/[pdpsoft]/nl.nikhef.pdp.fetchcrl/trunk/CHANGES
ViewVC logotype

Annotation of /nl.nikhef.pdp.fetchcrl/trunk/CHANGES

Parent Directory Parent Directory | Revision Log Revision Log


Revision 2715 - (hide annotations) (download)
Fri Jun 13 15:13:13 2014 UTC (7 years, 4 months ago) by davidg
File size: 17700 byte(s)
Empty trust anchor dir is now a warning, not an error

1 davidg 1758 ==============================================================================
2     CHANGES to fetch-crl - the Certificate Revocation List retrieval tool
3     ==============================================================================
4     The fetch-crl utility will retrieve certificate revocation lists (CRLs) for
5     a set of installed trust anchors, based on crl_url files or IGTF-style info
6     files. It will install these for use with OpenSSL, NSS or third-party tools.
7    
8 davidg 2715 Changes in 3.0.14-1
9     ----------------------
10     * Requesting CRL retrieval for an empty trust anchor store is now a warning
11     and no longer an error
12    
13 davidg 2690 Changes in 3.0.13-1
14     ----------------------
15     * Supplied system init script for boot phase will not re-run inadvertently
16 davidg 2693 * Add rcmode config option (added differentiated reporting and success-on-
17     solely-retrieval-errors)
18     * Add --define key=val command line argument to augment configuration data
19 davidg 2694 * Setting FETCHCRL_OPTIONS in /etc/sysconfig/fetch-crl will add these
20     options to the commandline of fetch-crl on start from cron or at boot time
21     Setting FETCHCRL_BOOT_OPTIONS adds them to the boot init script only
22     (e.g. FETCHCRLBOOTOPTIONS="--define rcmode=differentiated")
23     and FETCHCRL_CRON_OPTIONS does the same only for the cron job script
24 davidg 2690
25 davidg 2672 Changes in 3.0.12-1
26     ----------------------
27     * PEM formatted CRLs now always include a final newline character (fix
28     provided by Harald Barth <haba@kth.se>)
29    
30 davidg 2639 Changes in 3.0.11-1
31     ----------------------
32     * Added reference to /etc/fetch-crl.d/ to the man page, used shortened URL
33     to full documentation in man page
34 davidg 2648 * Added version information to help output and added -V option
35     * Added a dangerous clean-crl script to remove stale .r* files (beware!)
36 davidg 2639
37 davidg 2608 Changes in 3.0.10-1
38     ----------------------
39     * Added a "noquiet" option in the configuration file that will override
40     the default single "-q" option in the cro-job that is shipped with
41     the fetch-crl3 init scripts (feature request by Ryan Taylor)
42     * Added option "--inet6glue" and "inet6glue" config setting to load
43 davidg 2609 the Net::INET6Glue perl module (if it is available) to use IPv6
44 davidg 2608 connections in LWP to download CRLs
45    
46 davidg 2433 Changes in 3.0.8-1
47     ----------------------
48     * Trust anchor name inferrence based on retrieved-CRL added as option (at cost
49     of retrieving CRL even if there is no accompanying trust anchor found later)
50     Option is disabled by default, but can be enabled by using @HASH@ in the
51     ca-template name list. (feature request by Rob van der Wal, SARA, NL)
52    
53 davidg 2305 Changes in 3.0.7-1
54     ----------------------
55     * CRL modofication time heuristic inadvertently modified file name templates
56     (solves issue kindly reported by Elan Ruusamae)
57     * Expanded representation of tokenisation characters in strings to work
58     around bug in file(1) (rhbz#699546, works around RedHat Bugzilla 699548)
59    
60 davidg 2233 Changes in 3.0.6-1
61     ----------------------
62     * Response parsing disabled to suppress superfluous warning on unexpected
63     UTF-8 respons when retrieving a CRL (solves RedHat Bugzilla 688902)
64    
65 davidg 2188 Changes in 3.0.5-1
66     ----------------------
67     * CRLs for multiple similarly-named trust anchors might not all be downloaded.
68     This is fixed in this release.
69     * Spurious "restoreLogMode" internal errors are no longer raised
70    
71 davidg 2085 Changes in 3.0.4-1
72     ----------------------
73     * Add support for directory based drop-in configuration in /etc/fetch-crl.d/
74     * Only use cached CRL contents if the nextUpdate time of the cached CRL is
75     still in the future. This will ensure that a new download is attempted
76     each and everytime for CRLs that have already expired.
