~mathiaz/puppet/reductivelabs-master : changes

~mathiaz/puppet/reductivelabs-master » Changes from revision 2629

From Revision 2622 to 2603

Rev	Summary	Authors	Date
2622	Fixing puppetca so it uses the :local ca setting. Fixing puppetca so it uses the :local ca setting. This causes it to use both the :ca_file and :file terminus types.	Luke Kanies	16 years ago
2621	Added an Interface class to the CA to model puppetca's usage... Added an Interface class to the CA to model puppetca's usage. This class provides all of the semantics from puppetca, and appears to entirely duplicate the behaviour of the existing executable, with basically all of the code in a library file, instead of the executable. As such, I've deleted the test for the executable. We should have one, but it's not nearly as important.	Luke Kanies	16 years ago
2620	Making the SSL::Host's destroy method a class method, Making the SSL::Host's destroy method a class method, rather than an instance method.	Luke Kanies	16 years ago
2619	Adding the last functionality needed for puppetca to use the... Adding the last functionality needed for puppetca to use the Indirector. This commit adds 'list' and 'print' support to the CA. They're mostly delegator methods, but now the CA should be the sole interface for puppetca.	Luke Kanies	16 years ago
2618	Finishing the interface between the CA and the CRL. Finishing the interface between the CA and the CRL. Certificate revocation now works, the CA knows how to generate the CRL, and the SSL::Host class knows how to configure the CRL class for indirection.	Luke Kanies	16 years ago
2617	Adding inventory support to the new certificate authority. Adding inventory support to the new certificate authority. The new-style CA now keeps track of all of its signed certificates in its inventory file.	Luke Kanies	16 years ago
2616	Adding support within the inventory for real certs or Puppet... Adding support within the inventory for real certs or Puppet cert wrappers.	Luke Kanies	16 years ago
2615	Changing the Inventory class to rebuild when the Changing the Inventory class to rebuild when the first cert is added, so it's easier to test.	Luke Kanies	16 years ago
2614	Adding a comment to the inventory class. Adding a comment to the inventory class.	Luke Kanies	16 years ago
2613	Adding an SSl::Inventory class for managing the ssl inventor... Adding an SSl::Inventory class for managing the ssl inventory. This models the existing Inventory module in the sslcertificates/ directory, but does so as an instance, rather than a module.	Luke Kanies	16 years ago
2612	All SSL terminus classes now force the CA information into t... All SSL terminus classes now force the CA information into the right place. Without this, then you could end up duplicating your CA key into the normal directory depending on how caching was set up. Again, this design aspect isn't the most straightforward, but at least it's functional now.	Luke Kanies	16 years ago
2611	Switching the SSL::Host class to return Puppet instances. Switching the SSL::Host class to return Puppet instances. Previously, the class was returning OpenSSL instances (e.g, OpenSSL::X509::Certificate) instead of Puppet instances (e.g., Puppet::SSL::Certificate). This made some things easier, but it made them asymmetric (e.g., you assigned the key as a Puppet instance but got back an OpenSSL instance), and it also reduced your flexibility and introspectiveness.	Luke Kanies	16 years ago
2610	Setting the expiration date of certificate objects to the ex... Setting the expiration date of certificate objects to the expiry of the actual cert.	Luke Kanies	16 years ago
2609	Adding integration tests for a lot of the SSL code. Adding integration tests for a lot of the SSL code. This flushed out some problems, and things mostly look good now, but I don't think we're quite there yet.	Luke Kanies	16 years ago
2608	Moving the password file handling into the SSL::Key class. Moving the password file handling into the SSL::Key class. This was necessary because when the Indirector is used, there isn't necessarily enough context available to know when a password file should be used (e.g., when reading a Key from disk, you don't know if that key was encrypted). Now, the Key class automatically uses the right password file, and only tries to use those files that actually exist. This isn't very flexible, in that it only allows one CA file and one non-CA file, but no one really uses anything but the CA file anyway.	Luke Kanies	16 years ago
2607	Moving all of the ca-specific settings to the ca_file Moving all of the ca-specific settings to the ca_file terminus classes, rather than the normal :file classes. This is unfortunately complicated, and it means that the Key :ca_file is only ever actually used for retrieving the CA key itself.	Luke Kanies	16 years ago
2606	Adding SSL::Host-level support for managing the terminus and Adding SSL::Host-level support for managing the terminus and cache classes. Also, defaulting to the :file terminus for all of the SSL classes.	Luke Kanies	16 years ago
2605	Fixing the CA so it actually automatically generates its cer... Fixing the CA so it actually automatically generates its certificate.	Luke Kanies	16 years ago
2604	The certificate authority now uses a Host instance named 'ca... The certificate authority now uses a Host instance named 'ca'. It previously was a subclass of Host, but this should make it easier to separate between the thing doing the signing and the thing managing the necessary files.	Luke Kanies	16 years ago
2603	Changing all of the SSL terminus classes to treat CA files s... Changing all of the SSL terminus classes to treat CA files specially. This is a kind of weird design situation. For instance, we've got a collection of certificates in the :certdir, but then there's a special CA certificate off by itself. Rather than build a whole separate infrastructure for managing those separate files (cert and key, at least), I decided to add special support for specifying where to find the CA-specific bits, and then code for handling them when necessary. This requires that we have a standard way of knowing whether we should be managing the CA bits or normal host files. The Puppet::SSL::Host class now has a 'ca_name' method that returns the string we're using for the CA name; this name is currently 'ca'. We have to use a name, because the name is the only thing that all methods have access to (e.g., when trying to 'find' the right cert, we only have the name available). What this means is that if you want access to the CA key or cert, then create a Puppet::SSL::Host instance with the name 'ca'. You'll still get the CA cert created with the host's :certname; it will just be stored in a different location.	Luke Kanies	16 years ago

Older »