{"action":"created","comment":{"url":"https://api.github.com/repos/coreos/coreos-baremetal/pulls/comments/66542892","id":66542892,"diff_hunk":"@@ -0,0 +1,41 @@\n+package tlsutil\n+\n+import (\n+\t\"crypto/tls\"\n+)\n+\n+// TLSInfo prepares tls.Config's from TLS file inputs.\n+type TLSInfo struct {\n+\tCAFile   string\n+\tCertFile string\n+\tKeyFile  string\n+}\n+\n+// ClientConfig returns a tls.Config for client use.\n+func (info *TLSInfo) ClientConfig() (*tls.Config, error) {\n+\tpool, err := NewCertPool([]string{info.CAFile})\n+\tif err != nil {\n+\t\treturn nil, err\n+\t}\n+\n+\treturn &tls.Config{\n+\t\tMinVersion:         tls.VersionTLS12,\n+\t\tInsecureSkipVerify: false,\n+\t\t// CA bundle the client should trust when verifying a server\n+\t\tRootCAs: pool,\n+\t}, nil\n+}\n+\n+// ServerConfig returns a tls.Config for server use.\n+func (info *TLSInfo) ServerConfig() (*tls.Config, error) {","path":"bootcfg/tlsutil/info.go","position":39,"original_position":30,"commit_id":"9e924e3cd1226045931384dc5133d4b64f62f655","original_commit_id":"57d1c28c31cbb820bca739a37f92f47655baefa9","user":{"login":"dghubble","id":2253428,"avatar_url":"https://avatars.githubusercontent.com/u/2253428?v=3","gravatar_id":"","url":"https://api.github.com/users/dghubble","html_url":"https://github.com/dghubble","followers_url":"https://api.github.com/users/dghubble/followers","following_url":"https://api.github.com/users/dghubble/following{/other_user}","gists_url":"https://api.github.com/users/dghubble/gists{/gist_id}","starred_url":"https://api.github.com/users/dghubble/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dghubble/subscriptions","organizations_url":"https://api.github.com/users/dghubble/orgs","repos_url":"https://api.github.com/users/dghubble/repos","events_url":"https://api.github.com/users/dghubble/events{/privacy}","received_events_url":"https://api.github.com/users/dghubble/received_events","type":"User","site_admin":false},"body":"Added","created_at":"2016-06-10T00:01:44Z","updated_at":"2016-06-10T00:01:44Z","html_url":"https://github.com/coreos/coreos-baremetal/pull/231#discussion_r66542892","pull_request_url":"https://api.github.com/repos/coreos/coreos-baremetal/pulls/231","_links":{"self":{"href":"https://api.github.com/repos/coreos/coreos-baremetal/pulls/comments/66542892"},"html":{"href":"https://github.com/coreos/coreos-baremetal/pull/231#discussion_r66542892"},"pull_request":{"href":"https://api.github.com/repos/coreos/coreos-baremetal/pulls/231"}}},"pull_request":{"url":"https://api.github.com/repos/coreos/coreos-baremetal/pulls/231","id":73091410,"html_url":"https://github.com/coreos/coreos-baremetal/pull/231","diff_url":"https://github.com/coreos/coreos-baremetal/pull/231.diff","patch_url":"https://github.com/coreos/coreos-baremetal/pull/231.patch","issue_url":"https://api.github.com/repos/coreos/coreos-baremetal/issues/231","number":231,"state":"open","locked":false,"title":"Require gRPC TLS transport security, server verification, client authentication","user":{"login":"dghubble","id":2253428,"avatar_url":"https://avatars.githubusercontent.com/u/2253428?v=3","gravatar_id":"","url":"https://api.github.com/users/dghubble","html_url":"https://github.com/dghubble","followers_url":"https://api.github.com/users/dghubble/followers","following_url":"https://api.github.com/users/dghubble/following{/other_user}","gists_url":"https://api.github.com/users/dghubble/gists{/gist_id}","starred_url":"https://api.github.com/users/dghubble/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dghubble/subscriptions","organizations_url":"https://api.github.com/users/dghubble/orgs","repos_url":"https://api.github.com/users/dghubble/repos","events_url":"https://api.github.com/users/dghubble/events{/privacy}","received_events_url":"https://api.github.com/users/dghubble/received_events","type":"User","site_admin":false},"body":"* Add gRPC client-to-server TLS transport security and server verification (prevent MITM)\r\n    * A CA certificate (e.g. ca.crt) should be used to sign a server certificate (server.crt for a private key server.key)\r\n    * gRPC API server requires a server certificate and key to be enabled (passed via -cert-file and -key-file)\r\n    * gRPC client bootcmd tool must verify the server identity using a known CA (passed to bootcmd via -ca-file)\r\n* Example client and server commands/flags with rkt and