WEBDIENSTE/NLnetLabs-krill
1
0
Fork 0
mirror of https://github.com/NLnetLabs/krill.git synced 2026-09-22 01:14:54 +02:00
Code Issues Packages Projects Releases Wiki Activity

Support offline ta (#985)

Browse Source
This commit is contained in:
Tim Bruijnzeels
2023-01-24 10:30:22 +01:00
committed by GitHub
parent bfb5a53e77
commit 01e54ff22f
119 changed files with 5171 additions and 2930 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
+1 -1
View File
@@ -2,7 +2,7 @@
.idea/
.vscode/
.DS_Store
data
data*
krill.log
target/
tmp
README.md
+6
View File
@@ -31,6 +31,12 @@ in this [blog post](https://blog.nlnetlabs.nl/testing-the-waters-with-krill/).
In this release we introduce an API to set up CAs, and signed objects such as
ROAs in bulk.
API Changes:
We removed the repository next update time from the stats and metrics output.
It was inaccurate (usually 8 hours off), and not very informative. More useful
metrics are still provided: last exchange and last successful exchange. If these
times differ, then there is an issue that may need attention.
## 0.12.1 'Safety Belts'
src/bin/krillta.rs
+30
View File
@@ -0,0 +1,30 @@
extern crate krill;
use krill::cli::ta_client::*;
#[tokio::main]
async fn main() {
match TrustAnchorClientCommand::from_args() {
Ok(command) => {
let fmt = command.report_format();
match TrustAnchorClient::process(command).await {
Ok(response) => match response.report(fmt) {
Ok(Some(msg)) => println!("{}", msg),
Ok(None) => {}
Err(e) => {
eprintln!("{}", e);
::std::process::exit(1);
}
},
Err(e) => {
eprintln!("{}", e);
::std::process::exit(1);
}
}
}
Err(e) => {
eprintln!("{}", e);
::std::process::exit(1);
}
}
}
src/cli/mod.rs
+2
View File
@@ -4,3 +4,5 @@ pub mod report;
mod client;
pub use self::client::Error;
pub use self::client::KrillClient;
pub mod ta_client;
src/cli/options.rs
+100 -99
View File
@@ -43,15 +43,49 @@ use crate::{
daemon::ca::{ResourceTaggedAttestation, RtaContentRequest, RtaPrepareRequest},
};
struct GeneralArgs {
server: idexchange::ServiceUri,
token: Token,
format: ReportFormat,
api: bool,
#[derive(Debug)]
pub struct GeneralArgs {
pub server: idexchange::ServiceUri,
pub token: Token,
pub format: ReportFormat,
pub api: bool,
}
impl GeneralArgs {
fn from_matches(matches: &ArgMatches) -> Result<Self, Error> {
pub fn add_args<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
app.arg(
Arg::with_name(KRILL_CLI_SERVER_ARG)
.short("s")
.long(KRILL_CLI_SERVER_ARG)
.value_name("URI")
.help("The full URI to the Krill server. Or set env: KRILL_CLI_SERVER")
.required(false),
)
.arg(
Arg::with_name(KRILL_CLI_ADMIN_TOKEN_ARG)
.short("t")
.long(KRILL_CLI_ADMIN_TOKEN_ARG)
.value_name("string")
.help("The secret token for the Krill server. Or set env: KRILL_CLI_TOKEN")
.required(false),
)
.arg(
Arg::with_name(KRILL_CLI_FORMAT_ARG)
.short("f")
.long(KRILL_CLI_FORMAT_ARG)
.value_name("type")
.help("Report format: none|json|text (default). Or set env: KRILL_CLI_FORMAT")
.required(false),
)
.arg(
Arg::with_name(KRILL_CLI_API_ARG)
.long(KRILL_CLI_API_ARG)
.help("Only show the API call and exit. Or set env: KRILL_CLI_API=1")
.required(false),
)
}
pub fn from_matches(matches: &ArgMatches) -> Result<Self, Error> {
let server = {
let mut server = match env::var(KRILL_CLI_SERVER_ENV) {
Ok(server_str) => Some(idexchange::ServiceUri::from_str(&server_str)?),
@@ -146,39 +180,6 @@ impl Options {
}
}
fn add_general_args<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
app.arg(
Arg::with_name(KRILL_CLI_SERVER_ARG)
.short("s")
.long(KRILL_CLI_SERVER_ARG)
.value_name("URI")
.help("The full URI to the Krill server. Or set env: KRILL_CLI_SERVER")
.required(false),
)
.arg(
Arg::with_name(KRILL_CLI_ADMIN_TOKEN_ARG)
.short("t")
.long(KRILL_CLI_ADMIN_TOKEN_ARG)
.value_name("string")
.help("The secret token for the Krill server. Or set env: KRILL_CLI_TOKEN")
.required(false),
)
.arg(
Arg::with_name(KRILL_CLI_FORMAT_ARG)
.short("f")
.long(KRILL_CLI_FORMAT_ARG)
.value_name("type")
.help("Report format: none|json|text (default). Or set env: KRILL_CLI_FORMAT")
.required(false),
)
.arg(
Arg::with_name(KRILL_CLI_API_ARG)
.long(KRILL_CLI_API_ARG)
.help("Only show the API call and exit. Or set env: KRILL_CLI_API=1")
.required(false),
)
}
fn add_my_ca_arg<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
app.arg(
Arg::with_name(KRILL_CLI_MY_CA_ARG)
@@ -290,7 +291,7 @@ impl Options {
let mut simple = SubCommand::with_name("simple").about("Use a 3rd party repository for publishing");
simple = Self::add_general_args(simple);
simple = GeneralArgs::add_args(simple);
simple = add_data_dir_arg(simple);
simple = add_log_file_arg(simple);
@@ -301,7 +302,7 @@ impl Options {
let mut with_user =
SubCommand::with_name("user").about("Generate a user authentication configuration file fragment");
with_user = Self::add_general_args(with_user);
with_user = GeneralArgs::add_args(with_user);
with_user = add_id_arg(with_user);
with_user = add_attr_arg(with_user);
@@ -314,7 +315,7 @@ impl Options {
fn make_cas_list_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let sub = SubCommand::with_name("list").about("List the current CAs");
let sub = Self::add_general_args(sub);
let sub = GeneralArgs::add_args(sub);
app.subcommand(sub)
}
@@ -322,7 +323,7 @@ impl Options {
fn make_cas_show_ca_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("show").about("Show details of a CA");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
app.subcommand(sub)
@@ -331,7 +332,7 @@ impl Options {
fn make_cas_show_history_details_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("details").about("Show details for a command in the history of a CA");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
sub = sub.arg(
@@ -348,7 +349,7 @@ impl Options {
fn make_cas_show_history_list_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("commands").about("Show the commands sent to a CA");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
sub = sub.arg(
@@ -398,7 +399,7 @@ impl Options {
fn make_cas_add_ca_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("add").about("Add a new CA");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
app.subcommand(sub)
@@ -408,7 +409,7 @@ impl Options {
let mut sub = SubCommand::with_name("delete")
.about("Delete a CA and let it withdraw its objects and request revocation. WARNING: Irreversible!");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
app.subcommand(sub)
@@ -417,7 +418,7 @@ impl Options {
fn make_cas_children_add_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("add").about("Add a child to a CA");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
sub = Self::add_child_arg(sub);
sub = Self::add_resource_args(sub);
@@ -436,7 +437,7 @@ impl Options {
fn make_cas_children_update_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("update").about("Update an existing child of a CA");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
sub = Self::add_child_arg(sub);
sub = Self::add_resource_args(sub);
@@ -454,7 +455,7 @@ impl Options {
fn make_cas_children_response_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("response").about("Show the RFC 8183 Parent Response XML");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
sub = Self::add_child_arg(sub);
@@ -464,7 +465,7 @@ impl Options {
fn make_cas_children_info_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("info").about("Show info for a child (id and resources)");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
sub = Self::add_child_arg(sub);
@@ -474,7 +475,7 @@ impl Options {
fn make_cas_children_remove_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("remove").about("Remove an existing child from a CA");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
sub = Self::add_child_arg(sub);
@@ -484,7 +485,7 @@ impl Options {
fn make_cas_children_connections_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("connections").about("Show connections stats for children of a CA");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
app.subcommand(sub)
@@ -493,7 +494,7 @@ impl Options {
fn make_cas_children_suspend_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("suspend").about("Suspend a child CA: hide certificate(s) issued to child");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
sub = Self::add_child_arg(sub);
@@ -504,7 +505,7 @@ impl Options {
let mut sub =
SubCommand::with_name("unsuspend").about("Suspend a child CA: republish certificate(s) issued to child");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
sub = Self::add_child_arg(sub);
@@ -529,7 +530,7 @@ impl Options {
fn make_cas_parents_request_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("request").about("Show RFC 8183 Child Request XML");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
app.subcommand(sub)
@@ -538,7 +539,7 @@ impl Options {
fn make_cas_parents_add_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("add").about("Add a parent to, or update a parent of a CA");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
sub = Self::add_parent_arg(sub);
sub = sub.arg(
@@ -556,7 +557,7 @@ impl Options {
fn make_cas_parents_statuses_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("statuses").about("Show overview of all parent statuses of a CA");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
app.subcommand(sub)
@@ -565,7 +566,7 @@ impl Options {
fn make_cas_parents_contact_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("contact").about("Show contact information for a parent of a CA");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
sub = Self::add_parent_arg(sub);
@@ -575,7 +576,7 @@ impl Options {
fn make_cas_parents_remove_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("remove").about("Remove an existing parent from a CA");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
sub = Self::add_parent_arg(sub);
@@ -597,7 +598,7 @@ impl Options {
fn make_cas_keyroll_init_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("init").about("Initialize roll for all keys held by a CA");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
app.subcommand(sub)
@@ -606,7 +607,7 @@ impl Options {
fn make_cas_keyroll_activate_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("activate").about("Finish roll for all keys held by a CA");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
app.subcommand(sub)
@@ -624,7 +625,7 @@ impl Options {
fn make_cas_routes_list_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("list").about("Show current authorizations");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
app.subcommand(sub)
@@ -633,7 +634,7 @@ impl Options {
fn make_cas_routes_update_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("update").about("Update authorizations");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
sub = sub.arg(
@@ -690,7 +691,7 @@ impl Options {
fn make_cas_routes_bgp_full_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("analyze").about("Show full report of ROAs vs known BGP announcements");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
app.subcommand(sub)
}
@@ -698,7 +699,7 @@ impl Options {
fn make_cas_routes_bgp_suggestions_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("suggest").about("Show ROA suggestions based on known BGP announcements");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
sub = sub
@@ -745,7 +746,7 @@ impl Options {
fn make_cas_bgpsec_list_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("list").about("Show current BGPSec configurations");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
app.subcommand(sub)
@@ -754,7 +755,7 @@ impl Options {
fn make_cas_bgpsec_add_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("add").about("Add BGPSec configurations");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
sub = sub
@@ -780,7 +781,7 @@ impl Options {
fn make_cas_bgpsec_remove_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("remove").about("Remove a BGPSec definition");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
sub = sub
@@ -817,7 +818,7 @@ impl Options {
fn make_cas_aspas_add_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("add").about("Add or replace an ASPA configuration");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
sub = sub.arg(
@@ -835,7 +836,7 @@ impl Options {
fn make_cas_aspas_remove_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("remove").about("Remove the ASPA for a customer ASN");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
sub = sub.arg(
@@ -853,7 +854,7 @@ impl Options {
fn make_cas_aspas_update_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("update").about("Update an existing ASPA configuration");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
sub = sub.arg(
@@ -889,7 +890,7 @@ impl Options {
fn make_cas_aspas_list_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("list").about("Show current ASPA configurations");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
app.subcommand(sub)
@@ -910,7 +911,7 @@ impl Options {
fn make_cas_repo_request_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("request").about("Show RFC 8183 Publisher Request XML");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
app.subcommand(sub)
@@ -919,7 +920,7 @@ impl Options {
fn make_cas_repo_show_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("show").about("Show current repo config");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
app.subcommand(sub)
@@ -928,7 +929,7 @@ impl Options {
fn make_cas_repo_status_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("status").about("Show current repo status");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
app.subcommand(sub)
@@ -937,7 +938,7 @@ impl Options {
fn make_cas_repo_configure_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("configure").about("Configure which repository a CA uses");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
sub = sub.arg(
Arg::with_name("response")
@@ -965,7 +966,7 @@ impl Options {
fn make_cas_issues_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("issues").about("Show issues for a CA");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
app.subcommand(sub)
@@ -975,7 +976,7 @@ impl Options {
fn make_cas_rta_list<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("list").about("List RTAs");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
app.subcommand(sub)
@@ -985,7 +986,7 @@ impl Options {
fn make_cas_rta_show<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("show").about("Show RTA");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
sub = sub.arg(
@@ -1013,7 +1014,7 @@ impl Options {
fn make_cas_rta_sign_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("sign").about("Create an RTA signed by a CA");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
sub = Self::add_resource_args(sub);
@@ -1062,7 +1063,7 @@ impl Options {
fn make_cas_rta_multi_prep_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("prep").about("Prepare keys for multi-signed RTA");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
sub = Self::add_resource_args(sub);
@@ -1092,7 +1093,7 @@ impl Options {
fn make_cas_rta_multi_sign_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("cosign").about("Co-sign an existing (prepared) RTA");
sub = Self::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_my_ca_arg(sub);
sub = sub.arg(
@@ -1141,14 +1142,14 @@ impl Options {
let mut refresh =
SubCommand::with_name("refresh").about("Force that all CAs ask their parents for updated certificates");
refresh = Self::add_general_args(refresh);
refresh = GeneralArgs::add_args(refresh);
let mut republish = SubCommand::with_name("publish")
.about("Force that all CAs create new objects if needed (in which case they will also sync)");
republish = Self::add_general_args(republish);
republish = GeneralArgs::add_args(republish);
let mut resync = SubCommand::with_name("sync").about("Force that all CAs sync with their repo server");
resync = Self::add_general_args(resync);
resync = GeneralArgs::add_args(resync);
sub = sub.subcommand(refresh).subcommand(republish).subcommand(resync);
@@ -1157,25 +1158,25 @@ impl Options {
fn make_health_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let health = SubCommand::with_name("health").about("Perform an authenticated health check");
let health = Self::add_general_args(health);
let health = GeneralArgs::add_args(health);
app.subcommand(health)
}
fn make_info_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let info = SubCommand::with_name("info").about("Show server info");
let info = Self::add_general_args(info);
let info = GeneralArgs::add_args(info);
app.subcommand(info)
}
fn make_publishers_list_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("list").about("List all publishers");
sub = Options::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
app.subcommand(sub)
}
fn make_publishers_stale_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("stale").about("List all publishers which have not published in a while");
sub = Options::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = sub.arg(
Arg::with_name("seconds")
.value_name("seconds")
@@ -1223,7 +1224,7 @@ impl Options {
fn make_publishers_add_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("add").about("Add a publisher");
sub = Options::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = sub
.arg(
@@ -1248,34 +1249,34 @@ impl Options {
fn make_publishers_remove_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("remove").about("Remove a publisher");
sub = Options::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_publisher_arg(sub);
app.subcommand(sub)
}
fn make_publishers_show_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("show").about("Show details for a publisher");
sub = Options::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_publisher_arg(sub);
app.subcommand(sub)
}
fn make_publishers_response_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("response").about("Show RFC 8183 Repository Response XML");
sub = Options::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_publisher_arg(sub);
app.subcommand(sub)
}
fn make_publication_server_stats_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("stats").about("Show publication server stats");
sub = Options::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
app.subcommand(sub)
}
fn make_publication_server_init_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("init").about("Initialize publication server");
sub = Options::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = Self::add_rsync_base_arg(sub);
sub = Self::add_rrdp_base_uri_arg(sub);
@@ -1285,13 +1286,13 @@ impl Options {
fn make_publication_server_clear_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("clear").about("Clear the publication server so it can re-initialized");
sub = Options::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
app.subcommand(sub)
}
fn make_publication_server_session_reset_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("session-reset").about("Reset the RRDP session");
sub = Options::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
app.subcommand(sub)
}
@@ -1320,7 +1321,7 @@ impl Options {
fn make_pubserver_delete_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
let mut sub = SubCommand::with_name("delete").about("Delete specific files from the Publication Server");
sub = Options::add_general_args(sub);
sub = GeneralArgs::add_args(sub);
sub = sub.arg(
Arg::with_name("base_uri")
src/cli/report.rs
+16 -4
View File
@@ -10,12 +10,17 @@ use crate::{
api::{
AllCertAuthIssues, AspaDefinitionList, BgpSecCsrInfoList, CaCommandDetails, CaRepoDetails, CertAuthInfo,
CertAuthIssues, CertAuthList, ChildCaInfo, ChildrenConnectionStats, CommandHistory, ConfiguredRoas,
ParentCaContact, ParentStatuses, PublisherDetails, PublisherList, RepoStatus, RtaList, RtaPrepResponse,
ServerInfo,
IdCertInfo, ParentCaContact, ParentStatuses, PublisherDetails, PublisherList, RepoStatus,
RepositoryContact, RtaList, RtaPrepResponse, ServerInfo,
},
bgp::{BgpAnalysisAdvice, BgpAnalysisReport, BgpAnalysisSuggestion},
},
daemon::ca::ResourceTaggedAttestation,
daemon::{
ca::ResourceTaggedAttestation,
ta::{
TrustAnchorProxySignerExchanges, TrustAnchorSignedRequest, TrustAnchorSignedResponse, TrustAnchorSignerInfo,
},
},
pubd::RepoStats,
};
@@ -162,7 +167,7 @@ impl fmt::Display for ReportError {
/// This trait should be implemented by all api responses, so that the
/// response can be formatted for users.
