Skip to content

Commit 5ec02bc

Browse files
aarongableaarongable
committed
Merge branch main into rm-sa-methods
2 parents 658ccdf + 36426f8 commit 5ec02bc

File tree

217 files changed

+10673
-1602
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

217 files changed

+10673
-1602
lines changed

‎ca/ca_test.go‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -135,10 +135,6 @@ func (m *mockSA) GetLintPrecertificate(ctx context.Context, req *sapb.Serial, _
135135
return nil, berrors.NotFoundError("cannot find the precert")
136136
}
137137

138-
func (m *mockSA) SetCertificateStatusReady(ctx context.Context, req *sapb.Serial, _ ...grpc.CallOption) (*emptypb.Empty, error) {
139-
return &emptypb.Empty{}, nil
140-
}
141-
142138
var ctx = context.Background()
143139

144140
func setup(t *testing.T) *testCtx {

‎cmd/boulder-wfe2/main.go‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -380,8 +380,6 @@ func main() {
380380
wfe.DirectoryWebsite = c.WFE.DirectoryWebsite
381381
wfe.LegacyKeyIDPrefix = c.WFE.LegacyKeyIDPrefix
382382

383-
logger.Infof("WFE using key policy: %#v", kp)
384-
385383
if c.WFE.ListenAddress == "" {
386384
cmd.Fail("HTTP listen address is not configured")
387385
}

‎core/objects.go‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -76,18 +76,18 @@ type OCSPStatus string
7676
const (
7777
OCSPStatusGood = OCSPStatus("good")
7878
OCSPStatusRevoked = OCSPStatus("revoked")
79-
// Not a real OCSP status. This is a placeholder we write before the
80-
// actual precertificate is issued, to ensure we never return "good" before
81-
// issuance succeeds, for BR compliance reasons.
82-
OCSPStatusNotReady = OCSPStatus("wait")
8379
)
8480

8581
var OCSPStatusToInt = map[OCSPStatus]int{
86-
OCSPStatusGood: ocsp.Good,
87-
OCSPStatusRevoked: ocsp.Revoked,
88-
OCSPStatusNotReady: -1,
82+
OCSPStatusGood: ocsp.Good,
83+
OCSPStatusRevoked: ocsp.Revoked,
8984
}
9085

86+
const (
87+
RevocationStatusGood int64 = 0
88+
RevocationStatusRevoked int64 = 1
89+
)
90+
9191
// DNSPrefix is attached to DNS names in DNS challenges
9292
const DNSPrefix = "_acme-challenge"
9393

‎docs/ISSUANCE-CYCLE.md‎

Lines changed: 3 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -8,44 +8,12 @@ At a high level:
88
2. Recheck CAA for hostnames that need it.
99
3. Allocate and store a serial number.
1010
4. Select a certificate profile.
11-
5. Generate and store linting certificate, set status to "wait" (precommit).
12-
6. Sign, log (and don't store) precertificate, set status to "good".
11+
5. Generate and store linting precertificate.
12+
6. Sign, log (and don't store) precertificate.
1313
7. Submit precertificate to CT.
1414
8. Generate linting final certificate. Not logged or stored.
1515
9. Sign, log, and store final certificate.
1616

1717
Revocation can happen at any time after (5), whether or not step (6) was successful. We do things this way so that even in the event of a power failure or error storing data, we have a record of what we planned to sign (the tbsCertificate bytes of the linting certificate).
1818

19-
Note that to avoid needing a migration, we chose to store the linting certificate from (5)in the "precertificates" table, which is now a bit of a misnomer.
20-
21-
# OCSP Status state machine:
22-
23-
wait -> good -> revoked
24-
\
25-
-> revoked
26-
27-
Serial numbers with a "wait" status recorded have not been submitted to CT,
28-
because issuing the precertificate is a prerequisite to setting the status to
29-
"good". And because they haven't been submitted to CT, they also haven't been
30-
turned into a final certificate, nor have they been returned to a user.
31-
32-
OCSP requests for serial numbers in "wait" status will return 500, but we expect
33-
not to serve any 500s in practice because these serial numbers never wind up in
34-
users' hands. Serial numbers in "wait" status are not added to CRLs.
35-
36-
Note that "serial numbers never wind up in users' hands" does not relieve us of
37-
any compliance duties. Our duties start from the moment of signing a
38-
precertificate with trusted key material.
39-
40-
Since serial numbers in "wait" status _may_ have had a precertificate signed,
41-
We need the ability to set revocation status for them. For instance if the public key
42-
we planned to sign for turns out to be weak or compromised, we would want to serve
43-
a revoked status for that serial. However since they also _may not_ have had a
44-
Precertificate signed, we also can't serve an OCSP "good" status. That's why we
45-
serve 500. A 500 is appropriate because the only way a serial number can have "wait"
46-
status for any significant amount of time is if there was an internal error of some
47-
sort: an error during or before signing, or an error storing a record of the
48-
signing success in the database.
49-
50-
For clarity, "wait" is not an RFC 6960 status, but is an internal placeholder
51-
value specific to Boulder.
19+
Note that to avoid needing a migration, we chose to store the linting certificate from (5) in the "precertificates" table, which is now a bit of a misnomer.

‎go.mod‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,10 @@ module github.com/letsencrypt/boulder
33
go 1.25.0
44

55
require (
6-
github.com/aws/aws-sdk-go-v2 v1.36.5
7-
github.com/aws/aws-sdk-go-v2/config v1.29.17
8-
github.com/aws/aws-sdk-go-v2/service/s3 v1.83.0
9-
github.com/aws/smithy-go v1.22.4
6+
github.com/aws/aws-sdk-go-v2 v1.38.1
7+
github.com/aws/aws-sdk-go-v2/config v1.31.2
8+
github.com/aws/aws-sdk-go-v2/service/s3 v1.87.1
9+
github.com/aws/smithy-go v1.22.5
1010
github.com/eggsampler/acme/v3 v3.6.2
1111
github.com/go-jose/go-jose/v4 v4.1.2
1212
github.com/go-logr/stdr v1.2.2
@@ -49,20 +49,20 @@ require (
4949

5050
require (
5151
filippo.io/edwards25519 v1.1.0 // indirect
52-
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.11 // indirect
53-
github.com/aws/aws-sdk-go-v2/credentials v1.17.70 // indirect
54-
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.32 // indirect
55-
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.36 // indirect
56-
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.36 // indirect
52+
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.0 // indirect
53+
github.com/aws/aws-sdk-go-v2/credentials v1.18.6 // indirect
54+
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.4 // indirect
55+
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.4 // indirect
56+
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.4 // indirect
5757
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
58-
github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.36 // indirect
59-
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.4 // indirect
60-
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.4 // indirect
61-
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.17 // indirect
62-
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.17 // indirect
63-
github.com/aws/aws-sdk-go-v2/service/sso v1.25.5 // indirect
64-
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.3 // indirect
65-
github.com/aws/aws-sdk-go-v2/service/sts v1.34.0 // indirect
58+
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.4 // indirect
59+
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0 // indirect
60+
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.8.4 // indirect
61+
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.4 // indirect
62+
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.4 // indirect
63+
github.com/aws/aws-sdk-go-v2/service/sso v1.28.2 // indirect
64+
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.2 // indirect
65+
github.com/aws/aws-sdk-go-v2/service/sts v1.38.0 // indirect
6666
github.com/beorn7/perks v1.0.1 // indirect
6767
github.com/cenkalti/backoff/v5 v5.0.2 // indirect
6868
github.com/cespare/xxhash/v2 v2.3.0 // indirect

