/[pdpsoft]/nl.nikhef.pdp.fetchcrl/tags/fetch-crl-3.0.7-1/CHANGES
ViewVC logotype

Annotation of /nl.nikhef.pdp.fetchcrl/tags/fetch-crl-3.0.7-1/CHANGES

Parent Directory Parent Directory | Revision Log Revision Log


Revision 2305 - (hide annotations) (download)
Sun Jun 12 20:59:58 2011 UTC (10 years, 5 months ago) by davidg
Original Path: nl.nikhef.pdp.fetchcrl/trunk/CHANGES
File size: 15687 byte(s)
Fixed bug by Elan Ruusamae and works around Steven bug found in file(1)

1 davidg 1758 ==============================================================================
2     CHANGES to fetch-crl - the Certificate Revocation List retrieval tool
3     ==============================================================================
4     The fetch-crl utility will retrieve certificate revocation lists (CRLs) for
5     a set of installed trust anchors, based on crl_url files or IGTF-style info
6     files. It will install these for use with OpenSSL, NSS or third-party tools.
7    
8 davidg 2305 Changes in 3.0.7-1
9     ----------------------
10     * CRL modofication time heuristic inadvertently modified file name templates
11     (solves issue kindly reported by Elan Ruusamae)
12     * Expanded representation of tokenisation characters in strings to work
13     around bug in file(1) (rhbz#699546, works around RedHat Bugzilla 699548)
14    
15 davidg 2233 Changes in 3.0.6-1
16     ----------------------
17     * Response parsing disabled to suppress superfluous warning on unexpected
18     UTF-8 respons when retrieving a CRL (solves RedHat Bugzilla 688902)
19    
20 davidg 2188 Changes in 3.0.5-1
21     ----------------------
22     * CRLs for multiple similarly-named trust anchors might not all be downloaded.
23     This is fixed in this release.
24     * Spurious "restoreLogMode" internal errors are no longer raised
25    
26 davidg 2085 Changes in 3.0.4-1
27     ----------------------
28     * Add support for directory based drop-in configuration in /etc/fetch-crl.d/
29     * Only use cached CRL contents if the nextUpdate time of the cached CRL is
30     still in the future. This will ensure that a new download is attempted
31     each and everytime for CRLs that have already expired.
32    
33 davidg 1924 Changes in 3.0.3-1
34     ----------------------
35     * Clean up of man page format macro PU (reported by Mattias Ellert)
36    
37 davidg 1922 Changes in 3.0.2-1
38     ----------------------
39     * Clean up of man page format macro PU (reported by Mattias Ellert)
40    
41 davidg 1901 Changes in 3.0.1-1
42     ----------------------
43     * hunts through more places to find the latest successful CRL download to
44     set the latest local modification time for a CRL
45     (resolves a comparison error in case output and infodir are unset)
46    
47 davidg 1878 Changes in 3.0.0-0.RC4
48     ----------------------
49     * the config file name has changed to fetch-crl.conf, although a
50     fetch-crl.cnf file will also be used when present
51     * symlinked meta-data files can be ignored with the --nosymlinks option
52     (or nosymlinks in the configuration file). This allows fetch-crl to be
53     used effectively with new-format IGTF distribution before 1.37
54     * infinite loop for non-indexed CA file names fixed
55    
56 davidg 1758 Changes in fetch-crl 3.0
57     ------------------------
58     * fetch-crl 3.0 is a complete re-write, and shares no code with the 1.x and
59     2.x series utility of the same name, although the function and some of
60     the syntax is obviously the same
61    
62     * support for multiple output formats: OpenSSL 1 in dual-hash mode, specific
63     DER and PEM outputs, and NSS databases
64     * support for multiple CRLs for a single CA, allowing more than one CA with
65     the same subject name but different CLRs. Review your client software to see
66     if and how these CRLs are used.
67     * stateful retrieval helps reduce bandwidth usage by caching the CRLs locally
68     and respecting the Cache Control headers sent by the web server hosting the
69     CRL. This can reduce the number of downloads
70     * support for HEAD-only requests when state preservation is used (initially
71     only retrieve HTTP headers, and only if the CRL actually changed to a full
72     download)
73     * support for more CRL retrieval protocols (file:// and ftp://)
74     * ability to try site-local URLs first, before relying on the URLs shipped with
75     the trust anchor. This allows building an explicit local caching (web) server.
