Repository navigation
fix(ca-server): recover-admin, audit et reconcile sur Config::load_without_hsm - #33
Merged
Merged
Conversation
…thout_hsm Ces trois commandes n'ouvrent aucun token PKCS#11 avec le PIN du service (le PIN de recover-admin vient de l'entrée standard, jamais de l'environnement) et ne gravent aucune adresse dans un certificat : OPENEIDAS_ISSUING_PIN et OPENEIDAS_PKI_PUBLIC_URL ne leur sont donc plus exigées, comme pour ra list|approve|reject et operators bootstrap-admin. Un test par commande prouve l'absence d'exigence (mutation vérifiée : revenir à Config::load fait échouer chacun pour la bonne raison).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Contexte
Suite à la pile mergée (§2 de PROGRESSION.md), reste ouvert :
operators recover-admin|audit|reconcileexigeaient encoreOPENEIDAS_ISSUING_PINetOPENEIDAS_PKI_PUBLIC_URLalors qu'ils n'ouvrent aucun token PKCS#11 avec le PIN du service et ne gravent aucune adresse dans un certificat, commera list|approve|rejectetoperators bootstrap-admindéjà basculés.Changement
run_operators_recover_admin,run_operators_audit,run_operators_reconcile:Config::load()→Config::load_without_hsm().recover-adminvérifie toujours un vrai PIN de token PKCS#11, mais reçu sur l'entrée standard, jamais lu dans l'environnement du service.Config::load()(mutation vérifiée).Vérifications
cargo fmt --checkcargo clippy --workspace --all-targets -- -D warningscargo test --workspace(avecOE_CASTORE_TEST_DSN) : vertcargo audit --ignore RUSTSEC-2023-0071: rien à signaler