{"push_id":1204017592,"size":20,"distinct_size":1,"ref":"refs/heads/release","head":"a8ac802f9963b1ab9e42fe67438f941a6c3dd8fb","before":"32de599c805debbc598685ad09d10c42b1b60f02","commits":[{"sha":"a3696a2c581a89efd56ec09b42c85f5087263598","author":{"name":"Daniel McCarney","email":"4b94a04674ad2c69d990e94ab196ac3f8e9e03d4@binaryparadox.net"},"message":"Change `%v` to `%#v` in AssertEquals error msg. (#1983)\n\nWhenever I run into a test failure using `AssertEquals` I end up changing the error format string to include the full type information. I think given the context of when the message will be printed it makes sense to include type information all the time.\r\n\r\nThis commit changes the format string from `%v` to `%#v`. This avoids otherwise unhelpful test failures like:\r\n    `ra_test.go:789: [0] != [0]`\r\nwhere the underlying types differ while their String() representation matches.","distinct":false,"url":"https://api.github.com/repos/letsencrypt/boulder/commits/a3696a2c581a89efd56ec09b42c85f5087263598"},{"sha":"6007df8f3c68e8d2b3b2c46c2d842f07b8f39bb7","author":{"name":"Ben Irving","email":"0a12ce9f678164720ff3ba67d42f8a2ce90c45ca@gmail.com"},"message":"Split up boulder-config.json (WFE) (#1973)\n\nMoves the wfe to it's own config file.\r\n\r\nEach config will now belong in `test/config` and `test/config-next` analogous to `boulder-config` and `boulder-config-next`.","distinct":false,"url":"https://api.github.com/repos/letsencrypt/boulder/commits/6007df8f3c68e8d2b3b2c46c2d842f07b8f39bb7"},{"sha":"0c0e94dfafdfa24c8093abaab7f7ceee599b430d","author":{"name":"Jacob Hoffman-Andrews","email":"f27a17fc90c00d8c248d8510a1084221738b492b@hoffman-andrews.com"},"message":"Add enforcement for CAA SERVFAIL (#1971)\n\nhttps://github.com/letsencrypt/boulder/pull/1971","distinct":false,"url":"https://api.github.com/repos/letsencrypt/boulder/commits/0c0e94dfafdfa24c8093abaab7f7ceee599b430d"},{"sha":"04961d7c661d714425e717d7879ffdbc6850745d","author":{"name":"Roland Bracewell Shoemaker","email":"92f744913106d95591cacf71cd5e536dc4275f93@gmail.com"},"message":"Add basic ASN.1 structure test for pre-1.0.2 OpenSSL CSRs (#1972)\n\nAdds a test for CSRs generated using a pre-1.0.2 version of OpenSSL and a buggy client which will fail to parse with Golang 1.6+.\r\n\r\nThis test checks the values of the bytes in the 8th and 9th offsets, which in a properly formatted CSR should be the version integer declaration bytes, and if the malformed values are present will return a error to the user informing them that they are using an old version of OpenSSL and/or a client which doesn't explicitly set the CSR version.\r\n\r\nFixes #1902.","distinct":false,"url":"https://api.github.com/repos/letsencrypt/boulder/commits/04961d7c661d714425e717d7879ffdbc6850745d"},{"sha":"fd095b888113f1b63964bfa1377b738cbb200a76","author":{"name":"Jacob Hoffman-Andrews","email":"f27a17fc90c00d8c248d8510a1084221738b492b@hoffman-andrews.com"},"message":"Fix Docker test builds: latest certbot and grpc (#1991)\n\nThe `letsencrypt/boulder-tools` image was recently updated, pulling in version\r\n0.8.0 of certbot. That version stores the output of `certonly` requests in a\r\ndifferent path. In test.sh, we check out a specific tagged release of certbot in\r\norder to get its integration tests. Prior to this commit, we were using\r\ncertbot 0.8.0 with the integration tests from version 0.6.0 of certbot,\r\nwhich looked for `certonly` output in the wrong place, and failed.