Hello Michael Burns, Dan Kenigsberg,
I'd like you to do a code review. Please visit
to review the following change.
Change subject: setup: move the certificate generation ......................................................................
setup: move the certificate generation
Generating the certificate at the service startup (instead of during the rpm installation) has a better chance to succeed (and a better recovery process). Moreover this allows appliances (like ovirt-node) to postpone the certificate generation when the service is actually used for the first time.
In this patch: * Move the certificate generation from the spec file to the init file
Bug-Url: https://bugzilla.redhat.com/show_bug.cgi?id=860067 Signed-off-by: Federico Simoncelli fsimonce@redhat.com Change-Id: I40fa3d9a6a54e312e399af3f87ac67e843078360 Reviewed-on: http://gerrit.ovirt.org/8368 Reviewed-by: Dan Kenigsberg danken@redhat.com Reviewed-by: Michael Burns mburns@redhat.com Tested-by: Michael Burns mburns@redhat.com --- M vdsm.spec.in M vdsm/vdsm-gencerts.sh.in M vdsm/vdsmd.init.in 3 files changed, 9 insertions(+), 3 deletions(-)
git pull ssh://gerrit.ovirt.org:29418/vdsm refs/changes/15/10615/1
diff --git a/vdsm.spec.in b/vdsm.spec.in index 5f5f989..572b338 100644 --- a/vdsm.spec.in +++ b/vdsm.spec.in @@ -404,9 +404,6 @@ /etc/pki/vdsm/keys/libvirt_password fi
-# generate the vdsm certificates (if missing) -%{_libexecdir}/%{vdsm_name}/vdsm-gencerts.sh - %if 0%{?rhel} if [ "$1" -eq 1 ] ; then /sbin/chkconfig --add vdsmd diff --git a/vdsm/vdsm-gencerts.sh.in b/vdsm/vdsm-gencerts.sh.in index 1e11b69..3ee38c3 100755 --- a/vdsm/vdsm-gencerts.sh.in +++ b/vdsm/vdsm-gencerts.sh.in @@ -33,6 +33,10 @@
umask 077
+if [ "$1" = "--check" ]; then + [ -s "$VDSM_KEY" -a -s "$VDSM_CA" -a -s "$VDSM_CRT" ] && exit 0 || exit 1 +fi + if [ ! -f "$VDSM_KEY" ]; then /usr/bin/certtool --generate-privkey --outfile "$VDSM_KEY" 2> /dev/null /bin/chown "$VDSM_PERMS" "$VDSM_KEY" diff --git a/vdsm/vdsmd.init.in b/vdsm/vdsmd.init.in index dd6f3c6..a288c16 100755 --- a/vdsm/vdsmd.init.in +++ b/vdsm/vdsmd.init.in @@ -498,6 +498,11 @@
shutdown_conflicting_srv && stop_libvirtd_sysv
+ if ! @LIBEXECDIR@/vdsm-gencerts.sh --check; then + echo -n $"Configuring a self-signed VDSM host certificate: " + @LIBEXECDIR@/vdsm-gencerts.sh && success || failure ; echo + fi + reconfigure noforce ret_val=$? if [ $ret_val -ne 0 ]
-- To view, visit http://gerrit.ovirt.org/10615 To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: newchange Gerrit-Change-Id: I40fa3d9a6a54e312e399af3f87ac67e843078360 Gerrit-PatchSet: 1 Gerrit-Project: vdsm Gerrit-Branch: ovirt-3.1 Gerrit-Owner: Federico Simoncelli fsimonce@redhat.com Gerrit-Reviewer: Dan Kenigsberg danken@redhat.com Gerrit-Reviewer: Michael Burns mburns@redhat.com
Michael Burns has posted comments on this change.
Change subject: setup: move the certificate generation ......................................................................
Patch Set 1: Looks good to me, but someone else must approve
-- To view, visit http://gerrit.ovirt.org/10615 To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: comment Gerrit-Change-Id: I40fa3d9a6a54e312e399af3f87ac67e843078360 Gerrit-PatchSet: 1 Gerrit-Project: vdsm Gerrit-Branch: ovirt-3.1 Gerrit-Owner: Federico Simoncelli fsimonce@redhat.com Gerrit-Reviewer: Dan Kenigsberg danken@redhat.com Gerrit-Reviewer: Michael Burns mburns@redhat.com
Federico Simoncelli has posted comments on this change.
Change subject: setup: move the certificate generation ......................................................................
Patch Set 1: Verified; Looks good to me, approved
-- To view, visit http://gerrit.ovirt.org/10615 To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: comment Gerrit-Change-Id: I40fa3d9a6a54e312e399af3f87ac67e843078360 Gerrit-PatchSet: 1 Gerrit-Project: vdsm Gerrit-Branch: ovirt-3.1 Gerrit-Owner: Federico Simoncelli fsimonce@redhat.com Gerrit-Reviewer: Dan Kenigsberg danken@redhat.com Gerrit-Reviewer: Federico Simoncelli fsimonce@redhat.com Gerrit-Reviewer: Michael Burns mburns@redhat.com
Federico Simoncelli has submitted this change and it was merged.
Change subject: setup: move the certificate generation ......................................................................
setup: move the certificate generation
Generating the certificate at the service startup (instead of during the rpm installation) has a better chance to succeed (and a better recovery process). Moreover this allows appliances (like ovirt-node) to postpone the certificate generation when the service is actually used for the first time.
In this patch: * Move the certificate generation from the spec file to the init file
Bug-Url: https://bugzilla.redhat.com/show_bug.cgi?id=860067 Signed-off-by: Federico Simoncelli fsimonce@redhat.com Change-Id: I40fa3d9a6a54e312e399af3f87ac67e843078360 Reviewed-on: http://gerrit.ovirt.org/8368 Reviewed-by: Dan Kenigsberg danken@redhat.com Reviewed-by: Michael Burns mburns@redhat.com Tested-by: Michael Burns mburns@redhat.com --- M vdsm.spec.in M vdsm/vdsm-gencerts.sh.in M vdsm/vdsmd.init.in 3 files changed, 9 insertions(+), 3 deletions(-)
Approvals: Michael Burns: Looks good to me, but someone else must approve Federico Simoncelli: Verified; Looks good to me, approved
-- To view, visit http://gerrit.ovirt.org/10615 To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: merged Gerrit-Change-Id: I40fa3d9a6a54e312e399af3f87ac67e843078360 Gerrit-PatchSet: 1 Gerrit-Project: vdsm Gerrit-Branch: ovirt-3.1 Gerrit-Owner: Federico Simoncelli fsimonce@redhat.com Gerrit-Reviewer: Dan Kenigsberg danken@redhat.com Gerrit-Reviewer: Federico Simoncelli fsimonce@redhat.com Gerrit-Reviewer: Michael Burns mburns@redhat.com
vdsm-patches@lists.fedorahosted.org