:27, Christina Fu wrote: > when code is changed in a package, the version number in each > corresponding spec file needs to be bumped up by one. > This patch adjusts what had been missed for the code > *Bug 745278* > -[RFE] ECC encryption keys cannot be archived > > Please review. > thanks, > Christina > > > _______________________________________________ > Pki-devel mailing list > Pki-devel at redhat.com > https://www.redhat.com/mailman/listinfo/pki-devel ACK -------------- next part -------------- An HTML attachment was scrubbed... URL: From edewata at redhat.com Tue Sep 4 22:43:52 2012 From: edewata at redhat.com (Endi Sukma Dewata) Date: Tue, 04 Sep 2012 17:43:52 -0500 Subject: [Pki-devel] [PATCH] 106 Moved WAR creation code into CMake scripts. In-Reply-To: <503FB2C2.6000306@redhat.com> References: <503573D6.30006@redhat.com> <1346125966.2539.98.camel@aleeredhat.laptop> <503FB2C2.6000306@redhat.com> Message-ID: <50468428.4070906@redhat.com> On 8/30/2012 1:36 PM, Endi Sukma Dewata wrote: > New patch attached. The code is now moved into pkispawn so it will use > the correct theme files. New patch attached. The war_explosion.py has been renamed into webapp_deployment.py. -- Endi S. Dewata -------------- next part -------------- A non-text attachment was scrubbed... Name: pki-edewata-0106-2-Moved-webapp-deployment-code-into-pkispawn.patch Type: text/x-patch Size: 15233 bytes Desc: not available URL: From edewata at redhat.com Tue Sep 4 22:44:19 2012 From: edewata at redhat.com (Endi Sukma Dewata) Date: Tue, 04 Sep 2012 17:44:19 -0500 Subject: [Pki-devel] [PATCH] 107 Added proxy realm. In-Reply-To: <503FB2CE.4070703@redhat.com> References: <503573E0.7030007@redhat.com> <1346160812.2539.135.camel@aleeredhat.laptop> <503E9245.8050403@redhat.com> <503FB2CE.4070703@redhat.com> Message-ID: <50468443.5080109@redhat.com> On 8/30/2012 1:37 PM, Endi Sukma Dewata wrote: > Rebased. No code change. Rebased again, no code change. -- Endi S. Dewata -------------- next part -------------- A non-text attachment was scrubbed... Name: pki-edewata-0107-3-Added-proxy-realm.patch Type: text/x-patch Size: 34880 bytes Desc: not available URL: From mharmsen at redhat.com Wed Sep 5 02:41:41 2012 From: mharmsen at redhat.com (Matthew Harmsen) Date: Tue, 04 Sep 2012 19:41:41 -0700 Subject: [Pki-devel] [PATCH] 106 Moved WAR creation code into CMake scripts. In-Reply-To: <50468428.4070906@redhat.com> References: <503573D6.30006@redhat.com> <1346125966.2539.98.camel@aleeredhat.laptop> <503FB2C2.6000306@redhat.com> <50468428.4070906@redhat.com> Message-ID: <5046BBE5.60405@redhat.com> On 09/04/12 15:43, Endi Sukma Dewata wrote: > On 8/30/2012 1:36 PM, Endi Sukma Dewata wrote: >> New patch attached. The code is now moved into pkispawn so it will use >> the correct theme files. > > New patch attached. The war_explosion.py has been renamed into > webapp_deployment.py. > Successfully built, installed, deployed, and tested on 64-bit Fedora 17 machine. ACK From edewata at redhat.com Wed Sep 5 15:14:59 2012 From: edewata at redhat.com (Endi Sukma Dewata) Date: Wed, 05 Sep 2012 10:14:59 -0500 Subject: [Pki-devel] [PATCH] 106 Moved WAR creation code into CMake scripts. In-Reply-To: <5046BBE5.60405@redhat.com> References: <503573D6.30006@redhat.com> <1346125966.2539.98.camel@aleeredhat.laptop> <503FB2C2.6000306@redhat.com> <50468428.4070906@redhat.com> <5046BBE5.60405@redhat.com> Message-ID: <50476C73.4020007@redhat.com> On 9/4/2012 9:41 PM, Matthew Harmsen wrote: > ACK Pushed to master. Thanks. -- Endi S. Dewata From edewata at redhat.com Wed Sep 5 15:15:03 2012 From: edewata at redhat.com (Endi Sukma Dewata) Date: Wed, 05 Sep 2012 10:15:03 -0500 Subject: [Pki-devel] [PATCH] 107 Added proxy realm. In-Reply-To: <1346767231.24731.3.camel@aleeredhat.laptop> References: <503573E0.7030007@redhat.com> <1346160812.2539.135.camel@aleeredhat.laptop> <503E9245.8050403@redhat.com> <503FB2CE.4070703@redhat.com> <1346767231.24731.3.camel@aleeredhat.laptop> Message-ID: <50476C77.60608@redhat.com> On 9/4/2012 9:00 AM, Ade Lee wrote: > ack Pushed to master. -- Endi S. Dewata From edewata at redhat.com Wed Sep 5 15:15:08 2012 From: edewata at redhat.com (Endi Sukma Dewata) Date: Wed, 05 Sep 2012 10:15:08 -0500 Subject: [Pki-devel] [PATCH] 109 Merged Javadoc packages. In-Reply-To: <1346768788.24731.5.camel@aleeredhat.laptop> References: <503FD6E4.5090309@redhat.com> <1346768788.24731.5.camel@aleeredhat.laptop> Message-ID: <50476C7C.2030603@redhat.com> On 9/4/2012 9:26 AM, Ade Lee wrote: > ack Pushed to master. Thanks. -- Endi S. Dewata From mharmsen at redhat.com Sat Sep 8 02:02:38 2012 From: mharmsen at redhat.com (Matthew Harmsen) Date: Fri, 07 Sep 2012 19:02:38 -0700 Subject: [Pki-devel] [PATCH] Verify Symbolic Links (Dogtag 9) Message-ID: <504AA73E.3070802@redhat.com> The following patch fixes the problem of being unable to install an instance that does not contain the default name described in the following TRAC ticket: * TRAC Ticket #301 -Need to modify init scripts to verify needed symlinks in an instance -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: 20120907-Verify-symbolic-links-Dogtag-9.patch Type: text/x-patch Size: 1163 bytes Desc: not available URL: From mharmsen at redhat.com Sat Sep 8 02:02:43 2012 From: mharmsen at redhat.com (Matthew Harmsen) Date: Fri, 07 Sep 2012 19:02:43 -0700 Subject: [Pki-devel] [PATCH] Verify Symbolic Links (Dogtag 10) Message-ID: <504AA743.6040409@redhat.com> The following patch fixes the problem of being unable to install an instance that does not contain the default name described in the following TRAC ticket: * TRAC Ticket #301 -Need to modify init scripts to verify needed symlinks in an instance -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: 20120907-Verify-symbolic-links-Dogtag-10.patch Type: text/x-patch Size: 1165 bytes Desc: not available URL: From jmagne at redhat.com Sat Sep 8 02:07:43 2012 From: jmagne at