‎go.sum‎

Lines changed: 34 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -7,42 +7,42 @@ github.com/a8m/expect v1.0.0/go.mod h1:4IwSCMumY49ScypDnjNbYEjgVeqy1/U2cEs3Lat96
77
github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
88
github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
99
github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
10-
github.com/aws/aws-sdk-go-v2 v1.36.5 h1:0OF9RiEMEdDdZEMqF9MRjevyxAQcf6gY+E7vwBILFj0=
11-
github.com/aws/aws-sdk-go-v2 v1.36.5/go.mod h1:EYrzvCCN9CMUTa5+6lf6MM4tq3Zjp8UhSGR/cBsjai0=
12-
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.11 h1:12SpdwU8Djs+YGklkinSSlcrPyj3H4VifVsKf78KbwA=
13-
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.11/go.mod h1:dd+Lkp6YmMryke+qxW/VnKyhMBDTYP41Q2Bb+6gNZgY=
14-
github.com/aws/aws-sdk-go-v2/config v1.29.17 h1:jSuiQ5jEe4SAMH6lLRMY9OVC+TqJLP5655pBGjmnjr0=
15-
github.com/aws/aws-sdk-go-v2/config v1.29.17/go.mod h1:9P4wwACpbeXs9Pm9w1QTh6BwWwJjwYvJ1iCt5QbCXh8=
16-
github.com/aws/aws-sdk-go-v2/credentials v1.17.70 h1:ONnH5CM16RTXRkS8Z1qg7/s2eDOhHhaXVd72mmyv4/0=
17-
github.com/aws/aws-sdk-go-v2/credentials v1.17.70/go.mod h1:M+lWhhmomVGgtuPOhO85u4pEa3SmssPTdcYpP/5J/xc=
18-
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.32 h1:KAXP9JSHO1vKGCr5f4O6WmlVKLFFXgWYAGoJosorxzU=
19-
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.32/go.mod h1:h4Sg6FQdexC1yYG9RDnOvLbW1a/P986++/Y/a+GyEM8=
20-
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.36 h1:SsytQyTMHMDPspp+spo7XwXTP44aJZZAC7fBV2C5+5s=
21-
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.36/go.mod h1:Q1lnJArKRXkenyog6+Y+zr7WDpk4e6XlR6gs20bbeNo=
22-
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.36 h1:i2vNHQiXUvKhs3quBR6aqlgJaiaexz/aNvdCktW/kAM=
23-
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.36/go.mod h1:UdyGa7Q91id/sdyHPwth+043HhmP6yP9MBHgbZM0xo8=
10+
github.com/aws/aws-sdk-go-v2 v1.38.1 h1:j7sc33amE74Rz0M/PoCpsZQ6OunLqys/m5antM0J+Z8=
11+
github.com/aws/aws-sdk-go-v2 v1.38.1/go.mod h1:9Q0OoGQoboYIAJyslFyF1f5K1Ryddop8gqMhWx/n4Wg=
12+
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.0 h1:6GMWV6CNpA/6fbFHnoAjrv4+LGfyTqZz2LtCHnspgDg=
13+
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.0/go.mod h1:/mXlTIVG9jbxkqDnr5UQNQxW1HRYxeGklkM9vAFeabg=
14+
github.com/aws/aws-sdk-go-v2/config v1.31.2 h1:NOaSZpVGEH2Np/c1toSeW0jooNl+9ALmsUTZ8YvkJR0=
15+
github.com/aws/aws-sdk-go-v2/config v1.31.2/go.mod h1:17ft42Yb2lF6OigqSYiDAiUcX4RIkEMY6XxEMJsrAes=
16+
github.com/aws/aws-sdk-go-v2/credentials v1.18.6 h1:AmmvNEYrru7sYNJnp3pf57lGbiarX4T9qU/6AZ9SucU=
17+
github.com/aws/aws-sdk-go-v2/credentials v1.18.6/go.mod h1:/jdQkh1iVPa01xndfECInp1v1Wnp70v3K4MvtlLGVEc=
18+