76     * ability to specify additional URLs to try in case the URLs shipped with the
77     trust anchor were not responsive. This allows for automatic fall-back to
78     (local or global) mirror services for CRL downloads
79     * warnings and errors can be suppressed on a per-trust anchor basis, to allow
80     silencing for particularly unstable trust anchors
81     * aging tolerance (the delay time before errors are generated in case downloads
82     consistently fail) can be configured on a per-trust anchor basis
83     * parallel downloading for multiple trust anchors
84     * minimized use of temporary files in the file system (now limited to the
85     invocation of OpenSSL only, and only for brief periods of time)
86     * dependencies on wget, lynx and other unix utilities have been removed
87     * explicit web proxy support (using LWP http proxies)
88     * completely re-written in perl, with some (hopefully minimal) dependencies:
89     LWP, Sys::Syslog, POSIX. And Data::Dumper (when debugging is enabled),
90     and IO::Select (if parallel downloads are enabled).
91    
92     Differences with respect to the previous versions
93    
94     * when downloading CRLs via https, the server certificate is not checked,
95     neither for the correct DNS name nor for being issued by a valid CA. Since
96     the CRL in itself is signed, this is not a security vulnerability. If
97     stricter checking is anyway desired, and the Crypt::SSLeay perl module has
98     been installed, set the HTTPS_CA_FILE environment variable before invoking
99     fetch-crl -- but keep in mind that the DNS name verification is limited
100     and will (incorrectly) reject DNS names if these are listed only in the
101     subjectAlternativeName of the server certificate
102     * Existing files with a name that matches a CRL target name are overwritten,
103     even if they did not originally contain CRL data. In v2 this was configurable
104     via the FORCE_OVERWRITE configuration setting. In version 3, files are
105     overwritten by default, and this can no longer be configured.
106     * fetch-crl3 will no longer check CA certificates for consistency or validity
107     by themselves, only retrieved CRLs are verified
108    
109     Downsides of the new version
110    
111     * it requires perl5 to be installed (tested with perl 5.8.0 and higher) with
112     libwww-perl, whereas version 2 only required a traditional Bourne shell
113     * requires a version of OpenSSL (0.9.5a or better) to be installed. Needs
114     OpenSSL 1.0.0 (at least beta5) for dual-hash support.
115     * when using parallel downloads, it can only run on pure-POSIX systems
116     * parallelism in combination with the NSS database output format is not tested
117     * Even when only the NSS database output format has been selected, OpenSSL is
118     still needed for verification and processing
119    
120    
121     ==============================================================================
122    
123     The change log below applies to the 1.x and 2.x series fetch-crl and is
124     included for historical purposes only. Fetch-crl3, with which this
125     changes file is being shipped, is a complete re-write of the utility.
126     Although a lot of backwards compatibility has been preserves, there have
127     been significant changes and the information below should NOT be used
128     to infer any behaviour of fetch-crl3.
129    
130     Fetch-crl 1.x and 2.x were released under the EU DataGrid License.
131    
132     Changes in version EGP 2.8.5
133     ----------------------------
134     (2010.06.03)
135    
136     * fetch-crl was occasionally leaving behind {hash}.r0.XXXXXX.r0 files
137     This has been fixed in this release (patch thanks to Jason Smith, BNL)
138     * man page was not compliant to Debian guidelines, this has been fixed
139     (patch thanks to Mattias Ellert, Uppsala University)
140    
141     Changes in version EGP 2.8.4
142     ----------------------------
143     (2010.04.04)
144    
145     * Fixes error when randomWait is not set [RH Bug 579488]
146    
147     Changes in version EGP 2.8.3
148     ----------------------------
149     (2010.03.28)
150    
151     * Preserve SELinux context for CRL files if SElinux status program exists
152     and selinux is enabled (RH bug 577403)
153     * Fix argument parsing on syslog facility specification (RH bug 577387)
154     * Increase granularity of the RandomWait and allow for 0 in -r option
155    
156     Changes in version EGP 2.8.2
157     ----------------------------
158     (2010.03.03)
159    
160     * Improved support for multiple CRL URLs by downloading until a success
161     is achieved, instead of downloading all of them
162     * Imported randomwait patch from Steve Traylen
163    
164     Changes in version EGP 2.8.1
165     ----------------------------
166     (2010.01.26)
167    
168     * The installed CRL file is re-checked for validity to catch file system
169     errors and local disk corruption. When possible, it will try to restore
170     a backup copy. Failures are not subject to aging tolerance.