77    
78 davidg 1924 Changes in 3.0.3-1
79     ----------------------
80     * Clean up of man page format macro PU (reported by Mattias Ellert)
81    
82 davidg 1922 Changes in 3.0.2-1
83     ----------------------
84     * Clean up of man page format macro PU (reported by Mattias Ellert)
85    
86 davidg 1901 Changes in 3.0.1-1
87     ----------------------
88     * hunts through more places to find the latest successful CRL download to
89     set the latest local modification time for a CRL
90     (resolves a comparison error in case output and infodir are unset)
91    
92 davidg 1878 Changes in 3.0.0-0.RC4
93     ----------------------
94     * the config file name has changed to fetch-crl.conf, although a
95     fetch-crl.cnf file will also be used when present
96     * symlinked meta-data files can be ignored with the --nosymlinks option
97     (or nosymlinks in the configuration file). This allows fetch-crl to be
98     used effectively with new-format IGTF distribution before 1.37
99     * infinite loop for non-indexed CA file names fixed
100    
101 davidg 1758 Changes in fetch-crl 3.0
102     ------------------------
103     * fetch-crl 3.0 is a complete re-write, and shares no code with the 1.x and
104     2.x series utility of the same name, although the function and some of
105     the syntax is obviously the same
106    
107     * support for multiple output formats: OpenSSL 1 in dual-hash mode, specific
108     DER and PEM outputs, and NSS databases
109     * support for multiple CRLs for a single CA, allowing more than one CA with
110     the same subject name but different CLRs. Review your client software to see
111     if and how these CRLs are used.
112     * stateful retrieval helps reduce bandwidth usage by caching the CRLs locally
113     and respecting the Cache Control headers sent by the web server hosting the
114     CRL. This can reduce the number of downloads
115     * support for HEAD-only requests when state preservation is used (initially
116     only retrieve HTTP headers, and only if the CRL actually changed to a full
117     download)
118     * support for more CRL retrieval protocols (file:// and ftp://)
119     * ability to try site-local URLs first, before relying on the URLs shipped with
120     the trust anchor. This allows building an explicit local caching (web) server.
121     * ability to specify additional URLs to try in case the URLs shipped with the
122     trust anchor were not responsive. This allows for automatic fall-back to
123     (local or global) mirror services for CRL downloads
124     * warnings and errors can be suppressed on a per-trust anchor basis, to allow
125     silencing for particularly unstable trust anchors
126     * aging tolerance (the delay time before errors are generated in case downloads
127     consistently fail) can be configured on a per-trust anchor basis
128     * parallel downloading for multiple trust anchors
129     * minimized use of temporary files in the file system (now limited to the
130     invocation of OpenSSL only, and only for brief periods of time)
131     * dependencies on wget, lynx and other unix utilities have been removed
132     * explicit web proxy support (using LWP http proxies)
133     * completely re-written in perl, with some (hopefully minimal) dependencies:
134     LWP, Sys::Syslog, POSIX. And Data::Dumper (when debugging is enabled),
135     and IO::Select (if parallel downloads are enabled).
136    
137     Differences with respect to the previous versions
138    
139     * when downloading CRLs via https, the server certificate is not checked,
140     neither for the correct DNS name nor for being issued by a valid CA. Since
141     the CRL in itself is signed, this is not a security vulnerability. If
142     stricter checking is anyway desired, and the Crypt::SSLeay perl module has
143     been installed, set the HTTPS_CA_FILE environment variable before invoking
144     fetch-crl -- but keep in mind that the DNS name verification is limited
145     and will (incorrectly) reject DNS names if these are listed only in the
146     subjectAlternativeName of the server certificate
147     * Existing files with a name that matches a CRL target name are overwritten,
148     even if they did not originally contain CRL data. In v2 this was configurable
149     via the FORCE_OVERWRITE configuration setting. In version 3, files are
150     overwritten by default, and this can no longer be configured.
151     * fetch-crl3 will no longer check CA certificates for consistency or validity
152     by themselves, only retrieved CRLs are verified
153    
154     Downsides of the new version
155    
156     * it requires perl5 to be installed (tested with perl 5.8.0 and higher) with
157     libwww-perl, whereas version 2 only required a traditional Bourne shell
158     * requires a version of OpenSSL (0.9.5a or better) to be installed. Needs
159     OpenSSL 1.0.0 (at least beta5) for dual-hash support.
160     * when using parallel downloads, it can only run on pure-POSIX systems
161     * parallelism in combination with the NSS database output format is not tested
162     * Even when only the NSS database output format has been selected, OpenSSL is
163     still needed for verification and processing
164    
165    
166     ==============================================================================
167    
168     The change log below applies to the 1.x and 2.x series fetch-crl and is
169     included for historical purposes only. Fetch-crl3, with which this
170     changes file is being shipped, is a complete re-write of the utility.
171     Although a lot of backwards compatibility has been preserves, there have
172     been significant changes and the information below should NOT be used
173     to infer any behaviour of fetch-crl3.