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.4 h1:lpdMwTzmuDLkgW7086jE94HweHCqG+uOJwHf3LZs7T0=
19+
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.4/go.mod h1:9xzb8/SV62W6gHQGC/8rrvgNXU6ZoYM3sAIJCIrXJxY=
20+
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.4 h1:IdCLsiiIj5YJ3AFevsewURCPV+YWUlOW8JiPhoAy8vg=
21+
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.4/go.mod h1:l4bdfCD7XyyZA9BolKBo1eLqgaJxl0/x91PL4Yqe0ao=
22+
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.4 h1:j7vjtr1YIssWQOMeOWRbh3z8g2oY/xPjnZH2gLY4sGw=
23+
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.4/go.mod h1:yDmJgqOiH4EA8Hndnv4KwAo8jCGTSnM5ASG1nBI+toA=
2424
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 h1:bIqFDwgGXXN1Kpp99pDOdKMTTb5d2KyU5X/BZxjOkRo=
2525
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3/go.mod h1:H5O/EsxDWyU+LP/V8i5sm8cxoZgc2fdNR9bxlOFrQTo=
26-
github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.36 h1:GMYy2EOWfzdP3wfVAGXBNKY5vK4K8vMET4sYOYltmqs=
27-
github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.36/go.mod h1:gDhdAV6wL3PmPqBhiPbnlS447GoWs8HTTOYef9/9Inw=
28-
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.4 h1:CXV68E2dNqhuynZJPB80bhPQwAKqBWVer887figW6Jc=
29-
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.4/go.mod h1:/xFi9KtvBXP97ppCz1TAEvU1Uf66qvid89rbem3wCzQ=
30-
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.4 h1:nAP2GYbfh8dd2zGZqFRSMlq+/F6cMPBUuCsGAMkN074=
31-
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.4/go.mod h1:LT10DsiGjLWh4GbjInf9LQejkYEhBgBCjLG5+lvk4EE=
32-
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.17 h1:t0E6FzREdtCsiLIoLCWsYliNsRBgyGD/MCK571qk4MI=
33-
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.17/go.mod h1:ygpklyoaypuyDvOM5ujWGrYWpAK3h7ugnmKCU/76Ys4=
34-
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.17 h1:qcLWgdhq45sDM9na4cvXax9dyLitn8EYBRl8Ak4XtG4=
35-
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.17/go.mod h1:M+jkjBFZ2J6DJrjMv2+vkBbuht6kxJYtJiwoVgX4p4U=
36-
github.com/aws/aws-sdk-go-v2/service/s3 v1.83.0 h1:5Y75q0RPQoAbieyOuGLhjV9P3txvYgXv2lg0UwJOfmE=
37-
github.com/aws/aws-sdk-go-v2/service/s3 v1.83.0/go.mod h1:kUklwasNoCn5YpyAqC/97r6dzTA1SRKJfKq16SXeoDU=
38-
github.com/aws/aws-sdk-go-v2/service/sso v1.25.5 h1:AIRJ3lfb2w/1/8wOOSqYb9fUKGwQbtysJ2H1MofRUPg=
39-
github.com/aws/aws-sdk-go-v2/service/sso v1.25.5/go.mod h1:b7SiVprpU+iGazDUqvRSLf5XmCdn+JtT1on7uNL6Ipc=
40-
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.3 h1:BpOxT3yhLwSJ77qIY3DoHAQjZsc4HEGfMCE4NGy3uFg=
41-
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.3/go.mod h1:vq/GQR1gOFLquZMSrxUK/cpvKCNVYibNyJ1m7JrU88E=
42-