redhat.com (John Magne) Date: Fri, 7 Sep 2012 22:07:43 -0400 (EDT) Subject: [Pki-devel] [PATCH] Verify Symbolic Links (Dogtag 10) In-Reply-To: <504AA743.6040409@redhat.com> Message-ID: <1038798.31640156.1347070063554.JavaMail.root@redhat.com> Looks like simple change: ACK ----- Original Message ----- From: "Matthew Harmsen" To: "pki-devel" Sent: Friday, September 7, 2012 7:02:43 PM Subject: [Pki-devel] [PATCH] Verify Symbolic Links (Dogtag 10) The following patch fixes the problem of being unable to install an instance that does not contain the default name described in the following TRAC ticket: * TRAC Ticket #301 - Need to modify init scripts to verify needed symlinks in an instance _______________________________________________ Pki-devel mailing list Pki-devel at redhat.com https://www.redhat.com/mailman/listinfo/pki-devel From jmagne at redhat.com Sat Sep 8 02:11:07 2012 From: jmagne at redhat.com (John Magne) Date: Fri, 7 Sep 2012 22:11:07 -0400 (EDT) Subject: [Pki-devel] [PATCH] Verify Symbolic Links (Dogtag 9) In-Reply-To: <504AA73E.3070802@redhat.com> Message-ID: <1152178241.31640216.1347070267986.JavaMail.root@redhat.com> ACK ----- Original Message ----- From: "Matthew Harmsen" To: "pki-devel" Sent: Friday, September 7, 2012 7:02:38 PM Subject: [Pki-devel] [PATCH] Verify Symbolic Links (Dogtag 9) The following patch fixes the problem of being unable to install an instance that does not contain the default name described in the following TRAC ticket: * TRAC Ticket #301 - Need to modify init scripts to verify needed symlinks in an instance _______________________________________________ Pki-devel mailing list Pki-devel at redhat.com https://www.redhat.com/mailman/listinfo/pki-devel From mharmsen at redhat.com Sat Sep 8 03:20:27 2012 From: mharmsen at redhat.com (Matthew Harmsen) Date: Fri, 07 Sep 2012 20:20:27 -0700 Subject: [Pki-devel] Request to rebuild pki-core-9.0.23-1 for Dogtag 9 on Fedora 16 and Fedora 17 in Koji Message-ID: <504AB97B.2090705@redhat.com> Andrew, I have fixed 'TRAC Ticket #301 -Need to modify init scripts to verify needed symlinks in an instance' to be able to create non-default named instances, and have republished the source tarball. Please rebuild the Dogtag 9 versions of pki-core-9.0.23-1 for Fedora 16 and Fedora 17 in Koji. Thanks, -- Matt From jmagne at redhat.com Tue Sep 11 01:33:25 2012 From: jmagne at redhat.com (John Magne) Date: Mon, 10 Sep 2012 21:33:25 -0400 (EDT) Subject: [Pki-devel] GD Errata Status Message-ID: <1270393823.32693808.1347327205992.JavaMail.root@redhat.com> Code checked in, builds have been submitted for all packages. The build system is bogging down apparently, will finish off the errata tomorrow. From edewata at redhat.com Tue Sep 11 20:32:05 2012 From: edewata at redhat.com (Endi Sukma Dewata) Date: Tue, 11 Sep 2012 15:32:05 -0500 Subject: [Pki-devel] [PATCH] 114 Added dependency on redhat-rpm-config. Message-ID: <504F9FC5.3080206@redhat.com> To avoid multilib conflicts the spec file has been modified to depend on redhat-rpm-config. This way the brp-java-repack-jars will run to repack the JAR files to generate identical files across architectures. Ticket: #296 -- Endi S. Dewata -------------- next part -------------- A non-text attachment was scrubbed... Name: pki-edewata-0114-Added-dependency-on-redhat-rpm-config.patch Type: text/x-patch Size: 1751 bytes Desc: not available URL: From alee at redhat.com Tue Sep 11 21:47:22 2012 From: alee at redhat.com (Ade Lee) Date: Tue, 11 Sep 2012 17:47:22 -0400 Subject: [Pki-devel] [PATCH] various fixes to pki-deploy Message-ID: <1347400042.24731.127.camel@aleeredhat.laptop> Please review. Thanks, Ade -------------- next part -------------- A non-text attachment was scrubbed... Name: pki-vakwetu-0054-Various-fixes-to-installation-servlet-and-pki-deploy.patch Type: text/x-patch Size: 32605 bytes Desc: not available URL: From cfu at redhat.com Wed Sep 12 01:19:16 2012 From: cfu at redhat.com (Christina Fu) Date: Tue, 11 Sep 2012 18:19:16 -0700 Subject: [Pki-devel] Review Request: Token Management System ECC infrastructure Message-ID: <504FE314.5070506@redhat.com> https://fedorahosted.org/pki/attachment/ticket/304/TPS-ECC.patch2 This patch provides TMS ECC infrastructure as described in task #304: https://fedorahosted.org/pki/ticket/304 I have merged/sanitized the code from two sources: * Token ECC enrollment with client-side key generation support (provided by jmagne at redhat.com) * TMS ECC enrollment with server-side key generation and key archival support (provided by myself - cfu at redhat.com) The following tests have been conducted: * ECC enrollment via tpsclient * RSA enrollment via tpsclient * RSA server-side key generation via tpsclient * ECC server-side key generation via tpsclient * ECC enrollment via smart card token (Safenet 330j) * RSA enrollment via smart card token (Safenet sc650) note 1: For ECC enrollments, you will need a newer java applet, which is not yet ready for checkin. note 2: server-side key generation is currently not yet supported by the smart card token because of the lack of the key injection code, which will be covered by task #235 (https://fedorahosted.org/pki/ticket/235) thanks, Christina From mharmsen at redhat.com Wed Sep 12 02:20:17 2012 From: mharmsen at redhat.com (Matthew Harmsen) Date: Tue, 11 Sep 2012 19:20:17 -0700 Subject: [Pki-devel] [PATCH] Restart existing instances upon package update Message-ID: <504FF161.7020208@redhat.com> The attached patch addresses the following two PKI TRAC tickets: * TRAC Ticket #312 - Dogtag 10: Automatically restart any running instances upon RPM "update" . . . * TRAC Ticket #317 - Dogtag 10: Move "pkispawn"/"pkidestroy" from /usr/bin to /usr/sbin . . . Please review this patch. Thanks in advance, -- Matt -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: 20120911-Restart-existing-instances-upon-package-update.patch Type: text/x-patch