trait Report: Serialize + ToString {
pub trait Report: Serialize + ToString {
fn text(&self) -> Result<String, ReportError> {
Ok(self.to_string())
}
@@ -182,6 +187,8 @@ trait Report: Serialize + ToString {
impl Report for CertAuthList {}
impl Report for CertAuthInfo {}
impl Report for IdCertInfo {}
impl Report for RepositoryContact {}
impl Report for ChildCaInfo {}
@@ -244,3 +251,8 @@ impl Report for ServerInfo {}
impl Report for ResourceTaggedAttestation {}
impl Report for RtaList {}
impl Report for RtaPrepResponse {}
impl Report for TrustAnchorSignerInfo {}
impl Report for TrustAnchorSignedRequest {}
impl Report for TrustAnchorSignedResponse {}
impl Report for TrustAnchorProxySignerExchanges {}
src/cli/ta_client.rs
+1295
View File
File diff suppressed because it is too large Load Diff
src/commons/actor.rs
+9
View File
@@ -138,6 +138,15 @@ impl PartialEq<ActorDef> for Actor {
}
impl Actor {
/// Only for krillta
///
/// Mo authorizer framework exists for krillta. It is designed as a
/// CLI. Sysadmins should ensure that only trusted people can execute
/// the CLI (and/or read / write its data).
pub fn krillta() -> Actor {
Self::test_from_def(crate::constants::ACTOR_DEF_KRILLTA)
}
/// Only for use in testing
pub fn test_from_def(actor_def: ActorDef) -> Actor {
Actor {
src/commons/api/admin.rs
+20 -55
View File
@@ -16,13 +16,11 @@ use rpki::{
};
use crate::commons::{
api::{rrdp::PublishElement, IdCertInfo, Timestamp, TrustAnchorLocator},
api::{rrdp::PublishElement, IdCertInfo, Timestamp},
error::Error,
KrillResult,
};
use super::ReceivedCert;
//------------ Token ------------------------------------------------------
#[derive(Clone, Debug, Deserialize, Eq, Hash, PartialEq, Serialize)]
@@ -297,6 +295,12 @@ impl PartialEq for RepositoryContact {
impl Eq for RepositoryContact {}
impl From<RepositoryContact> for RepoInfo {
fn from(contact: RepositoryContact) -> Self {
contact.repo_info
}
}
//------------ ParentCaReq ---------------------------------------------------
/// This type defines all parent ca details needed to add a parent to a CA
@@ -331,32 +335,6 @@ impl ParentCaReq {
}
}
//------------ TaCertDetails -------------------------------------------------
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
pub struct TaCertDetails {
cert: ReceivedCert,
tal: TrustAnchorLocator,
}
impl TaCertDetails {
pub fn new(cert: ReceivedCert, tal: TrustAnchorLocator) -> Self {
TaCertDetails { cert, tal }
}
pub fn cert(&self) -> &ReceivedCert {
&self.cert
}
pub fn resources(&self) -> &ResourceSet {
self.cert.resources()
}
pub fn tal(&self) -> &TrustAnchorLocator {
&self.tal
}
}
//------------ ParentServerInfo ----------------------------------------------
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
@@ -427,7 +405,11 @@ impl fmt::Display for ParentServerInfo {
#[serde(rename_all = "snake_case")]
#[serde(tag = "type")]
pub enum ParentCaContact {
Ta(TaCertDetails),
// Note this used to include other, now deprecated, options.
// This is still an enum for backward compatibility without the need for
// a data migration of past events, and.. because theoretically we may
// need other options in future if there is an alternative to RFC 6492
// one day. Oh.. and having the "type" tag doesn't really hurt that much..
Rfc6492(ParentServerInfo),
}
@@ -452,32 +434,15 @@ impl ParentCaContact {
}))
}
pub fn for_ta(ta_cert_details: TaCertDetails) -> Self {
ParentCaContact::Ta(ta_cert_details)
}
pub fn parent_server_info(&self) -> Option<&ParentServerInfo> {
pub fn parent_server_info(&self) -> &ParentServerInfo {
match &self {
ParentCaContact::Ta(_) => None,
ParentCaContact::Rfc6492(info) => Some(info),
ParentCaContact::Rfc6492(info) => info,
}
}
pub fn to_ta_cert(&self) -> &ReceivedCert {
pub fn parent_uri(&self) -> &idexchange::ServiceUri {
match &self {
ParentCaContact::Ta(details) => details.cert(),
_ => panic!("Not a TA parent"),
}
}
pub fn is_ta(&self) -> bool {
matches!(*self, ParentCaContact::Ta(_))
}
pub fn parent_uri(&self) -> Option<&idexchange::ServiceUri> {
match &self {
ParentCaContact::Ta(_) => None,
ParentCaContact::Rfc6492(parent) => Some(parent.service_uri()),
ParentCaContact::Rfc6492(parent) => parent.service_uri(),
}
}
}
@@ -485,7 +450,6 @@ impl ParentCaContact {
impl fmt::Display for ParentCaContact {
fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
match self {
ParentCaContact::Ta(details) => details.tal().fmt(f),
ParentCaContact::Rfc6492(response) => response.fmt(f),
}
}
@@ -495,14 +459,12 @@ impl fmt::Display for ParentCaContact {
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
#[serde(rename_all = "snake_case")]
pub enum StorableParentContact {
Ta,
Rfc6492,
}
impl fmt::Display for StorableParentContact {
fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
match self {
StorableParentContact::Ta => write!(f, "This CA is a TA"),
StorableParentContact::Rfc6492 => write!(f, "RFC 6492 Parent"),
}
}
@@ -511,7 +473,6 @@ impl fmt::Display for StorableParentContact {
impl From<ParentCaContact> for StorableParentContact {
fn from(parent: ParentCaContact) -> Self {
match parent {
ParentCaContact::Ta(_) => StorableParentContact::Ta,
ParentCaContact::Rfc6492(_) => StorableParentContact::Rfc6492,
}
}
@@ -564,6 +525,10 @@ impl AddChildRequest {
}
}
pub fn handle(&self) -> &ChildHandle {
&self.handle
}
pub fn unpack(self) -> (ChildHandle, ResourceSet, IdCert) {
(self.handle, self.resources, self.id_cert)
}
src/commons/api/ca.rs
+44 -87
View File
@@ -2,6 +2,7 @@
//! can have access without needing to depend on the full krill_ca module.
use std::collections::HashMap;
use std::convert::TryFrom;
use std::ops::{self};
use std::str::FromStr;
use std::sync::Arc;
@@ -9,6 +10,7 @@ use std::{fmt, str};
use bytes::Bytes;
use chrono::{Duration, TimeZone, Utc};
use rpki::ca::publication::{PublishDelta, PublishDeltaElement};
use rpki::repository::x509::{Name, Validity};
use serde::{Deserialize, Serialize};
@@ -37,6 +39,7 @@ use rpki::{
};
use crate::commons::crypto::CsrInfo;
use crate::commons::error;
use crate::daemon::ca::BgpSecCertInfo;
use crate::{
commons::{
@@ -49,7 +52,7 @@ use crate::{
daemon::ca::RoaPayloadJsonMapKey,
};
use super::BgpSecAsnKey;
use super::{rrdp, BgpSecAsnKey};
//------------ IdCertInfo ----------------------------------------------------
@@ -116,6 +119,21 @@ impl From<IdCert> for IdCertInfo {
}
}
impl TryFrom<&IdCertInfo> for IdCert {
type Error = error::Error;
fn try_from(info: &IdCertInfo) -> Result<Self, Self::Error> {
IdCert::decode(info.base64.to_bytes().as_ref())
.map_err(|e| error::Error::Custom(format!("Could not decode IdCertInfo into IdCert: {}", e)))
}
}
impl fmt::Display for IdCertInfo {
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
writeln!(f, "{}", self.pem())
}
}
//------------ ChildState ----------------------------------------------------
#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
@@ -486,54 +504,6 @@ impl fmt::Display for InvalidCert {
impl std::error::Error for InvalidCert {}
//------------ TrustAnchorLocator --------------------------------------------
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
pub struct TrustAnchorLocator {
uris: Vec<uri::Https>,
rsync_uri: uri::Rsync,
encoded_ski: Base64,
}
impl TrustAnchorLocator {
/// Creates a new TAL, panics when the provided Cert is not a TA cert.