171    
172     Changes in version EGP 2.8.0
173     ----------------------------
174     (2009.09.22)
175    
176     * The RPM packaging has been overhauled and is now sufficiently conformant
177     to EPEL and FedoraProject guidelines.
178     * New init scripts and a cron job entry have been added to allow management
179     of fetch-crl via the chkconfig mechanism
180    
181     These changes were contributed by Steve Traylen (CERN, Geneva, CH).
182    
183     Changes in version EGP 2.7.0
184     ----------------------------
185     (2009.01.25)
186    
187     * Warnings and errors are now counted. If there are errors in the download
188     or verification process for one or more CRLs, the exit status will be 1;
189     if there are errors in the local setup or in the script invocation, the
190     exit status will be 2.
191     * The installed CRLs no longer have the textual representation of the CRL,
192     but only the PEM data blob, thus reducing IO and memory requirements.
193     * the CRL aging threshold is now set by default to 24 hours. The previous
194     default was 0. The CRL aging threshold is set in the config file using
195     CRL_AGING_THRESHOLD=<xx>, or with the "-a" command-line argument.
196     * Default network timeouts reduced to 10 seconds (was 30) and retries to 2
197     * Added caching and conditional downloading. When CACHEDIR is set, the
198     original downloads are preserved and wget timestamping mode enabled.
199     When the content did not change, only the timestamp on the installed
200     CRL is updated. If SLOPPYCRLHASHES is set, the has is calculated based
201     on the name of the crl_url file, otherwise it is taken from the CRL itself.
202     - The CACHEDIR must be exclusively writable by the user running fetch-crl
203     - Setting CACHEDIR significantly reduced the bandwidth used by fetch-crl
204     * Added RESETPATHMODE setting in sysconfig. It defines whether or not to
205     set re-set $PATH to "/bin:/usr/bin" before start. The search for OpenSSL
206     may be done based on the old path.
207     yes=always replace; searchopenssl=search for openssl first and then reset;
208     no=keep original path, whatever that me be (may be empty if called from cron)
209     Default="yes". This replaces the hard-coded path in the tool!
210     * Hidden "FORCE_OVERWRITE" option now has a regular name. This is backwards-
211     compatible. Set FORCE_OVERWRITE=yes if you want files overwritten that
212     have a CRL-like name and ought to have CRL content, but currently do not.
213     * Addresses gLite Savannah bugs 28418 and 29559. Bug 27023 is partially
214     addressed. Bug 20062 can be remedied with WGET_OPTS arguments.
215     Addresses OSG ticket 4673.
216    
217     Changes in version EGP 2.6.6
218     ----------------------------
219     (2007.09.16)
220     (version 2.5.5 is invalid and was not publicly released)
221    
222     * Added obscure configuration parameter to allow overwriting of
223     arbitrary data files with a downloaded CRL (on request of
224     CERN, see https://savannah.cern.ch/bugs/index.php?29559)
225    
226     Changes in version EGP 2.6.4
227     ----------------------------
228     (2007.08.15)
229    
230     * Expired CA issuer certificate now gives a warning instead of an error
231     with the full verification result message
232     * additional logfile output target can be selected via the configuration file
233     * CRL aging threshold documented in manual page. Errors will now also be
234     generated in the CRL download failed consistently and the current CRL
235     has already expired
236    
237     Changes in version EGP 2.6.3
238     ----------------------------
239     (2006.11.13)
240    
241     * cron job example: fetch-crl invocation syntax error corrected
242    
243     Changes in version EGP 2.6.2
244     ----------------------------
245     (2006.10.27)
246    
247     * fixed bug: older wget versions do not recognise --no-check-certificate
248    
249     Changes in version EGP 2.6.1
250     ----------------------------
251     (2006.10.25)
252    
253     * fixed local timezone vs UTC error in LastUpdate CRL validation comparison
254     * fixed time comparison is the one-hour LastUpdate/download tolerance
255     (both fixes thanks to Alain Roy)
256     * added support for directory names containing whitespace
257     * added support for syslog reporting (via -f option or SYSLOGFACILITY directive)
258     * SERVERCERTCHECK=no is now the default. It can be reset via the configuration
259     file, or using the "--check-server-certificate" commandline option
260     * the main configuration file location (formerly fixed to be
261     /etc/sysconfig/fetch-crl) can now be set via the variable $FETCH_CRL_SYSCONFIG
262     * logfile format timestamp and tag have been normalised
263    
264     Changes in version EGP 2.6
265     --------------------------
266     (2006.05.20)
267    
268     * if the current local CRL has a lastUpdate time in the future, and the
269     newly downloaded CRL is older that the current one, allow the installation
270     of the newly downloaded CRL and issue a warning.
