crypt/step-ca
1
0
Fork 0
mirror of synced 2026-10-24 12:59:18 +03:00
Code Activity
5,056 Commits 50 Branches 245 Tags
randutil-remove-errors
Commit Graph

1343 Commits

Author SHA1 Message Date
Marten Seemann
b362a07329 use new randutil functions without error return values 2025-06-06 13:13:16 +08:00
Mariano Cano
332aa4b39d Fix unit tests 2025-05-30 14:56:15 -07:00
Herman Slatman
acf4387180 Fix new golangci-lint v2 linter issues 2025-05-21 12:21:47 +02:00
Herman Slatman
27944b4eae Fix linter issues 2025-02-18 11:04:54 +01:00
Herman Slatman
f4736325fa Use github.com/smallstep/linkedca @ v0.23.0 2025-01-03 18:24:19 +01:00
Mariano Cano
98087fec30 Move wrap transport initialization to constructor 
This commit moves the wrap transport initialization to the controller
constructor.
 2024-12-12 10:41:21 -08:00
Panagiotis Siatras
809c7023c9 Transport wrappers (#2103) 
* internal/httptransport: implemented Wrapper & NoopWrapper

* added transport wrappers

* addressed review comments
 2024-12-12 09:51:36 -08:00
Panagiotis Siatras
c986962154 internal/httptransport: initial implementation of the package (#2098) 
* internal/httptransport: initial implementation of the package
* authority: refactored for httptransport
* ca: refactored for httptransport
* test: refactored for httptransport
 2024-12-10 18:03:37 +02:00
Herman Slatman
4c7aa8a623 Add test case for Nebula certificate errors 2024-12-10 12:19:50 +01:00
Herman Slatman
9000271ce0 Fix new return value from nebula.NewCAPoolFromBytes 2024-12-10 12:10:25 +01:00
Mariano Cano
05295d9c6a Propagate human errors from webhooks 
This commit adds a new field error in the webhook response that allows
to propagate errors to the client. With ACME, webhook errors are as
a new subproblem.
 2024-11-14 18:29:36 -08:00
Mariano Cano
ff37bf1811 Add unit tests for scepchallenge webhooks 2024-11-12 13:15:11 -08:00
Mariano Cano
f2663dd9d9 Add data support on SCEPCHALLENGE webhooks 
This commit adds support for using template data from SCEPCHALLENGE
webhooks.
 2024-11-11 18:35:28 -08:00
Max
bb8605c079 Add DisableSSHCAUser and DisableSSHCAHost options to linkedca GCP provisioner (#2045) 
* Add DisableSSHCAUser and DisableSSHCAHost options to linkedca GCP provisioner
 2024-10-28 16:14:59 -07:00
Herman Slatman
b45b73f4cc Use github.com/smallstep/cli-utils instead of go.step.sm/cli-utils 2024-10-28 10:53:44 +01:00
Max
88443ddab9 Use dnsNamesSubsetValidator for IID provisioners (#2044) 
* Use dnsNamesSubsetValidator for IID provisioners

... when disableCustomSANs is set to 'true'.

The DNS names in the certificate request must be a subset of the
authorized set of DNS names (from the IID token). The previous
functionality required that the DNS names in the certificate request
exactly matched the authorized DNS names.