github.com/aws/aws-sdk-go-v2/service/sts v1.34.0 h1:NFOJ/NXEGV4Rq//71Hs1jC/NvPs1ezajK+yQmkwnPV0=
43-
github.com/aws/aws-sdk-go-v2/service/sts v1.34.0/go.mod h1:7ph2tGpfQvwzgistp2+zga9f+bCjlQJPkPUmMgDSD7w=
44-
github.com/aws/smithy-go v1.22.4 h1:uqXzVZNuNexwc/xrh6Tb56u89WDlJY6HS+KC0S4QSjw=
45-
github.com/aws/smithy-go v1.22.4/go.mod h1:t1ufH5HMublsJYulve2RKmHDC15xu1f26kHCp/HgceI=
26+
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.4 h1:BE/MNQ86yzTINrfxPPFS86QCBNQeLKY2A0KhDh47+wI=
27+
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.4/go.mod h1:SPBBhkJxjcrzJBc+qY85e83MQ2q3qdra8fghhkkyrJg=
28+
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0 h1:6+lZi2JeGKtCraAj1rpoZfKqnQ9SptseRZioejfUOLM=
29+
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0/go.mod h1:eb3gfbVIxIoGgJsi9pGne19dhCBpK6opTYpQqAmdy44=
30+
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.8.4 h1:Beh9oVgtQnBgR4sKKzkUBRQpf1GnL4wt0l4s8h2VCJ0=
31+
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.8.4/go.mod h1:b17At0o8inygF+c6FOD3rNyYZufPw62o9XJbSfQPgbo=
32+
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.4 h1:ueB2Te0NacDMnaC+68za9jLwkjzxGWm0KB5HTUHjLTI=
33+
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.4/go.mod h1:nLEfLnVMmLvyIG58/6gsSA03F1voKGaCfHV7+lR8S7s=
34+
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.4 h1:HVSeukL40rHclNcUqVcBwE1YoZhOkoLeBfhUqR3tjIU=
35+
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.4/go.mod h1:DnbBOv4FlIXHj2/xmrUQYtawRFC9L9ZmQPz+DBc6X5I=
36+
github.com/aws/aws-sdk-go-v2/service/s3 v1.87.1 h1:2n6Pd67eJwAb/5KCX62/8RTU0aFAAW7V5XIGSghiHrw=
37+
github.com/aws/aws-sdk-go-v2/service/s3 v1.87.1/go.mod h1:w5PC+6GHLkvMJKasYGVloB3TduOtROEMqm15HSuIbw4=
38+
github.com/aws/aws-sdk-go-v2/service/sso v1.28.2 h1:ve9dYBB8CfJGTFqcQ3ZLAAb/KXWgYlgu/2R2TZL2Ko0=
39+
github.com/aws/aws-sdk-go-v2/service/sso v1.28.2/go.mod h1:n9bTZFZcBa9hGGqVz3i/a6+NG0zmZgtkB9qVVFDqPA8=
40+
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.2 h1:pd9G9HQaM6UZAZh19pYOkpKSQkyQQ9ftnl/LttQOcGI=
41+
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.2/go.mod h1:eknndR9rU8UpE/OmFpqU78V1EcXPKFTTm5l/buZYgvM=
42+
github.com/aws/aws-sdk-go-v2/service/sts v1.38.0 h1:iV1Ko4Em/lkJIsoKyGfc0nQySi+v0Udxr6Igq+y9JZc=
43+
github.com/aws/aws-sdk-go-v2/service/sts v1.38.0/go.mod h1:bEPcjW7IbolPfK67G1nilqWyoxYMSPrDiIQ3RdIdKgo=
44+
github.com/aws/smithy-go v1.22.5 h1:P9ATCXPMb2mPjYBgueqJNCA5S9UfktsW0tTxi+a7eqw=
45+
github.com/aws/smithy-go v1.22.5/go.mod h1:t1ufH5HMublsJYulve2RKmHDC15xu1f26kHCp/HgceI=
4646
github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
4747
github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
4848
github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=

