{"action":"created","comment":{"url":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/comments/199233873","pull_request_review_id":133319016,"id":199233873,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDE5OTIzMzg3Mw==","diff_hunk":"@@ -349,3 +350,54 @@\n                          :else (do\n                                  (Thread/sleep 500)\n                                  (recur (dec times)))))))))))\n+\n+\n+\n+(deftest ^:integration revoke-compile-master-test\n+  (testing \"Revoking compile master certificate\"\n+    (logutils/with-test-logging\n+      (bootstrap/with-puppetserver-running-with-mock-jrubies\n+       \"JRuby mocking is safe here because all of the requests are to the CA\n+       endpoints, which are implemented in Clojure.\"\n+        app\n+        ;; Q: Does one need to make up other config params like for eg. infra-crl-path\n+        ;; or can we assume anything unspecified will exist with appropriate defaults\n+        ;; Would the below override whatever defaults?\n+        {:certificate-authority {:compile-masters [\"dummy-compile-master\"]}}\n+        (testing \"should update infrastructure CRL\"\n+          (let [ca-cert (bootstrap/get-ca-cert-for-running-server)\n+                subject \"dummy-compile-master\"\n+                ;; In one of the other unit tests I noticed the localhost cert is\n+                ;; being revoked. If that does not affect things we could do that instead of \n+                ;; creating a new one. But wondering it actually may have impact on other \n+                ;; tests since this is integration\n+                cm-cert (bootstrap/get-cert-signed-by-ca-for-running-server\n+                             ca-cert\n+                             subject)\n+                 ;; TODO - Extract serial number of abvoe cert. Is there an easy way\n+                 ;; to do it here or can we make assumption on the expected serial number\n+                 ;;\n+\n+                 ;; Q: Do we need to do something to explicitly moved the certificate\n+                 ;; to CA's signed folder","path":"test/integration/puppetlabs/services/certificate_authority/certificate_authority_int_test.clj","position":41,"original_position":41,"commit_id":"5c88aa67c17a71d8acceffcd07e09c75b347b9b1","original_commit_id":"5c88aa67c17a71d8acceffcd07e09c75b347b9b1","user":{"login":"justinstoller","id":241423,"node_id":"MDQ6VXNlcjI0MTQyMw==","avatar_url":"https://avatars0.githubusercontent.com/u/241423?v=4","gravatar_id":"","url":"https://api.github.com/users/justinstoller","html_url":"https://github.com/justinstoller","followers_url":"https://api.github.com/users/justinstoller/followers","following_url":"https://api.github.com/users/justinstoller/following{/other_user}","gists_url":"https://api.github.com/users/justinstoller/gists{/gist_id}","starred_url":"https://api.github.com/users/justinstoller/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/justinstoller/subscriptions","organizations_url":"https://api.github.com/users/justinstoller/orgs","repos_url":"https://api.github.com/users/justinstoller/repos","events_url":"https://api.github.com/users/justinstoller/events{/privacy}","received_events_url":"https://api.github.com/users/justinstoller/received_events","type":"User","site_admin":false},"body":"The CA writes a copy of the cert out to the signed dir when it signs it.","created_at":"2018-06-29T17:47:56Z","updated_at":"2018-06-29T17:47:56Z","html_url":"https://github.com/puppetlabs/puppetserver/pull/1709#discussion_r199233873","pull_request_url":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/1709","author_association":"MEMBER","_links":{"self":{"href":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/comments/199233873"},"html":{"href":"https://github.com/puppetlabs/puppetserver/pull/1709#discussion_r199233873"},"pull_request":{"href":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/1709"}}},"pull_request":{"url":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/1709","id":194402713,"node_id":"MDExOlB1bGxSZXF1ZXN0MTk0NDAyNzEz","html_url":"https://github.com/puppetlabs/puppetserver/pull/1709","diff_url":"https://github.com/puppetlabs/puppetserver/pull/1709.diff","patch_url":"https://github.com/puppetlabs/puppetserver/pull/1709.patch","issue_url":"https://api.github.com/repos/puppetlabs/puppetserver/issues/1709","number":1709,"state":"open","locked":false,"title":"(SERVER-2231) Publish