/[pdpsoft]/nl.nikhef.pdp.fetchcrl/trunk/CHANGES
ViewVC logotype

Contents of /nl.nikhef.pdp.fetchcrl/trunk/CHANGES

Parent Directory Parent Directory | Revision Log Revision Log


Revision 1924 - (show annotations) (download)
Mon Sep 20 13:10:52 2010 UTC (11 years, 2 months ago) by davidg
Original Path: trunk/fetchcrl/CHANGES
File size: 14634 byte(s)
Fixed another issue in manpage

1 ==============================================================================
2 CHANGES to fetch-crl - the Certificate Revocation List retrieval tool
3 ==============================================================================
4 The fetch-crl utility will retrieve certificate revocation lists (CRLs) for
5 a set of installed trust anchors, based on crl_url files or IGTF-style info
6 files. It will install these for use with OpenSSL, NSS or third-party tools.
7
8 Changes in 3.0.3-1
9 ----------------------
10 * Clean up of man page format macro PU (reported by Mattias Ellert)
11
12 Changes in 3.0.2-1
13 ----------------------
14 * Clean up of man page format macro PU (reported by Mattias Ellert)
15
16 Changes in 3.0.1-1
17 ----------------------
18 * hunts through more places to find the latest successful CRL download to
19 set the latest local modification time for a CRL
20 (resolves a comparison error in case output and infodir are unset)
21
22 Changes in 3.0.0-0.RC4
23 ----------------------
24 * the config file name has changed to fetch-crl.conf, although a
25 fetch-crl.cnf file will also be used when present
26 * symlinked meta-data files can be ignored with the --nosymlinks option
27 (or nosymlinks in the configuration file). This allows fetch-crl to be
28 used effectively with new-format IGTF distribution before 1.37
29 * infinite loop for non-indexed CA file names fixed
30
31 Changes in fetch-crl 3.0
32 ------------------------
33 * fetch-crl 3.0 is a complete re-write, and shares no code with the 1.x and
34 2.x series utility of the same name, although the function and some of
35 the syntax is obviously the same
36
37 * support for multiple output formats: OpenSSL 1 in dual-hash mode, specific
38 DER and PEM outputs, and NSS databases
39 * support for multiple CRLs for a single CA, allowing more than one CA with
40 the same subject name but different CLRs. Review your client software to see
41 if and how these CRLs are used.
42 * stateful retrieval helps reduce bandwidth usage by caching the CRLs locally
43 and respecting the Cache Control headers sent by the web server hosting the
44 CRL. This can reduce the number of downloads
45 * support for HEAD-only requests when state preservation is used (initially
46 only retrieve HTTP headers, and only if the CRL actually changed to a full
47 download)
48 * support for more CRL retrieval protocols (file:// and ftp://)
49 * ability to try site-local URLs first, before relying on the URLs shipped with
50 the trust anchor. This allows building an explicit local caching (web) server.
51 * ability to specify additional URLs to try in case the URLs shipped with the
52 trust anchor were not responsive. This allows for automatic fall-back to
53 (local or global) mirror services for CRL downloads
54 * warnings and errors can be suppressed on a per-trust anchor basis, to allow
55 silencing for particularly unstable trust anchors
56 * aging tolerance (the delay time before errors are generated in case downloads
57 consistently fail) can be configured on a per-trust anchor basis
58 * parallel downloading for multiple trust anchors
59 * minimized use of temporary files in the file system (now limited to the
60 invocation of OpenSSL only, and only for brief periods of time)
61 * dependencies on wget, lynx and other unix utilities have been removed
62 * explicit web proxy support (using LWP http proxies)
63 * completely re-written in perl, with some (hopefully minimal) dependencies:
64 LWP, Sys::Syslog, POSIX. And Data::Dumper (when debugging is enabled),
65 and IO::Select (if parallel downloads are enabled).
66
67 Differences with respect to the previous versions
68
69 * when downloading CRLs via https, the server certificate is not checked,
70 neither for the correct DNS name nor for being issued by a valid CA. Since
71 the CRL in itself is signed, this is not a security vulnerability. If
72 stricter checking is anyway desired, and the Crypt::SSLeay perl module has
73 been installed, set the HTTPS_CA_FILE environment variable before invoking
74 fetch-crl -- but keep in mind that the DNS name verification is limited
75 and will (incorrectly) reject DNS names if these are listed only in the
76 subjectAlternativeName of the server certificate
77 * Existing files with a name that matches a CRL target name are overwritten,
78 even if they did not originally contain CRL data. In v2 this was configurable
79 via the FORCE_OVERWRITE configuration setting. In version 3, files are
80 overwritten by default, and this can no longer be configured.
81 * fetch-crl3 will no longer check CA certificates for consistency or validity
82 by themselves, only retrieved CRLs are verified
83
84 Downsides of the new version
85
86 * it requires perl5 to be installed (tested with perl 5.8.0 and higher) with
87 libwww-perl, whereas version 2 only required a traditional Bourne shell
88 * requires a version of OpenSSL (0.9.5a or better) to be installed. Needs
