puppetserver-ca 0.4.0 → 0.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 98b359182e9c882ea8a66b4315b873f9d87185de
-  data.tar.gz: 3de8823031139ae413aa7a151dc6bbd0c10176b0
+  metadata.gz: 7cdc97b5346544e3f5eaa1b6e8258e7f8ad6356d
+  data.tar.gz: fa5cafd9e26a01d03a0f9ffd73169b4ea98c77f0
 SHA512:
-  metadata.gz: 327b9b653764428a428f9531dcec525fde0dd67913be851fef86f25a9993d041624dd6f70cec1357687af50f22cd77f690ee1f7bc570bd79a255f53105e81b4a
-  data.tar.gz: baa44b1f602863f5323911446b1896ec9145eeb4360c1fcaa85fb0c63ad173b5acd59b81f5fd6d1fcd183161526154f4d9599ece1c3a0b7b5241d3b6fb372e82
+  metadata.gz: 96260c55c8b9a1499ce112e20300801306ab9e7ce7ebdaf2a8a0cff5cffb9f692e5b266dccdf1a2df14bb3ff4f6a57dc2b4bb17dc93ce9a2f092b57e6f61a002
+  data.tar.gz: b9ffc226ca976e0359530d89a5c449f1ec089c9e75b560aa0dbb5b5db133900ebbd657d14a96884d55f9d098b963f207f57f5249c3df257e7715ad14ba55e4c2

data/lib/puppetserver/ca/action/generate.rb

@@ -44,8 +44,8 @@ module Puppetserver
         BANNER = <<-BANNER
 Usage:
   puppetserver ca generate [--help]
-  puppetserver ca generate [--config PATH]
-  puppetserver ca generate [--subject-alt-names ALTNAME1[,ALTNAME2...]]
+  puppetserver ca generate [--config PATH] [--subject-alt-names ALTNAME1[,ALTNAME2...]]
+                           [--certname NAME] [--ca-name NAME]
 
 Description:
 Generate a root and intermediate signing CA for Puppet Server
@@ -77,31 +77,34 @@ BANNER
           end
 
           # Load, resolve, and validate puppet config settings
-          puppet = Config::Puppet.parse(config_path)
+          settings_overrides = {}
+          settings_overrides[:certname] = input['certname'] unless input['certname'].empty?
+          settings_overrides[:ca_name] = input['ca_name'] unless input['ca_name'].empty?
+          # Since puppet expects the key to be called 'dns_alt_names', we need to use that here
+          # to ensure that the overriding works correctly.
+          settings_overrides[:dns_alt_names] = input['subject_alt_names'] unless input['subject_alt_names'].empty?
+
+          puppet = Config::Puppet.new(config_path)
+          puppet.load(settings_overrides)
           return 1 if CliParsing.handle_errors(@logger, puppet.errors)
 
           # Load most secure signing digest we can for cers/crl/csr signing.
           signer = SigningDigest.new
           return 1 if CliParsing.handle_errors(@logger, signer.errors)
 
-          if input['subject_alt_names'].empty?
-            subject_alt_names = munge_alt_names(puppet.settings[:subject_alt_names])
-          else
-            subject_alt_names = munge_alt_names(input['subject_alt_names'])
-          end
-
           # Generate root and intermediate ca and put all the certificates, crls,
           # and keys where they should go.
-          errors = generate_pki(puppet.settings, signer.digest, subject_alt_names)
+          errors = generate_pki(puppet.settings, signer.digest)
           return 1 if CliParsing.handle_errors(@logger, errors)
 
           @logger.inform "Generation succeeded. Find your files in #{puppet.settings[:cadir]}"
           return 0
         end
 
-        def generate_pki(settings, signing_digest, subject_alt_names = '')
+        def generate_pki(settings, signing_digest)
           valid_until = Time.now + settings[:ca_ttl]
           host = Puppetserver::Ca::Host.new(signing_digest)
+          subject_alt_names = munge_alt_names(settings[:subject_alt_names])
 
           root_key = host.create_private_key(settings[:keylength])
           root_cert = self_signed_ca(root_key, settings[:root_ca_name], valid_until, signing_digest)
@@ -115,12 +118,14 @@ BANNER
           master_key = host.create_private_key(settings[:keylength])
           master_csr = host.create_csr(settings[:certname], master_key)
           master_cert = sign_master_cert(int_key, int_cert, master_csr,
-                                       valid_until, signing_digest, subject_alt_names)
+                                         valid_until, signing_digest,
+                                         subject_alt_names)
 