Size: 6400 bytes Desc: not available URL: From alee at redhat.com Wed Sep 12 14:31:25 2012 From: alee at redhat.com (Ade Lee) Date: Wed, 12 Sep 2012 10:31:25 -0400 Subject: [Pki-devel] [PATCH] 114 Added dependency on redhat-rpm-config. In-Reply-To: <504F9FC5.3080206@redhat.com> References: <504F9FC5.3080206@redhat.com> Message-ID: <1347460286.24731.137.camel@aleeredhat.laptop> ack On Tue, 2012-09-11 at 15:32 -0500, Endi Sukma Dewata wrote: > To avoid multilib conflicts the spec file has been modified to > depend on redhat-rpm-config. This way the brp-java-repack-jars > will run to repack the JAR files to generate identical files > across architectures. > > Ticket: #296 > > _______________________________________________ > Pki-devel mailing list > Pki-devel at redhat.com > https://www.redhat.com/mailman/listinfo/pki-devel From edewata at redhat.com Wed Sep 12 14:43:13 2012 From: edewata at redhat.com (Endi Sukma Dewata) Date: Wed, 12 Sep 2012 09:43:13 -0500 Subject: [Pki-devel] [PATCH] 112 Added common ROOT webapp. In-Reply-To: <504676B0.3050209@redhat.com> References: <504676B0.3050209@redhat.com> Message-ID: <50509F81.1060603@redhat.com> On 9/4/2012 4:46 PM, Endi Sukma Dewata wrote: > The current ROOT webapp will redirect users coming to the root > URL path to the proper path of the subsystem's webapp. > > Since now a single Tomcat instance may have multiple subsystems, > a new ROOT webapp has been added to present the user with a menu > of all available webapps from all subsystems in the instance. > > Ticket #89 Rebased. -- Endi S. Dewata -------------- next part -------------- A non-text attachment was scrubbed... Name: pki-edewata-0112-1-Added-common-ROOT-webapp.patch Type: text/x-patch Size: 21664 bytes Desc: not available URL: From edewata at redhat.com Wed Sep 12 14:43:53 2012 From: edewata at redhat.com (Endi Sukma Dewata) Date: Wed, 12 Sep 2012 09:43:53 -0500 Subject: [Pki-devel] [PATCH] 113 Fixed SELinux error during pkidestroy. In-Reply-To: <504676B5.8040501@redhat.com> References: <504676B5.8040501@redhat.com> Message-ID: <50509FA9.6010301@redhat.com> On 9/4/2012 4:46 PM, Endi Sukma Dewata wrote: > When removing a subsystem the pkidestroy would also remove the SELinux > contexts for the instance regardless of whether there are still other > subsystems in the instance. The code has been fixed such that it's > removing the SELinux contexts when deleting the last subsystem only. > > Ticket #89 New patch attached. Added log messages. -- Endi S. Dewata -------------- next part -------------- A non-text attachment was scrubbed... Name: pki-edewata-0113-1-Fixed-SELinux-error-during-pkidestroy.patch Type: text/x-patch Size: 6567 bytes Desc: not available URL: From edewata at redhat.com Wed Sep 12 14:45:15 2012 From: edewata at redhat.com (Endi Sukma Dewata) Date: Wed, 12 Sep 2012 09:45:15 -0500 Subject: [Pki-devel] [PATCH] 114 Added dependency on redhat-rpm-config. In-Reply-To: <1347460286.24731.137.camel@aleeredhat.laptop> References: <504F9FC5.3080206@redhat.com> <1347460286.24731.137.camel@aleeredhat.laptop> Message-ID: <50509FFB.40207@redhat.com> On 9/12/2012 9:31 AM, Ade Lee wrote: > ack Pushed to master. -- Endi S. Dewata From edewata at redhat.com Wed Sep 12 17:51:21 2012 From: edewata at redhat.com (Endi Sukma Dewata) Date: Wed, 12 Sep 2012 12:51:21 -0500 Subject: [Pki-devel] [PATCH] 111 Added common theme webapp. In-Reply-To: <5046769D.5060507@redhat.com> References: <5046769D.5060507@redhat.com> Message-ID: <5050CB99.1000401@redhat.com> On 9/4/2012 4:46 PM, Endi Sukma Dewata wrote: > A new theme webapp has been added to store the theme files for > all PKI webapps. In the future the subsystem webapps can be > modified to use the theme files provided by this common webapp > instead of having to include duplicate files in each webapp. > > Ticket #89 ACKed by Ade. Pushed to master. -- Endi S. Dewata From edewata at redhat.com Wed Sep 12 17:51:32 2012 From: edewata at redhat.com (Endi Sukma Dewata) Date: Wed, 12 Sep 2012 12:51:32 -0500 Subject: [Pki-devel] [PATCH] 112 Added common ROOT webapp. In-Reply-To: <50509F81.1060603@redhat.com> References: <504676B0.3050209@redhat.com> <50509F81.1060603@redhat.com> Message-ID: <5050CBA4.3020502@redhat.com> On 9/12/2012 9:43 AM, Endi Sukma Dewata wrote: > On 9/4/2012 4:46 PM, Endi Sukma Dewata wrote: >> The current ROOT webapp will redirect users coming to the root >> URL path to the proper path of the subsystem's webapp. >> >> Since now a single Tomcat instance may have multiple subsystems, >> a new ROOT webapp has been added to present the user with a menu >> of all available webapps from all subsystems in the instance. >> >> Ticket #89 > > Rebased. ACKed by Ade. Pushed to master. -- Endi S. Dewata From edewata at redhat.com Wed Sep 12 17:51:41 2012 From: edewata at redhat.com (Endi Sukma Dewata) Date: Wed, 12 Sep 2012 12:51:41 -0500 Subject: [Pki-devel] [PATCH] 113 Fixed SELinux error during pkidestroy. In-Reply-To: <50509FA9.6010301@redhat.com> References: <504676B5.8040501@redhat.com> <50509FA9.6010301@redhat.com> Message-ID: <5050CBAD.7030703@redhat.com> On 9/12/2012 9:43 AM, Endi Sukma Dewata wrote: > On 9/4/2012 4:46 PM, Endi Sukma Dewata wrote: >> When removing a subsystem the pkidestroy would also remove the SELinux >> contexts for the instance regardless of whether there are still other >> subsystems in the instance. The code has been fixed such that it's >> removing the SELinux contexts when deleting the last subsystem only. >> >> Ticket #89 > > New patch attached. Added log messages. ACKed by Ade. Pushed to master. -- Endi S. Dewata From jmagne at redhat.com Thu Sep 13 00:41:19 2012 From: jmagne at redhat.com (John Magne) Date: Wed, 12 Sep 2012 20:41:19 -0400 (EDT) Subject: [Pki-devel] Review Request: Token Management System ECC infrastructure In-Reply-To: <504FE314.5070506@redhat.com> Message-ID: <461841660.34169062.1347496879140.JavaMail.root@redhat.com> Just a few Comments/Questions ... GenerateKeyPairServlet.java Apparently StringTokenizer is discouraged in new code in favor of String.split. Could the following code be made a bit more efficient using some built in container? : // is the specified curve supported? 