271     * added non-suppressable warning in case the newly downloaded CRL has a
272     lastUpdate time in the future, but install that CRL anyway (as the local
273     clock might have been wrong).
274    
275     Changes in version EGP 2.5
276     --------------------------
277     (2006.01.16)
278    
279     * added additional configuration arguments and configuration variables
280     to skip the server certificate check in wget
281     (to support https:// URLs where the server is authenticated with
282     a certificate that is not part of it's own trusted domain, such as
283     the KISTI URL)
284    
285     Changes in version EGP 2.4
286     --------------------------
287     (2005.11.15)
288    
289     * for those platforms that support the stat(1) command, and in case the
290     .crl_url file is named after the hash of the crl subject name to download,
291     error eporting for individual download errors can be suppressed for
292     a configurable amount of time as set via the "-a" option (unit: hours).
293    
294     Changes in version EGP 2.3
295     --------------------------
296     (2005.11.05)
297    
298     * do not replace recent CRLs with ones that have an older lastUpdate
299     timestamp (prevents ARP/DNS DoS attacks)
300    
301     Changes in version EGP 2.2
302     --------------------------
303     (2005.10.27)
304    
305     * secure http download by wget recognise the CAs in the trusted directory.
306     solves the issue described in the LCG bug tracking system
307     https://savannah.cern.ch/bugs/index.php?func=detailitem&item_id=12182
308    
309     Changes in version EGP 2.1
310     --------------------------
311     (2005.08.12)
312     * specifically look for the most recent version of OpenSSL. The
313     one in GLOBUS_LOCATION (which used to take precedence in the
314     previous releases) is outdated in many cases and caused
315     troubles on the LCG production systems in validating v2 CRLs
316     * added manual page fetch-crl(8)
317    
318     Changes in version EGP 2.0
319     --------------------------
320     (2005.02.28)
321     * name of the installed script changed to "fetch-crl"
322     * the cronjob script is no longer installed by default, but supplied
323     as an example in the %doc directory
324     * RPM is now relocatable (default install in /usr)
325     * READMA and CHANGES file now inclued in %doc tree
326     * make install now installs
327     * version increased to 2.0
328    
329     Changes in version EGP 1.9
330     --------------------------
331     (2005.02.24)
332     * the content of the final target CRL file is now checked for
333     containing a valid CRL if it already exists. If it does not
334     contain a CRL, an error is displayed and the file left untouched
335     So making the final ".r0" file in ${outdir} a link to something else
336     will not work, preventing an escalation in the final stage.
337    
338     Changes in version EGP 1.8
339     --------------------------
340     (changes from Fabio's version 1.7, 2005.02.24)
341    
342     * All temporary files (the initial CRL download using wget
343     and the PEM-converted version of that file) are now created using
344     mktemp
345     * the RetrieveFileByURL function will not overwrite files that
346     have any data in them
347     * Note that the script can be run by a non-priviledged user, but
348     that the output directory must be made writable by that user
349     in an out-of-band way.
350    
351     EDG version 1.7
352     ---------------
353     Imported with consent of Fabio Hernandez and Steve Traylen from
354     the original EDG repository.
355     The EU DataGrid License applies, see http://www.eu-datagrid.org/

grid.support@nikhef.nl
ViewVC Help
Powered by ViewVC 1.1.28