{"action":"created","comment":{"url":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/comments/196973085","pull_request_review_id":130623886,"id":196973085,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDE5Njk3MzA4NQ==","diff_hunk":"@@ -475,6 +494,51 @@\n    (utils/subject-key-identifier\n      ca-public-key false)])\n \n+(schema/defn read-compile-masters\n+    \"Returns a list of compile masters from the specified file.\n+     Note that this method is agnostic of the file contents which could either\n+     be node names (FQDNs) or certificate serial numbers so long as they are\n+     organized as one item per line.\n+     Likewise this method could/will be re-used\"\n+    [cm-file :- schema/Str]\n+    (line-seq (io/reader cm-file)))\n+\n+(schema/defn generate-compile-master-serials\n+  \"Given a list of compile master nodes it will create a file containing \n+   serial numbers of their certificates (listed on separate lines).\n+   Compile masters is expected have at least one entry (MoM)\"\n+   [cm-nodes :- [schema/Str]\n+    compile-masters-serials-file :- schema/Str\n+    signeddir :- schema/Str]\n+\n+   ;; TODO: We may want to account for the possibility of compile masters to\n+   ;; be empty (by mistake, accident). In which case this can use the name\n+   ;; of the current node as the MoM as a fallback","path":"src/clj/puppetlabs/puppetserver/certificate_authority.clj","position":83,"original_position":67,"commit_id":"0b9f8effa849709ea437896b948b39a9d68cdb1c","original_commit_id":"4cd57177bd5139828329c1558655abc681ec9633","user":{"login":"justinstoller","id":241423,"node_id":"MDQ6VXNlcjI0MTQyMw==","avatar_url":"https://avatars0.githubusercontent.com/u/241423?v=4","gravatar_id":"","url":"https://api.github.com/users/justinstoller","html_url":"https://github.com/justinstoller","followers_url":"https://api.github.com/users/justinstoller/followers","following_url":"https://api.github.com/users/justinstoller/following{/other_user}","gists_url":"https://api.github.com/users/justinstoller/gists{/gist_id}","starred_url":"https://api.github.com/users/justinstoller/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/justinstoller/subscriptions","organizations_url":"https://api.github.com/users/justinstoller/orgs","repos_url":"https://api.github.com/users/justinstoller/repos","events_url":"https://api.github.com/users/justinstoller/events{/privacy}","received_events_url":"https://api.github.com/users/justinstoller/received_events","type":"User","site_admin":false},"body":"So, I think the custom extension denoting the puppet infra role would be valuable and itself not a lot of work, but it would require coordination across our products and making a policy about how to create certs for puppet infra, which we don't have currently and have always wavered on. That level of decisions and coordinating probably make it a significantly harder thing to implement then this approach.","created_at":"2018-06-20T23:32:42Z","updated_at":"2018-06-20T23:32:42Z","html_url":"https://github.com/puppetlabs/puppetserver/pull/1709#discussion_r196973085","pull_request_url":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/1709","author_association":"MEMBER","_links":{"self":{"href":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/comments/196973085"},"html":{"href":"https://github.com/puppetlabs/puppetserver/pull/1709#discussion_r196973085"},"pull_request":{"href":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/1709"}},"in_reply_to_id":196544544},"pull_request":{"url":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/1709","id":194402713,"node_id":"MDExOlB1bGxSZXF1ZXN0MTk0NDAyNzEz","html_url":"https://github.com/puppetlabs/puppetserver/pull/1709","diff_url":"https://github.com/puppetlabs/puppetserver/pull/1709.diff","patch_url":"https://github.com/puppetlabs/puppetserver/pull/1709.patch","issue_url":"https://api.github.com/repos/puppetlabs/puppetserver/issues/1709","number":1709,"state":"open","locked":false,"title":"(SERVER-2231) Publish