infra-CRL - preliminary changes for early review","user":{"login":"jsane","id":25072698,"node_id":"MDQ6VXNlcjI1MDcyNjk4","avatar_url":"https://avatars2.githubusercontent.com/u/25072698?v=4","gravatar_id":"","url":"https://api.github.com/users/jsane","html_url":"https://github.com/jsane","followers_url":"https://api.github.com/users/jsane/followers","following_url":"https://api.github.com/users/jsane/following{/other_user}","gists_url":"https://api.github.com/users/jsane/gists{/gist_id}","starred_url":"https://api.github.com/users/jsane/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jsane/subscriptions","organizations_url":"https://api.github.com/users/jsane/orgs","repos_url":"https://api.github.com/users/jsane/repos","events_url":"https://api.github.com/users/jsane/events{/privacy}","received_events_url":"https://api.github.com/users/jsane/received_events","type":"User","site_admin":false},"body":"NOTE - This is not meant to be a pull request. DO NOT MERGE. \r\n\r\nI am just hoping to get an early feedback here around a couple of things and thought it would be easier to get it with some code in place than via/over just documentation or email/hipchat discussions. \r\n\r\n- Design: Does it look reasonable for what it is trying to achieve? The idea is simple - if any of the master certificate is getting revoked we add it to an infra-CRL in addition to the regular/existing crl. For that we maintain a list of all master certificate serial numbers in a file generated during init time. I have avoided use of globals with 'state' being maintained in files. Hopefully there should not be any performance concerns with reading the file with compile master serial numbers during every revocation as they should not be very often and the file would be relatively small. \r\n- Conventions/styling: for some of the names used for functions, config settings etc. if they look odd and not. Placement of the newly introduced methods - if they seem out of place. I have added some comments at places just for review purposes at this stage. Can remove them if they seem rather excessive.\r\n- Opens: I guessed which methods/functions (endpoints used for servicing crls over http/network) that would require changes to return the infra-CRL once AFTER this is actually working and tested adequately. \r\n- Misc: Any Clojure novice-ness in the implementation that may have better alternatives.  And/or any unaccounted for conditions/situations. \r\n\r\nI am yet to add defaults for the newly introduced config settings in puppet (lib/puppet/defaults.rb) which I will be doing soon. I am thinking of maintaining the two new files for maintaining list of compile masters and their certificate serial numbers in the cadir ($ssldir/ca). \r\nThe other thing remaining is the monitoring the list of compile masters and restarting CA anytime that list changes (by sending a sighup to ??? trapperkeeper service).  \r\n\r\nAssuming it is ok to target master branch.\r\n\r\nthanks\r\n","created_at":"2018-06-12T20:45:30Z","updated_at":"2018-06-29T17:47:56Z","closed_at":null,"merged_at":null,"merge_commit_sha":"863c5cb5760a62347d974efe358212552622b082","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/1709/commits","review_comments_url":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/1709/comments","review_comment_url":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/comments{/number}","comments_url":"https://api.github.com/repos/puppetlabs/puppetserver/issues/1709/comments","statuses_url":"https://api.github.com/repos/puppetlabs/puppetserver/statuses/5c88aa67c17a71d8acceffcd07e09c75b347b9b1","head":{"label":"jsane:task/master/SERVER-2231-Publish_an_infrastructure_only_CRL","ref":"task/master/SERVER-2231-Publish_an_infrastructure_only_CRL","sha":"5c88aa67c17a71d8acceffcd07e09c75b347b9b1","user":{"login":"jsane","id":25072698,"node_id":"MDQ6VXNlcjI1MDcyNjk4","avatar_url":"https://avatars2.githubusercontent.com/u/25072698?v=4","gravatar_id":"","url":"https://api.github.com/users/jsane","html_url":"https://github.com/jsane","followers_url":"https://api.github.com/users/jsane/followers","following_url":"https://api.github.com/users/jsane/following{/other_user}","gists_url":"https://api.github.com/users/jsane/gists{/gist_id}","starred_url":"https://api.github.com/users/jsane/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jsane/subscriptions","organizations_url":"https://api.github.com/users/jsane/orgs","repos_url":"https://api.github.com/users/jsane/repos","events_url":"https://api.github.com/users/jsane/events{/privacy}","received_events_url":"https://api.github.com/users/jsane/received_events","type":"User","site_admin":false},"repo":{"id":91011794,"node_id":"MDEwOlJlcG9zaXRvcnk5MTAxMTc5NA==","name":"puppetserver","full_name":"jsane/puppetserver","owner":{"login":"jsane","id":25072698,"node_id":"MDQ6VXNlcjI1MDcyNjk4","avatar_url":"https://avatars2.githubusercontent.com/u/25072698?v=4","gravatar_id":"","url":"https://api.github.com/users/jsane","html_url":"https://github.com/jsane","followers_url":"https://api.github.com/users/jsane/followers","following_url":"https://api.github.com/users/jsane/following{/other_user}","gists_url":"https://api.github.com/users/jsane/gists{/gist_id}","starred_url":"https://api.github.com/users/jsane/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jsane/subscriptions","organizations_url":"https://api.github.com/users/jsane/orgs","repos_url":"https://api.github.com/users/jsane/repos","events_url":"https://api.github.com/users/jsane/events{/privacy}","received_events_url":"https://api.github.com/users/jsane/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/jsane/puppetserver","description":"Server automation framework and application","fork":true,"url":"https://api.github.com/repos/jsane/puppetserver","forks_url":"https://api.github.com/repos/jsane/puppetserver/forks","keys_url":"https://api.github.com/repos/jsane/puppetserver/keys{/key_id}","collaborators_url":"https://api.github.com/repos/jsane/puppetserver/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/jsane/puppetserver/teams","hooks_url":"https://api.github.com/repos/jsane/puppetserver/hooks","issue_events_url":"https://api.github.com/repos/jsane/puppetserver/issues/events{/number}","events_url":"https://api.github.com/repos/jsane/puppetserver/events","assignees_url":"https://api.github.com/repos/jsane/puppetserver/assignees{/user}","branches_url":"https://api.github.com/repos/jsane/puppetserver/branches{/branch}","tags_url":"https://api.github.com/repos/jsane/puppetserver/tags","blobs_url":"https://api.github.com/repos/jsane/puppetserver/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/jsane/puppetserver/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/jsane/puppetserver/git/refs{/sha}","trees_url":"https://api.github.com/repos/jsane/puppetserver/git/trees{/sha}","statuses_url":"https://api.github.com/repos/jsane/puppetserver/statuses/{sha}","languages_url":"https://api.github.com/repos/jsane/puppetserver/languages","stargazers_url":"https://api.github.com/repos/jsane/puppetserver/stargazers","contributors_url":"https://api.github.com/repos/jsane/puppetserver/contributors","subscribers_url":"https://api.github.com/repos/jsane/puppetserver/subscribers","subscription_url":"https://api.github.com/repos/jsane/puppetserver/subscription","commits_url":"https://api.github.com/repos/jsane/puppetserver/commits{/sha}","git_commits_url":"https://api.github.com/repos/jsane/puppetserver/git/commits{/sha}","comments_url":"https://api.github.com/repos/jsane/puppetserver/comments{/number}","issue_comment_url":"https://api.github.com/repos/jsane/puppetserver/issues/comments{/number}","contents_url":"https://api.github.com/repos/jsane/puppetserver/contents/{+path}","compare_url":"https://api.github.com/repos/jsane/puppetserver/compare/{base}...