/[pdpsoft]/nl.nikhef.pdp.fetchcrl/trunk/CHANGES
ViewVC logotype

Annotation of /nl.nikhef.pdp.fetchcrl/trunk/CHANGES

Parent Directory Parent Directory | Revision Log Revision Log


Revision 3178 - (hide annotations) (download)
Tue Apr 11 07:16:27 2017 UTC (4 years, 6 months ago) by davidg
File size: 18691 byte(s)
Qualify socket error messages at verb=4 and print only first error (bugzilla #29)

1 davidg 1758 ==============================================================================
2     CHANGES to fetch-crl - the Certificate Revocation List retrieval tool
3     ==============================================================================
4     The fetch-crl utility will retrieve certificate revocation lists (CRLs) for
5     a set of installed trust anchors, based on crl_url files or IGTF-style info
6     files. It will install these for use with OpenSSL, NSS or third-party tools.
7    
8 davidg 3178 Changes in 3.0.20-1
9     ----------------------
10     * network connection failure messages are pre-filtered and only primary
11     status lines shown in logs for download and head requests (bugzilla #29)
12    
13 davidg 3171 Changes in 3.0.19-1
14     ----------------------
15     * Do not add spurious newline to DER-format files (fixes report 201670320-01)
16     * run a script after the completion of every fetch-crl run (uses postexec
17     directive in config file)
18    
19 davidg 2804 Changes in 3.0.17-1
20     ----------------------
21     * Add optional cache-control max-age headers in all requests to hint a
22     maximum caching time to intermediate servers (bugzilla #26)
23    
24 davidg 2783 Changes in 3.0.16-1
25     ----------------------
26     * Added cache state freshness constraints (default maxcachetime set to 96hrs)
27     * Re-set cache expiry of state data if CRL nextUpdate is within or beyond
28     7 hrs (config "expirestolerance") claimed URL Expiry or Cache-control max-age
29    
30 davidg 2761 Changes in 3.0.15-1
31     ----------------------
32     * Fixed issues resulting in undefined attribute values to be returned for CRL
33    
34 davidg 2715 Changes in 3.0.14-1
35     ----------------------
36     * Requesting CRL retrieval for an empty trust anchor store is now a warning
37     and no longer an error
38    
39 davidg 2690 Changes in 3.0.13-1
40     ----------------------
41     * Supplied system init script for boot phase will not re-run inadvertently
42 davidg 2693 * Add rcmode config option (added differentiated reporting and success-on-
43     solely-retrieval-errors)
44     * Add --define key=val command line argument to augment configuration data
45 davidg 2694 * Setting FETCHCRL_OPTIONS in /etc/sysconfig/fetch-crl will add these
46     options to the commandline of fetch-crl on start from cron or at boot time
47     Setting FETCHCRL_BOOT_OPTIONS adds them to the boot init script only
48     (e.g. FETCHCRLBOOTOPTIONS="--define rcmode=differentiated")
49     and FETCHCRL_CRON_OPTIONS does the same only for the cron job script
50 davidg 2690
51 davidg 2672 Changes in 3.0.12-1
52     ----------------------
53     * PEM formatted CRLs now always include a final newline character (fix
54     provided by Harald Barth <haba@kth.se>)
55    
56 davidg 2639 Changes in 3.0.11-1
57     ----------------------
58     * Added reference to /etc/fetch-crl.d/ to the man page, used shortened URL
59     to full documentation in man page
60 davidg 2648 * Added version information to help output and added -V option
61     * Added a dangerous clean-crl script to remove stale .r* files (beware!)
