puppetserver-ca 2.3.0 → 2.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: af10497de6396a89adeeb920ea09df98f728c97a6e219e6baf5d92ab1f063937
-  data.tar.gz: 39e54eaa7e05c9274add48f046e0328d68bb74146343abef6bc2be8fd4aba2be
+  metadata.gz: 9443656cd200fac958b84f3b7444a402146344105b25022eef46dbe1d24201a1
+  data.tar.gz: aa4c2fbcae1976a25346c6cfe16d792099b6ccc722f24770535e58367bc4128d
 SHA512:
-  metadata.gz: 4e58d65112ae40fbd21881cb0514321c86311cea8d5947db8b049b1b19959268850a320375419a1b1506bae4dc805773e82d2ff23aeb43c528dd9e13157b8713
-  data.tar.gz: 9fe0a51c4966a39bef6317498f79ab1e953ed410ec409bc940003fb7ab295d09bf244a46832c4845c0dae1fef197c7da5ea4c4b77839256eb7724462d0d9ab52
+  metadata.gz: 34e5662cbb5d7f92bf9f1b3f91f69d37149986c4ba998e42655cf5440349a242116f04c3abfc50244140f4de681fdffed77fa9c56128286bfe3e96d49ebc2939
+  data.tar.gz: 24740e26cceae352f4def897433bc4971b78c8d51c94e0692b19868a10a73dec29c266c1f9f09281b46299dfd9f795cba00c57b00726556529faf0ef820bd664

data/lib/puppetserver/ca/action/prune.rb

@@ -50,15 +50,22 @@ BANNER
           loader = X509Loader.new(puppet.settings[:cacert], puppet.settings[:cakey], puppet.settings[:cacrl])
 
           puppet_crl = loader.crls.select { |crl| crl.verify(loader.key) }
-          prune_CRLs(puppet_crl)
-          update_pruned_CRL(puppet_crl, loader.key)
-          FileSystem.write_file(puppet.settings[:cacrl], loader.crls, 0644)
+          number_of_removed_duplicates = prune_CRLs(puppet_crl)
+
+          if number_of_removed_duplicates > 0
+            update_pruned_CRL(puppet_crl, loader.key)
+            FileSystem.write_file(puppet.settings[:cacrl], loader.crls, 0644)
+            @logger.inform("Removed #{number_of_removed_duplicates} duplicated certs from Puppet's CRL.")
+          else
+            @logger.inform("No duplicate revocations found in the CRL.")
+          end
 
-          @logger.inform("Finished pruning Puppet's CRL")
           return 0
         end
 
         def prune_CRLs(crl_list)
+          number_of_removed_duplicates = 0
+
           crl_list.each do |crl|
             existed_serial_number = Set.new()
             revoked_list = crl.revoked
@@ -69,6 +76,7 @@ BANNER
               if existed_serial_number.add?(revoked.serial)
                 false
               else
+                number_of_removed_duplicates += 1
                 @logger.debug("Removing duplicate of #{revoked.serial}, " \
                   "revoked on #{revoked.time}\n") if @logger.debug?
                 true
@@ -76,11 +84,18 @@ BANNER
             end
             crl.revoked=(revoked_list)
           end
+
+          return number_of_removed_duplicates
         end
 
         def update_pruned_CRL(crl_list, pkey)
           crl_list.each do |crl|
-            crl.version=(crl.version + 1)
+            number_ext, other_ext = crl.extensions.partition{ |ext| ext.oid == "crlNumber" }
+            number_ext.each do |crl_number|
+              updated_crl_number = OpenSSL::BN.new(crl_number.value) + OpenSSL::BN.new(1)
+              crl_number.value=(OpenSSL::ASN1::Integer(updated_crl_number))
+            end
+            crl.extensions=(number_ext + other_ext)
             crl.sign(pkey, OpenSSL::Digest::SHA256.new)
           end
         end

data/lib/puppetserver/ca/version.rb

@@ -1,5 +1,5 @@
 module Puppetserver
   module Ca
-    VERSION = "2.3.0"
+    VERSION = "2.3.1"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: puppetserver-ca
 version: !ruby/object:Gem::Version
-  version: 2.3.0
+  version: 2.3.1
 platform: ruby
 authors:
 - Puppet, Inc.
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2021-07-22 00:00:00.000000000 Z
+date: 2021-07-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: facter