{head}","merges_url":"https://api.github.com/repos/jsane/puppetserver/merges","archive_url":"https://api.github.com/repos/jsane/puppetserver/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/jsane/puppetserver/downloads","issues_url":"https://api.github.com/repos/jsane/puppetserver/issues{/number}","pulls_url":"https://api.github.com/repos/jsane/puppetserver/pulls{/number}","milestones_url":"https://api.github.com/repos/jsane/puppetserver/milestones{/number}","notifications_url":"https://api.github.com/repos/jsane/puppetserver/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/jsane/puppetserver/labels{/name}","releases_url":"https://api.github.com/repos/jsane/puppetserver/releases{/id}","deployments_url":"https://api.github.com/repos/jsane/puppetserver/deployments","created_at":"2017-05-11T18:35:06Z","updated_at":"2017-05-11T18:35:08Z","pushed_at":"2018-06-29T17:13:03Z","git_url":"git://github.com/jsane/puppetserver.git","ssh_url":"git@github.com:jsane/puppetserver.git","clone_url":"https://github.com/jsane/puppetserver.git","svn_url":"https://github.com/jsane/puppetserver","homepage":"https://tickets.puppetlabs.com/browse/SERVER","size":5849,"stargazers_count":0,"watchers_count":0,"language":"Clojure","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0","node_id":"MDc6TGljZW5zZTI="},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"puppetlabs:master","ref":"master","sha":"2e271f7c6768cf60f56d396f74b28ce62e3bd677","user":{"login":"puppetlabs","id":234268,"node_id":"MDEyOk9yZ2FuaXphdGlvbjIzNDI2OA==","avatar_url":"https://avatars0.githubusercontent.com/u/234268?v=4","gravatar_id":"","url":"https://api.github.com/users/puppetlabs","html_url":"https://github.com/puppetlabs","followers_url":"https://api.github.com/users/puppetlabs/followers","following_url":"https://api.github.com/users/puppetlabs/following{/other_user}","gists_url":"https://api.github.com/users/puppetlabs/gists{/gist_id}","starred_url":"https://api.github.com/users/puppetlabs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/puppetlabs/subscriptions","organizations_url":"https://api.github.com/users/puppetlabs/orgs","repos_url":"https://api.github.com/users/puppetlabs/repos","events_url":"https://api.github.com/users/puppetlabs/events{/privacy}","received_events_url":"https://api.github.com/users/puppetlabs/received_events","type":"Organization","site_admin":false},"repo":{"id":19546488,"node_id":"MDEwOlJlcG9zaXRvcnkxOTU0NjQ4OA==","name":"puppetserver","full_name":"puppetlabs/puppetserver","owner":{"login":"puppetlabs","id":234268,"node_id":"MDEyOk9yZ2FuaXphdGlvbjIzNDI2OA==","avatar_url":"https://avatars0.githubusercontent.com/u/234268?v=4","gravatar_id":"","url":"https://api.github.com/users/puppetlabs","html_url":"https://github.com/puppetlabs","followers_url":"https://api.github.com/users/puppetlabs/followers","following_url":"https://api.github.com/users/puppetlabs/following{/other_user}","gists_url":"https://api.github.com/users/puppetlabs/gists{/gist_id}","starred_url":"https://api.github.com/users/puppetlabs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/puppetlabs/subscriptions","organizations_url":"https://api.github.com/users/puppetlabs/orgs","repos_url":"https://api.github.com/users/puppetlabs/repos","events_url":"https://api.github.com/users/puppetlabs/events{/privacy}","received_events_url":"https://api.github.com/users/puppetlabs/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/puppetlabs/puppetserver","description":"Server automation framework and