Docker\r\n* Require TLS client auth for gRPC API\r\n    * gRPC API server requires a CA certificate to authenticate clients (passed via -ca-file)\r\n    * gRPC clients must authenticate with a client certificate and key (passed via -cert-file and -key-file)\r\n* Add examples/etc/bootcfg/cert-gen to create fake (ca, server, client) credentials for running the gRPC API examples locally. \r\n\r\nrel #140 cc @gtank @brianredbeard ","created_at":"2016-06-08T17:54:32Z","updated_at":"2016-06-10T00:01:44Z","closed_at":null,"merged_at":null,"merge_commit_sha":"19c0c1b6812f98bac7cd7952f06105614d2ae68f","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/coreos/coreos-baremetal/pulls/231/commits","review_comments_url":"https://api.github.com/repos/coreos/coreos-baremetal/pulls/231/comments","review_comment_url":"https://api.github.com/repos/coreos/coreos-baremetal/pulls/comments{/number}","comments_url":"https://api.github.com/repos/coreos/coreos-baremetal/issues/231/comments","statuses_url":"https://api.github.com/repos/coreos/coreos-baremetal/statuses/9e924e3cd1226045931384dc5133d4b64f62f655","head":{"label":"coreos:grpc-tls","ref":"grpc-tls","sha":"9e924e3cd1226045931384dc5133d4b64f62f655","user":{"login":"coreos","id":3730757,"avatar_url":"https://avatars.githubusercontent.com/u/3730757?v=3","gravatar_id":"","url":"https://api.github.com/users/coreos","html_url":"https://github.com/coreos","followers_url":"https://api.github.com/users/coreos/followers","following_url":"https://api.github.com/users/coreos/following{/other_user}","gists_url":"https://api.github.com/users/coreos/gists{/gist_id}","starred_url":"https://api.github.com/users/coreos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/coreos/subscriptions","organizations_url":"https://api.github.com/users/coreos/orgs","repos_url":"https://api.github.com/users/coreos/repos","events_url":"https://api.github.com/users/coreos/events{/privacy}","received_events_url":"https://api.github.com/users/coreos/received_events","type":"Organization","site_admin":false},"repo":{"id":48007294,"name":"coreos-baremetal","full_name":"coreos/coreos-baremetal","owner":{"login":"coreos","id":3730757,"avatar_url":"https://avatars.githubusercontent.com/u/3730757?v=3","gravatar_id":"","url":"https://api.github.com/users/coreos","html_url":"https://github.com/coreos","followers_url":"https://api.github.com/users/coreos/followers","following_url":"https://api.github.com/users/coreos/following{/other_user}","gists_url":"https://api.github.com/users/coreos/gists{/gist_id}","starred_url":"https://api.github.com/users/coreos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/coreos/subscriptions","organizations_url":"https://api.github.com/users/coreos/orgs","repos_url":"https://api.github.com/users/coreos/repos","events_url":"https://api.github.com/users/coreos/events{/privacy}","received_events_url":"https://api.github.com/users/coreos/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/coreos/coreos-baremetal","description":"Network boot and provision CoreOS Clusters (etcd, Kubernetes, self-hosted Kubernetes, Torus, and more)","fork":false,"url":"https://api.github.com/repos/coreos/coreos-baremetal","forks_url":"https://api.github.com/repos/coreos/coreos-baremetal/forks","keys_url":"https://api.github.com/repos/coreos/coreos-baremetal/keys{/key_id}","collaborators_url":"https://api.github.com/repos/coreos/coreos-baremetal/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/coreos/coreos-baremetal/teams","hooks_url":"https://api.github.com/repos/coreos/coreos-baremetal/hooks","issue_events_url":"https://api.github.com/repos/coreos/coreos-baremetal/issues/events{/number}","events_url":"https://api.github.com/repos/coreos/coreos-baremetal/events","assignees_url":"https://api.github.com/repos/coreos/coreos-baremetal/assignees{/user}","branches_url":"https://api.github.com/repos/coreos/coreos-baremetal/branches{/branch}","tags_url":"https://api.github.com/repos/coreos/coreos-baremetal/tags","blobs_url":"https://api.github.com/repos/coreos/coreos-baremetal/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/coreos/coreos-baremetal/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/coreos/coreos-baremetal/git/refs{/sha}","trees_url":"https://api.github.com/repos/coreos/coreos-baremetal/git/trees{/sha}","statuses_url":"https://api.github.com/repos/coreos/coreos-baremetal/statuses