pub fn new(uris: Vec<uri::Https>, rsync_uri: uri::Rsync, public_key: &PublicKey) -> Self {
let encoded_ski = Base64::from_content(&public_key.to_info_bytes());
TrustAnchorLocator {
uris,
rsync_uri,
encoded_ski,
}
}
}
impl fmt::Display for TrustAnchorLocator {
fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
let base64_string = self.encoded_ski.to_string();
for uri in self.uris.iter() {
writeln!(f, "{}", uri)?;
}
writeln!(f, "{}", self.rsync_uri)?;
writeln!(f)?;
let len = base64_string.len();
let wrap = 64;
for i in 0..=(len / wrap) {
if (i * wrap + wrap) < len {
writeln!(f, "{}", &base64_string[i * wrap..i * wrap + wrap])?;
} else {
write!(f, "{}", &base64_string[i * wrap..])?;
}
}
Ok(())
}
}
//------------ PendingKeyInfo ------------------------------------------------
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
@@ -930,11 +900,8 @@ pub struct ParentInfo {
}
impl ParentInfo {
pub fn new(handle: ParentHandle, contact: ParentCaContact) -> Self {
let kind = match contact {
ParentCaContact::Ta(_) => ParentKindInfo::Ta,
ParentCaContact::Rfc6492(_) => ParentKindInfo::Rfc6492,
};
pub fn new(handle: ParentHandle) -> Self {
let kind = ParentKindInfo::Rfc6492;
ParentInfo { handle, kind }
}
}
@@ -1192,30 +1159,14 @@ impl ParentStatus {
//------------ RepoStatus ----------------------------------------------------
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
pub struct RepoStatus {
last_exchange: Option<ParentExchange>,
last_success: Option<Timestamp>,
next_exchange_before: Timestamp,
published: Vec<PublishElement>,
}
impl Default for RepoStatus {
fn default() -> Self {
RepoStatus {
last_exchange: None,
last_success: None,
next_exchange_before: Timestamp::now_plus_hours(1),
published: vec![],
}
}
}
impl RepoStatus {
pub fn next_exchange_before(&self) -> Timestamp {
self.next_exchange_before
}
pub fn last_exchange(&self) -> Option<&ParentExchange> {
self.last_exchange.as_ref()
}
@@ -1237,22 +1188,37 @@ impl RepoStatus {
uri,
result: ExchangeResult::Failure(error),
});
self.next_exchange_before = timestamp.plus_minutes(5);
}
pub fn set_published(&mut self, uri: ServiceUri, published: Vec<PublishElement>, next_update: Timestamp) {
pub fn update_published(&mut self, uri: ServiceUri, delta: PublishDelta) {
let timestamp = Timestamp::now();
self.last_exchange = Some(ParentExchange {
timestamp,
uri,
result: ExchangeResult::Success,
});
self.published = published;
for element in delta.into_elements() {
match element {
PublishDeltaElement::Publish(publish) => {
self.published.push(publish.into());
}
PublishDeltaElement::Update(update) => {
let update = rrdp::UpdateElement::from(update);
self.published.retain(|el| el.uri() != update.uri());
self.published.push(update.into_publish());
}
PublishDeltaElement::Withdraw(withdraw) => {
let (_tag, uri, _hash) = withdraw.unpack();
self.published.retain(|el| el.uri() != &uri);
}
}
}
self.last_success = Some(timestamp);
self.next_exchange_before = next_update;
}
pub fn set_last_updated(&mut self, uri: ServiceUri, next_update: Timestamp) {
pub fn set_last_updated(&mut self, uri: ServiceUri) {
let timestamp = Timestamp::now();
self.last_exchange = Some(ParentExchange {
timestamp,
@@ -1260,7 +1226,6 @@ impl RepoStatus {
result: ExchangeResult::Success,
});
self.last_success = Some(timestamp);
self.next_exchange_before = next_update;
}
}
@@ -1277,11 +1242,6 @@ impl fmt::Display for RepoStatus {
if let Some(success) = self.last_success() {
writeln!(f, "Last successful contact: {}", success.to_rfc3339())?;
}
writeln!(
f,
"Next contact on or before: {}",
self.next_exchange_before().to_rfc3339()
)?;
}
}
Ok(())
@@ -1680,10 +1640,7 @@ impl CertAuthInfo {
children: Vec<ChildHandle>,
suspended_children: Vec<ChildHandle>,
) -> Self {
let parents = parents
.into_iter()
.map(|(handle, contact)| ParentInfo::new(handle, contact))
.collect();
let parents = parents.into_iter().map(|(handle, _)| ParentInfo::new(handle)).collect();
let empty = ResourceSet::default();
let resources = resource_classes.values().fold(ResourceSet::default(), |res, rci| {
@@ -2214,7 +2171,7 @@ mod test {
use rpki::crypto::PublicKeyFormat;
use crate::{commons::crypto::OpenSslSigner, test};
use crate::{commons::crypto::OpenSslSigner, daemon::ta::TrustAnchorLocator, test};
use super::*;
src/commons/api/history.rs
+5 -7
View File
@@ -9,6 +9,7 @@ use rpki::{
},
crypto::KeyIdentifier,
repository::{resources::ResourceSet, x509::Time},
rrdp::Hash,
};
use crate::{
@@ -261,6 +262,10 @@ impl CommandSummary {
self.with_arg("key", ki)
}
pub fn with_id_cert_hash(self, hash: &Hash) -> Self {
self.with_arg("id_cert_hash", hash)
}
pub fn with_parent_contact(self, contact: &StorableParentContact) -> Self {
self.with_arg("parent_contact", contact)
}
@@ -407,7 +412,6 @@ impl Default for CommandHistoryCriteria {
#[serde(rename_all = "snake_case")]
#[serde(tag = "type")]
pub enum StorableCaCommand {
MakeTrustAnchor,
ChildAdd {
child: ChildHandle,
ski: String,
@@ -513,7 +517,6 @@ pub struct StorableRcEntitlement {
impl WithStorableDetails for StorableCaCommand {
fn summary(&self) -> CommandSummary {
match self {
StorableCaCommand::MakeTrustAnchor => CommandSummary::new("cmd-ca-make-ta", &self),
StorableCaCommand::ChildAdd { child, ski, resources } => CommandSummary::new("cmd-ca-child-add", &self)
.with_child(child)
.with_id_ski(ski.as_ref())
@@ -628,11 +631,6 @@ impl WithStorableDetails for StorableCaCommand {
impl fmt::Display for StorableCaCommand {
fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
match self {
// ------------------------------------------------------------
// Becoming a trust anchor
// ------------------------------------------------------------
StorableCaCommand::MakeTrustAnchor => write!(f, "Turn into Trust Anchor"),
// ------------------------------------------------------------
// Being a parent
// ------------------------------------------------------------
src/commons/api/import.rs
+42 -17
View File
@@ -11,8 +11,8 @@ use rpki::{
};
use crate::{
commons::api::PublicationServerUris,
daemon::{ca::ta_handle, config},
commons::{api::PublicationServerUris, error::Error, KrillResult},
daemon::{config, ta::ta_handle},
};
use super::RoaConfiguration;
@@ -21,10 +21,24 @@ use super::RoaConfiguration;
/// set up when the import API is used.
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
pub struct Structure {
#[serde(skip_serializing_if = "Option::is_none")]
pub ta: Option<ImportTa>,
#[serde(skip_serializing_if = "Option::is_none")]
pub publication_server: Option<PublicationServerUris>,
#[serde(skip_serializing_if = "Vec::is_empty", default = "Vec::new")]
pub cas: Vec<ImportCa>,
}
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
pub struct ImportTa {
pub ta_aia: uri::Rsync,
pub ta_uri: uri::Https,
pub publication_server_uris: PublicationServerUris,
pub cas: Vec<ImportCa>,
}
impl ImportTa {
pub fn into_uris(self) -> (uri::Rsync, Vec<uri::Https>) {
(self.ta_aia, vec![self.ta_uri])
}
}
impl Structure {
@@ -35,9 +49,8 @@ impl Structure {
cas: Vec<ImportCa>,
) -> Self {
Structure {
ta_aia,
ta_uri,
publication_server_uris,
ta: Some(ImportTa { ta_aia, ta_uri }),
publication_server: Some(publication_server_uris),
cas,
}
}
@@ -45,7 +58,7 @@ impl Structure {
/// Check that all parents are valid for the CAs in this structure
/// in the order in which they appear, and that the parent CAs have
/// the resources for each child CA.
pub fn validate_ca_hierarchy(&self) -> Result<(), String> {
pub fn validate_ca_hierarchy(&self, mut existing_cas: HashMap<ParentHandle, ResourceSet>) -> KrillResult<()> {
// Note we define the parent child relationship in the child only.
// So, the child refers to one or more parents that should have already
// been seen in the import structure.
@@ -57,30 +70,42 @@ impl Structure {
// We will always have a TA, with ALL resources in this setup. This
// TA is not mentioned in the CAs part of this structure. So, we
// will mark it as implicitly seen.
let mut seen: HashMap<ParentHandle, ResourceSet> = HashMap::new();
seen.insert(ta_handle().into_converted(), ResourceSet::all());
let ta_handle = ta_handle();
existing_cas.insert(ta_handle.convert(), ResourceSet::all());
for ca in &self.cas {
if ca.handle == ta_handle {
return Err(Error::Custom(format!("CA name {} is reserved.", ta_handle)));
}
if existing_cas.contains_key(&ca.handle.convert()) {
return Err(Error::Custom(format!(
"CA with name {} already exists. Check import and server state!",
ca.handle
)));
}
let mut ca_resources = ResourceSet::empty();
for ca_parent in &ca.parents {
if let Some(seen_parent_resources) = seen.get(ca_parent.handle()) {
if let Some(seen_parent_resources) = existing_cas.get(ca_parent.handle()) {
if seen_parent_resources.contains(&ca_parent.resources) {
ca_resources = ca_resources.union(&ca_parent.resources);
} else {
return Err(format!(
return Err(Error::Custom(format!(
"CA '{}' under parent '{}' claims resources not held by parent.",
ca.handle,
ca_parent.handle()
));
)));
}
} else {
return Err(format!(
return Err(Error::Custom(format!(
"CA '{}' wants parent '{}', but this parent CA does not appear before this CA.",
ca.handle,
ca_parent.handle()
));
)));
}
}
seen.insert(ca.handle.convert(), ca_resources);
existing_cas.insert(ca.handle.convert(), ca_resources);
}
Ok(())
}
@@ -153,6 +178,6 @@ mod tests {
let json = include_str!("../../../test-resources/bulk-ca-import/structure.json");
let structure: Structure = serde_json::from_str(json).unwrap();
assert!(structure.validate_ca_hierarchy().is_ok());
assert!(structure.validate_ca_hierarchy(HashMap::new()).is_ok());
}
}
src/commons/crypto/signing/dispatch/krillsigner.rs
+17 -2
View File
@@ -1,11 +1,13 @@
use std::{path::Path, sync::Arc, time::Duration};
use bytes::Bytes;
use rpki::{
ca::{
csr::{Csr, RpkiCaCsr},
idcert::IdCert,
idexchange::RepoInfo,
provisioning, publication,
sigmsg::SignedMessage,
},
crypto::{KeyIdentifier, PublicKey, PublicKeyFormat, RpkiSignature, RpkiSignatureAlgorithm, Signer},
repository::{
@@ -31,13 +33,16 @@ use crate::{
signerprovider::{SignerFlags, SignerProvider},
signerrouter::SignerRouter,
},
CryptoResult, OpenSslSigner,
CryptoResult, OpenSslSigner, SignSupport,
},
error::Error,
KrillResult,
},
constants::ID_CERTIFICATE_VALIDITY_YEARS,
daemon::config::{SignerConfig, SignerType},
daemon::{
config::{SignerConfig, SignerType},
ta::TA_SIGNED_MESSAGE_DAYS,
},
};
#[cfg(feature = "hsm")]
@@ -199,6 +204,10 @@ impl KrillSigner {
.map_err(crypto::Error::signer)
}
pub fn import_key(&self, pem: &str) -> CryptoResult<KeyIdentifier> {
self.router.import_key(pem).map_err(crypto::Error::signer)
}
/// Creates a new self-signed (TA) IdCert
pub fn create_self_signed_id_cert(&self) -> CryptoResult<IdCert> {
let key = self.create_key()?;
@@ -316,6 +325,12 @@ impl KrillSigner {
) -> CryptoResult<publication::PublicationCms> {
publication::PublicationCms::create(message, signing_key, &self.router).map_err(crypto::Error::signing)
}
pub fn create_ta_signed_message(&self, data: Bytes, signing_key: &KeyIdentifier) -> CryptoResult<SignedMessage> {
let validity = SignSupport::sign_validity_days(TA_SIGNED_MESSAGE_DAYS);
SignedMessage::create(data, validity, signing_key, &self.router).map_err(crypto::Error::signing)
}
}
impl KrillSigner {
src/commons/crypto/signing/dispatch/signerprovider.rs
+14
View File
@@ -182,6 +182,20 @@ impl SignerProvider {
}
}
/// Import an existing private key. Only supported for OpenSslSigner. Other
/// signers will return an error.
pub fn import_key(&self, pem: &str) -> Result<KeyIdentifier, SignerError> {
match self {
SignerProvider::OpenSsl(_, signer) => signer.import_key(pem),
#[cfg(feature = "hsm")]
SignerProvider::Kmip(_, _) => Err(SignerError::other("import key not supported for kmip")),
#[cfg(feature = "hsm")]
SignerProvider::Pkcs11(_, _) => Err(SignerError::other("import key not supported for Pkcs11")),
#[cfg(all(test, feature = "hsm"))]
SignerProvider::Mock(_, _) => Err(SignerError::other("import key not supported for mock signer")),
}
}
pub fn get_key_info(&self, key: &KeyIdentifier) -> Result<PublicKey, KeyError<SignerError>> {
match self {
SignerProvider::OpenSsl(_, signer) => signer.get_key_info(key),
src/commons/crypto/signing/dispatch/signerrouter.rs
+7
View File
@@ -190,6 +190,13 @@ impl SignerRouter {
Ok(())
}
}
/// Import an existing private RSA key. Will only work for the OpenSslSigner.
/// Returns an error if another signer is used.
pub fn import_key(&self, pem: &str) -> Result<KeyIdentifier, SignerError> {
self.bind_ready_signers();
self.default_signer.import_key(pem)
}
}
/// When the "hsm" feature is enabled we can no longer assume that signers are immediately and always available as was
src/commons/crypto/signing/misc.rs
+14 -3
View File
@@ -73,6 +73,10 @@ impl CsrInfo {
(self.ca_repository, self.rpki_manifest, self.rpki_notify, self.key)
}
pub fn key(&self) -> &PublicKey {
&self.key
}
pub fn key_id(&self) -> KeyIdentifier {
self.key.key_identifier()
}
@@ -113,11 +117,10 @@ impl SignSupport {
csr: CsrInfo,
resources: &ResourceSet,
limit: RequestResourceLimit,
signing_key: &CertifiedKey,
signing_cert: &ReceivedCert,
validity: Validity,
signer: &KrillSigner,
) -> KrillResult<IssuedCertificate> {
let signing_cert = signing_key.incoming_cert();
let resources = limit.apply_to(resources)?;
if !signing_cert.resources().contains(&resources) {
return Err(Error::MissingResources);
@@ -126,7 +129,7 @@ impl SignSupport {
let request = CertRequest::Ca(csr, validity);
let tbs = Self::make_tbs_cert(&resources, signing_cert, request, signer)?;
let cert = signer.sign_cert(tbs, signing_key.key_id())?;
let cert = signer.sign_cert(tbs, &signing_cert.key_identifier())?;
let uri = signing_cert.uri_for_object(&cert);
@@ -223,6 +226,14 @@ impl SignSupport {
Ok(cert)
}
/// Returns a validity period from 5 minutes ago (in case of NTP mess-up), to
/// X weeks from now.
pub fn sign_validity_years(years: i32) -> Validity {
let from = Time::five_minutes_ago();
let until = Time::years_from_now(years);
Validity::new(from, until)
}
/// Returns a validity period from 5 minutes ago (in case of NTP mess-up), to
/// X weeks from now.
