puppetserver-ca 1.11.0 → 1.11.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 813b9f6f9913cd98abd4b81219cfb4882e7c9c1ace77f024218706be07411d7a
-  data.tar.gz: 8f7bd49d04fc6f23f4674006f1d159756286f9b3ae50a686cb4faa5b7b71832d
+  metadata.gz: 8257bbee6c6752b584beaa360580369b747a33375ebd9ff9da76b02fe29cb514
+  data.tar.gz: cf8f8b6d1bff9ab7136358919e2e4e0f6b2180b50f9dd87bf9eac5954327937f
 SHA512:
-  metadata.gz: a2dbfac65155e9dbd593931305b9f99079f2610bd02d64c20e1be00f8f61058f85bfcf410f5987439de892b6adf9e46beadb60d85a4f970c07a4eec2643c54d9
-  data.tar.gz: 26964af97f64152d3d5e1bfbcc931daa102734b1facf2ef588890552aee36791be3a6091e5e5563d328254149133035597773486c53e67ddd8e1624327f289bb
+  metadata.gz: 608fda03455ff0f57193593ce3923516c567966e9c153c05e3da27cebcbd81edcc9cab1f7030cfa49dfce62f01b1f1b25ec862a31cc2512eb0705d51805ee795
+  data.tar.gz: 7d3fc368714cb706d49b5289f2e59bb1307292afac31a043a07a2ba04b61ea3ae827222d81e40cbf48ed9a33ff0b0a4d826cae98f39a9bbae5b800ef2caacf38

data/lib/puppetserver/ca/action/prune.rb

@@ -50,15 +50,22 @@ BANNER
           loader = X509Loader.new(puppet.settings[:cacert], puppet.settings[:cakey], puppet.settings[:cacrl])
 
           puppet_crl = loader.crls.select { |crl| crl.verify(loader.key) }
-          prune_CRLs(puppet_crl)
-          update_pruned_CRL(puppet_crl, loader.key)
-          FileSystem.write_file(puppet.settings[:cacrl], loader.crls, 0644)
+          number_of_removed_duplicates = prune_CRLs(puppet_crl)
+
+          if number_of_removed_duplicates > 0
+            update_pruned_CRL(puppet_crl, loader.key)
+            FileSystem.write_file(puppet.settings[:cacrl], loader.crls, 0644)
+            @logger.inform("Removed #{number_of_removed_duplicates} duplicated certs from Puppet's CRL.")
+          else
+            @logger.inform("No duplicate revocations found in the CRL.")
+          end
 
-          @logger.inform("Finished pruning Puppet's CRL")
           return 0
         end
 
         def prune_CRLs(crl_list)
+          number_of_removed_duplicates = 0
+
           crl_list.each do |crl|
             existed_serial_number = Set.new()
             revoked_list = crl.revoked
@@ -69,6 +76,7 @@ BANNER
               if existed_serial_number.add?(revoked.serial)
                 false
               else
+                number_of_removed_duplicates += 1
                 @logger.debug("Removing duplicate of #{revoked.serial}, " \
                   "revoked on #{revoked.time}\n") if @logger.debug?
                 true
@@ -76,11 +84,18 @@ BANNER
             end
             crl.revoked=(revoked_list)
           end
+
+          return number_of_removed_duplicates
         end
 
         def update_pruned_CRL(crl_list, pkey)
           crl_list.each do |crl|
-            crl.version=(crl.version + 1)
+            number_ext, other_ext = crl.extensions.partition{ |ext| ext.oid == "crlNumber" }
+            number_ext.each do |crl_number|
+              updated_crl_number = OpenSSL::BN.new(crl_number.value) + OpenSSL::BN.new(1)
+              crl_number.value=(OpenSSL::ASN1::Integer(updated_crl_number))
+            end
+            crl.extensions=(number_ext + other_ext)
             crl.sign(pkey, OpenSSL::Digest::SHA256.new)
           end
         end

data/lib/puppetserver/ca/version.rb

@@ -1,5 +1,5 @@
 module Puppetserver
   module Ca
-    VERSION = "1.11.0"
+    VERSION = "1.11.1"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: puppetserver-ca
 version: !ruby/object:Gem::Version
-  version: 1.11.0
+  version: 1.11.1
 platform: ruby
 authors:
 - Puppet, Inc.
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2021-07-22 00:00:00.000000000 Z
+date: 2021-07-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: facter