Getting the $org and $env at yum update time
by Bryan Kearney
For Katello, subscription-manager will need to be able to cause repos
with the $org and $env to be substituted with the value which a consumer
is registered to. The plugin which we have already could do this.
However, we do not have the org or the environment stored on the machine.
We could do the following:
1) Enhance Candlepin and Katello to always return the org id and
envrionment id in the json. If we do this, then a single call is made to
the server to get these variables.
2) Record them at register time. Either in a file or in the facts. Have
the plugin read them back out.
3) Encode this in the cert. This may be an issue since candlepin does
not know the environment.
-- bk
12 years, 8 months
Fwd: Re: [katello-internal] Cloning Errata
by Bryan Kearney
Can you guys come to the katello list to discuss on this thread.
Thanks!
-- bk
-------- Original Message --------
Subject: Re: [katello-internal] Cloning Errata
Date: Mon, 29 Aug 2011 17:14:50 -0700
From: Mike McCune <mmccune(a)redhat.com>
To: Todd Sanders <tsanders(a)redhat.com>
CC: katello-internal(a)redhat.com <katello-internal(a)redhat.com>
On 08/29/2011 01:48 PM, Todd Sanders wrote:
> I put together the following page to illustrate errata cloning
> capabilities that we would like to incorporate into Katello/CFSM.
> Questions and Comments please. FYI....this is not currently targeted
> for v1.0; but wanted to make sure that we accounted for it in our
> current designs.
>
> https://engineering.redhat.com/trac/kalpana/wiki/ErrataCloning
>
> -Todd
>
some questions:
"4. User Clones RHEL 6 Server Product, only importing the 6.0
Repository. This clone is feedless, and therefore cannot be sync'd. "
so, when the user clones a product, they will need to pick which
repositories they wish to clone from the source product. makes sense,
just wanted to make sure.
"5. User promotes the Cloned RHEL 6 Server Product into the next
environment, and subscribes systems to the contained 6.0 Repository.
* These systems must consume Red Hat entitlements in the same
manner as those subscribed to mirrored products. "
Candlepin people: Does CP support the relationship between products
such that the subscriptions can be pulled from the same pool even if we
create this new 'cloned' product?
Mike
--
Mike McCune
mmccune AT redhat.com
Red Hat Engineering | Portland, OR
Systems Management | 650.254.4248
12 years, 8 months
Heads up: Ueber Cert
by Bryan Kearney
All:
Just a heads up, the katello guys are going to start looking at creating
an ueber cert. The goal will be a single fake "product" which exposes
content at $OWNER/. That should allow image factory to grab all content
during building. This will also serve as an administrative tool to
browse the content via a browers and bypass all checks.
-- bk
12 years, 8 months
Candlepin 0.4.11 released.
by jesus rodriguez
Candlepin 0.4.11 has been released. You can get the bits at:
http://repos.fedorapeople.org/repos/candlepin/candlepin/
Make sure you read over the Setup Guide, which is located at
https://fedorahosted.org/candlepin/wiki/Setup
For more information on Candlepin, please visit:
http://candlepinproject.org/
Features & Enhancements
========================
client
-------
* group subscriptions based on stacking attribute in the following
screens:
* subscriptions page
* compliance assistant
* view available subscription page
* the cli and gui now denote the state of the subscription: Subscribed,
Partially Subscribed, Expired or Not Subscribed.
* Nag messages now denote the 'Partially Subscribed' state.
* registration with multiple activation keys now supported
* list --available now shows if a subscription is multi-entitle capable
* GUI shows an asterisk to denote a subscription is multi-entitle
capable
* config command added to cli enabling editing of the configuration
values
* client tries to optionally heal the system to keep it properly
subscribed.
server
-------
* the list of consumer's installed product IDs are now stored
* the candlepin job status stable now stores the consumer uuid for
async bind.
* configuration added to disable batch jobs on a particular node
* Moved the translations to fedora.zanata.org
Bugs fixed
===========
729780: non-existent secure objects throw a 404 instead of a 403.
