[Pki-devel] [PATCH] 66 Added cert revocation CLI.

[Nathan Kinder]

On 06/08/2012 04:37 PM, Endi Sukma Dewata wrote:
> On 6/8/2012 2:19 PM, Nathan Kinder wrote:
>> On 06/08/2012 12:06 PM, Endi Sukma Dewata wrote:
>>> On 6/8/2012 1:12 PM, Andrew Wnuk wrote:
>>>> On 06/07/2012 02:04 PM, Endi Sukma Dewata wrote:
>>>>> On 6/7/2012 11:38 AM, Andrew Wnuk wrote:
>>>>>> On 06/07/2012 07:28 AM, Endi Sukma Dewata wrote:
>>>>>>> The cert revocation CLI provides a tool to revoke and unrevoke
>>>>>>> certificates.
>>>>>>
>>>>>> "unrevoke" is really inappropriate term. It suggests that one could
>>>>>> unrevoke any revoked certificate where is fact one can only take off
>>>>>> hold certificates that are currently on hold.
>>>>>
>>>>> How about a "revoke" command for permanent revocation only, and
>>>>> separate "on-hold" and "off-hold" commands for temporary revocation?
>>>>> Any suggestions?
>>>>>
>>>> This is asymmetric case. "on-hold" is just one of many revocation
>>>> reasons. Certificate can be taken off hold if it was revoked with
>>>> "on-hold" reason. There are only two operations: certificate 
>>>> revocation
>>>> and taking certificates off hold.
>>>
>>> The original "revoke" operation is partially asymmetric (permanent
>>> revocation) and partially symmetric (temporarily on-hold). It might be
>>> more intuitive to create a new "revoke" command that does asymmetric
>>> operation only (no "unrevoke" operation) and separate "on-hold" and
>>> "off-hold" commands for the symmetric operations.
>>>
>>> If we only have "revoke" and "off-hold" only, people might be
>>> thinking, there's an "off-hold" command, so how do I "hold" a cert? It
>>> might not be very obvious that the "revoke" command has an "on-hold"
>>> option which behaves differently from the other revoke reasons.
>>>
>> I tend to agree from a pure CLI perspective. Behind the scenes,
>> "on-hold" is really a revocation reason, but that doesn't mean we need
>> to make the CLI use the exact same terminology.
>>
>> How about having "revoke", "on-hold", and "off-hold" commands? We can
>> still allow one to use the "revoke" command and specify the revocation
>> reason as on-hold, which would be the equivalent of the "on-hold" 
>> command.
>
> +1
>
> Some other possibilities:
>  - revoke/hold/release
I like this one.  Maybe even "revoke/hold/release-hold"?  Plain 
"release" doesn't seem very descriptive on it's own.  I think 
"release-hold" is more clear.
>  - revoke/suspend/release
>  - revoke/enable/disable
>