pub fn sign_validity_weeks(weeks: i64) -> Validity {
src/commons/crypto/signing/signers/softsigner.rs
+56 -7
View File
@@ -152,7 +152,10 @@ impl OpenSslSigner {
fn build_key(&self) -> Result<KeyIdentifier, SignerError> {
let kp = OpenSslKeyPair::build()?;
self.store_key(kp)
}
fn store_key(&self, kp: OpenSslKeyPair) -> Result<KeyIdentifier, SignerError> {
let pk = &kp.subject_public_key_info()?;
let key_id = pk.key_identifier();
@@ -228,6 +231,16 @@ impl OpenSslSigner {
pub fn create_key(&self, _algorithm: PublicKeyFormat) -> Result<KeyIdentifier, SignerError> {
let key_id = self.build_key()?;
self.remember_key_id(&key_id)?;
Ok(key_id)
}
/// Import an existing RSA key pair from the PEM encoded private key
pub fn import_key(&self, pem: &str) -> Result<KeyIdentifier, SignerError> {
let kp = OpenSslKeyPair::from_pem(pem)?;
let key_id = self.store_key(kp)?;
self.remember_key_id(&key_id)?;
Ok(key_id)
}
@@ -296,13 +309,7 @@ impl<'de> Deserialize<'de> for OpenSslKeyPair {
D: Deserializer<'de>,
{
match String::deserialize(d) {
Ok(base64) => {
let bytes = base64::decode(&base64).map_err(de::Error::custom)?;
let pkey = PKey::private_key_from_der(&bytes).map_err(de::Error::custom)?;
Ok(OpenSslKeyPair { pkey })
}
Ok(base64) => Self::from_base64(&base64).map_err(de::Error::custom),
Err(err) => Err(err),
}
}
@@ -323,6 +330,22 @@ impl OpenSslKeyPair {
PublicKey::decode(bytes).map_err(SignerError::other)
}
/// Can be used to import an existing RSA key pair from
/// the pem encoded private key.
pub fn from_pem(pem: &str) -> Result<OpenSslKeyPair, SignerError> {
PKey::private_key_from_pem(pem.as_bytes())
.map(|pkey| OpenSslKeyPair { pkey })
.map_err(|e| SignerError::Other(format!("Invalid private key: {}", e)))
}
fn from_base64(base64: &str) -> Result<OpenSslKeyPair, SignerError> {
let bytes = base64::decode(base64).map_err(|_| SignerError::other("Cannot parse private key base64"))?;
PKey::private_key_from_der(&bytes)
.map(|pkey| OpenSslKeyPair { pkey })
.map_err(|e| SignerError::Other(format!("Invalid private key: {}", e)))
}
}
//------------ Tests ---------------------------------------------------------
@@ -354,4 +377,30 @@ pub mod tests {
// not implement Eq and PartialEq.
assert_eq!(json, json_from_des);
}
#[test]
fn import_existing_pkcs1_openssl_key() {
test::test_under_tmp(|d| {
// The following key was generated using openssl on the command
let pem = include_str!("../../../../../test-resources/ta/example-pkcs1.pem");
let signer = OpenSslSigner::build(&d, "dummy", None).unwrap();
let ki = signer.import_key(pem).unwrap();
signer.get_key_info(&ki).unwrap();
signer.destroy_key(&ki).unwrap();
})
}
#[test]
fn import_existing_pkcs8_openssl_key() {
test::test_under_tmp(|d| {
// The following key was generated using openssl on the command
let pem = include_str!("../../../../../test-resources/ta/example-pkcs8.pem");
let signer = OpenSslSigner::build(&d, "dummy", None).unwrap();
let ki = signer.import_key(pem).unwrap();
signer.get_key_info(&ki).unwrap();
signer.destroy_key(&ki).unwrap();
})
}
}
src/commons/error.rs
+32 -5
View File
@@ -23,7 +23,7 @@ use crate::{
eventsourcing::{AggregateStoreError, KeyValueError},
util::httpclient,
},
daemon::{ca::RoaPayloadJsonMapKey, http::tls_keys},
daemon::{ca::RoaPayloadJsonMapKey, http::tls_keys, ta},
upgrades::PrepareUpgradeError,
};
@@ -289,7 +289,8 @@ pub enum Error {
KeyUseNoOldKey,
KeyUseNoIssuedCert,
KeyUseNoMatch(KeyIdentifier),
KeyRollNotAllowed,
KeyRollInProgress,
KeyRollActivatePendingRequests,
//-----------------------------------------------------------------
// Resource Issues
@@ -299,11 +300,19 @@ pub enum Error {
MissingResources,
//-----------------------------------------------------------------
// Embedded (test) TA issues
// TA issues
//-----------------------------------------------------------------
TaNotAllowed,
TaNameReserved,
TaNotInitialized,
TaAlreadyInitialized,
TaProxyAlreadyHasRepository,
TaProxyHasNoRepository,
TaProxyHasNoSigner,
TaProxyAlreadyHasSigner,
TaProxyHasNoRequest,
TaProxyHasRequest,
TaProxyRequestNonceMismatch(ta::Nonce, ta::Nonce),
//-----------------------------------------------------------------
// Resource Tagged Attestation issues
@@ -470,7 +479,8 @@ impl fmt::Display for Error {
Error::KeyUseNoOldKey => write!(f, "No old key in resource class"),
Error::KeyUseNoIssuedCert => write!(f, "No issued cert matching pub key"),
Error::KeyUseNoMatch(ki) => write!(f, "No key found matching key identifier: '{}'", ki),
Error::KeyRollNotAllowed => write!(f, "Key roll in progress"),
Error::KeyRollInProgress => write!(f, "Key roll in progress"),
Error::KeyRollActivatePendingRequests => write!(f, "Cannot activate key while there are still pending requests."),
//-----------------------------------------------------------------
// Resource Issues
@@ -485,7 +495,15 @@ impl fmt::Display for Error {
//-----------------------------------------------------------------
Error::TaNotAllowed => write!(f, "Functionality not supported for Trust Anchor"),
Error::TaNameReserved => write!(f, "Name reserved for embedded Trust Anchor"),
Error::TaNotInitialized => write!(f, "TrustAnchor was not initialized"),
Error::TaAlreadyInitialized => write!(f, "TrustAnchor was already initialized"),
Error::TaProxyAlreadyHasRepository => write!(f, "Trust Anchor Proxy already has repository"),
Error::TaProxyHasNoRepository => write!(f, "Trust Anchor Proxy has no repository"),
Error::TaProxyHasNoSigner => write!(f, "Trust Anchor Proxy has no associated signer"),
Error::TaProxyAlreadyHasSigner => write!(f, "Trust Anchor Proxy already has associated signer"),
Error::TaProxyHasNoRequest => write!(f, "Trust Anchor Proxy has no signer request"),
Error::TaProxyHasRequest => write!(f, "Trust Anchor Proxy already has signer request"),
Error::TaProxyRequestNonceMismatch(rcvd, expected) => write!(f, "Trust Anchor Response nonce '{}' does not match open Request nonce '{}'", rcvd, expected),
//-----------------------------------------------------------------
// Resource Tagged Attestation issues
@@ -889,7 +907,8 @@ impl Error {
Error::KeyUseNoOldKey => ErrorResponse::new("key-no-old", &self),
Error::KeyUseNoIssuedCert => ErrorResponse::new("key-no-cert", &self),
Error::KeyUseNoMatch(ki) => ErrorResponse::new("key-no-match", &self).with_key_identifier(ki),
Error::KeyRollNotAllowed => ErrorResponse::new("key-roll-disallowed", &self),
Error::KeyRollInProgress => ErrorResponse::new("key-roll-disallowed", &self),
Error::KeyRollActivatePendingRequests => ErrorResponse::new("key-roll-pending-requests", &self),
//-----------------------------------------------------------------
// Resource Issues (label: rc-*)
@@ -903,7 +922,15 @@ impl Error {
//-----------------------------------------------------------------
Error::TaNotAllowed => ErrorResponse::new("ta-not-allowed", &self),
Error::TaNameReserved => ErrorResponse::new("ta-name-reserved", &self),
Error::TaNotInitialized => ErrorResponse::new("ta-not-initialized", &self),
Error::TaAlreadyInitialized => ErrorResponse::new("ta-initialized", &self),
Error::TaProxyAlreadyHasRepository => ErrorResponse::new("ta-has-repository", &self),
Error::TaProxyHasNoRepository => ErrorResponse::new("ta-has-no-repository", &self),
Error::TaProxyHasNoSigner => ErrorResponse::new("ta-has-no-signer", &self),
Error::TaProxyAlreadyHasSigner => ErrorResponse::new("ta-has-signer", &self),
Error::TaProxyHasNoRequest => ErrorResponse::new("ta-has-no-signer-req", &self),
Error::TaProxyHasRequest => ErrorResponse::new("ta-has-signer-req", &self),
Error::TaProxyRequestNonceMismatch(_rcvd, _expected) => ErrorResponse::new("ta-proxy-response-nonce", &self),
//-----------------------------------------------------------------
// Resource Tagged Attestation issues
src/commons/util/httpclient.rs
+13 -4
View File
@@ -189,19 +189,28 @@ pub async fn post_json_with_opt_response<T: DeserializeOwned>(
/// Performs a POST with no data to the given URI and expects and empty 200 OK response.
pub async fn post_empty(uri: &str, token: Option<&Token>) -> Result<(), Error> {
let res = do_empty_post(uri, token).await?;
empty_response(uri, res).await
}
/// Performs a POST with no data to the given URI and expects a response.
pub async fn post_empty_with_response<T: DeserializeOwned>(uri: &str, token: Option<&Token>) -> Result<T, Error> {
let res = do_empty_post(uri, token).await?;
process_json_response(uri, res).await
}
async fn do_empty_post(uri: &str, token: Option<&Token>) -> Result<Response, Error> {
if env::var(KRILL_CLI_API_ENV).is_ok() {
report_post_and_exit(uri, None, token, "<empty>");
}
let headers = headers(uri, Some(JSON_CONTENT), token)?;
let res = client(uri)?
client(uri)?
.post(uri)
.headers(headers)
.send()
.await
.map_err(|e| Error::execute(uri, e))?;
empty_response(uri, res).await
.map_err(|e| Error::execute(uri, e))
}
/// Posts binary data, and expects a binary response. Includes the full krill version
src/constants.rs
+7 -3
View File
@@ -7,8 +7,9 @@ pub const KRILL_VERSION_PATCH: &str = env!("CARGO_PKG_VERSION_PATCH");
pub const KRILL_SERVER_APP: &str = "Krill";
pub const KRILL_UP_APP: &str = "Krill Upgrade Helper";
pub const KRILL_CLIENT_APP: &str = "Krill Client";
pub const KRILL_TA_CLIENT_APP: &str = "Krill Trust Anchor Client";
pub const KRILL_DEFAULT_CONFIG_FILE: &str = "./defaults/krill.conf";
pub const KRILL_DEFAULT_CONFIG_FILE: &str = "/etc/krill.conf";
const KRILL_ENV_TEST: &str = "KRILL_TEST";
const KRILL_ENV_TEST_ANN: &str = "KRILL_TEST_ANN";
@@ -40,6 +41,8 @@ pub const KEYS_DIR: &str = "keys";
pub const SIGNERS_DIR: &str = "signers";
pub const CASERVER_DIR: &str = "cas";
pub const TA_PROXY_SERVER_DIR: &str = "ta_proxy";
pub const TA_SIGNER_SERVER_DIR: &str = "ta_signer";
pub const CA_OBJECTS_DIR: &str = "ca_objects";
pub const PUBSERVER_DFLT: &str = "0";
@@ -91,6 +94,7 @@ pub const OPENID_CONNECT_HTTP_CLIENT_TIMEOUT_SECS: u64 = 30;
pub const NO_RESOURCE: NoResourceType = NoResourceType;
pub const ACTOR_DEF_KRILL: ActorDef = ActorDef::system("krill", "admin");
pub const ACTOR_DEF_KRILLTA: ActorDef = ActorDef::system("krillta", "admin");
pub const ACTOR_DEF_ANON: ActorDef = ActorDef::anonymous();
pub const ACTOR_DEF_ADMIN_TOKEN: ActorDef = ActorDef::system("admin-token", "admin");
pub const ACTOR_DEF_TESTBED: ActorDef = ActorDef::system("testbed", "testbed");
@@ -114,8 +118,8 @@ pub const DEFAULT_SIGNER_NAME: &str = "Default OpenSSL signer";
#[cfg(all(feature = "hsm-tests-kmip", feature = "hsm-tests-pkcs11"))]
pub const DEFAULT_SIGNER_NAME: &str = "Default OpenSSL signer";
#[cfg(all(feature = "hsm-tests-kmip", not(feature = "hsm-tests-pkcs11")))]
pub const DEFAULT_KMIP_SIGNER_NAME: &str = "(test mode) Default KMIP signer";
pub const DEFAULT_SIGNER_NAME: &str = "(test mode) Default KMIP signer";
#[cfg(all(feature = "hsm-tests-pkcs11", not(feature = "hsm-tests-kmip")))]
pub const DEFAULT_PKCS11_SIGNER_NAME: &str = "(test mode) Default PKCS#11 signer";
pub const DEFAULT_SIGNER_NAME: &str = "(test mode) Default PKCS#11 signer";
pub const OPENSSL_ONE_OFF_SIGNER_NAME: &str = "OpenSSL one-off signer";
src/daemon/auth/providers/config_file/provider.rs
+1 -1
View File
@@ -159,7 +159,7 @@ impl ConfigFileAuthProvider {
)
.unwrap();
if hex::encode(hashed_hash) == user_password_hash.as_ref() {
if hex::encode(hashed_hash) == user_password_hash {
// And now finally check the user, so that both known and unknown user code paths do the same work
// and don't result in an obvious timing difference between the two scenarios which could potentially
// be used to discover user names.