708058: Server 500 error thrown when user auto-subscribes and has
no entitlements
728622: Inconsistent enable config entries
728624: Activation keys are successfully being created with invalid
chars
728636: Duplicate activation key error is hard to decipher
729125: Adding pools to an activation key should fail when quantity < 1
and quantity > totalQuantity for a multi-entitlement pool
729070: Adding pools to an activation key should be blocked when
specifying a quantity>1 for a non-multi-entitlement pool
728721: NullPointerException thrown when registering with an activation
key bound to a pool that requires_consumer_type person.
729066: remove logging statement to avoid filling up logs.
--
jesus m. rodriguez | jesusr(a)redhat.com
principal software engineer | irc: zeus
red hat systems management | 919.754.4413 (w)
rhce # 805008586930012 | 919.623.0080 (c)
+---------------------------------------------+
| "Those who cannot remember the past |
| are condemned to repeat it." |
| -- George Santayana |
+---------------------------------------------+
12 years, 8 months
nullable gpgUrl field in Content
by Dmitri Dolguikh
In content model gpgUrl is declared as nullable. However, it is used
during generation of content extension for the entitlement certificate
and an NPE is thrown if it is a null. Not sure what would be the best
way to handle this, but a patch fixing the issue is attached. Perhaps
the model should be updated to make gpg a non-null field as well?
cheers,
-d
12 years, 8 months
Fwd: [PATCH] Handle null values correcly before invoking the certificate generation
by Bryan Kearney
Please to look at...
-------- Original Message --------
Subject: [PATCH] Handle null values correcly before invoking the
certificate generation
Date: Mon, 22 Aug 2011 16:30:57 -0400
From: Bryan Kearney <bkearney(a)redhat.com>
To: candlepin-patches(a)redhat.com
CC: Bryan Kearney <bkearney(a)redhat.com>
---
.../candlepin/pki/impl/BouncyCastlePKIUtility.java | 39 ++++++++-------
.../impl/DefaultEntitlementCertServiceAdapter.java | 50
+++++++++++---------
2 files changed, 49 insertions(+), 40 deletions(-)
diff --git
a/proxy/src/main/java/org/fedoraproject/candlepin/pki/impl/BouncyCastlePKIUtility.java
b/proxy/src/main/java/org/fedoraproject/candlepin/pki/impl/BouncyCastlePKIUtility.java
index d283872..44474bd 100644
---
a/proxy/src/main/java/org/fedoraproject/candlepin/pki/impl/BouncyCastlePKIUtility.java
+++
b/proxy/src/main/java/org/fedoraproject/candlepin/pki/impl/BouncyCastlePKIUtility.java
@@ -61,26 +61,26 @@ import com.google.inject.Inject;
* This class implements methods to create X509 Certificates, X509
CRLs, encode
* objects in PEM format (for saving to the db or sending to the
client), and
* decode raw ASN.1 DER values (as read from a Certificate/CRL).
- *
+ *
* All code that imports bouncycastle should live either in this module,
* or in {@link BouncyCastlePKIReader}
- *
+ *
* (March 24, 2011) Notes on implementing a PKIUtility with NSS/JSS:
- *
+ *
* JSS provides classes and functions to generate X509Certificates
(see CertificateInfo,
* for example).
- *
+ *
* PEM encoding requires us to determine the object type (which we
know), add the correct
* header and footer to the output, base64 encode the DER for the
object, and line wrap
* the base64 encoding.
- *
+ *
* decodeDERValue should be simple, as JSS provides code to parse
ASN.1, but I wasn't
* able to get it to work.
- *
+ *
* The big one is CRL generation. JSS has no code to generate CRLs in
any format. We'll
* have to use the raw ASN.1 libraries to build up our own properly
formatted CRL DER
- * representation, then PEM encode it.
- *
+ * representation, then PEM encode it.
+ *
* See also {@link BouncyCastlePKIReader} for more notes on using
NSS/JSS, and a note
* about not using bouncycastle as the JSSE provider.