61 + boolean isSupportedCurve = false; 62 + for (int i=0; igetBuf(), decodePubKey->getLen()); How are we freeing the eccParams? I see the commented out section. Does it happen later or automatically somewhere? Buffer.cpp/Buffer.h Looks like we've added functions to the buffer that are already present. The length is gotten with the method "size()". TPS_PUBLIC unsigned int size() const { return len; } The raw buffer is obtainable with the operator "()". TPS_PUBLIC operator BYTE*() { return buf; } SecureChannel.cpp Looks like debug buffer calls like the following were previously commented out: RA::DebugBuffer("Secure_Channel::ComputeAPDUMac", "Data To MAC'ed", 1387 + &data); Was this done for a reason? I ask because we are actually now issuing these debug commands. ----- Original Message ----- From: "Christina Fu" To: "pki-devel" Sent: Tuesday, September 11, 2012 6:19:16 PM Subject: [Pki-devel] Review Request: Token Management System ECC infrastructure https://fedorahosted.org/pki/attachment/ticket/304/TPS-ECC.patch2 This patch provides TMS ECC infrastructure as described in task #304: https://fedorahosted.org/pki/ticket/304 I have merged/sanitized the code from two sources: * Token ECC enrollment with client-side key generation support (provided by jmagne at redhat.com) * TMS ECC enrollment with server-side key generation and key archival support (provided by myself - cfu at redhat.com) The following tests have been conducted: * ECC enrollment via tpsclient * RSA enrollment via tpsclient * RSA server-side key generation via tpsclient * ECC server-side key generation via tpsclient * ECC enrollment via smart card token (Safenet 330j) * RSA enrollment via smart card token (Safenet sc650) note 1: For ECC enrollments, you will need a newer java applet, which is not yet ready for checkin. note 2: server-side key generation is currently not yet supported by the smart card token because of the lack of the key injection code, which will be covered by task #235 (https://fedorahosted.org/pki/ticket/235) thanks, Christina _______________________________________________ Pki-devel mailing list Pki-devel at redhat.com https://www.redhat.com/mailman/listinfo/pki-devel From alee at redhat.com Thu Sep 13 01:25:50 2012 From: alee at redhat.com (Ade Lee) Date: Wed, 12 Sep 2012 21:25:50 -0400 Subject: [Pki-devel] [PATCH] Restart existing instances upon package update In-Reply-To: <504FF161.7020208@redhat.com> References: <504FF161.7020208@redhat.com> Message-ID: <1347499551.24731.143.camel@aleeredhat.laptop> ack On Tue, 2012-09-11 at 19:20 -0700, Matthew Harmsen wrote: > The attached patch addresses the following two PKI TRAC tickets: > * TRAC Ticket #312 - Dogtag 10: Automatically restart any > running instances upon RPM "update" . . . > * TRAC Ticket #317 - Dogtag 10: Move "pkispawn"/"pkidestroy" > from /usr/bin to /usr/sbin . . . > Please review this patch. > > Thanks in advance, > -- Matt > _______________________________________________ > Pki-devel mailing list > Pki-devel at redhat.com > https://www.redhat.com/mailman/listinfo/pki-devel From mharmsen at redhat.com Thu Sep 13 01:35:51 2012 From: mharmsen at redhat.com (Matthew Harmsen) Date: Wed, 12 Sep 2012 18:35:51 -0700 Subject: [Pki-devel] [PATCH] various fixes to pki-deploy In-Reply-To: <1347400042.24731.127.camel@aleeredhat.laptop> References: <1347400042.24731.127.camel@aleeredhat.laptop> Message-ID: <50513877.3090402@redhat.com> On 09/11/12 14:47, Ade Lee wrote: > Please review. > > Thanks, > Ade > > > > _______________________________________________ > Pki-devel mailing list > Pki-devel at redhat.com > https://www.redhat.com/mailman/listinfo/pki-devel ACK Caveats: * The first time that I attempted to install a cloned CA, I failed with a Permissions error on the '/tmp/ca_backup_keys.p12' file that was copied from the master CA. After discussions with Ade, we believe that this was due to SELinux being set to 'Enforcing', and since the '/tmp/ca_backup_keys.p12' file did not contain the appropriate SELinux permissions, the failure occurred. * Filed TRAC Ticket #326 - Dogtag 10: KRA connectors not automatically setup in CA clones -------------- next part -------------- An HTML attachment was scrubbed... URL: From alee at redhat.com Thu Sep 13 01:47:57 2012 From: alee at redhat.com (Ade Lee) Date: Wed, 12 Sep 2012 21:47:57 -0400 Subject: [Pki-devel] [PATCH] dbuser for cloning Message-ID: <1347500877.24731.145.camel@aleeredhat.laptop> Please review. Thanks, Ade -------------- next part -------------- A non-text attachment was scrubbed... Name: pki-vakwetu-0055-Modifications-for-dbuser-for-cloning.patch Type: text/x-patch Size: 6804 bytes Desc: not available URL: From alee at redhat.com Thu Sep 13 17:16:27 2012 From: alee at redhat.com (Ade Lee) Date: Thu, 13 Sep 2012 13:16:27 -0400 Subject: [Pki-devel] [PATCH] selinux file paths Message-ID: <1347556587.24731.150.camel@aleeredhat.laptop> default file fcontext definitions were wrong. -------------- next part -------------- A non-text attachment was scrubbed... Name: pki-vakwetu-0056-Correct-incorrect-file-paths-in-default-file-context.patch Type: text/x-patch Size: 1317 bytes Desc: not available URL: From alee at redhat.com Thu Sep 13 17:24:09 2012 From: alee at redhat.com (Ade Lee) Date: Thu, 13 Sep 2012 13:24:09 -0400 Subject: [Pki-devel] [PATCH] selinux file paths In-Reply-To: <1347556587.24731.150.camel@aleeredhat.laptop> References: <1347556587.24731.150.camel@aleeredhat.laptop> Message-ID: <1347557050.24731.151.camel@aleeredhat.laptop> acked by Endi. Pushed to master. On Thu, 2012-09-13 at 13:16 -0400, Ade Lee wrote: > default file fcontext definitions were