rpms/certmonger
7
0
Fork 0
Code Issues Pull Requests Releases Activity
8991081682
certmonger/.gitignore

93 lines
2.3 KiB
Plaintext
Raw Normal View History

- initial import (#541072)
2010-01-27 16:04:22 +00:00
certmonger-0.17.tar.gz
- update to 0.18 - add support for using encrypted storage for keys, using PIN values supplied directly or read from files whose names are supplied - don't choke on NSS database locations that use the "sql:" or "dbm:" prefix
2010-02-12 20:43:18 +00:00
certmonger-0.18.tar.gz
update to 0.19
2010-03-24 00:07:21 +00:00
certmonger-0.19.tar.gz
- update to 0.20 - correctly parse certificate validity periods given in years (spotted by Stephen Gallagher) - setup for translation - es by Héctor Daniel Cabrera! - ru by Yulia Poyarkova! - uk by Yuri Chornoivan! - fix unpreprocessed defaults in certmonger.conf's man page - tweak the IPA-specific message that indicates a principal name also needs to be specified if we're not using the default subject name (#579542) - make the validity period of self-signed certificates into a configuration setting and not a piece of the state information we track about the signer - init script: exit with status 2 instead of 1 when invoked with an unrecognized argument (#584517)
2010-04-21 21:57:28 +00:00
certmonger-0.20.tar.gz
- update to 0.21 - getcert/*-getcert: relay the desired CA to the local service, whether specified on the command line (in getcert) or as a built-in hard-wired default (in *-getcert) (#584983) - flesh out the default certmonger.conf so that people can get a feel for the expected formatting (Jenny Galipeau)
2010-05-04 18:37:19 +00:00
certmonger-0.21.tar.gz
- update to 0.22 - new translations - de by Fabian Affolter! - certmaster-submit: don't fall over when we can't find a certmaster.conf or a minion.conf (i.e., certmaster isn't installed) (#588932) - when reading extension values from certificates, prune out duplicate principal names, email addresses, and hostnames
2010-05-14 16:54:43 +00:00
certmonger-0.22.tar.gz
- update to 0.23 - new translations - pl by Piotr Drąg! - cancel daemon startup if we can't gain ownership of our well-known service name on the DBus (#596719)
2010-05-27 22:32:54 +00:00
certmonger-0.23.tar.gz
- update to 0.24 - keep the lock on the pid file, if we have one, when we fork, and cancel daemon startup if we can't gain ownership of the lock (the rest of #596719) - make the man pages note which external configuration files we consult when submitting requests to certmaster and ipa CAs
2010-06-08 15:26:12 +00:00
certmonger-0.24.tar.gz
- update to 0.26 - when canceling a submission request that's being handled by a helper, reap the child process's status after killing it (#624120) - update to 0.25 - new translations - in by Okta Purnama Rahadian! - fix detection of cases where we can't access a private key in an NSS database because we don't have the PIN - teach '*getcert start-tracking' about the -p and -P options which the '*getcert request' commands already understand (#621670), and also the -U, -K, -E, and -D flags - double-check that the nicknames of keys we get back from PK11_ListPrivKeysInSlot() match the desired nickname before accepting them as matches, so that our tests won't all blow up on EL5 - fix dynamic addition and removal of CAs implemented through helpers - init script: ensure that the subsys lock is created whenever we're called to "start" when we're already running (even more of #596719) - more gracefully handle manual daemon startups and cleaning up of unexpected crashes (still more of #596719) - don't create the daemon pidfile until after we've connected to the D-Bus (still more of #596719)
2010-08-13 18:35:38 +00:00
certmonger-0.26.tar.gz
- fix self-signing certificate notBefore and notAfter values on 32-bit machines - portability and test fixes
2010-08-23 16:04:13 +00:00
certmonger-0.28.tar.gz
- update to 0.30 - fix bugs caught by self-tests
2010-08-25 19:51:50 +00:00
/certmonger-0.30.tar.gz
update to 0.32
2010-11-30 18:58:31 +00:00
/certmonger-0.32.tar.gz
- update to 0.34
2011-01-14 15:02:47 +00:00
/certmonger-0.34.tar.gz
- self-test fixes to rebuild properly in mock (#670322)
2011-02-14 22:46:45 +00:00
/certmonger-0.35.tar.gz
- update to 0.35.1, because there's a leap day between now and a year from now
2011-03-02 20:51:28 +00:00
/certmonger-0.35.1.tar.gz
- update to 0.36 - fix some use-after-free bugs in the daemon (#689776) - fix a copy/paste error in certmonger-ipa-submit(8) - getcert now suppresses error details when not given its new -v option (#683926, more of #681641/#652047) - updated translations - de, es, pl, ru, uk - indonesian translation is now for "id" rather than "in"