infra-CRL - preliminary changes for early review","user":{"login":"jsane","id":25072698,"node_id":"MDQ6VXNlcjI1MDcyNjk4","avatar_url":"https://avatars2.githubusercontent.com/u/25072698?v=4","gravatar_id":"","url":"https://api.github.com/users/jsane","html_url":"https://github.com/jsane","followers_url":"https://api.github.com/users/jsane/followers","following_url":"https://api.github.com/users/jsane/following{/other_user}","gists_url":"https://api.github.com/users/jsane/gists{/gist_id}","starred_url":"https://api.github.com/users/jsane/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jsane/subscriptions","organizations_url":"https://api.github.com/users/jsane/orgs","repos_url":"https://api.github.com/users/jsane/repos","events_url":"https://api.github.com/users/jsane/events{/privacy}","received_events_url":"https://api.github.com/users/jsane/received_events","type":"User","site_admin":false},"body":"NOTE - This is not meant to be a pull request. DO NOT MERGE. \r\n\r\nI am just hoping to get an early feedback here around a couple of things and thought it would be easier to get it with some code in place than via/over just documentation or email/hipchat discussions. \r\n\r\n- Design: Does it look reasonable for what it is trying to achieve? The idea is simple - if any of the master certificate is getting revoked we add it to an infra-CRL in addition to the regular/existing crl. For that we maintain a list of all master certificate serial numbers in a file generated during init time. I have avoided use of globals with 'state' being maintained in files. Hopefully there should not be any performance concerns with reading the file with compile master serial numbers during every revocation as they should not be very often and the file would be relatively small. \r\n- Conventions/styling: for some of the names used for functions, config settings etc. if they look odd and not. Placement of the newly introduced methods - if they seem out of place. I have added some comments at places just for review purposes at this stage. Can remove them if they seem rather excessive.\r\n- Opens: I guessed which methods/functions (endpoints used for servicing crls over http/network) that would require changes to return the infra-CRL once AFTER this is actually working and tested adequately. \r\n- Misc: Any Clojure novice-ness in the implementation that may have better alternatives.  And/or any unaccounted for conditions/situations. \r\n\r\nI am yet to add defaults for the newly introduced config settings in puppet (lib/puppet/defaults.rb) which I will be doing soon. I am thinking of maintaining the two new files for maintaining list of compile masters and their certificate serial numbers in the cadir ($ssldir/ca). \r\nThe other thing remaining is the monitoring the list of compile masters and restarting CA anytime that list changes (by sending a sighup to ??? trapperkeeper service).  \r\n\r\nAssuming it is ok to target master branch.\r\n\r\nthanks\r\n","created_at":"2018-06-12T20:45:30Z","updated_at":"2018-06-20T23:32:42Z","closed_at":null,"merged_at":null,"merge_commit_sha":"9cd691b69d20e45cb58ab3e75e8753727e4d3dc9","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/1709/commits","review_comments_url":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/1709/comments","review_comment_url":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/comments{/number}","comments_url":"https://api.github.com/repos/puppetlabs/puppetserver/issues/1709/comments","statuses_url":"https://api.github.com/repos/puppetlabs/puppetserver/statuses/0b9f8effa849709ea437896b948b39a9d68cdb1c","head":{"label":"jsane:task/master/SERVER-2231-Publish_an_infrastructure_only_CRL","ref":"task/master/SERVER-2231-Publish_an_infrastructure_only_CRL","sha":"0b9f8effa849709ea437896b948b39a9d68cdb1c","user":{"login":"jsane","id":25072698,"node_id":"MDQ6VXNlcjI1MDcyNjk4","avatar_url":"https://avatars2.githubusercontent.