wrong. > _______________________________________________ > Pki-devel mailing list > Pki-devel at redhat.com > https://www.redhat.com/mailman/listinfo/pki-devel From mharmsen at redhat.com Fri Sep 14 00:26:35 2012 From: mharmsen at redhat.com (Matthew Harmsen) Date: Thu, 13 Sep 2012 17:26:35 -0700 Subject: [Pki-devel] [PATCH] De-register subsystem from merged instance Message-ID: <505279BB.1080706@redhat.com> The attached patch addresses the following PKI TRAC ticket: * TRAC Ticket #311 - Unable to deregister subsystem in merged instance Please review this patch. Thanks, -- Matt -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: 20120913-Deregister-subsystem-in-merged-instance.patch Type: text/x-patch Size: 2216 bytes Desc: not available URL: From alee at redhat.com Fri Sep 14 00:49:06 2012 From: alee at redhat.com (Ade Lee) Date: Thu, 13 Sep 2012 20:49:06 -0400 Subject: [Pki-devel] [PATCH] De-register subsystem from merged instance In-Reply-To: <505279BB.1080706@redhat.com> References: <505279BB.1080706@redhat.com> Message-ID: <1347583746.24731.152.camel@aleeredhat.laptop> ack On Thu, 2012-09-13 at 17:26 -0700, Matthew Harmsen wrote: > The attached patch addresses the following PKI TRAC ticket: > * TRAC Ticket #311 - Unable to deregister subsystem in merged > instance > Please review this patch. > > Thanks, > -- Matt > _______________________________________________ > Pki-devel mailing list > Pki-devel at redhat.com > https://www.redhat.com/mailman/listinfo/pki-devel From cfu at redhat.com Fri Sep 14 07:21:17 2012 From: cfu at redhat.com (Christina Fu) Date: Fri, 14 Sep 2012 00:21:17 -0700 Subject: [Pki-devel] Review Request: Token Management System ECC infrastructure In-Reply-To: <461841660.34169062.1347496879140.JavaMail.root@redhat.com> References: <461841660.34169062.1347496879140.JavaMail.root@redhat.com> Message-ID: <5052DAED.3030708@redhat.com> https://fedorahosted.org/pki/attachment/ticket/304/TPS-ECC.forReview2 Thanks for the comments. A new patch has been uploaded. Please see in-line response for some of your other comments/questions. On 09/12/2012 05:41 PM, John Magne wrote: > Just a few Comments/Questions ... > > GenerateKeyPairServlet.java > > > > Apparently StringTokenizer is discouraged in new code in favor of String.split. > > Could the following code be made a bit more efficient using some built in container? : > > > // is the specified curve supported? > 61 + boolean isSupportedCurve = false; > 62 + for (int i=0; i 63 + if (rKeycurve.equals(supportedECCurves[i])) { > 64 + isSupportedCurve = true; > 65 + } > 66 + } > > > RA_Enroll_Processor.cpp Yes, that was the result of copying and pasting existing code. Switched to using String.split()and Hashtable in the new patch. > > > In this code: > > rv = ATOB_ConvertAsciiToItem (&der, pKey_ascii); > 293 if (rv != SECSuccess){ > 294 - RA::Debug(LL_PER_CONNECTION,FN, > 295 - "failed to convert b64 private key to binary"); > 296 - SECITEM_FreeItem(&der, PR_FALSE); > 297 - status = STATUS_ERROR_MAC_ENROLL_PDU; > 298 - PR_snprintf(audit_msg, 512, "ServerSideKeyGen: failed to convert b64 private key to binary"); > 299 - goto loser; > 300 - }else { > > > If the call to ATOB_ConvertAsciiToItem fails, will there be a "der" variable to free with SECITEM_FreeItem ? The NSS call checks to see if &der exists. Also, in this case, der was actually declared as SECItem der. > Also, I'm curious why the change of the original code? Looks like we've added an extra step of processing as here: > > + Buffer *decodePubKey = Util::URLDecode(pKey); > 287 + char *pKey_ascii = > 288 + BTOA_DataToAscii(decodePubKey->getBuf(), decodePubKey->getLen()); I actually found this bug. We missed doing URL encoding/decoding before, and that happened to work. However, in case of ECC, I ran into issues. Doing URL Decoding and encoding is the right thing. > > How are we freeing the eccParams? I see the commented out section. Does it happen later or automatically somewhere? The commented out section should be removed (I removed it in the updated patch) as it causes confusion. The eccParams was assigned to point to part of the pk_p: eccParams = &pk_p->u.ec.DEREncodedParams; where pk_p was gotten from SECKEY_ExtractPublicKey if it's server side key generation. The code in the patch states that in case of serverKeygen, SECKEY_DestroyPublicKey to free pk_p, where the eccParams would be freed automatically; while in the case of client side key generation, free() is used on pk_p, as the memory was allocated with an arena. > Buffer.cpp/Buffer.h > > Looks like we've added functions to the buffer that are already present. > The length is gotten with the method "size()". TPS_PUBLIC unsigned int size() const { return len; } > The raw buffer is obtainable with the operator "()". TPS_PUBLIC operator BYTE*() { return buf; } I'm not sure I understand... I do not see such existing functions in my tree. Did I miss something? > > SecureChannel.cpp > > Looks like debug buffer calls like the following were previously commented out: > > RA::DebugBuffer("Secure_Channel::ComputeAPDUMac", "Data To MAC'ed", > 1387 +&data); > > Was this done for a reason? I ask because we are actually now issuing these debug commands. Could you have uncommented it for debugging? I can comment it out again (done so in this updated patch) > > ----- Original Message ----- > From: "Christina Fu" > To: "pki-devel" > Sent: Tuesday, September 11, 2012 6:19:16 PM > Subject: [Pki-devel] Review Request: Token Management System ECC infrastructure > > https://fedorahosted.org/pki/attachment/ticket/304/TPS-ECC.patch2 > > This patch provides TMS ECC infrastructure as described in task #304: > https://fedorahosted.org/pki/ticket/304 > > I have merged/sanitized the code from two sources: > * Token ECC enrollment with client-side key generation support (provided > by jmagne at redhat.com) > * TMS ECC enrollment with server-side key generation and key archival > support (provided by myself - cfu at redhat.com) > > The following tests have been conducted: > * ECC enrollment via tpsclient > * RSA enrollment via tpsclient > * RSA server-side key generation via tpsclient > * ECC server-side key generation via tpsclient > * ECC enrollment via smart card token (Safenet 330j) > * RSA enrollment via smart card token (Safenet sc650) > > note 1: For ECC enrollments, you will need a newer java applet, which is > not yet ready for checkin. > > note 2: server-side key generation is currently not yet supported by the > smart card token because of the lack of the key injection code, which > will be covered by task #235 (https://fedorahosted.org/pki/ticket/235) > > thanks, > Christina > > > > _______________________________________________ > Pki-devel mailing list > Pki-devel at redhat.com > https://www.redhat.com/mailman/listinfo/pki-devel From jmagne at redhat.com Fri Sep 14 18:20:37 2012 From: jmagne at redhat.com (John Magne) Date: Fri, 14 Sep 2012 14:20:37 -0400 (EDT) Subject: [Pki-devel] Review Request: Token Management System ECC infrastructure In-Reply-To: <5052DAED.3030708@redhat.com> Message-ID: <1211543147.35211573.1347646837082.JavaMail.root@redhat.com> Conditional ACK: Just a couple of things. Look in Buffer.h for the existing buffer functions in favor of your new ones? And make the new HashTable private to the class. I wouldn't imagine anyone on the outside would want it. ----- Original Message ----- From: "Christina Fu" To: "John Magne" Cc: "pki-devel" Sent: Friday, September 14, 2012 12:21:17 AM Subject: Re: [Pki-devel] Review Request: Token Management System ECC infrastructure https://fedorahosted.org/pki/attachment/ticket/304/TPS-ECC.forReview2 Thanks for the comments. A new patch has been uploaded. Please see in-line response for some of your other comments/questions. On 09/12/2012 05:41 PM, John Magne wrote: > Just a few Comments/Questions ... > > GenerateKeyPairServlet.java > > > > Apparently StringTokenizer is discouraged in new code in favor of String.split. > > Could the following code be made a bit more efficient using some built in container? : > > > // is the specified curve supported? > 61 + boolean isSupportedCurve = false; > 62 + for (int i=0; i 63 + if (rKeycurve.equals(supportedECCurves[i])) { > 64 + isSupportedCurve = true; > 65 + } > 66 + } > > > RA_Enroll_Processor.cpp Yes, that was the result of copying and pasting existing code. Switched to using String.split()and Hashtable in the new patch. > > > In this code: > > rv = ATOB_ConvertAsciiToItem (&der, pKey_ascii); > 293 if (rv != SECSuccess){ > 294 - RA::Debug(LL_PER_CONNECTION,FN, > 295 - "failed to convert b64 private key to binary"); > 296 - SECITEM_FreeItem(&der, PR_FALSE); > 297 - status = STATUS_ERROR_MAC_ENROLL_PDU; > 298 - PR_snprintf(audit_msg, 512, "ServerSideKeyGen: failed to convert b64 private key to binary"); > 299 - goto loser; > 300 - }else { > > > If the call to ATOB_ConvertAsciiToItem fails, will there be a "der" variable to free with SECITEM_FreeItem ? The NSS call checks to see if &der exists. Also, in this case, der was actually declared as SECItem der. > Also, I'm curious why the change of the original code? Looks like we've added an extra step of processing as here: > > + Buffer *decodePubKey = Util::URLDecode(pKey); > 287 + char *pKey_ascii = > 288 + BTOA_DataToAscii(decodePubKey->getBuf(), decodePubKey->getLen()); I actually found this bug. We missed doing URL encoding/decoding before, and that happened to work. However, in case of ECC, I ran into issues. Doing URL Decoding and encoding is the right thing. > > How are we freeing the eccParams? I see the commented out section. Does it happen later or automatically somewhere? The commented out section should be removed (I removed it in the updated patch) as it causes confusion. The eccParams was assigned to point to part of the pk_p: eccParams = &pk_p->u.ec.DEREncodedParams; where pk_p was gotten from SECKEY_ExtractPublicKey if it's server side key generation. The code in the patch states that in case of serverKeygen, SECKEY_DestroyPublicKey to free pk_p, where the eccParams would be freed automatically; while in the case of client side key generation, free() is used on pk_p, as the memory was allocated with an arena. > Buffer.cpp/Buffer.h > > Looks like we've added functions to the buffer that are already present. > The length is gotten with the method "size()". TPS_PUBLIC unsigned int size() const { return len; } > The raw buffer is obtainable with the operator "()". TPS_PUBLIC operator BYTE*() { return buf; } I'm not sure I understand... I do not see such existing functions in my tree. Did I miss something? > > SecureChannel.cpp > > Looks like debug buffer calls like the following were previously commented out: > > RA::DebugBuffer("Secure_Channel::ComputeAPDUMac", "Data To MAC'ed", > 1387 +&data); > > Was this done for a reason? I ask because we are actually now issuing these debug commands. Could you have uncommented it for debugging? I can comment it out again (done so in this updated patch) > > ----- Original Message ----- > From: "Christina Fu" > To: "pki-devel" > Sent: Tuesday, September 11, 2012 6:19:16 PM > Subject: [Pki-devel] Review Request: Token Management System ECC infrastructure > > https://fedorahosted.org/pki/attachment/ticket/304/TPS-ECC.patch2 > > This patch provides TMS ECC infrastructure as described in task #304: > https://fedorahosted.org/pki/ticket/304 > > I have merged/sanitized the code from two sources: > * Token ECC enrollment with client-side key generation support (provided > by jmagne at redhat.com) > * TMS ECC enrollment with server-side key generation and key archival > support (provided by myself - cfu at redhat.com) > > The following tests have been conducted: > * ECC enrollment via tpsclient > * RSA enrollment via tpsclient > * RSA server-side key generation via tpsclient > * ECC server-side