           FileSystem.ensure_dir(settings[:cadir])
           FileSystem.ensure_dir(settings[:certdir])
           FileSystem.ensure_dir(settings[:privatekeydir])
           FileSystem.ensure_dir(settings[:publickeydir])
+          FileSystem.ensure_dir(settings[:signeddir])
 
           public_files = [
             [settings[:cacert], [int_cert, root_cert]],
@@ -131,7 +136,8 @@ BANNER
             [settings[:hostpubkey], master_key.public_key],
             [settings[:capub], int_key.public_key],
             [settings[:cert_inventory], inventory_entry(master_cert)],
-            [settings[:serial], "0x0002"],
+            [settings[:serial], "002"],
+            [File.join(settings[:signeddir], "#{settings[:certname]}.pem"), master_cert],
           ]
 
           private_files = [
@@ -293,6 +299,8 @@ ERR
 
         def self.parser(parsed = {})
           parsed['subject_alt_names'] = ''
+          parsed['ca_name'] = ''
+          parsed['certname'] = ''
           OptionParser.new do |opts|
             opts.banner = BANNER
             opts.on('--help', 'Display this generate specific help output') do |help|
@@ -302,9 +310,17 @@ ERR
               parsed['config'] = conf
             end
             opts.on('--subject-alt-names NAME1[,NAME2]',
-                    'Subject alternative names for the CA signing cert') do |sans|
+                    'Subject alternative names for the master cert') do |sans|
               parsed['subject_alt_names'] = sans
             end
+            opts.on('--ca-name NAME',
+                    'Common name to use for the CA signing cert') do |name|
+              parsed['ca_name'] = name
+            end
+            opts.on('--certname NAME',
+                    'Common name to use for the master cert') do |name|
+              parsed['certname'] = name
+            end
           end
         end
       end

data/lib/puppetserver/ca/action/import.rb

@@ -14,7 +14,7 @@ module Puppetserver
         BANNER = <<-BANNER
 Usage:
   puppetserver ca import [--help]
-  puppetserver ca import [--config PATH]
+  puppetserver ca import [--config PATH] [--certname NAME]
       --private-key PATH --cert-bundle PATH --crl-chain PATH
 
 Description:
@@ -46,7 +46,10 @@ BANNER
           loader = X509Loader.new(bundle_path, key_path, chain_path)
           return 1 if CliParsing.handle_errors(@logger, loader.errors)
 
-          puppet = Config::Puppet.parse(config_path)
+          settings_overrides = {}
+          settings_overrides[:certname] = input['certname'] unless input['certname'].empty?
+          puppet = Config::Puppet.new(config_path)
+          puppet.load(settings_overrides)
           return 1 if CliParsing.handle_errors(@logger, puppet.errors)
 
           target_locations = [puppet.settings[:cacert],
@@ -75,7 +78,7 @@ ERR
           FileSystem.write_file(puppet.settings[:cacrl], loader.crls, 0640)
 
           # Puppet's internal CA expects these file to exist.
-          FileSystem.ensure_file(puppet.settings[:serial], "0x0001", 0640)
+          FileSystem.ensure_file(puppet.settings[:serial], "001", 0640)
           FileSystem.ensure_file(puppet.settings[:cert_inventory], "", 0640)
 
           @logger.inform "Import succeeded. Find your files in #{puppet.settings[:cadir]}"
@@ -124,6 +127,10 @@ ERR
             opts.on('--crl-chain CHAIN', 'Path to PEM encoded chain') do |chain|
               parsed['crl-chain'] = chain
             end
+            opts.on('--certname NAME',
+                    'Common name to use for the master cert') do |name|
+              parsed['certname'] = name
+            end
           end
         end
       end

data/lib/puppetserver/ca/config/puppet.rb

@@ -24,7 +24,7 @@ module Puppetserver
 
         include Puppetserver::Ca::Utils::Config
 
-        def self.parse(config_path = nil)
+        def self.parse(config_path)
           instance = new(config_path)
           instance.load
 
@@ -60,7 +60,7 @@ module Puppetserver
           user_specific_conf_dir + '/puppet.conf'
         end
 
-        def load
+        def load(cli_overrides = {})
           if explicitly_given_config_file_or_default_config_exists?
             results = parse_text(File.read(@config_path))
           end
@@ -70,6 +70,7 @@ module Puppetserver
           results[:master] ||= {}
 
           overrides = results[:main].merge(results[:master])
+          overrides.merge!(cli_overrides)
 
           @settings = resolve_settings(overrides).freeze
         end
@@ -133,6 +134,7 @@ module Puppetserver
             :publickeydir => '$ssldir/public_keys',
             :ca_ttl => '15y',
             :certificate_revocation => 'true',
+            :signeddir => '$cadir/signed',
           }
 
           # This loops through the base defaults and gives each setting a

data/lib/puppetserver/ca/version.rb

@@ -1,5 +1,5 @@
 module Puppetserver
   module Ca
-    VERSION = "0.4.0"
+    VERSION = "0.4.1"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: puppetserver-ca
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.4.1
 platform: ruby
 authors:
 - Puppet, Inc.
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2018-08-22 00:00:00.000000000 Z
+date: 2018-08-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: facter