com/u/25072698?v=4","gravatar_id":"","url":"https://api.github.com/users/jsane","html_url":"https://github.com/jsane","followers_url":"https://api.github.com/users/jsane/followers","following_url":"https://api.github.com/users/jsane/following{/other_user}","gists_url":"https://api.github.com/users/jsane/gists{/gist_id}","starred_url":"https://api.github.com/users/jsane/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jsane/subscriptions","organizations_url":"https://api.github.com/users/jsane/orgs","repos_url":"https://api.github.com/users/jsane/repos","events_url":"https://api.github.com/users/jsane/events{/privacy}","received_events_url":"https://api.github.com/users/jsane/received_events","type":"User","site_admin":false},"repo":{"id":91011794,"node_id":"MDEwOlJlcG9zaXRvcnk5MTAxMTc5NA==","name":"puppetserver","full_name":"jsane/puppetserver","owner":{"login":"jsane","id":25072698,"node_id":"MDQ6VXNlcjI1MDcyNjk4","avatar_url":"https://avatars2.githubusercontent.com/u/25072698?v=4","gravatar_id":"","url":"https://api.github.com/users/jsane","html_url":"https://github.com/jsane","followers_url":"https://api.github.com/users/jsane/followers","following_url":"https://api.github.com/users/jsane/following{/other_user}","gists_url":"https://api.github.com/users/jsane/gists{/gist_id}","starred_url":"https://api.github.com/users/jsane/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jsane/subscriptions","organizations_url":"https://api.github.com/users/jsane/orgs","repos_url":"https://api.github.com/users/jsane/repos","events_url":"https://api.github.com/users/jsane/events{/privacy}","received_events_url":"https://api.github.com/users/jsane/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/jsane/puppetserver","description":"Server automation framework and application","fork":true,"url":"https://api.github.com/repos/jsane/puppetserver","forks_url":"https://api.github.com/repos/jsane/puppetserver/forks","keys_url":"https://api.github.com/repos/jsane/puppetserver/keys{/key_id}","collaborators_url":"https://api.github.com/repos/jsane/puppetserver/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/jsane/puppetserver/teams","hooks_url":"https://api.github.com/repos/jsane/puppetserver/hooks","issue_events_url":"https://api.github.com/repos/jsane/puppetserver/issues/events{/number}","events_url":"https://api.github.com/repos/jsane/puppetserver/events","assignees_url":"https://api.github.com/repos/jsane/puppetserver/assignees{/user}","branches_url":"https://api.github.com/repos/jsane/puppetserver/branches{/branch}","tags_url":"https://api.github.com/repos/jsane/puppetserver/tags","blobs_url":"https://api.github.com/repos/jsane/puppetserver/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/jsane/puppetserver/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/jsane/puppetserver/git/refs{/sha}","trees_url":"https://api.github.com/repos/jsane/puppetserver/git/trees{/sha}","statuses_url":"https://api.github.com/repos/jsane/puppetserver/statuses/{sha}","languages_url":"https://api.github.com/repos/jsane/puppetserver/languages","stargazers_url":"https://api.github.com/repos/jsane/puppetserver/stargazers","contributors_url":"https://api.github.com/repos/jsane/puppetserver/contributors","subscribers_url":"https://api.github.com/repos/jsane/puppetserver/subscribers","subscription_url":"https://api.github.com/repos/jsane/puppetserver/subscription","commits_url":"https://api.github.com/repos/jsane/puppetserver/commits{/sha}","git_commits_url":"https://api.github.com/repos/jsane/puppetserver/git/commits{/sha}","comments_url":"https://api.github.com/repos/jsane/puppetserver/comments{/number}","issue_comment_url":"https://api.github.com/repos/jsane/puppetserver/issues/comments{/number}","contents_url":"https://api.github.com/repos/jsane/puppetserver/contents/{+path}","compare_url":"https://api.github.com/repos/jsane/puppetserver/compare/{base}...