* Update authority/provisioner/sign_options.go

Co-authored-by: Herman Slatman <hslatman@users.noreply.github.com>

* Update authority/provisioner/sign_options.go

Co-authored-by: Herman Slatman <hslatman@users.noreply.github.com>

* Use map[string]struct rather than map[string]bool for clarity

---------

Co-authored-by: Herman Slatman <hslatman@users.noreply.github.com>
 2024-10-25 10:39:04 -07:00
Mariano Cano
6b872e8806 Do not fail creating the provisioner HTTP client 
This commit avoids an error starting the CA if the `http.DefaultTransport`
is not an `*http.Transport`. If the DefaultTransport is overwritten, the
newHTTPClient method will return a simple *http.Client. With an
*http.Transport, it will return a client that trusts the system
certificate pool and the CA roots.
 2024-10-15 18:08:58 -07:00
Herman Slatman
55b097a8ec Fix protobuf enum field type error message comparison test 2024-10-08 10:46:47 +02:00
Herman Slatman
1b09b1143e Use require and assert in a few more Nebula test functions 2024-08-20 23:09:11 +02:00
Herman Slatman
74d30d975a Add test for Nebula with ECDSA P256 keys 2024-08-20 23:01:38 +02:00
Herman Slatman
84d340d373 Merge branch 'master' into herman/fix-nebula-curve-param 2024-08-20 21:15:21 +02:00
Herman Slatman
aeb5e1b366 Address linter issues 2024-08-20 16:54:29 +02:00
Herman Slatman
92e95e4df3 Merge pull request #1940 from smallstep/mariano/self-trust 
Allow to use private  IdPs with the OIDC provisioner
 2024-08-13 09:59:56 +02:00
Herman Slatman
8e956cc6cd Merge branch 'master' into wire-acme-extensions 2024-08-06 20:24:02 +02:00
Herman Slatman
42bea945c0 Use uppercase SSH in policy error messages 2024-08-05 14:45:34 +02:00
Herman Slatman
31656e3d14 Clarify SSH policy evaluation errors with opposing SSH cert type 2024-08-05 14:12:25 +02:00
Herman Slatman
cae47aa690 Merge branch 'master' into wire-acme-extensions 2024-08-02 22:58:56 +02:00
Mariano Cano
ad70982cda Use testify packages in x5c_test.go 2024-07-24 12:13:57 -07:00
Mariano Cano
656a03e5d1 Use x5rt#S256 claim instead of kid 2024-07-23 12:51:11 -07:00
Mariano Cano
6c6ed46fef Remove sshFingerprintValidator and rename fingerprintValidator 2024-07-23 11:48:46 -07:00
Mariano Cano
ccce670504 Merge branch 'master' into fix-1637 2024-07-23 11:37:00 -07:00
Mariano Cano
88f161818d Merge pull request #1558 from adantop/feat/support-gcp-ssh-user-certs-opt-2 
Allowing GCP provisioner to issue SSH User Certificates - Option 2
 2024-07-23 11:13:51 -07:00
Mariano Cano
a01a2fbba1 Allow to use private IdPs with the OIDC provisioner 
This commit allows using the OIDC provisioner with private identity
providers using a certificate from step-ca.

Fixes #1909
 2024-07-22 19:01:37 -07:00
Mariano Cano
343e7308a8 Remove Disabled provisioner add add an Uninitialized state 
This commit renames the Disabled provisioner to Uninitialized and adds
an state instead of just a boolean. It also adds tests.
 2024-07-11 15:18:52 -07:00
Mariano Cano
39089325b5 Merge branch 'master' into mariano/init-provisioners 2024-07-11 12:43:26 -07:00
Mariano Cano
191f1a598d Fix unit tests after introduction of rawSubject 2024-07-09 17:04:46 -07:00
Mariano Cano
f8bda96940 Apply suggestions from code review 
Co-authored-by: Herman Slatman <hslatman@users.noreply.github.com>
 2024-07-01 12:49:26 -07:00
Mariano Cano
cb9abbe25b Add support for validities in templates 
This commit upgrades go.step.sm/crypto with a version that adds support
for setting validity bounds in templates. It also adds support for these
in the certificate modifiers.

The priority for the validity bounds are:
1. Coming from flags.
2. Coming from the template.
3. Defaults.
 2024-06-28 16:21:12 -07:00
Mariano Cano
c8e65abfb1 Fix linter warnings 2024-06-12 16:03:01 -07:00
Mariano Cano
b4616ee8f1 Upgrade linkedca 
This commit upgrades go.step.sm/linkedca with dependencies required by
smallstep/certificates#1802. It also fixes some linter warnings.
 2024-06-12 15:54:17 -07:00
Mariano Cano
a7a3a4c5d9 Fix comments from code review 2024-06-12 15:42:27 -07:00
Mariano Cano
a017c0e3fb Merge branch 'master' into AuthParams 2024-06-12 15:39:07 -07:00
Max
474f5d28f4 Update hardcoded AWS certs (#1881) 2024-06-11 10:04:44 -07:00
adantop
bedb040659 Updating options to be Disable* and of type *bool 2024-05-30 13:54:03 -06:00
Mariano Cano
47b5048d82 Merge pull request #1850 from smallstep/mariano/signer 
Add GetX509Signer method
 2024-05-22 15:33:47 -07:00
max furman
99ce13a4ea Fix linter warnings 2024-05-20 11:06:53 -07:00
Mariano Cano
812ffd3c40 Reverse assert statements 2024-05-16 14:12:03 -07:00
Mariano Cano
d0548f9ec9 Use %q instead of '%s' 
Co-authored-by: Herman Slatman <hslatman@users.noreply.github.com>
 2024-05-16 13:52:37 -07:00
Mariano Cano
9e8087fbb1 Add GetX509Signer method 
This commit adds a method to the Authority type that returns the signer
used to sign X509 certificates.
 2024-05-15 17:41:33 -07:00
Mariano Cano
f3f484cee2 Log errors using slog.Logger 
This commit allows logging errors in a slog.Logger injected in the
context. This type of logger is not currently used directly in step-ca,
but this will change in the future.
 2024-05-15 15:40:40 -07:00