application","fork":false,"url":"https://api.github.com/repos/puppetlabs/puppetserver","forks_url":"https://api.github.com/repos/puppetlabs/puppetserver/forks","keys_url":"https://api.github.com/repos/puppetlabs/puppetserver/keys{/key_id}","collaborators_url":"https://api.github.com/repos/puppetlabs/puppetserver/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/puppetlabs/puppetserver/teams","hooks_url":"https://api.github.com/repos/puppetlabs/puppetserver/hooks","issue_events_url":"https://api.github.com/repos/puppetlabs/puppetserver/issues/events{/number}","events_url":"https://api.github.com/repos/puppetlabs/puppetserver/events","assignees_url":"https://api.github.com/repos/puppetlabs/puppetserver/assignees{/user}","branches_url":"https://api.github.com/repos/puppetlabs/puppetserver/branches{/branch}","tags_url":"https://api.github.com/repos/puppetlabs/puppetserver/tags","blobs_url":"https://api.github.com/repos/puppetlabs/puppetserver/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/puppetlabs/puppetserver/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/puppetlabs/puppetserver/git/refs{/sha}","trees_url":"https://api.github.com/repos/puppetlabs/puppetserver/git/trees{/sha}","statuses_url":"https://api.github.com/repos/puppetlabs/puppetserver/statuses/{sha}","languages_url":"https://api.github.com/repos/puppetlabs/puppetserver/languages","stargazers_url":"https://api.github.com/repos/puppetlabs/puppetserver/stargazers","contributors_url":"https://api.github.com/repos/puppetlabs/puppetserver/contributors","subscribers_url":"https://api.github.com/repos/puppetlabs/puppetserver/subscribers","subscription_url":"https://api.github.com/repos/puppetlabs/puppetserver/subscription","commits_url":"https://api.github.com/repos/puppetlabs/puppetserver/commits{/sha}","git_commits_url":"https://api.github.com/repos/puppetlabs/puppetserver/git/commits{/sha}","comments_url":"https://api.github.com/repos/puppetlabs/puppetserver/comments{/number}","issue_comment_url":"https://api.github.com/repos/puppetlabs/puppetserver/issues/comments{/number}","contents_url":"https://api.github.com/repos/puppetlabs/puppetserver/contents/{+path}","compare_url":"https://api.github.com/repos/puppetlabs/puppetserver/compare/{base}...{head}","merges_url":"https://api.github.com/repos/puppetlabs/puppetserver/merges","archive_url":"https://api.github.com/repos/puppetlabs/puppetserver/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/puppetlabs/puppetserver/downloads","issues_url":"https://api.github.com/repos/puppetlabs/puppetserver/issues{/number}","pulls_url":"https://api.github.com/repos/puppetlabs/puppetserver/pulls{/number}","milestones_url":"https://api.github.com/repos/puppetlabs/puppetserver/milestones{/number}","notifications_url":"https://api.github.com/repos/puppetlabs/puppetserver/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/puppetlabs/puppetserver/labels{/name}","releases_url":"https://api.github.com/repos/puppetlabs/puppetserver/releases{/id}","deployments_url":"https://api.github.com/repos/puppetlabs/puppetserver/deployments","created_at":"2014-05-07T19:00:24Z","updated_at":"2018-06-27T03:32:37Z","pushed_at":"2018-06-29T17:13:05Z","git_url":"git://github.com/puppetlabs/puppetserver.git","ssh_url":"git@github.com:puppetlabs/puppetserver.git","clone_url":"https://github.com/puppetlabs/puppetserver.git","svn_url":"https://github.com/puppetlabs/puppetserver","homepage":"https://tickets.puppetlabs.com/browse/SERVER","size":5869,"stargazers_count":180,"watchers_count":180,"language":"Clojure","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":138,"mirror_url":null,"archived":false,"open_issues_count":6,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0","node_id":"MDc6TGljZW5zZTI="},"forks":138,"open_issues":6,"watchers":180,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/1709"},"html":{"href":"https://github.com/puppetlabs/puppetserver/pull/1709"},"issue":{"href":"https://api.github.com/repos/puppetlabs/puppetserver/issues/1709"},"comments":{"href":"https://api.github.com/repos/puppetlabs/puppetserver/issues/1709/comments"},"review_comments":{"href":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/1709/comments"},"review_comment":{"href":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/1709/commits"},"statuses":{"href":"https://api.github.com/repos/puppetlabs/puppetserver/statuses/5c88aa67c17a71d8acceffcd07e09c75b347b9b1"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"justinstoller"}}