src/daemon/ca/certauth.rs
+7 -120
View File
@@ -15,12 +15,11 @@ use rpki::{
},
crypto::{KeyIdentifier, PublicKey},
repository::{
cert::{Cert, KeyUsage, Overclaim, TbsCert},
cert::Cert,
resources::ResourceSet,
rta::RtaBuilder,
x509::{Serial, Time, Validity},
x509::{Time, Validity},
},
uri,
};
use crate::{
@@ -29,8 +28,7 @@ use crate::{
AspaCustomer, AspaDefinitionList, AspaDefinitionUpdates, AspaProvidersUpdate, BgpSecAsnKey,
BgpSecCsrInfoList, BgpSecDefinitionUpdates, CertAuthInfo, ConfiguredRoa, IdCertInfo, IssuedCertificate,
ObjectName, ParentCaContact, ReceivedCert, RepositoryContact, Revocation, RoaConfiguration,
RoaConfigurationUpdates, RtaList, RtaName, RtaPrepResponse, StorableCaCommand, TaCertDetails,
TrustAnchorLocator,
RoaConfigurationUpdates, RtaList, RtaName, RtaPrepResponse, StorableCaCommand,
},
crypto::{CsrInfo, KrillSigner},
error::{Error, RoaDeltaError},
@@ -40,10 +38,9 @@ use crate::{
constants::test_mode_enabled,
daemon::{
ca::{
events::ChildCertificateUpdates, ta_handle, AspaDefinitions, BgpSecDefinitions, CaEvt, CaEvtDet,
ChildDetails, Cmd, CmdDet, DropReason, Ini, PreparedRta, ResourceClass, ResourceTaggedAttestation,
Rfc8183Id, RoaPayloadJsonMapKey, Routes, RtaContentRequest, RtaPrepareRequest, Rtas, SignedRta,
StoredBgpSecCsr,
events::ChildCertificateUpdates, AspaDefinitions, BgpSecDefinitions, CaEvt, CaEvtDet, ChildDetails, Cmd,
CmdDet, DropReason, Ini, PreparedRta, ResourceClass, ResourceTaggedAttestation, Rfc8183Id,
RoaPayloadJsonMapKey, Routes, RtaContentRequest, RtaPrepareRequest, Rtas, SignedRta, StoredBgpSecCsr,
},
config::{Config, IssuanceTimingConfig},
},
@@ -133,18 +130,6 @@ impl Aggregate for CertAuth {
fn apply(&mut self, event: CaEvt) {
self.version += 1;
match event.into_details() {
//-----------------------------------------------------------------------
// Being a trust anchor
//-----------------------------------------------------------------------
CaEvtDet::TrustAnchorMade { ta_cert_details } => {
let key_id = ta_cert_details.cert().key_identifier();
self.parents
.insert(ta_handle().into_converted(), ParentCaContact::Ta(ta_cert_details));
let rcn = ResourceClassName::from(self.next_class_name);
self.next_class_name += 1;
self.resources.insert(rcn.clone(), ResourceClass::for_ta(rcn, key_id));
}
//-----------------------------------------------------------------------
// Being a parent
//-----------------------------------------------------------------------
@@ -416,9 +401,6 @@ impl Aggregate for CertAuth {
}
match command.into_details() {
// trust anchor
CmdDet::MakeTrustAnchor(uris, rsync_uri, signer) => self.trust_anchor_make(uris, rsync_uri, signer),
// being a parent
CmdDet::ChildAdd(child, id_cert, resources) => self.child_add(child, id_cert, resources),
CmdDet::ChildUpdateResources(child, res) => self.child_update_resources(&child, res),
@@ -599,75 +581,6 @@ impl CertAuth {
}
}
/// # Being a Trust Anchor
///
impl CertAuth {
fn trust_anchor_make(
&self,
uris: Vec<uri::Https>,
rsync_uri: uri::Rsync,
signer: Arc<KrillSigner>,
) -> KrillResult<Vec<CaEvt>> {
if !self.resources.is_empty() {
return Err(Error::custom("Cannot turn CA with resources into TA"));
}
let repo_info = self.repository_contact()?.repo_info();
let key = signer.create_key()?;
let resources = ResourceSet::all();
let cert = {
let serial: Serial = signer.random_serial()?;
let pub_key = signer.get_key_info(&key).map_err(Error::signer)?;
let name = pub_key.to_subject_name();
let mut cert = TbsCert::new(
serial,
name.clone(),
Validity::new(Time::five_minutes_ago(), Time::years_from_now(100)),
Some(name),
pub_key.clone(),
KeyUsage::Ca,
Overclaim::Refuse,
);
cert.set_basic_ca(Some(true));
let ns = ResourceClassName::default().to_string();
cert.set_ca_repository(Some(repo_info.ca_repository(&ns)));
cert.set_rpki_manifest(Some(
repo_info.resolve(&ns, ObjectName::mft_for_key(&pub_key.key_identifier()).as_ref()),
));
cert.set_rpki_notify(repo_info.rpki_notify().cloned());
cert.set_as_resources(resources.to_as_resources());
cert.set_v4_resources(resources.to_ip_resources_v4());
cert.set_v6_resources(resources.to_ip_resources_v6());
signer.sign_cert(cert, &key)?
};
let tal = TrustAnchorLocator::new(uris, rsync_uri.clone(), cert.subject_public_key_info());
let rcvd_cert =
ReceivedCert::create(cert, rsync_uri, resources, RequestResourceLimit::default()).map_err(Error::custom)?;
let ta_cert_details = TaCertDetails::new(rcvd_cert, tal);
info!("Created Trust Anchor");
Ok(vec![StoredEvent::new(
&self.handle,
self.version,
CaEvtDet::TrustAnchorMade { ta_cert_details },
)])
}
}
/// # Being a parent
///
impl CertAuth {
@@ -1215,17 +1128,6 @@ impl CertAuth {
None
}
/// Returns true if this CertAuth is set up as a TA.
pub fn is_ta(&self) -> bool {
for info in self.parents.values() {
if let ParentCaContact::Ta(_) = info {
return true;
}
}
false
}
/// Gets the ParentCaContact for this ParentHandle. Returns an Err when the
/// parent does not exist.
pub fn parent(&self, parent: &ParentHandle) -> KrillResult<&ParentCaContact> {
@@ -1251,8 +1153,6 @@ impl CertAuth {
Err(Error::CaParentDuplicateName(self.handle.clone(), parent))
} else if let Some(other) = self.parent_for_info(&info) {
Err(Error::CaParentDuplicateInfo(self.handle.clone(), other.clone()))
} else if self.is_ta() {
Err(Error::TaNotAllowed)
} else {
info!("CA '{}' added parent '{}'", self.handle, parent);
Ok(vec![CaEvtDet::parent_added(&self.handle, self.version, parent, info)])
@@ -1289,8 +1189,6 @@ impl CertAuth {
fn update_parent(&self, parent: ParentHandle, info: ParentCaContact) -> KrillResult<Vec<CaEvt>> {
if !self.parent_known(&parent) {
Err(Error::CaParentUnknown(self.handle.clone(), parent))
} else if self.is_ta() {
Err(Error::TaNotAllowed)
} else {
info!("CA '{}' updated contact info for parent '{}'", self.handle, parent);
Ok(vec![CaEvtDet::parent_updated(&self.handle, self.version, parent, info)])
@@ -1526,10 +1424,6 @@ impl CertAuth {
///
impl CertAuth {
fn keyroll_initiate(&self, duration: Duration, signer: Arc<KrillSigner>) -> KrillResult<Vec<CaEvt>> {
if self.is_ta() {
return Ok(vec![]);
}
let mut version = self.version;
let mut res = vec![];
@@ -1561,10 +1455,6 @@ impl CertAuth {
config: Arc<Config>,
signer: Arc<KrillSigner>,
) -> KrillResult<Vec<CaEvt>> {
if self.is_ta() {
return Ok(vec![]);
}
let mut version = self.version;
let mut res = vec![];
@@ -1594,9 +1484,6 @@ impl CertAuth {
}
fn keyroll_finish(&self, rcn: ResourceClassName, _response: RevocationResponse) -> KrillResult<Vec<CaEvt>> {
if self.is_ta() {
return Ok(vec![]);
}
let my_rc = self
.resources
.get(&rcn)
@@ -1637,7 +1524,7 @@ impl CertAuth {
if !rc.key_roll_possible() {
// If we can't roll... well then we have to bail out.
// Note: none of these events are committed in that case.
return Err(Error::KeyRollNotAllowed);
return Err(Error::KeyRollInProgress);
}
evt_dets.append(&mut rc.keyroll_initiate(&info, Duration::seconds(0), signer)?);
src/daemon/ca/child.rs
+11 -14
View File
@@ -8,15 +8,12 @@ use rpki::{
use crate::{
commons::{
api::{ChildCaInfo, ChildState, IdCertInfo, IssuedCertificate, SuspendedCert, UnsuspendedCert},
api::{ChildCaInfo, ChildState, IdCertInfo, IssuedCertificate, ReceivedCert, SuspendedCert, UnsuspendedCert},
crypto::{KrillSigner, SignSupport},
error::Error,
KrillResult,
},
daemon::{
ca::{CertifiedKey, ChildCertificateUpdates},
config::IssuanceTimingConfig,
},
daemon::{ca::ChildCertificateUpdates, config::IssuanceTimingConfig},
};
//------------ UsedKeyState ------------------------------------------------
@@ -193,18 +190,18 @@ impl ChildCertificates {
/// Re-issue everything when activating a new key
pub fn activate_key(
&self,
new_key: &CertifiedKey,
signing_cert: &ReceivedCert,
issuance_timing: &IssuanceTimingConfig,
signer: &KrillSigner,
) -> KrillResult<ChildCertificateUpdates> {
let mut updates = ChildCertificateUpdates::default();
for issued in self.issued.values() {
updates.issue(self.re_issue(issued, None, new_key, issuance_timing, signer)?);
updates.issue(self.re_issue(issued, None, signing_cert, issuance_timing, signer)?);
}
// Also re-issue suspended certificates, they may yet become unsuspended at some point
for suspended in self.suspended.values() {
updates.suspend(
self.re_issue(&suspended.convert(), None, new_key, issuance_timing, signer)?
self.re_issue(&suspended.convert(), None, signing_cert, issuance_timing, signer)?
.into_converted(),
);
}
@@ -218,13 +215,13 @@ impl ChildCertificates {
/// with those resources.
pub fn shrink_overclaiming(
&self,
updated_key: &CertifiedKey,
received_cert: &ReceivedCert,
issuance_timing: &IssuanceTimingConfig,
signer: &KrillSigner,
) -> KrillResult<ChildCertificateUpdates> {
let mut updates = ChildCertificateUpdates::default();
let updated_resources = updated_key.incoming_cert().resources();
let updated_resources = received_cert.resources();
for issued in self.issued.values() {
if let Some(reduced_set) = issued.reduced_applicable_resources(updated_resources) {
@@ -233,7 +230,7 @@ impl ChildCertificates {
updates.remove(issued.key_identifier());
} else {
// re-issue
updates.issue(self.re_issue(issued, Some(reduced_set), updated_key, issuance_timing, signer)?);
updates.issue(self.re_issue(issued, Some(reduced_set), received_cert, issuance_timing, signer)?);
}
}
}
@@ -254,7 +251,7 @@ impl ChildCertificates {
self.re_issue(
&suspended.convert(),
Some(reduced_set),
updated_key,
received_cert,
issuance_timing,
signer,
)?
@@ -273,7 +270,7 @@ impl ChildCertificates {
&self,
previous: &IssuedCertificate,
updated_resources: Option<ResourceSet>,
signing_key: &CertifiedKey,
signing_cert: &ReceivedCert,
issuance_timing: &IssuanceTimingConfig,
signer: &KrillSigner,
) -> KrillResult<IssuedCertificate> {
@@ -285,7 +282,7 @@ impl ChildCertificates {
csr_info,
&resource_set,
limit,
signing_key,
signing_cert,
issuance_timing.new_child_cert_validity(),
signer,
)?;
src/daemon/ca/commands.rs
-22
View File
@@ -11,7 +11,6 @@ use rpki::{
},
},
repository::resources::ResourceSet,
uri,
};
use crate::{
@@ -46,11 +45,6 @@ pub type DropReason = String;
#[derive(Clone, Debug)]
#[allow(clippy::large_enum_variant)]
pub enum CmdDet {
// ------------------------------------------------------------
// Being a TA
// ------------------------------------------------------------
MakeTrustAnchor(Vec<uri::Https>, uri::Rsync, Arc<KrillSigner>),
// ------------------------------------------------------------
// Being a parent
// ------------------------------------------------------------
@@ -225,11 +219,6 @@ impl fmt::Display for CmdDet {
impl From<CmdDet> for StorableCaCommand {
fn from(d: CmdDet) -> Self {
match d {
// ------------------------------------------------------------
// Being a TA
// ------------------------------------------------------------
CmdDet::MakeTrustAnchor(_, _, _) => StorableCaCommand::MakeTrustAnchor,
// ------------------------------------------------------------
// Being a parent
// ------------------------------------------------------------
@@ -344,17 +333,6 @@ impl From<CmdDet> for StorableCaCommand {
}
impl CmdDet {
/// Turns this CA into a TrustAnchor
pub fn make_trust_anchor(
handle: &CaHandle,
uris: Vec<uri::Https>,
rsync_uri: uri::Rsync,
signer: Arc<KrillSigner>,
actor: &Actor,
) -> Cmd {
eventsourcing::SentCommand::new(handle, None, CmdDet::MakeTrustAnchor(uris, rsync_uri, signer), actor)
}
/// Adds a child to this CA. Will return an error in case you try
/// to give the child resources not held by the CA.