key generation via tpsclient > * ECC enrollment via smart card token (Safenet 330j) > * RSA enrollment via smart card token (Safenet sc650) > > note 1: For ECC enrollments, you will need a newer java applet, which is > not yet ready for checkin. > > note 2: server-side key generation is currently not yet supported by the > smart card token because of the lack of the key injection code, which > will be covered by task #235 (https://fedorahosted.org/pki/ticket/235) > > thanks, > Christina > > > > _______________________________________________ > Pki-devel mailing list > Pki-devel at redhat.com > https://www.redhat.com/mailman/listinfo/pki-devel From edewata at redhat.com Mon Sep 17 18:49:20 2012 From: edewata at redhat.com (Endi Sukma Dewata) Date: Mon, 17 Sep 2012 13:49:20 -0500 Subject: [Pki-devel] [PATCH] Fixed problems with optional pki-symkey. Message-ID: <505770B0.9050403@redhat.com> The deployment and init scripts have been fixed to create and check the links to symkey.jar only if the pki-symkey is installed. Ticket #331 -- Endi S. Dewata -------------- next part -------------- A non-text attachment was scrubbed... Name: pki-edewata-0115-Fixed-problems-with-optional-pki-symkey.patch Type: text/x-patch Size: 4354 bytes Desc: not available URL: From alee at redhat.com Mon Sep 17 21:24:36 2012 From: alee at redhat.com (Ade Lee) Date: Mon, 17 Sep 2012 17:24:36 -0400 Subject: [Pki-devel] [PATCH] Fixed problems with optional pki-symkey. In-Reply-To: <505770B0.9050403@redhat.com> References: <505770B0.9050403@redhat.com> Message-ID: <1347917077.2624.20.camel@aleeredhat.laptop> I'm wondering if we can be a little more precise here. We know after all that pki-symkey is required for a tks instance only. So, for the init scripts, perhaps we need to require the link if /var/lib/pki/{foo}/tks exists (for dogtag 10) - and a similar check for dogtag 9. And for the pkispawn code, maybe we only need to include the link if we know we are installing a TKS? Ade On Mon, 2012-09-17 at 13:49 -0500, Endi Sukma Dewata wrote: > The deployment and init scripts have been fixed to create and check > the links to symkey.jar only if the pki-symkey is installed. > > Ticket #331 > > _______________________________________________ > Pki-devel mailing list > Pki-devel at redhat.com > https://www.redhat.com/mailman/listinfo/pki-devel From edewata at redhat.com Tue Sep 18 03:55:03 2012 From: edewata at redhat.com (Endi Sukma Dewata) Date: Mon, 17 Sep 2012 22:55:03 -0500 Subject: [Pki-devel] [PATCH] 115 Fixed problems with optional pki-symkey. In-Reply-To: <1347917077.2624.20.camel@aleeredhat.laptop> References: <505770B0.9050403@redhat.com> <1347917077.2624.20.camel@aleeredhat.laptop> Message-ID: <5057F097.1040309@redhat.com> On 9/17/2012 4:24 PM, Ade Lee wrote: > I'm wondering if we can be a little more precise here. We know after > all that pki-symkey is required for a tks instance only. > > So, for the init scripts, perhaps we need to require the link > if /var/lib/pki/{foo}/tks exists (for dogtag 10) - and a similar check > for dogtag 9. > > And for the pkispawn code, maybe we only need to include the link if we > know we are installing a TKS? Fixed. New patch attached. In a merged instance it will add the symkey link if TKS is added, and remove the link if TKS is removed. -- Endi S. Dewata -------------- next part -------------- A non-text attachment was scrubbed... Name: pki-edewata-0115-1-Fixed-problems-with-optional-pki-symkey.patch Type: text/x-patch Size: 6280 bytes Desc: not available URL: From edewata at redhat.com Tue Sep 18 03:55:49 2012 From: edewata at redhat.com (Endi Sukma Dewata) Date: Mon, 17 Sep 2012 22:55:49 -0500 Subject: [Pki-devel] [PATCH] 116 Fixed conflicting log4j.properties. Message-ID: <5057F0C5.3010408@redhat.com> The /lib link has been replaced with a real folder which contains links to the files in /usr/share/tomcat/lib. This way the log4j.properties can be placed in this folder without causing conflicts with other instances. Ticket: #284 Note: This patch only addresses the conflict. Further modification might be needed to get log4j working properly. -- Endi S. Dewata -------------- next part -------------- A non-text attachment was scrubbed... Name: pki-edewata-0116-Fixed-conflicting-log4j.properties.patch Type: text/x-patch Size: 8558 bytes Desc: not available URL: From edewata at redhat.com Tue Sep 18 16:29:40 2012 From: edewata at redhat.com (Endi Sukma Dewata) Date: Tue, 18 Sep 2012 11:29:40 -0500 Subject: [Pki-devel] [PATCH] 117 Added DN and filter escaping in UGSubsystem. Message-ID: <5058A174.4050903@redhat.com> The UGSubsystem has been modified to escape values used in DN or filter according to LDAP standard. Ticket #193 -- Endi S. Dewata -------------- next part -------------- A non-text attachment was scrubbed... Name: pki-edewata-0117-Added-DN-and-filter-escaping-in-UGSubsystem.patch Type: text/x-patch Size: 12742 bytes Desc: not available URL: From edewata at redhat.com Tue Sep 18 16:29:43 2012 From: edewata at redhat.com (Endi Sukma Dewata) Date: Tue, 18 Sep 2012 11:29:43 -0500 Subject: [Pki-devel] [PATCH] 118 Removed duplicate DN escaping methods. Message-ID: <5058A177.90409@redhat.com> The duplicate methods to escape DN value have been removed. The codes that used the duplicate methods have been modified to use LDAPUtil.escapeDN(). Ticket #193 -- Endi S. Dewata -------------- next part -------------- A non-text attachment was scrubbed... Name: pki-edewata-0118-Removed-duplicate-DN-escaping-methods.patch Type: text/x-patch Size: 13590 bytes Desc: not available URL: From edewata at redhat.com Tue Sep 18 17:00:16 2012 From: edewata at redhat.com (Endi Sukma Dewata) Date: Tue, 18 Sep 2012 12:00:16 -0500 Subject: [Pki-devel] [PATCH] 118 Removed duplicate DN escaping methods. In-Reply-To: <5058A177.90409@redhat.com> References: <5058A177.90409@redhat.com> Message-ID: <5058A8A0.30600@redhat.com> On 9/18/2012 