62 davidg 2639
63 davidg 2608 Changes in 3.0.10-1
64     ----------------------
65     * Added a "noquiet" option in the configuration file that will override
66     the default single "-q" option in the cro-job that is shipped with
67     the fetch-crl3 init scripts (feature request by Ryan Taylor)
68     * Added option "--inet6glue" and "inet6glue" config setting to load
69 davidg 2609 the Net::INET6Glue perl module (if it is available) to use IPv6
70 davidg 2608 connections in LWP to download CRLs
71    
72 davidg 2433 Changes in 3.0.8-1
73     ----------------------
74     * Trust anchor name inferrence based on retrieved-CRL added as option (at cost
75     of retrieving CRL even if there is no accompanying trust anchor found later)
76     Option is disabled by default, but can be enabled by using @HASH@ in the
77     ca-template name list. (feature request by Rob van der Wal, SARA, NL)
78    
79 davidg 2305 Changes in 3.0.7-1
80     ----------------------
81     * CRL modofication time heuristic inadvertently modified file name templates
82     (solves issue kindly reported by Elan Ruusamae)
83     * Expanded representation of tokenisation characters in strings to work
84     around bug in file(1) (rhbz#699546, works around RedHat Bugzilla 699548)
85    
86 davidg 2233 Changes in 3.0.6-1
87     ----------------------
88     * Response parsing disabled to suppress superfluous warning on unexpected
89     UTF-8 respons when retrieving a CRL (solves RedHat Bugzilla 688902)
90    
91 davidg 2188 Changes in 3.0.5-1
92     ----------------------
93     * CRLs for multiple similarly-named trust anchors might not all be downloaded.
94     This is fixed in this release.
95     * Spurious "restoreLogMode" internal errors are no longer raised
96    
97 davidg 2085 Changes in 3.0.4-1
98     ----------------------
99     * Add support for directory based drop-in configuration in /etc/fetch-crl.d/
100     * Only use cached CRL contents if the nextUpdate time of the cached CRL is
101     still in the future. This will ensure that a new download is attempted
102     each and everytime for CRLs that have already expired.
103    
104 davidg 1924 Changes in 3.0.3-1
105     ----------------------
106     * Clean up of man page format macro PU (reported by Mattias Ellert)
107    
108 davidg 1922 Changes in 3.0.2-1
109     ----------------------
110     * Clean up of man page format macro PU (reported by Mattias Ellert)
111    
112 davidg 1901 Changes in 3.0.1-1
113     ----------------------
114     * hunts through more places to find the latest successful CRL download to
115     set the latest local modification time for a CRL
116     (resolves a comparison error in case output and infodir are unset)
117    
118 davidg 1878 Changes in 3.0.0-0.RC4
119     ----------------------
120     * the config file name has changed to fetch-crl.conf, although a
121     fetch-crl.cnf file will also be used when present
122     * symlinked meta-data files can be ignored with the --nosymlinks option
123     (or nosymlinks in the configuration file). This allows fetch-crl to be
124     used effectively with new-format IGTF distribution before 1.37
125     * infinite loop for non-indexed CA file names fixed
126    
127 davidg 1758 Changes in fetch-crl 3.0
128     ------------------------
129     * fetch-crl 3.0 is a complete re-write, and shares no code with the 1.x and
130     2.x series utility of the same name, although the function and some of
131     the syntax is obviously the same
132    
133     * support for multiple output formats: OpenSSL 1 in dual-hash mode, specific
134     DER and PEM outputs, and NSS databases
135     * support for multiple CRLs for a single CA, allowing more than one CA with
136     the same subject name but different CLRs. Review your client software to see
137     if and how these CRLs are used.
138     * stateful retrieval helps reduce bandwidth usage by caching the CRLs locally
139     and respecting the Cache Control headers sent by the web server hosting the
140     CRL. This can reduce the number of downloads
141     * support for HEAD-only requests when state preservation is used (initially
142     only retrieve HTTP headers, and only if the CRL actually changed to a full
143     download)
144     * support for more CRL retrieval protocols (file:// and ftp://)
145     * ability to try site-local URLs first, before relying on the URLs shipped with
146     the trust anchor. This allows building an explicit local caching (web) server.