*/
@@ -142,8 +142,11 @@ public class BouncyCastlePKIUtility extends
PKIUtility {
if (extensions != null) {
for (X509ExtensionWrapper wrapper : extensions) {
+ // Bounceycastle hates null values. So, set them to blank
+ // if they are null
+ String value = wrapper.getValue() == null ? "" :
wrapper.getValue();
certGen.addExtension(wrapper.getOid(),
wrapper.isCritical(),
- new DERUTF8String(wrapper.getValue()));
+ new DERUTF8String(value));
}
}
@@ -153,7 +156,7 @@ public class BouncyCastlePKIUtility extends PKIUtility {
@Override
public X509CRL createX509CRL(List<X509CRLEntryWrapper> entries,
BigInteger crlNumber) {
-
+
try {
X509Certificate caCert = reader.getCACert();
X509V2CRLGenerator generator = new X509V2CRLGenerator();
@@ -177,7 +180,7 @@ public class BouncyCastlePKIUtility extends PKIUtility {
throw new RuntimeException(e);
}
}
-
+
private byte[] getPemEncoded(Object obj) throws IOException {
ByteArrayOutputStream byteArrayOutputStream = new
ByteArrayOutputStream();
OutputStreamWriter oswriter = new
OutputStreamWriter(byteArrayOutputStream);
@@ -186,22 +189,22 @@ public class BouncyCastlePKIUtility extends
PKIUtility {
writer.close();
return byteArrayOutputStream.toByteArray();
}
-
+
@Override
public byte[] getPemEncoded(X509Certificate cert) throws IOException {
return getPemEncoded((Object) cert);
}
-
- @Override
+
+ @Override
public byte[] getPemEncoded(Key key) throws IOException {
return getPemEncoded((Object) key);
}
-
+
@Override
public byte[] getPemEncoded(X509CRL crl) throws IOException {
return getPemEncoded((Object) crl);
}
-
+
@Override
public String decodeDERValue(byte[] value) {
ASN1InputStream vis = null;
@@ -210,7 +213,7 @@ public class BouncyCastlePKIUtility extends PKIUtility {
vis = new ASN1InputStream(value);
decoded = new ASN1InputStream(
((DEROctetString) vis.readObject()).getOctets());
-
+
return decoded.readObject().toString();
}
catch (IOException e) {
@@ -225,7 +228,7 @@ public class BouncyCastlePKIUtility extends PKIUtility {
log.warn("failed to close ASN1 stream", e);
}
}
-
+
if (decoded != null) {
try {
decoded.close();
diff --git
a/proxy/src/main/java/org/fedoraproject/candlepin/service/impl/DefaultEntitlementCertServiceAdapter.java
b/proxy/src/main/java/org/fedoraproject/candlepin/service/impl/DefaultEntitlementCertServiceAdapter.java
index 2855a67..8d836d7 100644
---
a/proxy/src/main/java/org/fedoraproject/candlepin/service/impl/DefaultEntitlementCertServiceAdapter.java
+++
b/proxy/src/main/java/org/fedoraproject/candlepin/service/impl/DefaultEntitlementCertServiceAdapter.java
@@ -52,28 +52,28 @@ import com.google.inject.Inject;
/**
* DefaultEntitlementCertServiceAdapter
*/
-public class DefaultEntitlementCertServiceAdapter extends
+public class DefaultEntitlementCertServiceAdapter extends
BaseEntitlementCertServiceAdapter {
-
+
private PKIUtility pki;
private X509ExtensionUtil extensionUtil;
private KeyPairCurator keyPairCurator;
private CertificateSerialCurator serialCurator;
private ProductServiceAdapter productAdapter;
private EntitlementCurator entCurator;
-
- private static Logger log =
+
+ private static Logger log =
LoggerFactory.getLogger(DefaultEntitlementCertServiceAdapter.class);
-
+
@Inject
public DefaultEntitlementCertServiceAdapter(PKIUtility pki,
X509ExtensionUtil extensionUtil,
- EntitlementCertificateCurator entCertCurator,
+ EntitlementCertificateCurator entCertCurator,
KeyPairCurator keyPairCurator,
CertificateSerialCurator serialCurator,
ProductServiceAdapter productAdapter,
EntitlementCurator entCurator) {
-
+
this.pki = pki;
this.extensionUtil = extensionUtil;
this.entCertCurator = entCertCurator;
@@ -83,18 +83,18 @@ public class DefaultEntitlementCertServiceAdapter
extends
this.entCurator = entCurator;
}
-
+
// NOTE: we use entitlement here, but it version does not...