‎log/log.go‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -160,6 +160,19 @@ type stdoutWriter struct {
160160
isatty bool
161161
}
162162

163+
// NewLineChecksum computes a CRC32 over the log line, which can be checked by
164+
// log-validator to ensure no unexpected log corruption has occurred.
165+
// It is currently only accepted for Validation, and will be switched in for
166+
// LogLineChecksum in an upcoming release.
167+
func NewLineChecksum(line string) string {
168+
crc := crc32.ChecksumIEEE([]byte(line))
169+
buf := make([]byte, crc32.Size)
170+
// Error is unreachable because we provide a supported type and buffer size
171+
_, _ = binary.Encode(buf, binary.LittleEndian, crc)
172+
return base64.RawURLEncoding.EncodeToString(buf)
173+
}
174+
175+
// LogLineChecksum is the current checksum algorithm, emitted in every log line.
163176
func LogLineChecksum(line string) string {
164177
crc := crc32.ChecksumIEEE([]byte(line))
165178
// Using the hash.Hash32 doesn't make this any easier

‎log/log_test.go‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ import (
1212
"time"
1313

1414
"github.com/jmhodges/clock"
15+
1516
"github.com/letsencrypt/boulder/test"
1617
)
1718

@@ -342,3 +343,34 @@ func TestLogAtLevelEscapesNewlines(t *testing.T) {
342343

343344
test.Assert(t, strings.Contains(buf.String(), "foo\\nbar"), "failed to escape newline")
344345
}
346+
347+
func TestLogLineChecksum(t *testing.T) {
348+
testCases := []struct {
349+
name string
350+
function func(string) string
351+
input string
352+
expected string
353+
}{
354+
{
355+
name: "NewLineChecksum with Hello, World!",
356+
function: NewLineChecksum,
357+
input: "Hello, World!",
358+
expected: "0MNK7A",
359+
},
360+
{
361+
name: "LogLineChecksum with Info log",
362+
function: LogLineChecksum,
363+
input: "Info log",
364+
expected: "pcbo7wk",
365+
},
366+
}
367+
368+
for _, tc := range testCases {
369+
t.Run(tc.name, func(t *testing.T) {
370+
checksum := tc.function(tc.input)
371+
if checksum != tc.expected {
372+
t.Fatalf("got %q, want %q", checksum, tc.expected)
373+
}
374+
})
375+
}
376+
}

‎log/validator/validator.go‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -186,9 +186,10 @@ func lineValid(text string) error {
186186
}
187187
checksum := fields[5]
188188
_, err := base64.RawURLEncoding.DecodeString(checksum)
189-
if err != nil || len(checksum) != 7 {
189+
// TODO(#8414): Temporarily accept length 6 or 7 checksums
190+
if err != nil || (len(checksum) != 6 && len(checksum) != 7) {
190191
return fmt.Errorf(
191-
"%s expected a 7 character base64 raw URL decodable string, got %q: %w",
192+
"%s expected a 6 or 7 character base64 raw URL decodable string, got %q: %w",
192193
errorPrefix,
193194
checksum,
194195
errInvalidChecksum,
@@ -204,7 +205,14 @@ func lineValid(text string) error {
204205
return nil
205206
}
206207
// Check the extracted checksum against the computed checksum
207-
if computedChecksum := log.LogLineChecksum(line); checksum != computedChecksum {
208+
// TODO(#8414): Accept both the old and new checksum format, distinguished by length
209+
var computedChecksum string
210+
if len(checksum) == 6 {
211+
computedChecksum = log.NewLineChecksum(line)
212+
} else {
213+
computedChecksum = log.LogLineChecksum(line)
214+
}
215+
if checksum != computedChecksum {
208216
return fmt.Errorf("%s invalid checksum (expected %q, got %q)", errorPrefix, computedChecksum, checksum)
209217
}
210218
return nil

‎log/validator/validator_test.go‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,16 @@ import (
66
"github.com/letsencrypt/boulder/test"
77
)
88

9-
func TestLineValidAccepts(t *testing.T) {
10-
err := lineValid("2020-07-06T18:07:43.109389+00:00 70877f679c72 datacenter 6 boulder-wfe[1595]: kKG6cwA Caught SIGTERM")
9+
func TestLineValidAcceptsNew(t *testing.T) {
10+
err := lineValid("2020-07-06T18:07:43.109389+00:00 70877f679c72 datacenter 6 boulder-wfe[1595]: kJBuDg Caught SIGTERM")
1111
test.AssertNotError(t, err, "errored on valid checksum")
1212
}
1313

14+
func TestLineValidAcceptsOld(t *testing.T) {
15+
err := lineValid("2020-07-06T18:07:43.109389+00:00 70877f679c72 datacenter 6 boulder-wfe[1595]: kKG6cwA Caught SIGTERM")
16+
test.AssertNotError(t, err, "errored on valid old checksum")
17+
}
18+
1419
func TestLineValidRejects(t *testing.T) {
1520
err := lineValid("2020-07-06T18:07:43.109389+00:00 70877f679c72 datacenter 6 boulder-wfe[1595]: xxxxxxx Caught SIGTERM")
1621
test.AssertError(t, err, "didn't error on invalid checksum")

0 commit comments

Comments
 (0)