174    
175     Fetch-crl 1.x and 2.x were released under the EU DataGrid License.
176    
177     Changes in version EGP 2.8.5
178     ----------------------------
179     (2010.06.03)
180    
181     * fetch-crl was occasionally leaving behind {hash}.r0.XXXXXX.r0 files
182     This has been fixed in this release (patch thanks to Jason Smith, BNL)
183     * man page was not compliant to Debian guidelines, this has been fixed
184     (patch thanks to Mattias Ellert, Uppsala University)
185    
186     Changes in version EGP 2.8.4
187     ----------------------------
188     (2010.04.04)
189    
190     * Fixes error when randomWait is not set [RH Bug 579488]
191    
192     Changes in version EGP 2.8.3
193     ----------------------------
194     (2010.03.28)
195    
196     * Preserve SELinux context for CRL files if SElinux status program exists
197     and selinux is enabled (RH bug 577403)
198     * Fix argument parsing on syslog facility specification (RH bug 577387)
199     * Increase granularity of the RandomWait and allow for 0 in -r option
200    
201     Changes in version EGP 2.8.2
202     ----------------------------
203     (2010.03.03)
204    
205     * Improved support for multiple CRL URLs by downloading until a success
206     is achieved, instead of downloading all of them
207     * Imported randomwait patch from Steve Traylen
208    
209     Changes in version EGP 2.8.1
210     ----------------------------
211     (2010.01.26)
212    
213     * The installed CRL file is re-checked for validity to catch file system
214     errors and local disk corruption. When possible, it will try to restore
215     a backup copy. Failures are not subject to aging tolerance.
216    
217     Changes in version EGP 2.8.0
218     ----------------------------
219     (2009.09.22)
220    
221     * The RPM packaging has been overhauled and is now sufficiently conformant
222     to EPEL and FedoraProject guidelines.
223     * New init scripts and a cron job entry have been added to allow management
224     of fetch-crl via the chkconfig mechanism
225    
226     These changes were contributed by Steve Traylen (CERN, Geneva, CH).
227    
228     Changes in version EGP 2.7.0
229     ----------------------------
230     (2009.01.25)
231    
232     * Warnings and errors are now counted. If there are errors in the download
233     or verification process for one or more CRLs, the exit status will be 1;
234     if there are errors in the local setup or in the script invocation, the
235     exit status will be 2.
236     * The installed CRLs no longer have the textual representation of the CRL,
237     but only the PEM data blob, thus reducing IO and memory requirements.
238     * the CRL aging threshold is now set by default to 24 hours. The previous
239     default was 0. The CRL aging threshold is set in the config file using
240     CRL_AGING_THRESHOLD=<xx>, or with the "-a" command-line argument.
241     * Default network timeouts reduced to 10 seconds (was 30) and retries to 2
242     * Added caching and conditional downloading. When CACHEDIR is set, the
243     original downloads are preserved and wget timestamping mode enabled.
244     When the content did not change, only the timestamp on the installed
245     CRL is updated. If SLOPPYCRLHASHES is set, the has is calculated based
246     on the name of the crl_url file, otherwise it is taken from the CRL itself.
247     - The CACHEDIR must be exclusively writable by the user running fetch-crl
248     - Setting CACHEDIR significantly reduced the bandwidth used by fetch-crl
249     * Added RESETPATHMODE setting in sysconfig. It defines whether or not to
250     set re-set $PATH to "/bin:/usr/bin" before start. The search for OpenSSL
251     may be done based on the old path.
252     yes=always replace; searchopenssl=search for openssl first and then reset;
253     no=keep original path, whatever that me be (may be empty if called from cron)
254     Default="yes". This replaces the hard-coded path in the tool!
255     * Hidden "FORCE_OVERWRITE" option now has a regular name. This is backwards-
256     compatible. Set FORCE_OVERWRITE=yes if you want files overwritten that
257     have a CRL-like name and ought to have CRL content, but currently do not.
258     * Addresses gLite Savannah bugs 28418 and 29559. Bug 27023 is partially
259     addressed. Bug 20062 can be remedied with WGET_OPTS arguments.
