{"push_id":2600323907,"size":9,"distinct_size":9,"ref":"refs/heads/master","head":"dd0e0249e5d716753c902dfab6cb3ab54106e98e","before":"f7dd91534d638da75fee89386be3db3742bca45d","commits":[{"sha":"084819b011aec4cb50e03b2fe719acf5985b1186","author":{"name":"Daniel McCarney","email":"3d0f3b9ddcacec30c4008c5e030e6c13a478cb4f@binaryparadox.net"},"message":"VA: CAA tag identifiers are case insensitive. (#3722)\n\nPer RFC 6844 Section 5.1 the matching of CAA tag identifiers (e.g.\r\n\"Issue\") is case insensitive. This commit updates the CAA tag processing\r\nto be case insensitive as required by the RFC.\r\n\r\nTo exercise the fix this commit adds a test case to the `caaMockDNS`\r\n`LookupCAA` implementation for a hostname (`mixedcase.com`) that has\r\na CAA record with a mixed case `Issue` tag. Prior to the fix from this\r\nbranch being included in `va/caa.go` the test fails:\r\n```\r\n    --- FAIL: TestCAAChecking/Bad_(Reserved,_Mixed_case_Issue) (0.00s)\r\n          caa_test.go:292: checkCAARecords validity mismatch for\r\n          mixedcase.com: got true expected false\r\n```\r\n\r\nWith the fix applied, the test passes.","distinct":true,"url":"https://api.github.com/repos/fszlin/boulder/commits/084819b011aec4cb50e03b2fe719acf5985b1186"},{"sha":"3df93d223047da8ac9c3a0273b996259ac093c09","author":{"name":"Daniel McCarney","email":"3d0f3b9ddcacec30c4008c5e030e6c13a478cb4f@binaryparadox.net"},"message":"VA: Log observed CAA records. (#3726)\n\nThis is a quick first pass at audit logging the *dns.CAA records in JSON format from within the VA's IsCAAValid function. This will provide more information for post-hoc analysis of CAA decisions.","distinct":true,"url":"https://api.github.com/repos/fszlin/boulder/commits/3df93d223047da8ac9c3a0273b996259ac093c09"},{"sha":"e78a7bdb10a4897bd0636f00f63750afb081412d","author":{"name":"Tom Delmas","email":"64b2b6d12bfe4baae7dad3d018f8cbf6b0e7a044@tdelmas.eu"},"message":"Doc \"Boulder divergences from ACME\": ACME v2 is in production (#3725)\n\nUpdate ACME divergences to reflect that ACME v2 is in production and has 3 divergences from the current RFC.","distinct":true,"url":"https://api.github.com/repos/fszlin/boulder/commits/e78a7bdb10a4897bd0636f00f63750afb081412d"},{"sha":"ef0324727de0200f857caea7317caec26745671d","author":{"name":"Jacob Hoffman-Andrews","email":"64b2b6d12bfe4baae7dad3d018f8cbf6b0e7a044@hoffman-andrews.com"},"message":"Remove exclude for Go 1.10.2 coverage build. (#3728)","distinct":true,"url":"https://api.github.com/repos/fszlin/boulder/commits/ef0324727de0200f857caea7317caec26745671d"},{"sha":"dbcb16543e18e236466b6f4945c1cc09018dd24a","author":{"name":"Jacob Hoffman-Andrews","email":"64b2b6d12bfe4baae7dad3d018f8cbf6b0e7a044@hoffman-andrews.com"},"message":"Start using multiple-IP hostnames for load balancing (#3687)\n\nWe'd like to start using the DNS load balancer in the latest version of gRPC. That means putting all IPs for a service under a single hostname (or using a SRV record, but we're not taking that path). This change adds an sd-test-srv to act as our service discovery DNS service. It returns both Boulder IP addresses for any A lookup ending in \".boulder\". This change also sets up the Docker DNS for our boulder container to defer to sd-test-srv when it doesn't know an answer.\r\n\r\nsd-test-srv doesn't know how to resolve public Internet names like `github.com`. Resolving public names is required for the `godep-restore` test phase, so this change breaks out a copy of the boulder container that is used only for `godep-restore`.\r\n\r\nThis change implements a shim of a DNS resolver for gRPC, so that we can switch to DNS-based load balancing with the currently vendored gRPC, then when we upgrade to the latest gRPC we won't need a simultaneous config update.\r\n\r\nAlso, this change introduces a check at the end of the integration test that each backend received at least one RPC, ensuring that we are not sending all load to a single backend.","distinct":true,"url":"https://api.github.com/repos/fszlin/boulder/commits/dbcb16543e18e236466b6f4945c1cc09018dd24a"},{"sha":"5ad14170fbd64cce64886623428a7a1348525763","author":{"name":"Jacob Hoffman-Andrews","email":"64b2b6d12bfe4baae7dad3d018f8cbf6b0e7a044@hoffman-andrews.com"},"message":"Ignore canceled IsSafeDomain calls. (#3730)\n\nFixes #3681.","distinct":true,"url":"https://api.github.com/repos/fszlin/boulder/commits/5ad14170fbd64cce64886623428a7a1348525763"},{"sha":"2540d59296032f9059c420f1365a00c8a63c80cf","author":{"name":"Joel Sing","email":"4816dabf8db1bc6cac35b3a24cab2ff844b5b0c7@sing.id.au"},"message":"Implement CAA validation-methods checking. (#3716)\n\nWhen performing CAA checking respect the validation-methods parameter (if\r\npresent) and restrict the allowed authorization methods to those specified.\r\nThis allows a domain to restrict authorization methods that can be used with\r\nLet's Encrypt.\r\n\r\nThis is largely based on PR #3003 (by @lukaslihotzki), which was landed and\r\nthen later reverted due to issue #3143. The bug the resulted in the previous\r\ncode being reverted has been addressed (likely inadvertently) by 76973d0f.\r\n\r\nThis implementation also includes integration tests for CAA validation-methods.\r\n\r\nFixes issue #3143.","distinct":true,"url":"https://api.github.com/repos/fszlin/boulder/commits/2540d59296032f9059c420f1365a00c8a63c80cf"},{"sha":"b3f5c0f6e5f19517408025465cfe18ae594bc502","author":{"name":"Jacob Hoffman-Andrews","email":"64b2b6d12bfe4baae7dad3d018f8cbf6b0e7a044@hoffman-andrews.com"},"message":"Speed up goodkey test. (#3733)\n\nThis is one of our slowest unittests, clocking in at 23 seconds in a recent run.\r\nThis was largely due to generating keys. Note that performance is significantly\r\nworse under the race detector.","distinct":true,"url":"https://api.github.com/repos/fszlin/boulder/commits/b3f5c0f6e5f19517408025465cfe18ae594bc502"},{"sha":"dd0e0249e5d716753c902dfab6cb3ab54106e98e","author":{"name":"Kyle Spiers","email":"5f789ce3a7925f2c4f312b401a4f37f0ab84634d@gmail.com"},"message":"core/util: ValidSerial should return false if the serial is not 32 or 36 (#3712)\n\nThe current check always fails because a length can't be simultaneously be both less than 32 and greater than 36.","distinct":true,"url":"https://api.github.com/repos/fszlin/boulder/commits/dd0e0249e5d716753c902dfab6cb3ab54106e98e"}]}
{"actor":{"display_login":"fszlin"}}