89 OpenSSL 1.0.0 (at least beta5) for dual-hash support.
90 * when using parallel downloads, it can only run on pure-POSIX systems
91 * parallelism in combination with the NSS database output format is not tested
92 * Even when only the NSS database output format has been selected, OpenSSL is
93 still needed for verification and processing
94
95
96 ==============================================================================
97
98 The change log below applies to the 1.x and 2.x series fetch-crl and is
99 included for historical purposes only. Fetch-crl3, with which this
100 changes file is being shipped, is a complete re-write of the utility.
101 Although a lot of backwards compatibility has been preserves, there have
102 been significant changes and the information below should NOT be used
103 to infer any behaviour of fetch-crl3.
104
105 Fetch-crl 1.x and 2.x were released under the EU DataGrid License.
106
107 Changes in version EGP 2.8.5
108 ----------------------------
109 (2010.06.03)
110
111 * fetch-crl was occasionally leaving behind {hash}.r0.XXXXXX.r0 files
112 This has been fixed in this release (patch thanks to Jason Smith, BNL)
113 * man page was not compliant to Debian guidelines, this has been fixed
114 (patch thanks to Mattias Ellert, Uppsala University)
115
116 Changes in version EGP 2.8.4
117 ----------------------------
118 (2010.04.04)
119
120 * Fixes error when randomWait is not set [RH Bug 579488]
121
122 Changes in version EGP 2.8.3
123 ----------------------------
124 (2010.03.28)
125
126 * Preserve SELinux context for CRL files if SElinux status program exists
127 and selinux is enabled (RH bug 577403)
128 * Fix argument parsing on syslog facility specification (RH bug 577387)
129 * Increase granularity of the RandomWait and allow for 0 in -r option
130
131 Changes in version EGP 2.8.2
132 ----------------------------
133 (2010.03.03)
134
135 * Improved support for multiple CRL URLs by downloading until a success
136 is achieved, instead of downloading all of them
137 * Imported randomwait patch from Steve Traylen
138
139 Changes in version EGP 2.8.1
140 ----------------------------
141 (2010.01.26)
142
143 * The installed CRL file is re-checked for validity to catch file system
144 errors and local disk corruption. When possible, it will try to restore
145 a backup copy. Failures are not subject to aging tolerance.
146
147 Changes in version EGP 2.8.0
148 ----------------------------
149 (2009.09.22)
150
151 * The RPM packaging has been overhauled and is now sufficiently conformant
152 to EPEL and FedoraProject guidelines.
153 * New init scripts and a cron job entry have been added to allow management
154 of fetch-crl via the chkconfig mechanism
155
156 These changes were contributed by Steve Traylen (CERN, Geneva, CH).
157
158 Changes in version EGP 2.7.0
159 ----------------------------
160 (2009.01.25)
161
162 * Warnings and errors are now counted. If there are errors in the download
163 or verification process for one or more CRLs, the exit status will be 1;
164 if there are errors in the local setup or in the script invocation, the
165 exit status will be 2.
166 * The installed CRLs no longer have the textual representation of the CRL,
167 but only the PEM data blob, thus reducing IO and memory requirements.
168 * the CRL aging threshold is now set by default to 24 hours. The previous
169 default was 0. The CRL aging threshold is set in the config file using
170 CRL_AGING_THRESHOLD=<xx>, or with the "-a" command-line argument.
171 * Default network timeouts reduced to 10 seconds (was 30) and retries to 2
172 * Added caching and conditional downloading. When CACHEDIR is set, the
173 original downloads are preserved and wget timestamping mode enabled.
174 When the content did not change, only the timestamp on the installed
175 CRL is updated. If SLOPPYCRLHASHES is set, the has is calculated based
176 on the name of the crl_url file, otherwise it is taken from the CRL itself.
177 - The CACHEDIR must be exclusively writable by the user running fetch-crl
178 - Setting CACHEDIR significantly reduced the bandwidth used by fetch-crl
179 * Added RESETPATHMODE setting in sysconfig. It defines whether or not to
180 set re-set $PATH to "/bin:/usr/bin" before start. The search for OpenSSL
181 may be done based on the old path.
182 yes=always replace; searchopenssl=search for openssl first and then reset;
183 no=keep original path, whatever that me be (may be empty if called from cron)
184 Default="yes". This replaces the hard-coded path in the tool!
185 * Hidden "FORCE_OVERWRITE" option now has a regular name. This is backwards-
186 compatible. Set FORCE_OVERWRITE=yes if you want files overwritten that
187 have a CRL-like name and ought to have CRL content, but currently do not.
188 * Addresses gLite Savannah bugs 28418 and 29559. Bug 27023 is partially
189 addressed. Bug 20062 can be remedied with WGET_OPTS arguments.
190 Addresses OSG ticket 4673.
191
192 Changes in version EGP 2.6.6
193 ----------------------------
194 (2007.09.16)
195 (version 2.5.5 is invalid and was not publicly released)
196
197 * Added obscure configuration parameter to allow overwriting of
198 arbitrary data files with a downloaded CRL (on request of
199 CERN, see https://savannah.cern.ch/bugs/index.php?29559)
200