{head}","merges_url":"https://api.github.com/repos/jsane/puppetserver/merges","archive_url":"https://api.github.com/repos/jsane/puppetserver/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/jsane/puppetserver/downloads","issues_url":"https://api.github.com/repos/jsane/puppetserver/issues{/number}","pulls_url":"https://api.github.com/repos/jsane/puppetserver/pulls{/number}","milestones_url":"https://api.github.com/repos/jsane/puppetserver/milestones{/number}","notifications_url":"https://api.github.com/repos/jsane/puppetserver/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/jsane/puppetserver/labels{/name}","releases_url":"https://api.github.com/repos/jsane/puppetserver/releases{/id}","deployments_url":"https://api.github.com/repos/jsane/puppetserver/deployments","created_at":"2017-05-11T18:35:06Z","updated_at":"2017-05-11T18:35:08Z","pushed_at":"2018-06-20T21:11:01Z","git_url":"git://github.com/jsane/puppetserver.git","ssh_url":"git@github.com:jsane/puppetserver.git","clone_url":"https://github.com/jsane/puppetserver.git","svn_url":"https://github.com/jsane/puppetserver","homepage":"https://tickets.puppetlabs.com/browse/SERVER","size":5765,"stargazers_count":0,"watchers_count":0,"language":"Clojure","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0","node_id":"MDc6TGljZW5zZTI="},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"puppetlabs:master","ref":"master","sha":"dc4f20a6c13bf3241ced1beec7dc6628625539a9","user":{"login":"puppetlabs","id":234268,"node_id":"MDEyOk9yZ2FuaXphdGlvbjIzNDI2OA==","avatar_url":"https://avatars0.githubusercontent.com/u/234268?v=4","gravatar_id":"","url":"https://api.github.com/users/puppetlabs","html_url":"https://github.com/puppetlabs","followers_url":"https://api.github.com/users/puppetlabs/followers","following_url":"https://api.github.com/users/puppetlabs/following{/other_user}","gists_url":"https://api.github.com/users/puppetlabs/gists{/gist_id}","starred_url":"https://api.github.com/users/puppetlabs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/puppetlabs/subscriptions","organizations_url":"https://api.github.com/users/puppetlabs/orgs","repos_url":"https://api.github.com/users/puppetlabs/repos","events_url":"https://api.github.com/users/puppetlabs/events{/privacy}","received_events_url":"https://api.github.com/users/puppetlabs/received_events","type":"Organization","site_admin":false},"repo":{"id":19546488,"node_id":"MDEwOlJlcG9zaXRvcnkxOTU0NjQ4OA==","name":"puppetserver","full_name":"puppetlabs/puppetserver","owner":{"login":"puppetlabs","id":234268,"node_id":"MDEyOk9yZ2FuaXphdGlvbjIzNDI2OA==","avatar_url":"https://avatars0.githubusercontent.com/u/234268?v=4","gravatar_id":"","url":"https://api.github.com/users/puppetlabs","html_url":"https://github.com/puppetlabs","followers_url":"https://api.github.com/users/puppetlabs/followers","following_url":"https://api.github.com/users/puppetlabs/following{/other_user}","gists_url":"https://api.github.com/users/puppetlabs/gists{/gist_id}","starred_url":"https://api.github.com/users/puppetlabs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/puppetlabs/subscriptions","organizations_url":"https://api.github.com/users/puppetlabs/orgs","repos_url":"https://api.github.com/users/puppetlabs/repos","events_url":"https://api.github.com/users/puppetlabs/events{/privacy}","received_events_url":"https://api.github.com/users/puppetlabs/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/puppetlabs/puppetserver","description":"Server automation framework and