/{sha}","languages_url":"https://api.github.com/repos/coreos/coreos-baremetal/languages","stargazers_url":"https://api.github.com/repos/coreos/coreos-baremetal/stargazers","contributors_url":"https://api.github.com/repos/coreos/coreos-baremetal/contributors","subscribers_url":"https://api.github.com/repos/coreos/coreos-baremetal/subscribers","subscription_url":"https://api.github.com/repos/coreos/coreos-baremetal/subscription","commits_url":"https://api.github.com/repos/coreos/coreos-baremetal/commits{/sha}","git_commits_url":"https://api.github.com/repos/coreos/coreos-baremetal/git/commits{/sha}","comments_url":"https://api.github.com/repos/coreos/coreos-baremetal/comments{/number}","issue_comment_url":"https://api.github.com/repos/coreos/coreos-baremetal/issues/comments{/number}","contents_url":"https://api.github.com/repos/coreos/coreos-baremetal/contents/{+path}","compare_url":"https://api.github.com/repos/coreos/coreos-baremetal/compare/{base}...{head}","merges_url":"https://api.github.com/repos/coreos/coreos-baremetal/merges","archive_url":"https://api.github.com/repos/coreos/coreos-baremetal/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/coreos/coreos-baremetal/downloads","issues_url":"https://api.github.com/repos/coreos/coreos-baremetal/issues{/number}","pulls_url":"https://api.github.com/repos/coreos/coreos-baremetal/pulls{/number}","milestones_url":"https://api.github.com/repos/coreos/coreos-baremetal/milestones{/number}","notifications_url":"https://api.github.com/repos/coreos/coreos-baremetal/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/coreos/coreos-baremetal/labels{/name}","releases_url":"https://api.github.com/repos/coreos/coreos-baremetal/releases{/id}","deployments_url":"https://api.github.com/repos/coreos/coreos-baremetal/deployments","created_at":"2015-12-14T23:23:12Z","updated_at":"2016-06-09T18:42:26Z","pushed_at":"2016-06-09T23:57:47Z","git_url":"git://github.com/coreos/coreos-baremetal.git","ssh_url":"git@github.com:coreos/coreos-baremetal.git","clone_url":"https://github.com/coreos/coreos-baremetal.git","svn_url":"https://github.com/coreos/coreos-baremetal","homepage":"","size":13512,"stargazers_count":99,"watchers_count":99,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":22,"mirror_url":null,"open_issues_count":35,"forks":22,"open_issues":35,"watchers":99,"default_branch":"master"}},"base":{"label":"coreos:master","ref":"master","sha":"84e0272f10b97d33471ed67e4ec63057ef3d46a5","user":{"login":"coreos","id":3730757,"avatar_url":"https://avatars.githubusercontent.com/u/3730757?v=3","gravatar_id":"","url":"https://api.github.com/users/coreos","html_url":"https://github.com/coreos","followers_url":"https://api.github.com/users/coreos/followers","following_url":"https://api.github.com/users/coreos/following{/other_user}","gists_url":"https://api.github.com/users/coreos/gists{/gist_id}","starred_url":"https://api.github.com/users/coreos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/coreos/subscriptions","organizations_url":"https://api.github.com/users/coreos/orgs","repos_url":"https://api.github.com/users/coreos/repos","events_url":"https://api.github.com/users/coreos/events{/privacy}","received_events_url":"https://api.github.com/users/coreos/received_events","type":"Organization","site_admin":false},"repo":{"id":48007294,"name":"coreos-baremetal","full_name":"coreos/coreos-baremetal","owner":{"login":"coreos","id":3730757,"avatar_url":"https://avatars.githubusercontent.com/u/3730757?v=3","gravatar_id":"","url":"https://api.github.com/users/coreos","html_url":"https://github.com/coreos","followers_url":"https://api.github.com/users/coreos/followers","following_url":"https://api.github.com/users/coreos/following{/other_user}","gists_url":"https://api.github.com/users/coreos/gists{/gist_id}","starred_url":"https://api.github.com/users/coreos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/coreos/subscriptions","organizations_url":"https://api.github.com/users/coreos/orgs","repos_url":"https://api.github.com/users/coreos/repos","events_url":"https://api.github.com/users/coreos/events{/privacy}","received_events_url":"https://api.github.com/users/coreos/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/coreos/coreos-baremetal","description":"Network boot and provision CoreOS Clusters (etcd, Kubernetes, self-hosted Kubernetes, Torus, and