<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix"><tt>This patch documents continued
implementation of the PKI Deployment Framework based upon the
revised filesystem layout documented here:<br>
</tt>
<ul>
<li><tt><a class="moz-txt-link-freetext"
href="http://pki.fedoraproject.org/wiki/PKI_Instance_Deployment#CA_.2F_KRA_.2F_OCSP_.2F_RA_.2F_TKS_.2F_TPS">http://pki.fedoraproject.org/wiki/PKI_Instance_Deployment#CA_.2F_KRA_.2F_OCSP_.2F_RA_.2F_TKS_.2F_TPS</a></tt></li>
</ul>
<tt>This patch addresses the issues listed below as well as the
following issues:<br>
</tt>
<ul>
<li><tt>TRAC Ticket #266 - for non-master CA subsystems,
pkidestroy needs to contact the security domain to update
the domain</tt></li>
<li><tt>Made Fedora 17 rely upon tomcatjss 7.0.0 or later</tt></li>
<li><tt>Changed Dogtag 10 build-time and runtime requirements
for 'pki-deploy'</tt></li>
<li><tt>Altered PKI Package Dependency Chain (top-to-bottom):
pki-ca, pki-kra, pki-ocsp, pki-tks --> pki-deploy -->
pki-common</tt></li>
<li><tt>Changed TPS to require a build-time dependency of
'httpd-devel >= 2.4.2'<br>
<br>
</tt></li>
</ul>
<tt>It has been tested and proven to work successfully to
spawn/destroy/spawn a KRA as a separate instance on a 64-bit
Fedora 17 machine (using the appropriate 'tomcatjss.jar').</tt><br>
<br>
On 08/15/12 12:50, Ade Lee wrote:<br>
</div>
<blockquote cite="mid:1345060256.21349.158.camel@aleeredhat.laptop"
type="cite">
<pre wrap="">1. As discussed on #irc, the correct fix is to add null as the last
argument for the outputError() function calls when status is sent in.
Please fix this for all of these calls.
2. Use dict function get(foo, default) rather than setdefault(foo,
default)
3. The line : nick = subsystemnick.split(' ', 2) is confusing and not
necessary. Its better to use code like this:
if ':' in subsystemnick:
token_name = subsystemnick.split(':')[0]
else:
token_name = "internal"
4. Please use str.format() when constructing big strings like the sslget
command.
5. In the case where you check if the security domain is defined, you
should log that it does not and then return (NOT exit).
6. We should not exit in any cases here except if the sslget call has an
invocation error. If there is an error, it should be prominently logged
but it should not stop the pkidestroy.
7. Check what happens if sslget fails to reach the server. In this
case, it is likely that status will be set to None (along with error).
If this is the case, right now your code will throw an exception.
Ade
On Tue, 2012-08-14 at 18:21 -0700, Matthew Harmsen wrote:
</pre>
<blockquote type="cite">
<pre wrap="">This patch documents continued implementation of the PKI Deployment
Framework based upon the revised filesystem layout documented here:
* <a class="moz-txt-link-freetext" href="http://pki.fedoraproject.org/wiki/PKI_Instance_Deployment#CA_.2F_KRA_.2F_OCSP_.2F_RA_.2F_TKS_.2F_TPS">http://pki.fedoraproject.org/wiki/PKI_Instance_Deployment#CA_.2F_KRA_.2F_OCSP_.2F_RA_.2F_TKS_.2F_TPS</a>
This patch addresses the following issues:
* TRAC Ticket #266 - for non-master CA subsystems, pkidestroy
needs to contact the security domain to update the domain
* Made Fedora 17 rely upon tomcatjss 7.0.0 or later
It has been tested and proven to work successfully to
spawn/destroy/spawn a KRA as a separate instance on a 64-bit Fedora 17
machine (using the appropriate 'tomcatjss.jar').
P. S. - While fixing the parameters passed via "outputError()" in
'base/common/src/com/netscape/cms/servlet/csadmin/UpdateDomainXML.java', I noticed that several of the other servlets in this directory also utilized the "AUTH_FAILURE" error value for the second argument of "outputError()" which gets passed as the string "2" --- while this string is technically acceptable, I believe that this may be old usage of some legacy parent method since "outputError()" is currently defined in "base/common/src/com/netscape/cms/servlet/base/CMSServlet.java" as:
* protected void outputError(HttpServletResponse httpResp,
String errorString)
* protected void outputError(HttpServletResponse httpResp,
String errorString, String requestId)
* protected void outputError(HttpServletResponse httpResp,
String status, String errorString, String requestId)
so for all of my changes to "outputError()" in "UpdateDomainXML.java",
I merely changed these incorrect three parameter call versions to the
two parameter call version by removing the second parameter
("AUTH_FAILURE"). If I am correct about this seemingly legacy usage,
please let me know if I need to file a TRAC ticket for this issue.
Thanks,
-- Matt
_______________________________________________
Pki-devel mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Pki-devel@redhat.com">Pki-devel@redhat.com</a>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/pki-devel">https://www.redhat.com/mailman/listinfo/pki-devel</a>
</pre>
</blockquote>
<pre wrap="">
</pre>
</blockquote>
<br>
</body>
</html>