{"action":"created","issue":{"url":"https://api.github.com/repos/mozilla/tls-observatory/issues/183","repository_url":"https://api.github.com/repos/mozilla/tls-observatory","labels_url":"https://api.github.com/repos/mozilla/tls-observatory/issues/183/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/tls-observatory/issues/183/comments","events_url":"https://api.github.com/repos/mozilla/tls-observatory/issues/183/events","html_url":"https://github.com/mozilla/tls-observatory/pull/183","id":193868823,"number":183,"title":"Added technical constraint checks","user":{"login":"autrilla","id":2260567,"avatar_url":"https://avatars.githubusercontent.com/u/2260567?v=3","gravatar_id":"","url":"https://api.github.com/users/autrilla","html_url":"https://github.com/autrilla","followers_url":"https://api.github.com/users/autrilla/followers","following_url":"https://api.github.com/users/autrilla/following{/other_user}","gists_url":"https://api.github.com/users/autrilla/gists{/gist_id}","starred_url":"https://api.github.com/users/autrilla/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/autrilla/subscriptions","organizations_url":"https://api.github.com/users/autrilla/orgs","repos_url":"https://api.github.com/users/autrilla/repos","events_url":"https://api.github.com/users/autrilla/events{/privacy}","received_events_url":"https://api.github.com/users/autrilla/received_events","type":"User","site_admin":false},"labels":[{"id":305013035,"url":"https://api.github.com/repos/mozilla/tls-observatory/labels/in%20progress","name":"in progress","color":"ededed","default":false}],"state":"open","locked":false,"assignee":{"login":"jvehent","id":415617,"avatar_url":"https://avatars.githubusercontent.com/u/415617?v=3","gravatar_id":"","url":"https://api.github.com/users/jvehent","html_url":"https://github.com/jvehent","followers_url":"https://api.github.com/users/jvehent/followers","following_url":"https://api.github.com/users/jvehent/following{/other_user}","gists_url":"https://api.github.com/users/jvehent/gists{/gist_id}","starred_url":"https://api.github.com/users/jvehent/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jvehent/subscriptions","organizations_url":"https://api.github.com/users/jvehent/orgs","repos_url":"https://api.github.com/users/jvehent/repos","events_url":"https://api.github.com/users/jvehent/events{/privacy}","received_events_url":"https://api.github.com/users/jvehent/received_events","type":"User","site_admin":false},"assignees":[{"login":"jvehent","id":415617,"avatar_url":"https://avatars.githubusercontent.com/u/415617?v=3","gravatar_id":"","url":"https://api.github.com/users/jvehent","html_url":"https://github.com/jvehent","followers_url":"https://api.github.com/users/jvehent/followers","following_url":"https://api.github.com/users/jvehent/following{/other_user}","gists_url":"https://api.github.com/users/jvehent/gists{/gist_id}","starred_url":"https://api.github.com/users/jvehent/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jvehent/subscriptions","organizations_url":"https://api.github.com/users/jvehent/orgs","repos_url":"https://api.github.com/users/jvehent/repos","events_url":"https://api.github.com/users/jvehent/events{/privacy}","received_events_url":"https://api.github.com/users/jvehent/received_events","type":"User","site_admin":false}],"milestone":null,"comments":1,"created_at":"2016-12-06T19:55:33Z","updated_at":"2016-12-21T13:54:10Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/mozilla/tls-observatory/pulls/183","html_url":"https://github.com/mozilla/tls-observatory/pull/183","diff_url":"https://github.com/mozilla/tls-observatory/pull/183.diff","patch_url":"https://github.com/mozilla/tls-observatory/pull/183.patch"},"body":"I've made some small changes to @jcjones's work on technical constraints and vendored them on certificate/constraints/vendor/crypto/x509, and I provided a small API over these specific changes that allows passing in a stdlib x509.Certificate and getting name constraints back.\r\n\r\nA few notes:\r\n\r\n- lib/pq does not support cidr types yet, so we have to store it as varchar[] and convert back and forth.\r\n- I made some changes to certificate/constraints/vendor/crypto/x509's cgo symbol names, so they don't collide with the standard library's crypto/x509\r\n- I have tested this with Deutsche Post's certificate, with www.intraship-dhl.at specifically.\r\n\r\n### Warning: this contains changes to the DB (I've set up defaults for NOT NULL columns in schema.sql so nothing breaks)."},"comment":{"url":"https://api.github.com/repos/mozilla/tls-observatory/issues/comments/268527911","html_url":"https://github.com/mozilla/tls-observatory/pull/183#issuecomment-268527911","issue_url":"https://api.github.com/repos/mozilla/tls-observatory/issues/183","id":268527911,"user":{"login":"jvehent","id":415617,"avatar_url":"https://avatars.githubusercontent.com/u/415617?v=3","gravatar_id":"","url":"https://api.github.com/users/jvehent","html_url":"https://github.com/jvehent","followers_url":"https://api.github.com/users/jvehent/followers","following_url":"https://api.github.com/users/jvehent/following{/other_user}","gists_url":"https://api.github.com/users/jvehent/gists{/gist_id}","starred_url":"https://api.github.com/users/jvehent/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jvehent/subscriptions","organizations_url":"https://api.github.com/users/jvehent/orgs","repos_url":"https://api.github.com/users/jvehent/repos","events_url":"https://api.github.com/users/jvehent/events{/privacy}","received_events_url":"https://api.github.com/users/jvehent/received_events","type":"User","site_admin":false},"created_at":"2016-12-21T13:54:10Z","updated_at":"2016-12-21T13:54:10Z","body":"DB changes to be pushed before deployment:\r\n```sql\r\nalter table certificates add column permitted_dns_domains varchar[] DEFAULT '{}';\r\nalter table certificates add column permitted_ip_addresses varchar[] DEFAULT '{}';\r\nalter table certificates add column excluded_dns_domains varchar[] DEFAULT '{}';\r\nalter table certificates add column excluded_ip_addresses varchar[] DEFAULT '{}';\r\nalter table certificates add column is_technically_constrained bool DEFAULT false;\r\n```\r\n\r\nThen after deployment, `DROP` columns `is_name_constrained` and `permitted_names`.\r\n"}}
{"actor":{"display_login":"jvehent"}}