pub fn child_add(
src/daemon/ca/events.rs
+11 -26
View File
@@ -13,8 +13,7 @@ use crate::{
commons::{
api::{
AspaCustomer, AspaDefinition, AspaProvidersUpdate, BgpSecAsnKey, IdCertInfo, IssuedCertificate, ObjectName,
ParentCaContact, ReceivedCert, RepositoryContact, RoaAggregateKey, RtaName, SuspendedCert, TaCertDetails,
UnsuspendedCert,
ParentCaContact, ReceivedCert, RepositoryContact, RoaAggregateKey, RtaName, SuspendedCert, UnsuspendedCert,
},
crypto::KrillSigner,
eventsourcing::StoredEvent,
@@ -48,6 +47,12 @@ impl Rfc8183Id {
}
}
impl From<Rfc8183Id> for IdCertInfo {
fn from(id: Rfc8183Id) -> Self {
id.cert
}
}
//------------ Ini -----------------------------------------------------------
pub type Ini = StoredEvent<IniDet>;
@@ -425,11 +430,6 @@ pub type CaEvt = StoredEvent<CaEvtDet>;
#[serde(rename_all = "snake_case")]
#[serde(tag = "type")]
pub enum CaEvtDet {
// Being a Trust Anchor
TrustAnchorMade {
ta_cert_details: TaCertDetails,
},
// Being a parent Events
/// A child was added to this (parent) CA
ChildAdded {
@@ -774,13 +774,6 @@ impl CaEvtDet {
impl fmt::Display for CaEvtDet {
fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
match self {
// Being a Trust Anchor
CaEvtDet::TrustAnchorMade { ta_cert_details } => write!(
f,
"turn into TA with key (hash) {}",
ta_cert_details.cert().key_identifier()
),
// Being a parent Events
CaEvtDet::ChildAdded {
child,
@@ -874,19 +867,11 @@ impl fmt::Display for CaEvtDet {
"updated RFC8183 id to key '{}'",
id.cert().public_key().key_identifier()
),
CaEvtDet::ParentAdded { parent, contact } => {
let contact_str = match contact {
ParentCaContact::Ta(_) => "TA proxy",
ParentCaContact::Rfc6492(_) => "RFC6492",
};
write!(f, "added {} parent '{}' ", contact_str, parent)
CaEvtDet::ParentAdded { parent, .. } => {
write!(f, "added parent '{}' ", parent)
}
CaEvtDet::ParentUpdated { parent, contact } => {
let contact_str = match contact {
ParentCaContact::Ta(_) => "TA proxy",
ParentCaContact::Rfc6492(_) => "RFC6492",
};
write!(f, "updated parent '{}' contact to '{}' ", parent, contact_str)
CaEvtDet::ParentUpdated { parent, .. } => {
write!(f, "updated parent '{}'", parent)
}
CaEvtDet::ParentRemoved { parent } => write!(f, "removed parent '{}'", parent),
src/daemon/ca/keys.rs
+10 -6
View File
@@ -573,12 +573,16 @@ impl KeyState {
signer: &KrillSigner,
) -> KrillResult<CaEvtDet> {
match self {
KeyState::RollNew(_new, current) => {
let revoke_req = Self::revoke_key(parent_class_name, current.key_id(), signer)?;
Ok(CaEvtDet::KeyRollActivated {
resource_class_name,
revoke_req,
})
KeyState::RollNew(new, current) => {
if new.request().is_some() || current.request().is_some() {
Err(Error::KeyRollActivatePendingRequests)
} else {
let revoke_req = Self::revoke_key(parent_class_name, current.key_id(), signer)?;
Ok(CaEvtDet::KeyRollActivated {
resource_class_name,
revoke_req,
})
}
}
_ => Err(Error::KeyUseNoNewKey),
}
src/daemon/ca/manager.rs
+622 -272
View File
File diff suppressed because it is too large Load Diff
src/daemon/ca/mod.rs
-6
View File
@@ -44,14 +44,8 @@ pub use self::rta::*;
mod status;
pub use self::status::*;
pub const TA_NAME: &str = "ta"; // reserved for TA
pub const TESTBED_CA_NAME: &str = "testbed"; // reserved for testbed mode
pub fn ta_handle() -> CaHandle {
use std::str::FromStr;
CaHandle::from_str(TA_NAME).unwrap()
}
pub fn testbed_ca_handle() -> CaHandle {
use std::str::FromStr;
CaHandle::from_str(TESTBED_CA_NAME).unwrap()
src/daemon/ca/publishing.rs
+21 -34
View File
@@ -27,7 +27,7 @@ use crate::{
commons::{
api::{
rrdp::PublishElement, CertInfo, IssuedCertificate, ObjectName, ReceivedCert, RepositoryContact, Revocation,
Revocations, Timestamp,
Revocations,
},
crypto::KrillSigner,
error::Error,
@@ -344,24 +344,6 @@ impl CaObjects {
all_elements
}
/// Returns the closest next update time from among manifests held by this CA
pub fn closest_next_update(&self) -> Option<Timestamp> {
let mut closest = None;
for resource_class_objects in self.classes.values() {
let rco_time = Timestamp::from(resource_class_objects.next_update_time());
if let Some(current_closest) = closest {
if current_closest > rco_time {
closest = Some(rco_time);
}
} else {
closest = Some(rco_time);
}
}
closest
}
pub fn deprecated_repos(&self) -> &Vec<DeprecatedRepository> {
&self.deprecated_repos
}
@@ -643,14 +625,6 @@ impl ResourceClassObjects {
}
}
fn next_update_time(&self) -> Time {
match &self.keys {
ResourceClassKeyState::Current(state) => state.current_set.next_update(),
ResourceClassKeyState::Old(state) => state.current_set.next_update(),
ResourceClassKeyState::Staging(state) => state.current_set.next_update(),
}
}
fn reissue(&mut self, timing: &IssuanceTimingConfig, signer: &KrillSigner) -> KrillResult<()> {
match self.keys.borrow_mut() {
ResourceClassKeyState::Current(state) => state.current_set.reissue(timing, signer),
@@ -888,7 +862,7 @@ impl KeyObjectSet {
let signing_key = signing_cert.key_identifier();
let issuer = signing_cert.subject().clone();
let revocations = Revocations::default();
let revision = ObjectSetRevision::create(timing);
let revision = ObjectSetRevision::create(timing.publish_next());
let crl = CrlBuilder::build(signing_key, issuer, &revocations, revision, signer)?;
let published_objects = HashMap::new();
@@ -1031,7 +1005,7 @@ impl KeyObjectSet {
}
fn reissue(&mut self, timing: &IssuanceTimingConfig, signer: &KrillSigner) -> KrillResult<()> {
self.revision.next(timing);
self.revision.next(timing.publish_next());
self.revocations.remove_expired();
let signing_key = self.signing_cert.key_identifier();
@@ -1095,18 +1069,31 @@ impl ObjectSetRevision {
next_update,
}
}
fn create(timing: &IssuanceTimingConfig) -> Self {
pub fn number(&self) -> u64 {
self.number
}
pub fn this_update(&self) -> Time {
self.this_update
}
pub fn next_update(&self) -> Time {
self.next_update
}
fn create(next_update: Time) -> Self {
ObjectSetRevision {
number: 1,
this_update: Time::five_minutes_ago(),
next_update: timing.publish_next(),
next_update,
}
}
fn next(&mut self, timing: &IssuanceTimingConfig) {
pub fn next(&mut self, next_update: Time) {
self.number += 1;
self.this_update = Time::five_minutes_ago();
self.next_update = timing.publish_next();
self.next_update = next_update;
}
}
@@ -1281,7 +1268,7 @@ impl ManifestBuilder {
self
}
fn build_new_mft(self, signing_cert: &ReceivedCert, signer: &KrillSigner) -> KrillResult<Manifest> {
pub fn build_new_mft(self, signing_cert: &ReceivedCert, signer: &KrillSigner) -> KrillResult<Manifest> {
let mft_uri = signing_cert.mft_uri();
let crl_uri = signing_cert.crl_uri();
src/daemon/ca/rc.rs
+12 -9
View File
@@ -26,10 +26,11 @@ use crate::{
daemon::{
ca::events::RoaUpdates,
ca::{
self, ta_handle, AspaObjects, AspaObjectsUpdates, CaEvtDet, CertifiedKey, ChildCertificates, CurrentKey,
KeyState, NewKey, OldKey, PendingKey, Roas, Routes,
self, AspaObjects, AspaObjectsUpdates, CaEvtDet, CertifiedKey, ChildCertificates, CurrentKey, KeyState,
NewKey, OldKey, PendingKey, Roas, Routes,
},
config::{Config, IssuanceTimingConfig},
ta::ta_handle,
},
};
@@ -367,9 +368,9 @@ impl ResourceClass {
let updated_key = CertifiedKey::create(rcvd_cert);
// Shrink any overclaiming child certificates
let updates = self
.certificates
.shrink_overclaiming(&updated_key, &config.issuance_timing, signer)?;
let updates =
self.certificates
.shrink_overclaiming(updated_key.incoming_cert(), &config.issuance_timing, signer)?;
if !updates.is_empty() {
res.push(CaEvtDet::ChildCertificatesUpdated {
resource_class_name: self.name.clone(),
@@ -621,7 +622,9 @@ impl ResourceClass {
events.push(aspas_updated);
}
let cert_updates = self.certificates.activate_key(new_key, issuance_timing, signer)?;
let cert_updates = self
.certificates
.activate_key(new_key.incoming_cert(), issuance_timing, signer)?;
if !cert_updates.is_empty() {
let certs_updated = CaEvtDet::ChildCertificatesUpdated {
resource_class_name: self.name.clone(),
@@ -676,15 +679,15 @@ impl ResourceClass {
issuance_timing: &IssuanceTimingConfig,
signer: &KrillSigner,
) -> KrillResult<IssuedCertificate> {
let signing_key = self.get_current_key()?;
let parent_resources = signing_key.incoming_cert().resources();
let signing_cert = self.get_current_key()?.incoming_cert();
let parent_resources = signing_cert.resources();
let resources = parent_resources.intersection(child_resources);
let issued = SignSupport::make_issued_cert(
csr,
&resources,
limit,
signing_key,
signing_cert,
issuance_timing.new_child_cert_validity(),
signer,
)?;
src/daemon/ca/status.rs
+7 -12
View File
@@ -3,12 +3,13 @@ use std::{collections::HashMap, path::Path, str::FromStr, sync::RwLock};
use rpki::ca::{
idexchange::{CaHandle, ChildHandle, ParentHandle, ServiceUri},
provisioning::ResourceClassListResponse as Entitlements,
publication::PublishDelta,
};
use crate::commons::{
api::{
rrdp::PublishElement, ChildConnectionStats, ChildStatus, ChildrenConnectionStats, ErrorResponse, ParentStatus,
ParentStatuses, RepoStatus, Timestamp,
ChildConnectionStats, ChildStatus, ChildrenConnectionStats, ErrorResponse, ParentStatus, ParentStatuses,
RepoStatus,
},
error::Error,
eventsourcing::{KeyStoreKey, KeyValueStore},
@@ -285,18 +286,12 @@ impl StatusStore {
self.update_repo_status(ca, |status| status.set_failure(uri, error_response))
}
pub fn set_status_repo_success(&self, ca: &CaHandle, uri: ServiceUri, next_update: Timestamp) -> KrillResult<()> {
self.update_repo_status(ca, |status| status.set_last_updated(uri, next_update))
pub fn set_status_repo_success(&self, ca: &CaHandle, uri: ServiceUri) -> KrillResult<()> {
self.update_repo_status(ca, |status| status.set_last_updated(uri))
}
pub fn set_status_repo_published(
&self,
ca: &CaHandle,
uri: ServiceUri,
published: Vec<PublishElement>,
next_update: Timestamp,
) -> KrillResult<()> {
self.update_repo_status(ca, |status| status.set_published(uri, published, next_update))
pub fn set_status_repo_published(&self, ca: &CaHandle, uri: ServiceUri, delta: PublishDelta) -> KrillResult<()> {
self.update_repo_status(ca, |status| status.update_published(uri, delta))
}
fn update_repo_status<F>(&self, ca: &CaHandle, op: F) -> KrillResult<()>
src/daemon/config.rs
+49 -24
View File
@@ -61,7 +61,7 @@ impl ConfigDefaults {
env::var(KRILL_ENV_FORCE_RECOVER).is_ok()
}
fn log_level() -> LevelFilter {
pub fn log_level() -> LevelFilter {
match env::var(KRILL_ENV_LOG_LEVEL) {
Ok(level) => match LevelFilter::from_str(&level) {
Ok(level) => level,
@@ -74,7 +74,7 @@ impl ConfigDefaults {
}
}
fn log_type() -> LogType {
pub fn log_type() -> LogType {
LogType::File
}
@@ -90,7 +90,7 @@ impl ConfigDefaults {
AuthType::AdminToken
}
fn admin_token() -> Token {
pub fn admin_token() -> Token {
match env::var(KRILL_ENV_ADMIN_TOKEN) {
Ok(token) => Token::from(token),
Err(_) => match env::var(KRILL_ENV_ADMIN_TOKEN_DEPRECATED) {
@@ -223,23 +223,27 @@ impl ConfigDefaults {
4
}
pub fn openssl_signer_only() -> Vec<SignerConfig> {
let signer_config = OpenSslSignerConfig { keys_path: None };
vec![SignerConfig::new(
DEFAULT_SIGNER_NAME.to_string(),
SignerType::OpenSsl(signer_config),
)]
}
pub fn signers() -> Vec<SignerConfig> {
#[cfg(not(any(feature = "hsm-tests-kmip", feature = "hsm-tests-pkcs11")))]
{
let signer_config = OpenSslSignerConfig { keys_path: None };
vec![SignerConfig::new(
DEFAULT_SIGNER_NAME.to_string(),
SignerType::OpenSsl(signer_config),
)]
Self::openssl_signer_only()
}
#[cfg(all(feature = "hsm-tests-kmip", feature = "hsm-tests-pkcs11"))]
{
let signer_config = OpenSslSignerConfig { keys_path: None };
vec![SignerConfig::new(
DEFAULT_SIGNER_NAME.to_string(),
SignerType::OpenSsl(signer_config),
)]
// If we have both enables then just go with openssl.
// This is because we are using rust features here to drive testing
// which is not ideal.. should be changes when we remove the feature
// flags for this.