147     * ability to specify additional URLs to try in case the URLs shipped with the
148     trust anchor were not responsive. This allows for automatic fall-back to
149     (local or global) mirror services for CRL downloads
150     * warnings and errors can be suppressed on a per-trust anchor basis, to allow
151     silencing for particularly unstable trust anchors
152     * aging tolerance (the delay time before errors are generated in case downloads
153     consistently fail) can be configured on a per-trust anchor basis
154     * parallel downloading for multiple trust anchors
155     * minimized use of temporary files in the file system (now limited to the
156     invocation of OpenSSL only, and only for brief periods of time)
157     * dependencies on wget, lynx and other unix utilities have been removed
158     * explicit web proxy support (using LWP http proxies)
159     * completely re-written in perl, with some (hopefully minimal) dependencies:
160     LWP, Sys::Syslog, POSIX. And Data::Dumper (when debugging is enabled),
161     and IO::Select (if parallel downloads are enabled).
162    
163     Differences with respect to the previous versions
164    
165     * when downloading CRLs via https, the server certificate is not checked,
166     neither for the correct DNS name nor for being issued by a valid CA. Since
167     the CRL in itself is signed, this is not a security vulnerability. If
168     stricter checking is anyway desired, and the Crypt::SSLeay perl module has
169     been installed, set the HTTPS_CA_FILE environment variable before invoking
170     fetch-crl -- but keep in mind that the DNS name verification is limited
171     and will (incorrectly) reject DNS names if these are listed only in the
172     subjectAlternativeName of the server certificate
173     * Existing files with a name that matches a CRL target name are overwritten,
174     even if they did not originally contain CRL data. In v2 this was configurable
175     via the FORCE_OVERWRITE configuration setting. In version 3, files are
176     overwritten by default, and this can no longer be configured.
177     * fetch-crl3 will no longer check CA certificates for consistency or validity
178     by themselves, only retrieved CRLs are verified
179    
180     Downsides of the new version
181    
182     * it requires perl5 to be installed (tested with perl 5.8.0 and higher) with
183     libwww-perl, whereas version 2 only required a traditional Bourne shell
184     * requires a version of OpenSSL (0.9.5a or better) to be installed. Needs
185     OpenSSL 1.0.0 (at least beta5) for dual-hash support.
186     * when using parallel downloads, it can only run on pure-POSIX systems
187     * parallelism in combination with the NSS database output format is not tested
188     * Even when only the NSS database output format has been selected, OpenSSL is
189     still needed for verification and processing
190    
191    
192     ==============================================================================
193    
194     The change log below applies to the 1.x and 2.x series fetch-crl and is
195     included for historical purposes only. Fetch-crl3, with which this
196     changes file is being shipped, is a complete re-write of the utility.
197     Although a lot of backwards compatibility has been preserves, there have
198     been significant changes and the information below should NOT be used
199     to infer any behaviour of fetch-crl3.
200    
201     Fetch-crl 1.x and 2.x were released under the EU DataGrid License.
202    
203     Changes in version EGP 2.8.5
204     ----------------------------
205     (2010.06.03)
206    
207     * fetch-crl was occasionally leaving behind {hash}.r0.XXXXXX.r0 files
208     This has been fixed in this release (patch thanks to Jason Smith, BNL)
209     * man page was not compliant to Debian guidelines, this has been fixed
210     (patch thanks to Mattias Ellert, Uppsala University)
211    
212     Changes in version EGP 2.8.4
213     ----------------------------
214     (2010.04.04)
215    
216     * Fixes error when randomWait is not set [RH Bug 579488]
217    
218     Changes in version EGP 2.8.3
219     ----------------------------
220     (2010.03.28)
221    
222     * Preserve SELinux context for CRL files if SElinux status program exists
223     and selinux is enabled (RH bug 577403)
224     * Fix argument parsing on syslog facility specification (RH bug 577387)
225     * Increase granularity of the RandomWait and allow for 0 in -r option
226    
227     Changes in version EGP 2.8.2
228     ----------------------------
229     (2010.03.03)
230    
231     * Improved support for multiple CRL URLs by downloading until a success
232     is achieved, instead of downloading all of them
233     * Imported randomwait patch from Steve Traylen
234    
235     Changes in version EGP 2.8.1
236     ----------------------------
237     (2010.01.26)
238    
239     * The installed CRL file is re-checked for validity to catch file system
240     errors and local disk corruption. When possible, it will try to restore
241     a backup copy. Failures are not subject to aging tolerance.