\r\n\r\nThis commit changes test.sh to checkout the 0.8.0 branch, and also removes a\r\ntemporary shim we used to make the `certbot` command call out to the\r\n`letsencrypt` command.\r\n\r\nAlso, since the latest version of `letsencrypt/boulder-tools` includes an updated\r\n`protoc-gen-go`, this change also updates the support packages to match.","distinct":false,"url":"https://api.github.com/repos/letsencrypt/boulder/commits/fd095b888113f1b63964bfa1377b738cbb200a76"},{"sha":"55657fad0dd5e09b79adbe5831ada42f5cdae763","author":{"name":"Jacob Hoffman-Andrews","email":"f27a17fc90c00d8c248d8510a1084221738b492b@hoffman-andrews.com"},"message":"RA doesn't need CAASERVFAILExceptions. (#1992)\n\nIn #1971 we added the CAASERVFAILExceptions config field and argument to NewDNSResolverImpl. This argument only needs to be passed to the VA, where we do CAA validations. However, I accidentally added code to the RA as well to use this new config field. This changes backs that out.","distinct":false,"url":"https://api.github.com/repos/letsencrypt/boulder/commits/55657fad0dd5e09b79adbe5831ada42f5cdae763"},{"sha":"0ab507339b391b5dfc6cf633d7be24ee398e6a28","author":{"name":"Roland Bracewell Shoemaker","email":"92f744913106d95591cacf71cd5e536dc4275f93@gmail.com"},"message":"Fix CDR test race in go 1.5 (#1990)\n\nFixes #1976.","distinct":false,"url":"https://api.github.com/repos/letsencrypt/boulder/commits/0ab507339b391b5dfc6cf633d7be24ee398e6a28"},{"sha":"c4f7fb580d3e0629c580c51b03377486e5c4c7c8","author":{"name":"Ben Irving","email":"0a12ce9f678164720ff3ba67d42f8a2ce90c45ca@gmail.com"},"message":"Split up boulder-config.json (RA) (#1974)\n\nPart of #1962","distinct":false,"url":"https://api.github.com/repos/letsencrypt/boulder/commits/c4f7fb580d3e0629c580c51b03377486e5c4c7c8"},{"sha":"821d572366b9b30b8065102ab767dad8ac00e31c","author":{"name":"Maxime Boisvert","email":"8d027b51f83fb40ae952c5dc019733fd3a5d6b62@shopify.com"},"message":"Adds RejectedIdentifierError on Blacklisted error. (#1944)\n\nBoulder uses MalformedRequestError as a universal error. This pull request adds the RejectedIdentifierError and use it on a blacklist error.\r\n\r\nFor a client implementation, it is easier and cleaner to use an exception than parse the error message.\r\n\r\nhttps://github.com/letsencrypt/boulder/blob/1336c428130cba866768b766b51b421176ad14ef/policy/pa.go#L131\r\n\r\nFixes #1938\r\n\r\nPR in acme : ietf-wg-acme/acme#142","distinct":false,"url":"https://api.github.com/repos/letsencrypt/boulder/commits/821d572366b9b30b8065102ab767dad8ac00e31c"},{"sha":"6162533c00bf97bd20fe0a572ee1eab9c7a66c73","author":{"name":"Ben Irving","email":"0a12ce9f678164720ff3ba67d42f8a2ce90c45ca@gmail.com"},"message":"Split up boulder-config.json (SA) (#1975)\n\nDepends on #1973\r\n\r\nhttps://github.com/letsencrypt/boulder/pull/1975","distinct":false,"url":"https://api.github.com/repos/letsencrypt/boulder/commits/6162533c00bf97bd20fe0a572ee1eab9c7a66c73"},{"sha":"d0eef4b49867d857c646612c36434f6a7e3f9dc5","author":{"name":"Jacob Hoffman-Andrews","email":"f27a17fc90c00d8c248d8510a1084221738b492b@hoffman-andrews.com"},"message":"Fix crash in expiration-mailer (#1997)\n\nIn #1923 we changed reg.Contact to a pointer, which can be nil if the corresponding data from the DB is the literal string \"null\". This causes panics in expiration-mailer, which we need to fix.\r\n\r\nThis change fixes modelToRegistration to always return a pointer to a non-nil slice. It also adds an extra sanity check in expiration-mailer itself.