2011-03-22 15:44:09 +00:00
/certmonger-0.36.tar.gz
- update to 0.37 - be more careful about checking if we can read a PIN file successfully before we even call an API that might need us to try (#688229) - fix strict aliasing warnings
2011-03-22 23:33:39 +00:00
/certmonger-0.37.tar.gz
- update to 0.38 - catch cases where we can't read a PIN file, but we never have to log in to the token to access the private key (more of #688229)
2011-03-24 19:30:29 +00:00
/certmonger-0.38.tar.gz
- update to 0.39 - fix use of an uninitialized variable in the xmlrpc-based submission helpers (#690886)
2011-03-25 18:12:02 +00:00
/certmonger-0.39.tar.gz
- update to 0.40 - fix validation check on EKU OIDs in getcert (#691351) - get session bus mode sorted - add a list of recognized EKU values to the getcert-request man page
2011-03-28 21:14:09 +00:00
/certmonger-0.40.tar.gz
- update to 0.41
2011-04-11 21:35:07 +00:00
/certmonger-0.41.tar.gz
- getcert: fix a buffer overrun preparing a request for the daemon when there are more parameters to encode than space in the array (#696185) - updated translations: de, es, id, pl, ru, uk
2011-04-13 14:29:00 +00:00
/certmonger-0.42.tar.gz
- update to 0.43
2011-08-10 22:24:45 +00:00
/certmonger-0.43.tar.gz
- update to 0.44: - check specifically for cases where a specified token that we need to use just isn't present for whatever reason (#697058)
2011-08-11 15:50:26 +00:00
/certmonger-0.44.tar.gz
- modify the systemd .service file to be a proper 'dbus' service (more of #718172)
2011-08-11 17:56:57 +00:00
/certmonger-0.45.tar.gz
- treat the ability to access keys in an NSS database without using a PIN, when we've been told we need one, as an error (#692766, really this time)
2011-08-15 19:37:00 +00:00
/certmonger-0.46.tar.gz
- update to 0.49: - when using an NSS database, skip loading the module database (#743042) - when using an NSS database, skip loading root certs - generate SPKAC values when generating CSRs, though we don't do anything with SPKAC values yet - internally maintain and use challenge passwords, if we have them - behave better when certificates have shorter lifetimes - add/recognize/handle notification type "none" - getcert: error out when "list -c" finds no matching CA (#743488) - getcert: error out when "list -i" finds no matching request (#743485) - don't incorrectly assume that CERT_ImportCerts() returns a NULL-terminated array (#742348) - getcert: distinguish between {stat() succeeds but isn't a directory} and {stat() failed} when printing an error message (#739903) - getcert resubmit/start-tracking: when we're looking for an existing request by ID, and we don't find one, note that specifically (#741262)
2011-10-13 21:25:09 +00:00
/certmonger-0.49.tar.gz
/certmonger-0.49.tar.gz.sig
- really fix these this time: - getcert: error out when "list -c" finds no matching CA (#743488) - getcert: error out when "list -i" finds no matching request (#743485)
2011-10-14 15:55:56 +00:00
/certmonger-0.50.tar.gz
/certmonger-0.50.tar.gz.sig
- update to 0.51, mainly to add compatibility with super-new IPA
2011-12-06 16:08:31 +00:00
/certmonger-0.51.tar.gz
/certmonger-0.51.tar.gz.sig
- note that SELinux usually confines us to writing only to cert_t in doc/getting-started.txt (#765599) - fix crashes when we add a request during our first run when we're populating the hard-coded CA list - properly deal with cases where a path is passed to us is "./XXX" - in session mode, create our data directories as we go
2011-12-16 16:18:45 +00:00
/certmonger-0.52.tar.gz
/certmonger-0.52.tar.gz.sig
- update to 0.54
2012-02-15 07:27:13 +00:00
/certmonger-0.54.tar.gz
/certmonger-0.54.tar.gz.sig
-update to 0.55 - allow root to use our implementation of org.freedesktop.DBus.Properties - take more care to not emit useless PropertiesChanged signals
2012-02-15 22:44:35 +00:00
/certmonger-0.55.tar.gz
/certmonger-0.55.tar.gz.sig
- when a caller sets the is-default flag on a CA, and another CA is no longer the default, emit the PropertiesChanged signal on the CA which is not the default, instead on the new default a second time - drop some dead code from the D-Bus message handlers (static analysis, #796813) - cache public keys when we read private keys - go back to printing an error indicating that we're missing a required argument when we're missing a required argument, not that the option is invalid (broken since 0.51, #796542)
2012-03-03 06:20:58 +00:00
/certmonger-0.56.tar.gz
/certmonger-0.56.tar.gz.sig
