candlepin August 2011

candlepin@lists.stg.fedorahosted.org

14 participants
21 discussions

Getting the $org and $env at yum update time
by Bryan Kearney 31 Aug '11

31 Aug '11

For Katello, subscription-manager will need to be able to cause repos with the $org and $env to be substituted with the value which a consumer is registered to. The plugin which we have already could do this. However, we do not have the org or the environment stored on the machine. We could do the following: 1) Enhance Candlepin and Katello to always return the org id and envrionment id in the json. If we do this, then a single call is made to the server to get these variables. 2) Record them at register time. Either in a file or in the facts. Have the plugin read them back out. 3) Encode this in the cert. This may be an issue since candlepin does not know the environment. -- bk

2 2

Fwd: Re: [katello-internal] Cloning Errata
by Bryan Kearney 30 Aug '11

30 Aug '11

Can you guys come to the katello list to discuss on this thread. Thanks! -- bk -------- Original Message -------- Subject: Re: [katello-internal] Cloning Errata Date: Mon, 29 Aug 2011 17:14:50 -0700 From: Mike McCune <mmccune(a)redhat.com> To: Todd Sanders <tsanders(a)redhat.com> CC: katello-internal(a)redhat.com <katello-internal(a)redhat.com> On 08/29/2011 01:48 PM, Todd Sanders wrote: > I put together the following page to illustrate errata cloning > capabilities that we would like to incorporate into Katello/CFSM. > Questions and Comments please. FYI....this is not currently targeted > for v1.0; but wanted to make sure that we accounted for it in our > current designs. > > https://engineering.redhat.com/trac/kalpana/wiki/ErrataCloning > > -Todd > some questions: "4. User Clones RHEL 6 Server Product, only importing the 6.0 Repository. This clone is feedless, and therefore cannot be sync'd. " so, when the user clones a product, they will need to pick which repositories they wish to clone from the source product. makes sense, just wanted to make sure. "5. User promotes the Cloned RHEL 6 Server Product into the next environment, and subscribes systems to the contained 6.0 Repository. * These systems must consume Red Hat entitlements in the same manner as those subscribed to mirrored products. " Candlepin people: Does CP support the relationship between products such that the subscriptions can be pulled from the same pool even if we create this new 'cloned' product? Mike -- Mike McCune mmccune AT redhat.com Red Hat Engineering | Portland, OR Systems Management | 650.254.4248

1 0

Product certificate
by Lukas Zapletal 30 Aug '11

30 Aug '11

Hello, there is one mention of "product certificate" on the CP wiki: https://fedorahosted.org/candlepin/search?q="product+certificate" Actually its on the API page (https://fedorahosted.org/candlepin/wiki/API) """ GET /products/{product_uuid}/certificate : Get a product certificate """ What is a product certificate and what is used for? Thanks -- Later, Lukas "lzap" Zapletal

2 1

Heads up: Ueber Cert
by Bryan Kearney 30 Aug '11

30 Aug '11

All: Just a heads up, the katello guys are going to start looking at creating an ueber cert. The goal will be a single fake "product" which exposes content at $OWNER/. That should allow image factory to grab all content during building. This will also serve as an administrative tool to browse the content via a browers and bypass all checks. -- bk

2 5

Candlepin 0.4.11 released.
by jesus rodriguez 29 Aug '11

29 Aug '11

Candlepin 0.4.11 has been released. You can get the bits at: http://repos.fedorapeople.org/repos/candlepin/candlepin/ Make sure you read over the Setup Guide, which is located at https://fedorahosted.org/candlepin/wiki/Setup For more information on Candlepin, please visit: http://candlepinproject.org/ Features & Enhancements ======================== client ------- * group subscriptions based on stacking attribute in the following screens: * subscriptions page * compliance assistant * view available subscription page * the cli and gui now denote the state of the subscription: Subscribed, Partially Subscribed, Expired or Not Subscribed. * Nag messages now denote the 'Partially Subscribed' state. * registration with multiple activation keys now supported * list --available now shows if a subscription is multi-entitle capable * GUI shows an asterisk to denote a subscription is multi-entitle capable * config command added to cli enabling editing of the configuration values * client tries to optionally heal the system to keep it properly subscribed. server ------- * the list of consumer's installed product IDs are now stored * the candlepin job status stable now stores the consumer uuid for async bind. * configuration added to disable batch jobs on a particular node * Moved the translations to fedora.zanata.org Bugs fixed =========== 729780: non-existent secure objects throw a 404 instead of a 403. 708058: Server 500 error thrown when user auto-subscribes and has no entitlements 728622: Inconsistent enable config entries 728624: Activation keys are successfully being created with invalid chars 728636: Duplicate activation key error is hard to decipher 729125: Adding pools to an activation key should fail when quantity < 1 and quantity > totalQuantity for a multi-entitlement pool 729070: Adding pools to an activation key should be blocked when specifying a quantity>1 for a non-multi-entitlement pool 728721: NullPointerException thrown when registering with an activation key bound to a pool that requires_consumer_type person. 729066: remove logging statement to avoid filling up logs. -- jesus m. rodriguez | jesusr(a)redhat.com principal software engineer | irc: zeus red hat systems management | 919.754.4413 (w) rhce # 805008586930012 | 919.623.0080 (c) +---------------------------------------------+ | "Those who cannot remember the past | | are condemned to repeat it." | | -- George Santayana | +---------------------------------------------+