242    
243     Changes in version EGP 2.8.0
244     ----------------------------
245     (2009.09.22)
246    
247     * The RPM packaging has been overhauled and is now sufficiently conformant
248     to EPEL and FedoraProject guidelines.
249     * New init scripts and a cron job entry have been added to allow management
250     of fetch-crl via the chkconfig mechanism
251    
252     These changes were contributed by Steve Traylen (CERN, Geneva, CH).
253    
254     Changes in version EGP 2.7.0
255     ----------------------------
256     (2009.01.25)
257    
258     * Warnings and errors are now counted. If there are errors in the download
259     or verification process for one or more CRLs, the exit status will be 1;
260     if there are errors in the local setup or in the script invocation, the
261     exit status will be 2.
262     * The installed CRLs no longer have the textual representation of the CRL,
263     but only the PEM data blob, thus reducing IO and memory requirements.
264     * the CRL aging threshold is now set by default to 24 hours. The previous
265     default was 0. The CRL aging threshold is set in the config file using
266     CRL_AGING_THRESHOLD=<xx>, or with the "-a" command-line argument.
267     * Default network timeouts reduced to 10 seconds (was 30) and retries to 2
268     * Added caching and conditional downloading. When CACHEDIR is set, the
269     original downloads are preserved and wget timestamping mode enabled.
270     When the content did not change, only the timestamp on the installed
271     CRL is updated. If SLOPPYCRLHASHES is set, the has is calculated based
272     on the name of the crl_url file, otherwise it is taken from the CRL itself.
273     - The CACHEDIR must be exclusively writable by the user running fetch-crl
274     - Setting CACHEDIR significantly reduced the bandwidth used by fetch-crl
275     * Added RESETPATHMODE setting in sysconfig. It defines whether or not to
276     set re-set $PATH to "/bin:/usr/bin" before start. The search for OpenSSL
277     may be done based on the old path.
278     yes=always replace; searchopenssl=search for openssl first and then reset;
279     no=keep original path, whatever that me be (may be empty if called from cron)
280     Default="yes". This replaces the hard-coded path in the tool!
281     * Hidden "FORCE_OVERWRITE" option now has a regular name. This is backwards-
282     compatible. Set FORCE_OVERWRITE=yes if you want files overwritten that
283     have a CRL-like name and ought to have CRL content, but currently do not.
284     * Addresses gLite Savannah bugs 28418 and 29559. Bug 27023 is partially
285     addressed. Bug 20062 can be remedied with WGET_OPTS arguments.
286     Addresses OSG ticket 4673.
287    
288     Changes in version EGP 2.6.6
289     ----------------------------
290     (2007.09.16)
291     (version 2.5.5 is invalid and was not publicly released)
292    
293     * Added obscure configuration parameter to allow overwriting of
294     arbitrary data files with a downloaded CRL (on request of
295     CERN, see https://savannah.cern.ch/bugs/index.php?29559)
296    
297     Changes in version EGP 2.6.4
298     ----------------------------
299     (2007.08.15)
300    
301     * Expired CA issuer certificate now gives a warning instead of an error
302     with the full verification result message
303     * additional logfile output target can be selected via the configuration file
304     * CRL aging threshold documented in manual page. Errors will now also be
305     generated in the CRL download failed consistently and the current CRL
306     has already expired
307    
308     Changes in version EGP 2.6.3
309     ----------------------------
310     (2006.11.13)
311    
312     * cron job example: fetch-crl invocation syntax error corrected
313    
314     Changes in version EGP 2.6.2
315     ----------------------------
316     (2006.10.27)
317    
318     * fixed bug: older wget versions do not recognise --no-check-certificate
319    
320     Changes in version EGP 2.6.1
321     ----------------------------
322     (2006.10.25)
323    
324     * fixed local timezone vs UTC error in LastUpdate CRL validation comparison
325     * fixed time comparison is the one-hour LastUpdate/download tolerance
326     (both fixes thanks to Alain Roy)
327     * added support for directory names containing whitespace
328     * added support for syslog reporting (via -f option or SYSLOGFACILITY directive)
329     * SERVERCERTCHECK=no is now the default. It can be reset via the configuration
330     file, or using the "--check-server-certificate" commandline option
331     * the main configuration file location (formerly fixed to be
332     /etc/sysconfig/fetch-crl) can now be set via the variable $FETCH_CRL_SYSCONFIG
333     * logfile format timestamp and tag have been normalised
334    
335     Changes in version EGP 2.6
336     --------------------------
337     (2006.05.20)
338    
339     * if the current local CRL has a lastUpdate time in the future, and the
340     newly downloaded CRL is older that the current one, allow the installation
341     of the newly downloaded CRL and issue a warning.