Self::openssl_signer_only()
}
#[cfg(all(feature = "hsm-tests-kmip", not(feature = "hsm-tests-pkcs11")))]
@@ -267,7 +271,7 @@ impl ConfigDefaults {
max_response_bytes: KmipSignerConfig::default_max_response_bytes(),
};
return vec![SignerConfig::new(
DEFAULT_KMIP_SIGNER_NAME.to_string(),
DEFAULT_SIGNER_NAME.to_string(),
SignerType::Kmip(signer_config),
)];
}
@@ -285,7 +289,7 @@ impl ConfigDefaults {
max_retry_seconds: Pkcs11SignerConfig::default_max_retry_seconds(),
};
vec![SignerConfig::new(
DEFAULT_PKCS11_SIGNER_NAME.to_string(),
DEFAULT_SIGNER_NAME.to_string(),
SignerType::Pkcs11(signer_config),
)]
}
@@ -312,7 +316,7 @@ pub enum SignerReference {
Index(usize),
}
fn deserialize_signer_ref<'de, D>(deserializer: D) -> Result<SignerReference, D::Error>
pub fn deserialize_signer_ref<'de, D>(deserializer: D) -> Result<SignerReference, D::Error>
where
D: Deserializer<'de>,
{
@@ -403,6 +407,22 @@ pub struct Config {
#[serde(default)] // default is false
pub data_dir_use_lock: bool,
// default is false
// implicitly enabled in case of testbed
// for that reason.. not pub, but fn provided
#[serde(default)]
pub ta_support_enabled: bool,
// default is false
// implicitly enabled in case of testbed
// MUST be enabled for ca imports to work,
// but can be disabled later and signer can
// be migrated.
//
// for that reason.. not pub, but fn provided
#[serde(default)]
pub ta_signer_enabled: bool,
#[serde(default = "ConfigDefaults::always_recover_data")]
pub always_recover_data: bool,
@@ -568,14 +588,6 @@ impl IssuanceTimingConfig {
self.timing_publish_hours_before_next.into()
}
/// Worst case guess for re-issuance
pub fn republish_worst_case(&self) -> Time {
Time::now()
+ Duration::hours(self.timing_publish_next_hours.into())
+ Duration::hours(self.timing_publish_next_jitter_hours.into())
- Duration::hours(self.publish_hours_before_next())
}
//-- Child Cert
/// Validity period for newly issued child certificates
@@ -807,6 +819,17 @@ impl Config {
}
}
/// Returns whether TA support is explicitly enabled in the config, or
/// implicitly enabled in case testbed (or benchmark) mode is used.
pub fn ta_proxy_enabled(&self) -> bool {
self.ta_support_enabled || self.testbed.is_some()
}
/// Returns whether TA signer is enabled.
pub fn ta_signer_enabled(&self) -> bool {
self.ta_signer_enabled || self.testbed.is_some()
}
pub fn suspend_child_after_inactive_seconds(&self) -> Option<i64> {
match self.suspend_child_after_inactive_seconds {
Some(seconds) => Some(seconds.into()),
@@ -1008,6 +1031,8 @@ impl Config {
https_mode,
data_dir,
data_dir_use_lock,
ta_support_enabled: false, // but, enabled by testbed where applicable
ta_signer_enabled: false, // same as above
always_recover_data,
pid_file,
service_uri: None,
src/daemon/http/server.rs
+141 -15
View File
@@ -53,13 +53,14 @@ use crate::{
daemon::{
auth::common::permissions::Permission,
auth::{Auth, Handle},
ca::{CaStatus, TA_NAME},
ca::CaStatus,
config::Config,
http::{
auth::auth, statics::statics, testbed::testbed, tls, tls_keys, HttpResponse, Request, RequestPath,
RoutingResult,
},
krillserver::KrillServer,
ta::{self, TA_NAME},
},
upgrades::{finalise_data_migration, post_start_upgrade, prepare_upgrade_data_migrations, UpgradeMode},
};
@@ -604,19 +605,6 @@ pub async fn metrics(req: Request) -> RoutingResult {
));
}
}
res.push('\n');
res.push_str("# HELP krill_ca_ps_next_planned_time unix timestamp in seconds of next planned CA to Publication Server connection (unless e.g. ROAs are changed)\n");
res.push_str("# TYPE krill_ca_ps_next_planned_time gauge\n");
for (ca, status) in ca_status_map.iter() {
// skip the ones for which we have no status yet, i.e it was really only just added
// and no attempt to connect has yet been made.
let timestamp = status.repo().next_exchange_before();
res.push_str(&format!(
"krill_ca_ps_next_planned_time{{ca=\"{}\"}} {}\n",
ca, timestamp
));
}
}
// Do not show child metrics if none of the CAs has any children..
@@ -934,7 +922,7 @@ async fn ta(req: Request) -> RoutingResult {
}
pub async fn tal(req: Request) -> RoutingResult {
match req.state().ta().await {
match req.state().ta_cert_details().await {
Ok(ta) => Ok(HttpResponse::text(format!("{}", ta.tal()).into_bytes())),
Err(_) => render_unknown_resource(),
}
@@ -1117,6 +1105,7 @@ async fn api(req: Request) -> RoutingResult {
Some("bulk") => api_bulk(req, &mut path).await,
Some("cas") => api_cas(req, &mut path).await,
Some("pubd") => aa!(req, Permission::PUB_ADMIN, api_publication_server(req, &mut path).await),
Some("ta") => aa!(req, Permission::CA_ADMIN, api_ta(req, &mut path).await),
_ => render_unknown_method(),
}
})
@@ -2221,6 +2210,143 @@ async fn api_ca_rta_multi_sign(req: Request, ca: CaHandle, name: RtaName) -> Rou
})
}
//-------------------------------- API TA --------------------------------------------------
async fn api_ta(req: Request, path: &mut RequestPath) -> RoutingResult {
//
// krillta proxy --server .. --token ..
//
// Uses API krill API:
//
// /api/v1/ta/
//
// - proxy and signer set up
// POST /proxy/init initialise proxy
// POST /proxy/id proxy id cert info
// GET /proxy/repo/request.xml get RFC8181 publisher request
// GET /proxy/repo/request.json get RFC8181 publisher request
// GET /proxy/repo get repository contact
// POST /proxy/repo add pub server
// POST /proxy/signer/add add initialised signer to proxy
// POST /proxy/signer/request create sign request for signer (returns request)
// GET /proxy/signer/request show open sign request if any
// POST /proxy/signer/response process sign response from signer
//
// - children
// GET /proxy/children/ future: list children
// POST /proxy/children/ add child
// GET /proxy/children/{child}/parent_response.json show parent response for child
// GET /proxy/children/{child}/parent_response.xml show parent response for child
// POST /proxy/children/{child} future: update child
// DEL /proxy/children/{child} future: remove child
//
// krillta signer --dir
// init
// process
// history (future)
// response <nonce>
match path.next() {
Some("proxy") => match path.next() {
Some("init") => render_empty_res(req.state().ta_proxy_init().await),
Some("id") => render_json_res(req.state().ta_proxy_id().await),
Some("repo") => match path.next() {
Some("request.xml") => match req.state().ta_proxy_publisher_request().await {
Ok(req) => Ok(HttpResponse::xml(req.to_xml_vec())),
Err(e) => render_error(e),
},
Some("request.json") => render_json_res(req.state().ta_proxy_publisher_request().await),
None => match *req.method() {
Method::POST => {
let ta_handle = ta::ta_handle();
let server = req.state().clone();
let actor = req.actor.clone();
match req
.api_bytes()
.await
.map(|bytes| extract_repository_contact(&ta_handle, bytes))
{
Ok(Ok(contact)) => {
render_empty_res(server.ta_proxy_repository_update(contact, &actor).await)
}
Ok(Err(e)) | Err(e) => render_error(e),
}
}
Method::GET => render_json_res(req.state().ta_proxy_repository_contact().await),
_ => render_unknown_method(),
},
_ => render_unknown_method(),
},
Some("signer") => match path.next() {
Some("add") => {
let server = req.state().clone();
let actor = req.actor.clone();
match req.json().await {
Ok(ta_signer_info) => {
render_empty_res(server.ta_proxy_signer_add(ta_signer_info, &actor).await)
}
Err(e) => render_error(e),
}
}
Some("request") => match *req.method() {
Method::POST => render_json_res(req.state().ta_proxy_signer_make_request(&req.actor()).await),
Method::GET => render_json_res(req.state().ta_proxy_signer_get_request().await),
_ => render_unknown_method(),
},
Some("response") => match *req.method() {
Method::POST => {
let server = req.state().clone();
let actor = req.actor.clone();
match req.json().await {
Ok(response) => {
render_empty_res(server.ta_proxy_signer_process_response(response, &actor).await)
}
Err(e) => render_error(e),
}
}
_ => render_unknown_method(),
},
_ => render_unknown_method(),
},
Some("children") => match path.path_arg::<ChildHandle>() {
Some(child) => match path.next() {
Some("parent_response.json") => {
render_json_res(req.state().ca_parent_response(&ta::ta_handle(), child).await)
}
Some("parent_response.xml") => {
match req.state().ca_parent_response(&ta::ta_handle(), child).await {
Ok(parent_response) => Ok(HttpResponse::xml(parent_response.to_xml_vec())),
Err(e) => render_error(e),
}
}
None => match *req.method() {
Method::POST => render_error(Error::custom("update TA child not yet supported")),
Method::DELETE => render_error(Error::custom("remove TA child not yet supported")),
_ => render_unknown_method(),
},
_ => render_unknown_method(),
},
None => match *req.method() {
Method::POST => {
let actor = req.actor();
let server = req.state().clone();
match req.json().await {
Ok(child_req) => render_json_res(server.ta_proxy_children_add(child_req, &actor).await),
Err(e) => render_error(e),
}
}
Method::GET => render_error(Error::custom("show TA child not yet supported")),
_ => render_unknown_method(),
},
},
_ => render_unknown_method(),
},
_ => render_unknown_method(),
}
}
/// A naive lock implementation used to prevent that two Krill instances
/// access the same krill data directory simultaneously.
struct KrillLock(PathBuf);
src/daemon/http/testbed.rs
+2 -1
View File
@@ -5,7 +5,7 @@ use rpki::ca::idexchange::PublisherHandle;
use crate::{
constants::ACTOR_DEF_TESTBED,
daemon::{
ca::{ta_handle, testbed_ca_handle},
ca::testbed_ca_handle,
http::{
server::{
api_add_pbl, api_ca_add_child, api_ca_child_remove, api_ca_parent_res_xml, api_remove_pbl,
@@ -13,6 +13,7 @@ use crate::{
},
HttpResponse, Request, RequestPath, RoutingResult,
},
ta::ta_handle,
},
};
src/daemon/krillserver.rs
+135 -59
View File
@@ -22,10 +22,10 @@ use crate::{
self, AddChildRequest, AllCertAuthIssues, AspaCustomer, AspaDefinitionList, AspaDefinitionUpdates,
AspaProvidersUpdate, BgpSecCsrInfoList, BgpSecDefinitionUpdates, CaCommandDetails, CaRepoDetails,
CertAuthInfo, CertAuthInit, CertAuthIssues, CertAuthList, CertAuthStats, ChildCaInfo,
ChildrenConnectionStats, CommandHistory, CommandHistoryCriteria, ConfiguredRoa, ParentCaContact,
ParentCaReq, PublicationServerUris, PublisherDetails, ReceivedCert, RepoFileDeleteCriteria,
RepositoryContact, RoaConfiguration, RoaConfigurationUpdates, RoaPayload, RtaList, RtaName,
RtaPrepResponse, ServerInfo, TaCertDetails, Timestamp, UpdateChildRequest,
ChildrenConnectionStats, CommandHistory, CommandHistoryCriteria, ConfiguredRoa, IdCertInfo,
ParentCaContact, ParentCaReq, PublicationServerUris, PublisherDetails, ReceivedCert,
RepoFileDeleteCriteria, RepositoryContact, RoaConfiguration, RoaConfigurationUpdates, RoaPayload, RtaList,
RtaName, RtaPrepResponse, ServerInfo, Timestamp, UpdateChildRequest,
},
bgp::{BgpAnalyser, BgpAnalysisReport, BgpAnalysisSuggestion},
crypto::KrillSignerBuilder,
@@ -36,14 +36,12 @@ use crate::{
constants::*,
daemon::{
auth::{providers::AdminTokenAuthProvider, Authorizer, LoggedInUser},
ca::{
self, ta_handle, testbed_ca_handle, CaStatus, ResourceTaggedAttestation, RtaContentRequest,
RtaPrepareRequest,
},
ca::{self, testbed_ca_handle, CaStatus, ResourceTaggedAttestation, RtaContentRequest, RtaPrepareRequest},
config::{AuthType, Config},
http::HttpResponse,
mq::TaskQueue,
scheduler::Scheduler,
ta::{ta_handle, TaCertDetails, TA_NAME},
},
pubd::{RepoStats, RepositoryManager},
};
@@ -54,7 +52,10 @@ use crate::daemon::auth::{
providers::{ConfigFileAuthProvider, OpenIDConnectAuthProvider},
};
use super::ca::CaManager;
use super::{
ca::CaManager,
ta::{TrustAnchorSignedRequest, TrustAnchorSignedResponse, TrustAnchorSignerInfo},
};
//------------ KrillServer ---------------------------------------------------
@@ -366,26 +367,77 @@ impl KrillServer {
}
}
/// # Being a parent
/// # TA Support
///
impl KrillServer {
pub async fn ta(&self) -> KrillResult<TaCertDetails> {
let ta_handle = ta_handle();
let ta = self.ca_manager.get_ca(&ta_handle).await?;
pub fn ta_proxy_enabled(&self) -> bool {
self.config.ta_proxy_enabled()
}
let parent_handle = ParentHandle::new(ta_handle.into_name());
pub async fn ta_proxy_init(&self) -> KrillResult<()> {
self.ca_manager.ta_proxy_init().await
}
if let ParentCaContact::Ta(ta) = ta.parent(&parent_handle).unwrap() {
Ok(ta.clone())
} else {
panic!("Found TA which was not initialized as TA.")