\r\n\r\nFixes #1993\r\n\r\nhttps://github.com/letsencrypt/boulder/pull/1997","distinct":false,"url":"https://api.github.com/repos/letsencrypt/boulder/commits/d0eef4b49867d857c646612c36434f6a7e3f9dc5"},{"sha":"b6c554b6232816ed367d52c58cad88677260b5ca","author":{"name":"Jacob Hoffman-Andrews","email":"f27a17fc90c00d8c248d8510a1084221738b492b@hoffman-andrews.com"},"message":"Remove inquirer from test.js. (#1994)\n\nWe never use test.js in interactive mode so it was unnecessary complexity.\r\nAlso allow registering with no email.","distinct":false,"url":"https://api.github.com/repos/letsencrypt/boulder/commits/b6c554b6232816ed367d52c58cad88677260b5ca"},{"sha":"7172e49650e67a39b24bc653b2cb2e0ca94a9151","author":{"name":"Simone Carletti","email":"b44aacaf28294582976a076e1d10840e0919630e@weppos.net"},"message":"Replace x/net/publicsuffix with weppos/publicsuffix-go (#1969)\n\nThis PR replaces the `x/net/publicsuffix` package with `weppos/publicsuffix-go`.\r\n\r\nThe conversations that leaded to this decision are #1479 and #1374. To summarize the discussion, the main issue with `x/net/publicsuffix` is that the package compiles the list into the Go source code and doesn't provide a way to easily pull updates (e.g. by re-parsing the original PSL) unless the entire package is recompiled.\r\n\r\nThe PSL update frequency is almost daily, which makes very hard to recompile the official Golang package to stay up-to-date with all the changes. Moreover, Golang maintainers expressed some concerns about rebuilding and committing changes with a frequency that would keep the package in sync with the original PSL. See https://github.com/letsencrypt/boulder/issues/1374#issuecomment-182429297\r\n\r\n`weppos/publicsuffix-go` contains a compiled version of the list that is updated weekly (or more frequently). Moreover, the package can read and parse a PSL from a String or a File which will effectively decouple the Boulder source code with the list itself. The main benefit is that it will be possible to update the definition by simply downloading the latest list and restarting the application (assuming the list is persisted in memory).","distinct":false,"url":"https://api.github.com/repos/letsencrypt/boulder/commits/7172e49650e67a39b24bc653b2cb2e0ca94a9151"},{"sha":"97bc63c4847b60a245c19b80b7df12599b73deb9","author":{"name":"Roland Bracewell Shoemaker","email":"92f744913106d95591cacf71cd5e536dc4275f93@gmail.com"},"message":"Fix RA test race (#1995)\n\nThe RA test uses a `DummyValidationAuthority` which is called from `ra.UpdateAuithorization` in a goroutine. Both the tester and the spawned  goroutine want to mutate/read fields on the `DummyValidationAuthority` which causes a race. This PR fixes the race by blocking on a `chan struct{}` until the `DummyValidationAuthority` has mutated the required state.\r\n\r\nFixes #1980.\r\n\r\nhttps://github.com/letsencrypt/boulder/pull/1995","distinct":false,"url":"https://api.github.com/repos/letsencrypt/boulder/commits/97bc63c4847b60a245c19b80b7df12599b73deb9"},{"sha":"21e0b3bdc732519d56b8e9bfee5d4bd37221128c","author":{"name":"Ben Irving","email":"0a12ce9f678164720ff3ba67d42f8a2ce90c45ca@gmail.com"},"message":"Split up boulder-config.json (CA) (#1978)","distinct":false,"url":"https://api.github.com/repos/letsencrypt/boulder/commits/21e0b3bdc732519d56b8e9bfee5d4bd37221128c"},{"sha":"bea8e5753644bade7090e2832c19a26543f46aea","author":{"name":"Ben Irving","email":"0a12ce9f678164720ff3ba67d42f8a2ce90c45ca@gmail.com"},"message":"Split up boulder-config.json (VA) (#1979)","distinct":false,"url":"https://api.github.com/repos/letsencrypt/boulder/commits/bea8e5753644bade7090e2832c19a26543f46aea"},{"sha":"893512285b1adf4b40f5e0b9b711918cdcf5f17b","author":{"name":"Daniel McCarney","email":"4b94a04674ad2c69d990e94ab196ac3f8e9e03d4@binaryparadox.net"},"message":"Fix index out of range panic in `getCerts`. (#2005)\n\nBoulder issue #2004 describes a panic observed in `getCerts` caused by an index out of range. It appears as though this is caused by a race condition between the initial `SelectOne` lookup for the count of certificates, and the subsequent individual `Select` queries to fetch the Certificates. If the number of eligible certificates changes between these points (e.g. due to certificates expiring) there is a potential that one of the Select calls will return an empty result set. If this happens, then the `lastSerial` update will access an index out of range.\r\n\r\nThis PR adds an explicit `len` check to the processing loop before the `lastSerial` update. If there are no results returned from the DB query then the loop is broken. This resolves #2004\r\n\r\nA test case for the fix was written and included in this PR. The testcase initially caused the out of range panic observed in #2004. After adding the `len` fix in this commit the test began passing without error.","distinct":false,"url":"https://api.github.com/repos/letsencrypt/boulder/commits/893512285b1adf4b40f5e0b9b711918cdcf5f17b"},{"sha":"209c74f28a99d5f079c5d269cadd1d408ea62e27","author":{"name":"Daniel McCarney","email":"4b94a04674ad2c69d990e94ab196ac3f8e9e03d4@binaryparadox.net"},"message":"Merge pull request #2009 from letsencrypt/master\n\nMerge master into staging","distinct":false,"url":"https://api.github.com/repos/letsencrypt/boulder/commits/209c74f28a99d5f079c5d269cadd1d408ea62e27"},{"sha":"4df33efb024d7c67825a5fc34e6176eed1749606","author":{"name":"Jacob Hoffman-Andrews","email":"f27a17fc90c00d8c248d8510a1084221738b492b@hoffman-andrews.com"},"message":"Merge master into staging (#2037)\n\n* Split up boulder-config.json (Publisher) (#2008)\r\n\r\n* Split Boulder Config (OCSP Updater) (#2013)\r\n\r\n* notify-mailer/contact-exporter bug fixes & documentation (#2016)\r\n\r\nFor the notify-mailer, this PR fixes a bug with the -end parameter where the default (99999999) would cause a slice index out of range error. This was fixed by setting the -end value to len(m.destinations) in run when it is too large.\r\n\r\nFor both the notify-mailer and the contact-exporter a bug was fixed that was comparing the required flags against nil when the defaults were set to a non-nil pointer to \"\". This resulted in confusing errors when the mandatory arguments were not provided.\r\n\r\nThis PR also adds a separated config example for both the notify-mailer and the contact-exporter into test/config and test/config-next respectively.\r\n\r\nFinally a documentation string was added to describe the overall design & usage of both tools, including example invocations.\r\n\r\n* Switch to a real docker tag (#2015)\r\n\r\nSwitches from using `boulder-tools:latest` to using `boulder-tools:2016-07-05`. Using this tag format going forward we can preserve old versions of the image and not break master tests when we need to update images.\r\n\r\n* Remove spurious log.Info's from rpc-wrappers. (#2023)\r\n\r\n* Remove embedded (anonymous) fields from configs (#2019)\r\n\r\nThis PR removes the use of all anonymous struct fields that were introduced by myself as per my work on splitting up boulder-config (#1962).