update to 0.59 0.59: - mostly documentation updates 0.58: - add a "dogtag-ipa-renew-agent" CA so that we can renew certificates using an IPA server's internal Dogtag instance - export the requested profile and old certificate to enrollment helpers - make libxml and libcurl into hard build-time requirements - serialize all pre/save/post sequences to make sure that stop/save/start doesn't become stop1/save1/stop2/start1/save2/start2 when we're stopping a service while we muck with more than one of its certificates - add a command option (-T) to getcert for specifying which enrollment profile to tell a CA that we're using, in case it cares (#10) 0.57 - clarify that the command passed to getcert -C is a "post"-save command - add a "pre"-save command option to getcert, specified with the -B flag (#9)
2012-07-14 02:31:55 +00:00
/certmonger-0.59.tar.gz
/certmonger-0.59.tar.gz.sig
update to 0.60 - adjust internals of logic for talking to dogtag to at least have a concept of non-agent cases - when talking to an IPA server's internal Dogtag instance, infer which ports the CA is listening on from the "dogtag_version" setting in the IPA configuration (Ade Lee) - send a notification (or log a message, whatever) when we save a new certificate (#766167)
2012-09-05 23:37:06 +00:00
/certmonger-0.60.tar.gz
/certmonger-0.60.tar.gz.sig
update to 0.61 fixes a regression reading request state files where the request's state is either NEED_TO_NOTIFY or NOTIFY
2012-09-24 21:10:27 +00:00
/certmonger-0.61.tar.gz
/certmonger-0.61.tar.gz.sig
update to 0.62 - add a -u flag to getcert to enable requesting a keyUsage extension value - request subjectKeyIdentifier extensions from CAs, and include them in self-signed certificates - request basicConstraints from CAs, defaulting to requests for end-entity certificates - when requesting CA certificates, also request authorityKeyIdentifier - add support for requesting CRL distribution point and authorityInfoAccess extensions that specify OCSP responder locations - don't crash when OpenSSL can't build a template certificate from a request when we're in FIPS mode - put NSS in FIPS mode, when the system booted that way, except when we're trying to write certificates to a database - fix CSR generation and self-signing in FIPS mode with NSS - fix self-signing in FIPS mode with OpenSSL - new languages from the translation team: mai, ml, nn, ga
2012-11-29 05:45:48 +00:00
/certmonger-0.62.tar.gz
/certmonger-0.62.tar.gz.sig
update to 0.63 update to 0.63: - serialize access to NSS databases and the running of pre- and post-save commands which might also access them (possibly fixing part of #883484)
2012-12-19 17:03:42 +00:00
/certmonger-0.63.tar.gz
/certmonger-0.63.tar.gz.sig
update to 0.65 Update to 0.65, which flushes out bugs in the locking work that landed in 0.63.
2013-01-09 16:15:48 +00:00
/certmonger-0.65.tar.gz
/certmonger-0.65.tar.gz.sig
update to 0.67 0.67: - when saving certificates to NSS databases, try to preserve the trust value assigned to a previously-present certificate with the same nickname and subject, if one is found - when saving certificates to NSS databases, also prune certificates from the database which have both the same nickname and subject as the one we're adding, to avoid tripping up tools that only fetch one certificate by nickname 0.66: - build as position-independent executables with early binding (#883966) - also don't tag the unit file as a configuration file (internal tooling) - don't tag the D-Bus session .service file as a configuration file (internal tooling)
2013-03-11 22:08:35 +00:00
/certmonger-0.67.tar.gz
/certmonger-0.67.tar.gz.sig
update to 0.68 - notice when the OpenSSL RNG isn't seeded - notice when saving certificates or keys fails due to filesystem-related permission denial (#996581)
2013-08-29 20:12:05 +00:00
/certmonger-0.68.tar.gz
/certmonger-0.68.tar.gz.sig
Update to 0.69 - tweak how we decide whether we're on the master or a minion when we're told to use certmaster as a CA - clean up one of the tests so that it doesn't have to work around internal logging producing duplicate messages - when logging errors while setting up to contact xmlrpc servers, explicitly note that the error is client-side - don't abort() due to incorrect locking when an attempt to save an issued certificate to the designated location fails (part of #1032760/#1033333, ticket #22) - when reading an issued certificate from an enrollment helper, ignore noise before or after the certificate itself (more of #1032760/1033333, ticket #22) - run subprocesses in a cleaned-up environment (more of #1032760/1033333, ticket #22) - clear the ca-error that we saved when we had an error talking to the CA if we subsequently succeed in talking to the CA - various other static-analysis fixes