342     * added non-suppressable warning in case the newly downloaded CRL has a
343     lastUpdate time in the future, but install that CRL anyway (as the local
344     clock might have been wrong).
345    
346     Changes in version EGP 2.5
347     --------------------------
348     (2006.01.16)
349    
350     * added additional configuration arguments and configuration variables
351     to skip the server certificate check in wget
352     (to support https:// URLs where the server is authenticated with
353     a certificate that is not part of it's own trusted domain, such as
354     the KISTI URL)
355    
356     Changes in version EGP 2.4
357     --------------------------
358     (2005.11.15)
359    
360     * for those platforms that support the stat(1) command, and in case the
361     .crl_url file is named after the hash of the crl subject name to download,
362     error eporting for individual download errors can be suppressed for
363     a configurable amount of time as set via the "-a" option (unit: hours).
364    
365     Changes in version EGP 2.3
366     --------------------------
367     (2005.11.05)
368    
369     * do not replace recent CRLs with ones that have an older lastUpdate
370     timestamp (prevents ARP/DNS DoS attacks)
371    
372     Changes in version EGP 2.2
373     --------------------------
374     (2005.10.27)
375    
376     * secure http download by wget recognise the CAs in the trusted directory.
377     solves the issue described in the LCG bug tracking system
378     https://savannah.cern.ch/bugs/index.php?func=detailitem&item_id=12182
379    
380     Changes in version EGP 2.1
381     --------------------------
382     (2005.08.12)
383     * specifically look for the most recent version of OpenSSL. The
384     one in GLOBUS_LOCATION (which used to take precedence in the
385     previous releases) is outdated in many cases and caused
386     troubles on the LCG production systems in validating v2 CRLs
387     * added manual page fetch-crl(8)
388    
389     Changes in version EGP 2.0
390     --------------------------
391     (2005.02.28)
392     * name of the installed script changed to "fetch-crl"
393     * the cronjob script is no longer installed by default, but supplied
394     as an example in the %doc directory
395     * RPM is now relocatable (default install in /usr)
396     * READMA and CHANGES file now inclued in %doc tree
397     * make install now installs
398     * version increased to 2.0
399    
400     Changes in version EGP 1.9
401     --------------------------
402     (2005.02.24)
403     * the content of the final target CRL file is now checked for
404     containing a valid CRL if it already exists. If it does not
405     contain a CRL, an error is displayed and the file left untouched
406     So making the final ".r0" file in ${outdir} a link to something else
407     will not work, preventing an escalation in the final stage.
408    
409     Changes in version EGP 1.8
410     --------------------------
411     (changes from Fabio's version 1.7, 2005.02.24)
412    
413     * All temporary files (the initial CRL download using wget
414     and the PEM-converted version of that file) are now created using
415     mktemp
416     * the RetrieveFileByURL function will not overwrite files that
417     have any data in them
418     * Note that the script can be run by a non-priviledged user, but
419     that the output directory must be made writable by that user
420     in an out-of-band way.
421    
422     EDG version 1.7
423     ---------------
424     Imported with consent of Fabio Hernandez and Steve Traylen from
425     the original EDG repository.
426     The EU DataGrid License applies, see http://www.eu-datagrid.org/

grid.support@nikhef.nl
ViewVC Help
Powered by ViewVC 1.1.28