2 1

Feedback on installation
by Cliff Perry 29 Aug '11

29 Aug '11

During install running: /usr/share/candlepin/cpsetup I hit an error state (message no longer in my terminal buffer). tsetup.restart() print("Waiting for tomcat to restart...") time.sleep(5) run_command("wget -qO- http://localhost:8080/candlepin/admin/init") In short, tomcat was not ready by the time the count of 5 completed and the wget failed. I manually ran the command and it worked and finished off the install. Take a look at the wait_for_tomcat routine used in spacewalk as an example implementation of polling tomcat and once it is up do stuff, vs blindly hitting it: http://git.fedorahosted.org/git/?p=spacewalk.git;a=blob;f=spacewalk/setup/b… Cliff

2 1

Translations moved to the public zanata server
by Bryan Kearney 24 Aug '11

24 Aug '11

All: I have moved the translations to the public zanata server. This will allow anyone with a Fedora account to submit translations. You can see the projects at: Subscription Manager: https://fedora.zanata.org/zanata/project/view/subscription-manager Candlepin: https://fedora.zanata.org/zanata/project/view/candlepin Headpin: https://fedora.zanata.org/zanata/project/view/headpin -- bk

2 4

nullable gpgUrl field in Content
by Dmitri Dolguikh 23 Aug '11

23 Aug '11

In content model gpgUrl is declared as nullable. However, it is used during generation of content extension for the entitlement certificate and an NPE is thrown if it is a null. Not sure what would be the best way to handle this, but a patch fixing the issue is attached. Perhaps the model should be updated to make gpg a non-null field as well? cheers, -d

3 3

Fwd: [PATCH] Handle null values correcly before invoking the certificate generation
by Bryan Kearney 23 Aug '11