2013-12-10 00:43:57 +00:00
/certmonger-0.69.tar.gz
/certmonger-0.69.tar.gz.sig
update to 0.70 - add a --with-homedir option to configure, and use it, since subprocesses which we run and which use NSS may attempt to write to $HOME/.pki, and 0.69's strategy of setting that to "/" was rightly hitting SELinux policy denials (#1047798)
2014-01-02 18:12:26 +00:00
/certmonger-0.70.tar.gz
/certmonger-0.70.tar.gz.sig
Update to 0.71(.2) - check for cases where we fail to allocate memory while reading a request or CA entry from disk (John Haxby) - only handle one watch at a time, which should avoid abort() during attempts to reconnect to the message bus after losing our connection to it (#1055521)
2014-01-27 22:22:09 +00:00
/certmonger-0.71.2.tar.gz
/certmonger-0.71.2.tar.gz.sig
Update to 0.73 - encode the friendlyName attribute in signing requests as a BMPString, not as a PrintableString - catch more filesystem permissions problems earlier (more of #996581) - move the tmpfiles.d file from /etc/tmpfiles.d to %%{_tmpfilesdir}, where it belongs - support generating requests and self-signing using DSA and EC keys
2014-02-24 15:18:07 +00:00
/certmonger-0.73.tar.gz
/certmonger-0.73.tar.gz.sig
Update to 0.74 - also save state when we exit due to SIGHUP - don't get tripped up when enrollment helpers hand us certificates which include CRLF line terminators (ticket #25) - be tolerant of certificate issuer names, subject names, DNS, email, and Kerberos principal namem subjectAltNames, and crl distribution point URLs that contain newlines - read and cache the certificate template extension in certificates - enforce different minimum key sizes depending on the type of key we're trying to generate - store DER versions of subject, issuer and template subject, if we have them (Jan Cholasta, ticket #26) - when generating signing requests with subject names that don't quite parse as subject names, encode what we're given as PrintableString rather than as a UTF8String - always chdir() to a known location at startup, even if we're not becoming a daemon - fix a couple of memory leaks (static analysis) - add missing buildrequires: on which
2014-04-03 17:27:21 +00:00
/certmonger-0.74.tar.gz
/certmonger-0.74.tar.gz.sig
Update to 0.75 - add a -w (wait) flag to the getcert's request/resubmit/start-tracking commands, and add a non-waiting "status" command - add the "local" signer, a local toy CA that signs anything you'll ask it to sign - fix self-test errors that we trigger with new OpenSSL - fix a build error that would sometimes happen when we're told to build PIE binaries - quiet a compile warning - retrieve CA information from CAs, if the helpers can do so, and add a command to explicitly refresh that data: "getcert refresh-ca" - offer to save CA certificates to files and databases, when specified with new -a and -F flags to getcert request/resubmit/start-tracking (#1098208, trac #31) - add IP address subject alternate names when getcert request/resubmit is passed the -A option (trac #35) - read and cache the freshestCRL extension in certificates - properly interpret KDC-unreachable errors encountered in the IPA submission error as a server-unreachable error that we will retry, rather than a misconfiguration error which we won't - don't let tests get tripped up by new formatting used in dos2unix status messages (#1099080) - updated translations - be explicit that we are going to use bashisms in test scripts by calling the shell interpreter as 'bash' rather than 'sh' (trac #27)
2014-06-13 21:27:25 +00:00
/certmonger-0.75.tar.gz
/certmonger-0.75.tar.gz.sig
Update to 0.75.1 - log the state in 'getcert status' verbose mode
2014-06-15 04:14:39 +00:00
/certmonger-0.75.1.tar.gz
/certmonger-0.75.1.tar.gz.sig
Update to 0.75.2 - when generating keys using OpenSSL, if key generation fails, try again with the default key size, in case we're in FIPS mode - documentation updates
2014-06-16 22:42:06 +00:00
/certmonger-0.75.2.tar.gz
/certmonger-0.75.2.tar.gz.sig
Update to 0.75.3 - read and cache whether or not we saw a noOCSPcheck extension in certificates - documentation updates
2014-06-18 18:39:06 +00:00
/certmonger-0.75.3.tar.gz
/certmonger-0.75.3.tar.gz.sig
Update to 0.75.5 - documentation updates - add a %%trigger to remove knowledge of the "dogtag-ipa-renew-agent" CA when we detect certmonger versions prior to 0.58 being installed, to avoid cases where some older versions choke on CAs with nicknames that contain characters that can't legally be part of a D-Bus name (#948993) - fix creation and packaging of the "local" CA's data directory