260     Addresses OSG ticket 4673.
261    
262     Changes in version EGP 2.6.6
263     ----------------------------
264     (2007.09.16)
265     (version 2.5.5 is invalid and was not publicly released)
266    
267     * Added obscure configuration parameter to allow overwriting of
268     arbitrary data files with a downloaded CRL (on request of
269     CERN, see https://savannah.cern.ch/bugs/index.php?29559)
270    
271     Changes in version EGP 2.6.4
272     ----------------------------
273     (2007.08.15)
274    
275     * Expired CA issuer certificate now gives a warning instead of an error
276     with the full verification result message
277     * additional logfile output target can be selected via the configuration file
278     * CRL aging threshold documented in manual page. Errors will now also be
279     generated in the CRL download failed consistently and the current CRL
280     has already expired
281    
282     Changes in version EGP 2.6.3
283     ----------------------------
284     (2006.11.13)
285    
286     * cron job example: fetch-crl invocation syntax error corrected
287    
288     Changes in version EGP 2.6.2
289     ----------------------------
290     (2006.10.27)
291    
292     * fixed bug: older wget versions do not recognise --no-check-certificate
293    
294     Changes in version EGP 2.6.1
295     ----------------------------
296     (2006.10.25)
297    
298     * fixed local timezone vs UTC error in LastUpdate CRL validation comparison
299     * fixed time comparison is the one-hour LastUpdate/download tolerance
300     (both fixes thanks to Alain Roy)
301     * added support for directory names containing whitespace
302     * added support for syslog reporting (via -f option or SYSLOGFACILITY directive)
303     * SERVERCERTCHECK=no is now the default. It can be reset via the configuration
304     file, or using the "--check-server-certificate" commandline option
305     * the main configuration file location (formerly fixed to be
306     /etc/sysconfig/fetch-crl) can now be set via the variable $FETCH_CRL_SYSCONFIG
307     * logfile format timestamp and tag have been normalised
308    
309     Changes in version EGP 2.6
310     --------------------------
311     (2006.05.20)
312    
313     * if the current local CRL has a lastUpdate time in the future, and the
314     newly downloaded CRL is older that the current one, allow the installation
315     of the newly downloaded CRL and issue a warning.
316     * added non-suppressable warning in case the newly downloaded CRL has a
317     lastUpdate time in the future, but install that CRL anyway (as the local
318     clock might have been wrong).
319    
320     Changes in version EGP 2.5
321     --------------------------
322     (2006.01.16)
323    
324     * added additional configuration arguments and configuration variables
325     to skip the server certificate check in wget
326     (to support https:// URLs where the server is authenticated with
327     a certificate that is not part of it's own trusted domain, such as
328     the KISTI URL)
329    
330     Changes in version EGP 2.4
331     --------------------------
332     (2005.11.15)
333    
334     * for those platforms that support the stat(1) command, and in case the
335     .crl_url file is named after the hash of the crl subject name to download,
336     error eporting for individual download errors can be suppressed for
337     a configurable amount of time as set via the "-a" option (unit: hours).
338    
339     Changes in version EGP 2.3
340     --------------------------
341     (2005.11.05)
342    
343     * do not replace recent CRLs with ones that have an older lastUpdate
344     timestamp (prevents ARP/DNS DoS attacks)
345    
346     Changes in version EGP 2.2
347     --------------------------
348     (2005.10.27)
349    
350     * secure http download by wget recognise the CAs in the trusted directory.
351     solves the issue described in the LCG bug tracking system
352     https://savannah.cern.ch/bugs/index.php?func=detailitem&item_id=12182
353    
354     Changes in version EGP 2.1
355     --------------------------
356     (2005.08.12)
357     * specifically look for the most recent version of OpenSSL. The
358     one in GLOBUS_LOCATION (which used to take precedence in the
359     previous releases) is outdated in many cases and caused
360     troubles on the LCG production systems in validating v2 CRLs
361     * added manual page fetch-crl(8)
362    
363     Changes in version EGP 2.0
364     --------------------------
365     (2005.02.28)
366     * name of the installed script changed to "fetch-crl"
367     * the cronjob script is no longer installed by default, but supplied
368     as an example in the %doc directory
369     * RPM is now relocatable (default install in /usr)
370     * READMA and CHANGES file now inclued in %doc tree
371     * make install now installs
372     * version increased to 2.0
373    
374     Changes in version EGP 1.9
375     --------------------------
376     (2005.02.24)
377     * the content of the final target CRL file is now checked for
378     containing a valid CRL if it already exists. If it does not
379     contain a CRL, an error is displayed and the file left untouched
380     So making the final ".r0" file in ${outdir} a link to something else
381     will not work, preventing an escalation in the final stage.
382    
383     Changes in version EGP 1.8
384     --------------------------
385     (changes from Fabio's version 1.7, 2005.02.24)
386    
387     * All temporary files (the initial CRL download using wget
388     and the PEM-converted version of that file) are now created using
389     mktemp
390     * the RetrieveFileByURL function will not overwrite files that
391     have any data in them
392     * Note that the script can be run by a non-priviledged user, but
393     that the output directory must be made writable by that user
394     in an out-of-band way.
395    
396     EDG version 1.7
397     ---------------
398     Imported with consent of Fabio Hernandez and Steve Traylen from
399     the original EDG repository.
400     The EU DataGrid License applies, see http://www.eu-datagrid.org/

grid.support@nikhef.nl
ViewVC Help
Powered by ViewVC 1.1.28