23 Aug '11

Please to look at... -------- Original Message -------- Subject: [PATCH] Handle null values correcly before invoking the certificate generation Date: Mon, 22 Aug 2011 16:30:57 -0400 From: Bryan Kearney <bkearney(a)redhat.com> To: candlepin-patches(a)redhat.com CC: Bryan Kearney <bkearney(a)redhat.com> --- .../candlepin/pki/impl/BouncyCastlePKIUtility.java | 39 ++++++++------- .../impl/DefaultEntitlementCertServiceAdapter.java | 50 +++++++++++--------- 2 files changed, 49 insertions(+), 40 deletions(-) diff --git a/proxy/src/main/java/org/fedoraproject/candlepin/pki/impl/BouncyCastlePKIUtility.java b/proxy/src/main/java/org/fedoraproject/candlepin/pki/impl/BouncyCastlePKIUtility.java index d283872..44474bd 100644 --- a/proxy/src/main/java/org/fedoraproject/candlepin/pki/impl/BouncyCastlePKIUtility.java +++ b/proxy/src/main/java/org/fedoraproject/candlepin/pki/impl/BouncyCastlePKIUtility.java @@ -61,26 +61,26 @@ import com.google.inject.Inject; * This class implements methods to create X509 Certificates, X509 CRLs, encode * objects in PEM format (for saving to the db or sending to the client), and * decode raw ASN.1 DER values (as read from a Certificate/CRL). - * + * * All code that imports bouncycastle should live either in this module, * or in {@link BouncyCastlePKIReader} - * + * * (March 24, 2011) Notes on implementing a PKIUtility with NSS/JSS: - * + * * JSS provides classes and functions to generate X509Certificates (see CertificateInfo, * for example). - * + * * PEM encoding requires us to determine the object type (which we know), add the correct * header and footer to the output, base64 encode the DER for the object, and line wrap * the base64 encoding. - * + * * decodeDERValue should be simple, as JSS provides code to parse ASN.1, but I wasn't * able to get it to work. - * + * * The big one is CRL generation. JSS has no code to generate CRLs in any format. We'll * have to use the raw ASN.1 libraries to build up our own properly formatted CRL DER - * representation, then PEM encode it. - * + * representation, then PEM encode it. + * * See also {@link BouncyCastlePKIReader} for more notes on using NSS/JSS, and a note * about not using bouncycastle as the JSSE provider. */ @@ -142,8 +142,11 @@ public class BouncyCastlePKIUtility extends PKIUtility { if (extensions != null) { for (X509ExtensionWrapper wrapper : extensions) { + // Bounceycastle hates null values. So, set them to blank + // if they are null + String value = wrapper.getValue() == null ? "" : wrapper.getValue(); certGen.addExtension(wrapper.getOid(), wrapper.isCritical(), - new DERUTF8String(wrapper.getValue())); + new DERUTF8String(value)); } } @@ -153,7 +156,7 @@ public class BouncyCastlePKIUtility extends PKIUtility { @Override public X509CRL createX509CRL(List<X509CRLEntryWrapper> entries, BigInteger crlNumber) { - + try { X509Certificate caCert = reader.getCACert(); X509V2CRLGenerator generator = new X509V2CRLGenerator(); @@ -177,7 +180,7 @@ public class BouncyCastlePKIUtility extends PKIUtility { throw new RuntimeException(e); } } - + private byte[] getPemEncoded(Object obj) throws IOException { ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream(); OutputStreamWriter oswriter = new OutputStreamWriter(byteArrayOutputStream); @@ -186,22 +189,22 @@ public class BouncyCastlePKIUtility extends PKIUtility { writer.close(); return byteArrayOutputStream.toByteArray(); } - + @Override public byte[] getPemEncoded(X509Certificate cert) throws IOException { return getPemEncoded((Object) cert); } - - @Override + + @Override public byte[] getPemEncoded(Key key) throws IOException { return getPemEncoded((Object) key); } - + @Override public byte[] getPemEncoded(X509CRL crl) throws IOException { return getPemEncoded((Object) crl); } - + @Override public String decodeDERValue(byte[] value) { ASN1InputStream vis = null; @@ -210,7 +213,7 @@ public class BouncyCastlePKIUtility extends PKIUtility { vis = new ASN1InputStream(value); decoded = new ASN1InputStream( ((DEROctetString) vis.readObject()).getOctets()); - + return decoded.readObject().toString(); } catch (IOException e) { @@ -225,7 +228,7 @@ public class BouncyCastlePKIUtility extends PKIUtility { log.warn("failed to close ASN1 stream", e); } } - + if (decoded != null) { try { decoded.close(); diff --git a/proxy/src/main/java/org/fedoraproject/candlepin/service/impl/DefaultEntitlementCertServiceAdapter.java b/proxy/src/main/java/org/fedoraproject/candlepin/service/impl/DefaultEntitlementCertServiceAdapter.java index 2855a67..8d836d7 100644 --- a/proxy/src/main/java/org/fedoraproject/candlepin/service/impl/DefaultEntitlementCertServiceAdapter.java +++ b/proxy/src/main/java/org/fedoraproject/candlepin/service/impl/DefaultEntitlementCertServiceAdapter.java @@ -52,28 +52,28 @@ import com.google.inject.Inject; /** * DefaultEntitlementCertServiceAdapter */ -public class DefaultEntitlementCertServiceAdapter extends +public class DefaultEntitlementCertServiceAdapter extends BaseEntitlementCertServiceAdapter { - + private PKIUtility pki; private X509ExtensionUtil extensionUtil; private KeyPairCurator keyPairCurator; private CertificateSerialCurator serialCurator; private ProductServiceAdapter productAdapter; private EntitlementCurator entCurator; - - private static Logger log = + + private static Logger log = LoggerFactory.getLogger(DefaultEntitlementCertServiceAdapter.class); - + @Inject public DefaultEntitlementCertServiceAdapter(PKIUtility pki, X509ExtensionUtil extensionUtil, - EntitlementCertificateCurator entCertCurator, + EntitlementCertificateCurator entCertCurator, KeyPairCurator keyPairCurator, CertificateSerialCurator serialCurator, ProductServiceAdapter productAdapter, EntitlementCurator entCurator) { - + this.pki = pki; this.extensionUtil = extensionUtil; this.entCertCurator = entCertCurator; @@ -83,18 +83,18 @@ public class DefaultEntitlementCertServiceAdapter extends this.entCurator = entCurator; } - + // NOTE: we use entitlement here, but it version does not... // NOTE: we can get consumer from entitlement.getConsumer() @Override - public EntitlementCertificate generateEntitlementCert(Entitlement entitlement, + public EntitlementCertificate generateEntitlementCert(Entitlement entitlement, Subscription sub, Product product) throws GeneralSecurityException, IOException { - + log.debug("Generating entitlement cert for:"); log.debug(" consumer: {}", entitlement.getConsumer().getUuid()); log.debug(" product: {}" , product.getId()); - log.debug("entitlement's endDt == subs endDt? {} == {} ?", + log.debug("entitlement's endDt == subs endDt? {} == {} ?", entitlement.getEndDate(), sub.getEndDate()); Preconditions .checkArgument( @@ -108,31 +108,31 @@ public class DefaultEntitlementCertServiceAdapter extends // We need the sequence generated id before we create the EntitlementCertificate, // otherwise we could have used cascading create serialCurator.create(serial); - + X509Certificate x509Cert = createX509Certificate(entitlement, sub, product, BigInteger.valueOf(serial.getId()), keyPair); - + EntitlementCertificate cert = new EntitlementCertificate(); cert.setSerial(serial); cert.setKeyAsBytes(pki.getPemEncoded(keyPair.getPrivate())); cert.setCertAsBytes(this.pki.getPemEncoded(x509Cert)); cert.setEntitlement(entitlement); - + log.debug("Generated cert serial number: " + serial.getId()); log.debug("Key: " + cert.getKey()); log.debug("Cert: " + cert.getCert()); - + entitlement.getCertificates().add(cert); entCertCurator.create(cert); return cert; } - + @Override public void revokeEntitlementCertificates(Entitlement e) { for (EntitlementCertificate cert : e.getCertificates()) { CertificateSerial serial = cert.getSerial(); serial.setRevoked(true); - + this.serialCurator.merge(serial); } } @@ -152,12 +152,12 @@ public class DefaultEntitlementCertServiceAdapter extends } return providedProducts; } - + /** * Scan the product content looking for any which modify some other product. If found * we must check that this consumer has another entitlement granting them access * to that modified product. If they do not, we should filter out this content. - * + * * @param prod * @param ent * @return ProductContent to include in the certificate. @@ -180,7 +180,7 @@ public class DefaultEntitlementCertServiceAdapter extends } } } - + if (include) { filtered.add(pc); } @@ -211,17 +211,23 @@ public class DefaultEntitlementCertServiceAdapter extends if (sub != null) { extensions.addAll(extensionUtil.subscriptionExtensions(sub, ent)); } - + extensions.addAll(extensionUtil.entitlementExtensions(ent)); extensions.addAll(extensionUtil.consumerExtensions(ent.getConsumer())); + if (log.isDebugEnabled()) { + for (X509ExtensionWrapper eWrapper : extensions) { + log.debug(String.format("Extension %s with value %s", + eWrapper.getOid(), eWrapper.getValue())); + } + } X509Certificate x509Cert = this.pki.createX509Certificate( createDN(ent), extensions, sub.getStartDate(), ent.getEndDate(), keyPair, serialNumber, null); return x509Cert; } - + private String createDN(Entitlement ent) { StringBuilder sb = new StringBuilder("CN="); sb.append(ent.getId()); -- 1.7.4.4

2 1

404 for all exceptions around auth?
by Bryan Kearney 17 Aug '11

17 Aug '11

Devan: Take a look at the latest patch in [1]. It builds on the earlier patch. I would tend to vote that I do not like this patch, since it causes us to loose fidelity in why exceptions are failing in order to stop folks from fishing the app for owner ids. If I am in the minority, I am happy to push it in. Comments from other folks are appreciated. -- bk [1]http://post-office.corp.redhat.com/archives/candlepin-patches/2011-August…

4 7

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

candlepin August 2011