2014-06-20 21:06:03 +00:00
/certmonger-0.75.5.tar.gz
/certmonger-0.75.5.tar.gz.sig
Update to 0.75.6 - avoid potential use-after-free and read overrun after a CA is added dynamically (thanks to Jan Cholasta)
2014-06-26 14:18:38 +00:00
/certmonger-0.75.6.tar.gz
/certmonger-0.75.6.tar.gz.sig
Update to 0.75.8 - add a 'refresh' option to the getcert command - add a '-a' flag to the getcert command's 'refresh-ca' option - adjust package Requires: on systemd-sysv on F19 and EL6 and older, conditionalized it so that it's ignored on newer releases, and make whether or not we call systemd-sysv-convert in triggers depend on that, too (#1104138) - fix an inconsistency in how we parse cookie values returned by CA helpers, in that single-line values would lose the end-of-line after a daemon restart, but not before - handle timeout values and exit status values when calling CA helpers in non-SUBMIT, non-POLL modes (#1118468) - rework how we save CA certificates so that we save CA certificates associated with end-entity certificates when we save that end-entity certificate, which requires running all of the involved pre- and post-save commands
2014-07-21 20:25:17 +00:00
/certmonger-0.75.8.tar.gz
/certmonger-0.75.8.tar.gz.sig
Update to 0.75.9 - avoid potential use-after-free after a CA is removed dynamically (thanks to Keenan Brock) (#1125342) - add a "external-helper" property to CA objects
2014-07-31 18:24:23 +00:00
/certmonger-0.75.9.tar.gz
/certmonger-0.75.9.tar.gz.sig
Update to 0.75.10 - when attempting to contact an IPA LDAP server, if no "ldap_uri" is set in default.conf, and no "host" is set either, try to construct the server URI using the "server" setting (#1126985)
2014-08-05 19:44:15 +00:00
/certmonger-0.75.10.tar.gz
/certmonger-0.75.10.tar.gz.sig
Update to 0.75.13 - correct encoding/decoding of variant-typed data which we receive and send as part of the org.freedesktop.DBus.Properties interface over the bus, and add some tests for them (based on patch from David Kupka, ticket #36) - when getcert is passed a -a flag, to indicate that CA root certificates should be stored in the specified database, don't ignore locations which don't include a storage scheme (#1129537) - when called to 'start-tracking' with the -a or -F flags, if we have applicable certificates on-hand for a CA that we're either told to use or which we decide is the correct one, save the certificates (#1129696)
2014-08-18 17:20:11 +00:00
/certmonger-0.75.13.tar.gz
/certmonger-0.75.13.tar.gz.sig
Update to 0.75.14 - make pathname canonicalization slightly smarter, to handle ".." in locations - updates to self-tests
2014-08-28 18:11:42 +00:00
/certmonger-0.75.14.tar.gz
/certmonger-0.75.14.tar.gz.sig
Update to 0.76.6 Update to 0.76.6: - avoid premature exit on CA data analysis failures (should fix issue reported by Natxo Asenjo) - fixes for bugs found by static analysis - rework the state machine so that we save an issued certificate's associated CA certificates, then re-read the certificate, then run the post hook and issue notifications, in that order, instead of saving CA certificates after running the post hook, which was always a surprising order (#1131700) - add a generic dogtag-submit helper that doesn't include any IPA defaults, to make it easier to know the difference between paramenters it requires and parameters which are optional - ipa-submit: when we fail to locate/contact LDAP or XML-RPC servers, use discovery to find them (#1136900) - require a single certificate to be specified to 'getcert status' (#1148001) - shorten the default help message which getcert prints when it's not given a specific command (#1131704) - add private listener (-l, -L, -P) mode to certmonger, to allow it to listen for connections directly from clients running under the same UID - add a command mode (-c) to certmonger, in which once it's started, it launches a specified command, and after that command exits, the daemon exits - when getcert is invoked with no bus running, if it's running as root, run certmonger in private listener mode with the same invocation of getcert as the command to start and wait for (#1134497)
2014-11-10 22:58:42 +00:00
/certmonger-0.76.6.tar.gz
/certmonger-0.76.6.tar.gz.sig
Update to 0.76.7 - correctly read CA not-valid-after dates on 32-bit machines (also reported by Natxo Asenjo), so that we don't spin on polling them
2014-11-11 18:06:53 +00:00
/certmonger-0.76.7.tar.gz
/certmonger-0.76.7.tar.gz.sig
Reference in New Issue Copy Permalink