201 Changes in version EGP 2.6.4
202 ----------------------------
203 (2007.08.15)
204
205 * Expired CA issuer certificate now gives a warning instead of an error
206 with the full verification result message
207 * additional logfile output target can be selected via the configuration file
208 * CRL aging threshold documented in manual page. Errors will now also be
209 generated in the CRL download failed consistently and the current CRL
210 has already expired
211
212 Changes in version EGP 2.6.3
213 ----------------------------
214 (2006.11.13)
215
216 * cron job example: fetch-crl invocation syntax error corrected
217
218 Changes in version EGP 2.6.2
219 ----------------------------
220 (2006.10.27)
221
222 * fixed bug: older wget versions do not recognise --no-check-certificate
223
224 Changes in version EGP 2.6.1
225 ----------------------------
226 (2006.10.25)
227
228 * fixed local timezone vs UTC error in LastUpdate CRL validation comparison
229 * fixed time comparison is the one-hour LastUpdate/download tolerance
230 (both fixes thanks to Alain Roy)
231 * added support for directory names containing whitespace
232 * added support for syslog reporting (via -f option or SYSLOGFACILITY directive)
233 * SERVERCERTCHECK=no is now the default. It can be reset via the configuration
234 file, or using the "--check-server-certificate" commandline option
235 * the main configuration file location (formerly fixed to be
236 /etc/sysconfig/fetch-crl) can now be set via the variable $FETCH_CRL_SYSCONFIG
237 * logfile format timestamp and tag have been normalised
238
239 Changes in version EGP 2.6
240 --------------------------
241 (2006.05.20)
242
243 * if the current local CRL has a lastUpdate time in the future, and the
244 newly downloaded CRL is older that the current one, allow the installation
245 of the newly downloaded CRL and issue a warning.
246 * added non-suppressable warning in case the newly downloaded CRL has a
247 lastUpdate time in the future, but install that CRL anyway (as the local
248 clock might have been wrong).
249
250 Changes in version EGP 2.5
251 --------------------------
252 (2006.01.16)
253
254 * added additional configuration arguments and configuration variables
255 to skip the server certificate check in wget
256 (to support https:// URLs where the server is authenticated with
257 a certificate that is not part of it's own trusted domain, such as
258 the KISTI URL)
259
260 Changes in version EGP 2.4
261 --------------------------
262 (2005.11.15)
263
264 * for those platforms that support the stat(1) command, and in case the
265 .crl_url file is named after the hash of the crl subject name to download,
266 error eporting for individual download errors can be suppressed for
267 a configurable amount of time as set via the "-a" option (unit: hours).
268
269 Changes in version EGP 2.3
270 --------------------------
271 (2005.11.05)
272
273 * do not replace recent CRLs with ones that have an older lastUpdate
274 timestamp (prevents ARP/DNS DoS attacks)
275
276 Changes in version EGP 2.2
277 --------------------------
278 (2005.10.27)
279
280 * secure http download by wget recognise the CAs in the trusted directory.
281 solves the issue described in the LCG bug tracking system
282 https://savannah.cern.ch/bugs/index.php?func=detailitem&item_id=12182
283
284 Changes in version EGP 2.1
285 --------------------------
286 (2005.08.12)
287 * specifically look for the most recent version of OpenSSL. The
288 one in GLOBUS_LOCATION (which used to take precedence in the
289 previous releases) is outdated in many cases and caused
290 troubles on the LCG production systems in validating v2 CRLs
291 * added manual page fetch-crl(8)
292
293 Changes in version EGP 2.0
294 --------------------------
295 (2005.02.28)
296 * name of the installed script changed to "fetch-crl"
297 * the cronjob script is no longer installed by default, but supplied
298 as an example in the %doc directory
299 * RPM is now relocatable (default install in /usr)
300 * READMA and CHANGES file now inclued in %doc tree
301 * make install now installs
302 * version increased to 2.0
303
304 Changes in version EGP 1.9
305 --------------------------
306 (2005.02.24)
307 * the content of the final target CRL file is now checked for
308 containing a valid CRL if it already exists. If it does not
309 contain a CRL, an error is displayed and the file left untouched
310 So making the final ".r0" file in ${outdir} a link to something else
311 will not work, preventing an escalation in the final stage.
312
313 Changes in version EGP 1.8
314 --------------------------
315 (changes from Fabio's version 1.7, 2005.02.24)
316
317 * All temporary files (the initial CRL download using wget
318 and the PEM-converted version of that file) are now created using
319 mktemp
320 * the RetrieveFileByURL function will not overwrite files that
321 have any data in them
322 * Note that the script can be run by a non-priviledged user, but
323 that the output directory must be made writable by that user
324 in an out-of-band way.
325
326 EDG version 1.7
327 ---------------
328 Imported with consent of Fabio Hernandez and Steve Traylen from
329 the original EDG repository.
330 The EU DataGrid License applies, see http://www.eu-datagrid.org/

grid.support@nikhef.nl
ViewVC Help
Powered by ViewVC 1.1.28