application","fork":false,"url":"https://api.github.com/repos/puppetlabs/puppetserver","forks_url":"https://api.github.com/repos/puppetlabs/puppetserver/forks","keys_url":"https://api.github.com/repos/puppetlabs/puppetserver/keys{/key_id}","collaborators_url":"https://api.github.com/repos/puppetlabs/puppetserver/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/puppetlabs/puppetserver/teams","hooks_url":"https://api.github.com/repos/puppetlabs/puppetserver/hooks","issue_events_url":"https://api.github.com/repos/puppetlabs/puppetserver/issues/events{/number}","events_url":"https://api.github.com/repos/puppetlabs/puppetserver/events","assignees_url":"https://api.github.com/repos/puppetlabs/puppetserver/assignees{/user}","branches_url":"https://api.github.com/repos/puppetlabs/puppetserver/branches{/branch}","tags_url":"https://api.github.com/repos/puppetlabs/puppetserver/tags","blobs_url":"https://api.github.com/repos/puppetlabs/puppetserver/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/puppetlabs/puppetserver/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/puppetlabs/puppetserver/git/refs{/sha}","trees_url":"https://api.github.com/repos/puppetlabs/puppetserver/git/trees{/sha}","statuses_url":"https://api.github.com/repos/puppetlabs/puppetserver/statuses/{sha}","languages_url":"https://api.github.com/repos/puppetlabs/puppetserver/languages","stargazers_url":"https://api.github.com/repos/puppetlabs/puppetserver/stargazers","contributors_url":"https://api.github.com/repos/puppetlabs/puppetserver/contributors","subscribers_url":"https://api.github.com/repos/puppetlabs/puppetserver/subscribers","subscription_url":"https://api.github.com/repos/puppetlabs/puppetserver/subscription","commits_url":"https://api.github.com/repos/puppetlabs/puppetserver/commits{/sha}","git_commits_url":"https://api.github.com/repos/puppetlabs/puppetserver/git/commits{/sha}","comments_url":"https://api.github.com/repos/puppetlabs/puppetserver/comments{/number}","issue_comment_url":"https://api.github.com/repos/puppetlabs/puppetserver/issues/comments{/number}","contents_url":"https://api.github.com/repos/puppetlabs/puppetserver/contents/{+path}","compare_url":"https://api.github.com/repos/puppetlabs/puppetserver/compare/{base}...{head}","merges_url":"https://api.github.com/repos/puppetlabs/puppetserver/merges","archive_url":"https://api.github.com/repos/puppetlabs/puppetserver/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/puppetlabs/puppetserver/downloads","issues_url":"https://api.github.com/repos/puppetlabs/puppetserver/issues{/number}","pulls_url":"https://api.github.com/repos/puppetlabs/puppetserver/pulls{/number}","milestones_url":"https://api.github.com/repos/puppetlabs/puppetserver/milestones{/number}","notifications_url":"https://api.github.com/repos/puppetlabs/puppetserver/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/puppetlabs/puppetserver/labels{/name}","releases_url":"https://api.github.com/repos/puppetlabs/puppetserver/releases{/id}","deployments_url":"https://api.github.com/repos/puppetlabs/puppetserver/deployments","created_at":"2014-05-07T19:00:24Z","updated_at":"2018-06-19T17:46:30Z","pushed_at":"2018-06-20T21:11:02Z","git_url":"git://github.com/puppetlabs/puppetserver.git","ssh_url":"git@github.com:puppetlabs/puppetserver.git","clone_url":"https://github.com/puppetlabs/puppetserver.git","svn_url":"https://github.com/puppetlabs/puppetserver","homepage":"https://tickets.puppetlabs.com/browse/SERVER","size":5833,"stargazers_count":178,"watchers_count":178,"language":"Clojure","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":138,"mirror_url":null,"archived":false,"open_issues_count":7,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0","node_id":"MDc6TGljZW5zZTI="},"forks":138,"open_issues":7,"watchers":178,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/1709"},"html":{"href":"https://github.com/puppetlabs/puppetserver/pull/1709"},"issue":{"href":"https://api.github.com/repos/puppetlabs/puppetserver/issues/1709"},"comments":{"href":"https://api.github.com/repos/puppetlabs/puppetserver/issues/1709/comments"},"review_comments":{"href":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/1709/comments"},"review_comment":{"href":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/1709/commits"},"statuses":{"href":"https://api.github.com/repos/puppetlabs/puppetserver/statuses/0b9f8effa849709ea437896b948b39a9d68cdb1c"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"justinstoller"}}