11:29 AM, Endi Sukma Dewata wrote: > The duplicate methods to escape DN value have been removed. The > codes that used the duplicate methods have been modified to use > LDAPUtil.escapeDN(). > > Ticket #193 New patch attached. Missed a few changes. -- Endi S. Dewata -------------- next part -------------- A non-text attachment was scrubbed... Name: pki-edewata-0118-1-Removed-duplicate-DN-escaping-methods.patch Type: text/x-patch Size: 15154 bytes Desc: not available URL: From edewata at redhat.com Tue Sep 18 17:50:59 2012 From: edewata at redhat.com (Endi Sukma Dewata) Date: Tue, 18 Sep 2012 12:50:59 -0500 Subject: [Pki-devel] [PATCH] 119 Added DN and filter escaping in ConfigurationUtils. Message-ID: <5058B483.3050305@redhat.com> The ConfigurationUtils has been modified to escape values used in DN or filter according to LDAP standard. Ticket #193 -- Endi S. Dewata -------------- next part -------------- A non-text attachment was scrubbed... Name: pki-edewata-0119-Added-DN-and-filter-escaping-in-ConfigurationUtils.patch Type: text/x-patch Size: 9718 bytes Desc: not available URL: From alee at redhat.com Tue Sep 18 18:04:46 2012 From: alee at redhat.com (Ade Lee) Date: Tue, 18 Sep 2012 14:04:46 -0400 Subject: [Pki-devel] [PATCH] 115 Fixed problems with optional pki-symkey. In-Reply-To: <5057F097.1040309@redhat.com> References: <505770B0.9050403@redhat.com> <1347917077.2624.20.camel@aleeredhat.laptop> <5057F097.1040309@redhat.com> Message-ID: <1347991487.2624.21.camel@aleeredhat.laptop> ack On Mon, 2012-09-17 at 22:55 -0500, Endi Sukma Dewata wrote: > On 9/17/2012 4:24 PM, Ade Lee wrote: > > I'm wondering if we can be a little more precise here. We know after > > all that pki-symkey is required for a tks instance only. > > > > So, for the init scripts, perhaps we need to require the link > > if /var/lib/pki/{foo}/tks exists (for dogtag 10) - and a similar check > > for dogtag 9. > > > > And for the pkispawn code, maybe we only need to include the link if we > > know we are installing a TKS? > > Fixed. New patch attached. In a merged instance it will add the symkey > link if TKS is added, and remove the link if TKS is removed. > From edewata at redhat.com Tue Sep 18 18:27:09 2012 From: edewata at redhat.com (Endi Sukma Dewata) Date: Tue, 18 Sep 2012 13:27:09 -0500 Subject: [Pki-devel] [PATCH] 115 Fixed problems with optional pki-symkey. In-Reply-To: <1347991487.2624.21.camel@aleeredhat.laptop> References: <505770B0.9050403@redhat.com> <1347917077.2624.20.camel@aleeredhat.laptop> <5057F097.1040309@redhat.com> <1347991487.2624.21.camel@aleeredhat.laptop> Message-ID: <5058BCFD.6090100@redhat.com> On 9/18/2012 1:04 PM, Ade Lee wrote: > ack Pushed to master. -- Endi S. Dewata From mharmsen at redhat.com Tue Sep 18 22:13:40 2012 From: mharmsen at redhat.com (Matthew Harmsen) Date: Tue, 18 Sep 2012 15:13:40 -0700 Subject: [Pki-devel] [PATCH] 116 Fixed conflicting log4j.properties. In-Reply-To: <5057F0C5.3010408@redhat.com> References: <5057F0C5.3010408@redhat.com> Message-ID: <5058F214.3050301@redhat.com> On 09/17/12 20:55, Endi Sukma Dewata wrote: > The /lib link has been replaced with a real folder > which contains links to the files in /usr/share/tomcat/lib. This > way the log4j.properties can be placed in this folder without > causing conflicts with other instances. > > Ticket: #284 > > Note: This patch only addresses the conflict. Further modification > might be needed to get log4j working properly. > > > > _______________________________________________ > Pki-devel mailing list > Pki-devel at redhat.com > https://www.redhat.com/mailman/listinfo/pki-devel ACK -------------- next part -------------- An HTML attachment was scrubbed... URL: From awnuk at redhat.com Wed Sep 19 00:47:00 2012 From: awnuk at redhat.com (Andrew Wnuk) Date: Tue, 18 Sep 2012 17:47:00 -0700 Subject: [Pki-devel] [PATCH] time based searches Message-ID: <50591604.6040200@redhat.com> This patch removes "fixed" year from time based searches for agent and EE interfaces. It also unifies time selection between search and revocation templates. Bug 854420. -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- Index: pki/redhat/ca-ui/shared/webapps/ca/ee/ca/reasonToRevoke.template =================================================================== --- pki/redhat/ca-ui/shared/webapps/ca/ee/ca/reasonToRevoke.template (revision 16054) +++ pki/redhat/ca-ui/shared/webapps/ca/ee/ca/reasonToRevoke.template (working copy) @@ -33,7 +33,7 @@ var filter = "(|"; var n = 0; - if (!dateIsEmpty(document.forms[0])) { + if (document.forms[0].invalidityEnabled.checked) { var d = convertDate(document.forms[0], "Invalidity Date"); if (d == null) return false; document.forms[0].invalidityDate.value = d; @@ -77,6 +77,26 @@ return true; } +function clickedOnInvalidityEnabled() +{ + if (document.forms[0].invalidityEnabled.checked) { + var date = new Date(); + if (document.forms[0].day.options[document.forms[0].day.selectedIndex].value == 0) { + document.forms[0].day.selectedIndex = date.getDate(); + } + if (document.forms[0].month.options[document.forms[0].month.selectedIndex].value == 13) { + document.forms[0].month.selectedIndex = date.getMonth() +1; + } + if (document.forms[0].year.options[document.forms[0].year.selectedIndex].value == 0) { + for (var i = 0; i < document.forms[0].year.options.length; i++) { + if (document.forms[0].year.options[i].value == date.getFullYear()) { + document.forms[0].year.selectedIndex = i; + } + } + } + } +} + function toHex1(number) { var absValue = "", sign = ""; @@ -283,6 +303,7 @@ + Invalidity date:  Index: pki/redhat/ca-ui/shared/webapps/ca/ee/ca/srchCert.html =================================================================== --- pki/redhat/ca-ui/shared/webapps/ca/ee/ca/srchCert.html (revision 16054) +++ pki/redhat/ca-ui/shared/webapps/ca/ee/ca/srchCert.html (working copy) @@ -345,7 +345,7 @@
- + @@ -411,23 +411,11 @@ @@ -490,23 +478,11 @@