\r\n\r\nThe root of the bug was related to the loading of the json configuration file into the config struct. The config structs contained several embedded (anonymous) fields. An embedded (anonymous) field in a struct actually results in the flattening of the json structure. This caused json.Unmarshal to look not at the nested level, but at the root level of the json object and hence not find the nested field (i.e. AllowedSigningAlgos).\r\n\r\nSee https://play.golang.org/p/6uVCsEu3Df for a working example.\r\n\r\nThis fixes the reported bug: #2018\r\n\r\n* Registration update optimizations (#2001)\r\n\r\nThis PR adds two optimizations to fix the optimistic lock errors observed in #1986.\r\n\r\nFirst, the WFE now returns early for registration POST's (before invoking the RA and SA) when the POST body is the trivial update (`{\"resource\":\"reg\"}`). This prevents any DB operations from being performed when there is no work to be done.\r\n\r\nSecond, the RA now tracks whether a update actually changes the base registration's `Contact` slice, or `Agreement` string. If the proposed update doesn't change either of these fields then the RA will return early before handing the update to the SA. \r\n\r\nBoth changes save database operations from being performed needlessly and will help avoid the optimistic lock errors we observed when a problematic client was POSTing the trivial update repeatedly in a short period.\r\n\r\nThe fix was verified as follows: I checked out master and artificially introduced lock contention into the SA by adding a 2s sleep into `UpdateRegistration` between fetching the `existingRegModel` to get the `LockCol` value and calling `ssa.dbMap.Update`. With the sleep in place & two certbot clients posting matching registration updates the lock contention error is produced as expected. After checking out the `empty-reg-updates` branch, re-adding the sleep to the SA, and performing the same two client reg updates no error is produced.\r\n\r\n* Split up boulder-config.json (OCSP Responder) (#2017)\r\n\r\n* Update certbot tests (#2027)\r\n\r\nThis PR changes the `certbot` integration tests that are run from the `0.8.0` release to master.\r\n\r\nNote: this is only updating the *tests* that are run. We continue to invoke the `certbot` binary that is installed from jessie-backports as part of the `boulder-tools` image.\r\n\r\nThis fixes #2021\r\n\r\n* Add back version flag for all binaries. (#2034)\r\n\r\nFixes #2020\r\n\r\n* Switch to using SoftHSM in Docker for testing (#1920)\r\n\r\nInstead of reading the CA key from a file on disk into memory and using that for signing in `boulder-ca` this patch adds a new Docker container that runs SoftHSM and pkcs11-proxy in order to hold the key and perform signing operations. The pkcs11-proxy module is used by `boulder-ca` to talk to the SoftHSM container.\r\n\r\nThis exercises (almost) the full pkcs11 path through boulder and will allow testing various HSM related failures in the future as well as simplifying tuning signing performance for benchmarking.\r\n\r\nFixes #703.","distinct":false,"url":"https://api.github.com/repos/letsencrypt/boulder/commits/4df33efb024d7c67825a5fc34e6176eed1749606"},{"sha":"a8ac802f9963b1ab9e42fe67438f941a6c3dd8fb","author":{"name":"Jacob Hoffman-Andrews","email":"f27a17fc90c00d8c248d8510a1084221738b492b@hoffman-andrews.com"},"message":"Merge pull request #2049 from letsencrypt/staging\n\nMerge staging into release","distinct":true,"url":"https://api.github.com/repos/letsencrypt/boulder/commits/a8ac802f9963b1ab9e42fe67438f941a6c3dd8fb"}]}
{"actor":{"display_login":"jsha"}}