// NOTE: we can get consumer from entitlement.getConsumer()
@Override
- public EntitlementCertificate generateEntitlementCert(Entitlement
entitlement,
+ public EntitlementCertificate generateEntitlementCert(Entitlement
entitlement,
Subscription sub, Product product)
throws GeneralSecurityException, IOException {
-
+
log.debug("Generating entitlement cert for:");
log.debug(" consumer: {}", entitlement.getConsumer().getUuid());
log.debug(" product: {}" , product.getId());
- log.debug("entitlement's endDt == subs endDt? {} == {} ?",
+ log.debug("entitlement's endDt == subs endDt? {} == {} ?",
entitlement.getEndDate(), sub.getEndDate());
Preconditions
.checkArgument(
@@ -108,31 +108,31 @@ public class DefaultEntitlementCertServiceAdapter
extends
// We need the sequence generated id before we create the
EntitlementCertificate,
// otherwise we could have used cascading create
serialCurator.create(serial);
-
+
X509Certificate x509Cert = createX509Certificate(entitlement, sub,
product, BigInteger.valueOf(serial.getId()), keyPair);
-
+
EntitlementCertificate cert = new EntitlementCertificate();
cert.setSerial(serial);
cert.setKeyAsBytes(pki.getPemEncoded(keyPair.getPrivate()));
cert.setCertAsBytes(this.pki.getPemEncoded(x509Cert));
cert.setEntitlement(entitlement);
-
+
log.debug("Generated cert serial number: " + serial.getId());
log.debug("Key: " + cert.getKey());
log.debug("Cert: " + cert.getCert());
-
+
entitlement.getCertificates().add(cert);
entCertCurator.create(cert);
return cert;
}
-
+
@Override
public void revokeEntitlementCertificates(Entitlement e) {
for (EntitlementCertificate cert : e.getCertificates()) {
CertificateSerial serial = cert.getSerial();
serial.setRevoked(true);
-
+
this.serialCurator.merge(serial);
}
}
@@ -152,12 +152,12 @@ public class DefaultEntitlementCertServiceAdapter
extends
}
return providedProducts;
}
-
+
/**
* Scan the product content looking for any which modify some
other product. If found
* we must check that this consumer has another entitlement
granting them access
* to that modified product. If they do not, we should filter out
this content.
- *
+ *
* @param prod
* @param ent
* @return ProductContent to include in the certificate.
@@ -180,7 +180,7 @@ public class DefaultEntitlementCertServiceAdapter
extends
}
}
}
-
+
if (include) {
filtered.add(pc);
}
@@ -211,17 +211,23 @@ public class DefaultEntitlementCertServiceAdapter
extends
if (sub != null) {
extensions.addAll(extensionUtil.subscriptionExtensions(sub, ent));
}
-
+
extensions.addAll(extensionUtil.entitlementExtensions(ent));
extensions.addAll(extensionUtil.consumerExtensions(ent.getConsumer()));
+ if (log.isDebugEnabled()) {
+ for (X509ExtensionWrapper eWrapper : extensions) {
+ log.debug(String.format("Extension %s with value %s",
+ eWrapper.getOid(), eWrapper.getValue()));
+ }
+ }
X509Certificate x509Cert = this.pki.createX509Certificate(
createDN(ent), extensions, sub.getStartDate(),
ent.getEndDate(),
keyPair, serialNumber, null);
return x509Cert;
}
-
+
private String createDN(Entitlement ent) {
StringBuilder sb = new StringBuilder("CN=");
sb.append(ent.getId());
--
1.7.4.4
12 years, 8 months