more)","fork":false,"url":"https://api.github.com/repos/coreos/coreos-baremetal","forks_url":"https://api.github.com/repos/coreos/coreos-baremetal/forks","keys_url":"https://api.github.com/repos/coreos/coreos-baremetal/keys{/key_id}","collaborators_url":"https://api.github.com/repos/coreos/coreos-baremetal/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/coreos/coreos-baremetal/teams","hooks_url":"https://api.github.com/repos/coreos/coreos-baremetal/hooks","issue_events_url":"https://api.github.com/repos/coreos/coreos-baremetal/issues/events{/number}","events_url":"https://api.github.com/repos/coreos/coreos-baremetal/events","assignees_url":"https://api.github.com/repos/coreos/coreos-baremetal/assignees{/user}","branches_url":"https://api.github.com/repos/coreos/coreos-baremetal/branches{/branch}","tags_url":"https://api.github.com/repos/coreos/coreos-baremetal/tags","blobs_url":"https://api.github.com/repos/coreos/coreos-baremetal/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/coreos/coreos-baremetal/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/coreos/coreos-baremetal/git/refs{/sha}","trees_url":"https://api.github.com/repos/coreos/coreos-baremetal/git/trees{/sha}","statuses_url":"https://api.github.com/repos/coreos/coreos-baremetal/statuses/{sha}","languages_url":"https://api.github.com/repos/coreos/coreos-baremetal/languages","stargazers_url":"https://api.github.com/repos/coreos/coreos-baremetal/stargazers","contributors_url":"https://api.github.com/repos/coreos/coreos-baremetal/contributors","subscribers_url":"https://api.github.com/repos/coreos/coreos-baremetal/subscribers","subscription_url":"https://api.github.com/repos/coreos/coreos-baremetal/subscription","commits_url":"https://api.github.com/repos/coreos/coreos-baremetal/commits{/sha}","git_commits_url":"https://api.github.com/repos/coreos/coreos-baremetal/git/commits{/sha}","comments_url":"https://api.github.com/repos/coreos/coreos-baremetal/comments{/number}","issue_comment_url":"https://api.github.com/repos/coreos/coreos-baremetal/issues/comments{/number}","contents_url":"https://api.github.com/repos/coreos/coreos-baremetal/contents/{+path}","compare_url":"https://api.github.com/repos/coreos/coreos-baremetal/compare/{base}...{head}","merges_url":"https://api.github.com/repos/coreos/coreos-baremetal/merges","archive_url":"https://api.github.com/repos/coreos/coreos-baremetal/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/coreos/coreos-baremetal/downloads","issues_url":"https://api.github.com/repos/coreos/coreos-baremetal/issues{/number}","pulls_url":"https://api.github.com/repos/coreos/coreos-baremetal/pulls{/number}","milestones_url":"https://api.github.com/repos/coreos/coreos-baremetal/milestones{/number}","notifications_url":"https://api.github.com/repos/coreos/coreos-baremetal/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/coreos/coreos-baremetal/labels{/name}","releases_url":"https://api.github.com/repos/coreos/coreos-baremetal/releases{/id}","deployments_url":"https://api.github.com/repos/coreos/coreos-baremetal/deployments","created_at":"2015-12-14T23:23:12Z","updated_at":"2016-06-09T18:42:26Z","pushed_at":"2016-06-09T23:57:47Z","git_url":"git://github.com/coreos/coreos-baremetal.git","ssh_url":"git@github.com:coreos/coreos-baremetal.git","clone_url":"https://github.com/coreos/coreos-baremetal.git","svn_url":"https://github.com/coreos/coreos-baremetal","homepage":"","size":13512,"stargazers_count":99,"watchers_count":99,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":22,"mirror_url":null,"open_issues_count":35,"forks":22,"open_issues":35,"watchers":99,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/coreos/coreos-baremetal/pulls/231"},"html":{"href":"https://github.com/coreos/coreos-baremetal/pull/231"},"issue":{"href":"https://api.github.com/repos/coreos/coreos-baremetal/issues/231"},"comments":{"href":"https://api.github.com/repos/coreos/coreos-baremetal/issues/231/comments"},"review_comments":{"href":"https://api.github.com/repos/coreos/coreos-baremetal/pulls/231/comments"},"review_comment":{"href":"https://api.github.com/repos/coreos/coreos-baremetal/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/coreos/coreos-baremetal/pulls/231/commits"},"statuses":{"href":"https://api.github.com/repos/coreos/coreos-baremetal/statuses/9e924e3cd1226045931384dc5133d4b64f62f655"}}}}
{"actor":{"display_login":"dghubble"}}