}
pub async fn ta_proxy_id(&self) -> KrillResult<IdCertInfo> {
self.ca_manager.ta_proxy_id().await
}
pub async fn ta_proxy_publisher_request(&self) -> KrillResult<idexchange::PublisherRequest> {
self.ca_manager.ta_proxy_publisher_request().await
}
pub async fn ta_proxy_repository_update(&self, contact: RepositoryContact, actor: &Actor) -> KrillResult<()> {
self.ca_manager.ta_proxy_repository_update(contact, actor).await
}
pub async fn ta_proxy_repository_contact(&self) -> KrillResult<RepositoryContact> {
self.ca_manager.ta_proxy_repository_contact().await
}
pub async fn ta_proxy_signer_add(&self, info: TrustAnchorSignerInfo, actor: &Actor) -> KrillResult<()> {
self.ca_manager.ta_proxy_signer_add(info, actor).await
}
pub async fn ta_proxy_signer_make_request(&self, actor: &Actor) -> KrillResult<TrustAnchorSignedRequest> {
self.ca_manager.ta_proxy_signer_make_request(actor).await
}
pub async fn ta_proxy_signer_get_request(&self) -> KrillResult<TrustAnchorSignedRequest> {
self.ca_manager.ta_proxy_signer_get_request().await
}
pub async fn ta_proxy_signer_process_response(
&self,
response: TrustAnchorSignedResponse,
actor: &Actor,
) -> KrillResult<()> {
self.ca_manager.ta_proxy_signer_process_response(response, actor).await
}
pub async fn ta_proxy_children_add(
&self,
child_request: AddChildRequest,
actor: &Actor,
) -> KrillResult<idexchange::ParentResponse> {
// TA as parent is handled a special case in the following
self.ca_manager
.ca_add_child(&ta_handle().convert(), child_request, &self.config.service_uri(), actor)
.await
}
pub async fn ta_cert_details(&self) -> KrillResult<TaCertDetails> {
let proxy = self.ca_manager.get_trust_anchor_proxy().await?;
Ok(proxy.get_ta_details()?.clone())
}
pub async fn trust_anchor_cert(&self) -> Option<ReceivedCert> {
self.ta().await.ok().map(|details| details.cert().clone())
self.ta_cert_details().await.ok().map(|details| details.into())
}
}
/// # Being a parent
///
impl KrillServer {
/// Adds a child to a CA and returns the ParentCaInfo that the child
/// will need to contact this CA for resource requests.
pub async fn ca_add_child(
@@ -511,29 +563,42 @@ impl KrillServer {
Ok(res)
}
//
pub async fn cas_import(&self, structure: api::import::Structure) -> KrillResult<()> {
let actor = Arc::new(self.system_actor().clone());
if !self.ca_list(&actor)?.cas().is_empty() || self.repo_manager.initialized()? {
Err(Error::custom("Import CAs is only permitted when Krill is empty."))
} else if let Err(e) = structure.validate_ca_hierarchy() {
Err(Error::Custom(e))
// We need to know which CAs already exist. They should not be imported again,
// but can serve as parents.
let mut existing_cas = HashMap::new();
for ca in self.ca_list(&actor)?.cas() {
let parent_handle = ca.handle().convert();
let resources = self.ca_manager.get_ca(ca.handle()).await?.all_resources();
existing_cas.insert(parent_handle, resources);
}
structure.validate_ca_hierarchy(existing_cas)?;
if !self.config.ta_proxy_enabled() {
Err(Error::custom(
"Import CAs is only possible when ta_support_enabled = true",
))
} else if !self.config.ta_signer_enabled() {
Err(Error::custom(
"Import CAs is only possible when ta_signer_enabled = true",
))
} else {
if let Some(publication_server_uris) = structure.publication_server.clone() {
info!("Initialising publication server");
self.repo_manager.init(publication_server_uris)?;
}
if let Some(import_ta) = structure.ta.clone() {
info!("Creating embedded Trust Anchor");
let (ta_aia, ta_uris) = import_ta.into_uris();
self.ca_manager
.ta_init_fully_embedded(ta_aia, ta_uris, &self.repo_manager, &actor)
.await?;
}
info!("Bulk import {} CAs", structure.cas.len());
info!("Initialising publication server");
self.repo_manager.init(structure.publication_server_uris.clone())?;
info!("Creating embedded Trust Anchor");
self.ca_manager
.init_ta(
structure.ta_aia.clone(),
vec![structure.ta_uri.clone()],
&self.repo_manager,
&actor,
)
.await?;
// Set up each online TA child with local repo, do this in parallel.
let mut import_fns = vec![];
let service_uri = Arc::new(self.config.service_uri());
@@ -607,30 +672,33 @@ impl KrillServer {
let mut tried = 0;
let parent_as_ca: CaHandle = parent.convert();
loop {
tried += 1;
if let Ok(parent) = ca_manager.get_ca(&parent_as_ca).await {
if parent.all_resources().contains(&resources) {
break;
// If the parent is the TA, then there is no need to wait.
if parent.as_str() != TA_NAME {
loop {
tried += 1;
if let Ok(parent) = ca_manager.get_ca(&parent_as_ca).await {
if parent.all_resources().contains(&resources) {
break;
} else {
info!(
"Parent {} does not (yet) have resources for {}. Will wait a bit and try again",
parent.handle(),
ca_handle
);
}
} else {
info!(
"Parent {} does not (yet) have resources for {}. Will wait a bit and try again",
parent.handle(),
ca_handle
"Parent {} for CA {} is not yet created. Will wait a bit and try again",
parent_as_ca, ca_handle
);
}
} else {
info!(
"Parent {} for CA {} is not yet created. Will wait a bit and try again",
parent_as_ca, ca_handle
);
}
tokio::time::sleep(std::time::Duration::from_millis(wait_ms)).await;
if tried >= max_tries {
return Err(Error::Custom(format!(
"Could not import CA {}. Parent: {} is not created",
ca_handle, parent_as_ca
)));
tokio::time::sleep(std::time::Duration::from_millis(wait_ms)).await;
if tried >= max_tries {
return Err(Error::Custom(format!(
"Could not import CA {}. Parent: {} is not created",
ca_handle, parent_as_ca
)));
}
}
}
@@ -658,6 +726,14 @@ impl KrillServer {
// Second sync will send that CSR to the parent
ca_manager.ca_sync_parent(&ca_handle, &parent, &actor).await?;
// If the parent is a TA, then we will need to push a bit more..
// Normally this should be handled by triggered tasks, but the
// task scheduler is not running when we do this at startup.
if parent.as_str() == TA_NAME {
ca_manager.sync_ta_proxy_signer_if_possible().await?;
ca_manager.ca_sync_parent(&ca_handle, &parent, &actor).await?;
}
}
}
src/daemon/mod.rs
+1
View File
@@ -5,3 +5,4 @@ pub mod http;
pub mod krillserver;
pub mod mq;
pub mod scheduler;
pub mod ta;
src/daemon/mq.rs
+45 -2
View File
@@ -20,9 +20,14 @@ use crate::{
api::Timestamp,
eventsourcing::{self, Event},
},
daemon::ca::{CaEvt, CaEvtDet, CertAuth},
daemon::{
ca::{CaEvt, CaEvtDet, CertAuth},
ta::{ta_handle, TrustAnchorProxyEventDetails},
},
};
use super::ta::{TrustAnchorProxy, TrustAnchorProxyEvent};
//------------ Task ---------------------------------------------------------
/// This type contains tasks with the details needed for triggered processing.
@@ -40,6 +45,8 @@ pub enum Task {
parent: ParentHandle,
},
SyncTrustAnchorProxySignerIfPossible,
SuspendChildrenIfNeeded {
ca: CaHandle,
},
@@ -75,6 +82,7 @@ impl fmt::Display for Task {
Task::QueueStartTasks => write!(f, "Server just started"),
Task::SyncRepo { ca } => write!(f, "synchronize repo for '{}'", ca),
Task::SyncParent { ca, parent } => write!(f, "synchronize CA '{}' with parent '{}'", ca, parent),
Task::SyncTrustAnchorProxySignerIfPossible => write!(f, "sync TA Proxy and Signer if both in this server."),
Task::SuspendChildrenIfNeeded { ca } => write!(f, "verify if CA '{}' has children to suspend", ca),
Task::RepublishIfNeeded => write!(f, "let CAs republish their mft/crls if needed"),
Task::RenewObjectsIfNeeded => write!(f, "let CAs renew their signed objects if needed"),
@@ -217,6 +225,10 @@ impl TaskQueue {
self.schedule(Task::SyncParent { ca, parent }, priority);
}
pub fn sync_ta_proxy_signer_if_possible(&self) {
self.schedule(Task::SyncTrustAnchorProxySignerIfPossible, now())
}
pub fn suspend_children(&self, ca: CaHandle, priority: Priority) {
self.schedule(Task::SuspendChildrenIfNeeded { ca }, priority);
}
@@ -253,7 +265,7 @@ impl TaskQueue {
}
}
/// Implement listening for CertAuth Published events.
/// Implement listening for CertAuth events.
impl eventsourcing::PostSaveEventListener<CertAuth> for TaskQueue {
fn listen(&self, ca: &CertAuth, events: &[CaEvt]) {
for event in events {
@@ -349,6 +361,37 @@ impl eventsourcing::PostSaveEventListener<CertAuth> for TaskQueue {
}
}
/// Implement listening for TrustAnchorProxy events.
impl eventsourcing::PostSaveEventListener<TrustAnchorProxy> for TaskQueue {
fn listen(&self, _proxy: &TrustAnchorProxy, events: &[TrustAnchorProxyEvent]) {
for event in events {
trace!("Seen TrustAnchorProxy event '{}'", event);
match event.details() {
TrustAnchorProxyEventDetails::ChildRequestAdded(_child, _request) => {
// schedule proxy -> signer sync
self.sync_ta_proxy_signer_if_possible();
}
TrustAnchorProxyEventDetails::SignerResponseReceived(response) => {
// schedule publication for the TA
self.sync_repo(ta_handle(), now());
// Schedule child->ta sync(s) now that there is a response.
for ca in response.content().child_responses.keys() {
debug!("Received signed response for TA child {}", ca);
self.sync_parent(ca.convert(), ta_handle().into_converted(), now());
}
}
TrustAnchorProxyEventDetails::RepositoryAdded(_)
| TrustAnchorProxyEventDetails::SignerAdded(_)
| TrustAnchorProxyEventDetails::SignerRequestMade(_)
| TrustAnchorProxyEventDetails::ChildAdded(_)
| TrustAnchorProxyEventDetails::ChildResponseGiven(_, _) => {
// No triggered actions needed
}
}
}
}
}
//------------ Priority ------------------------------------------------------
/// Can be used as a priority value for [`PriorityQueue`]. Meaning that the
src/daemon/scheduler.rs
+12
View File
@@ -75,6 +75,8 @@ impl Scheduler {
Task::SyncParent { ca, parent } => self.sync_parent(ca, parent).await,
Task::SyncTrustAnchorProxySignerIfPossible => self.sync_ta_proxy_signer_if_possible().await,
Task::SuspendChildrenIfNeeded { ca } => self.suspend_children_if_needed(ca).await,
Task::RepublishIfNeeded => self.republish_if_needed().await,
@@ -237,6 +239,16 @@ impl Scheduler {
Ok(())
}
/// Try to synchronise the Trust Anchor Proxy with the *local* Signer - if it exists
/// in this server.
async fn sync_ta_proxy_signer_if_possible(&self) -> KrillResult<()> {
debug!("Synchronise Trust Anchor Proxy with Signer - if Signer is local.");
if let Err(e) = self.ca_manager.sync_ta_proxy_signer_if_possible().await {
error!("There was an issue synchronising the TA Proxy and Signer: {}", e);
}
Ok(())
}
/// Try to suspend children for a CA
async fn suspend_children_if_needed(&self, ca_handle: CaHandle) -> KrillResult<()> {
debug!("Verify if CA '{}' has children that need to be suspended", ca_handle);
src/daemon/ta/common.rs
+724
View File
@@ -0,0 +1,724 @@
//! Common types used in the communication (API) between the Proxy and Signer
use std::{
collections::HashMap,
fmt::{self, Debug},
sync::Arc,
};
use bytes::Bytes;
use rpki::{
ca::{
idexchange::{ChildHandle, RecipientHandle, SenderHandle},
provisioning,
publication::Base64,
sigmsg::SignedMessage,
},
crypto::{KeyIdentifier, PublicKey},
repository::{resources::ResourceSet, x509::Time},
uri,
};
use serde::Serialize;
use crate::{
commons::{
api::{IdCertInfo, IssuedCertificate, ObjectName, ReceivedCert, Revocations},
crypto::KrillSigner,
error::Error,
KrillResult,
},
daemon::ca::{
CrlBuilder, ManifestBuilder, ObjectSetRevision, PublishedCrl, PublishedManifest, PublishedObject, UsedKeyState,
},
};
// Some timing constants used by the Trust Anchor code. We may need to support
// configuring these things instead..
pub const TA_CERTIFICATE_VALIDITY_YEARS: i32 = 100;
pub const TA_ISSUED_CERTIFICATE_VALIDITY_WEEKS: i64 = 52;
pub const TA_MFT_NEXT_UPDATE_WEEKS: i64 = 12;
pub const TA_SIGNED_MESSAGE_DAYS: i64 = 14;
//------------ TrustAnchorObjects ------------------------------------------
/// Contains all Trust Anchor objects, including the the TA certificate
/// and TAL.
///
/// This is kept by the Trust Anchor Proxy as read-only, so that it can
/// publish these objects.
///
/// The Trust Anchor Signer can make changes to this set based on the
/// requests it gets from the proxy. It can then return a response to the
/// proxy that allow it to update the state with that same change.
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
pub struct TrustAnchorObjects {
// The revision of the set, meaning its number and the
// "this update" and "next update" values used on the
// manifest and CRL.
revision: ObjectSetRevision,
// TA Key Identifier (may not change)
key_identifier: KeyIdentifier,
// Base URI for objects published by this TA (may not change)
base_uri: uri::Rsync,
// Track revocations and the last issued CRL.
revocations: Revocations,
crl: PublishedCrl,
// The last issued manifest.
manifest: PublishedManifest,
// Certificates issued to children. We use a map to avoid having
// to loop. (yes, even if typically the list would be very short)
issued: HashMap<KeyIdentifier, IssuedCertificate>,
}
impl TrustAnchorObjects {
/// Creates a new TrustAnchorObjects for the signing certificate.
pub fn create(signing_cert: &ReceivedCert, signer: &KrillSigner) -> KrillResult<Self> {
let revision = ObjectSetRevision::new(1, Self::this_update(), Self::next_update());
let key_identifier = signing_cert.key_identifier();
let base_uri = signing_cert.ca_repository().clone();
let revocations = Revocations::default();
let signing_key = signing_cert.key_identifier();
let issuer = signing_cert.subject().clone();
let crl = CrlBuilder::build(signing_key, issuer, &revocations, revision, signer)?;
let manifest = ManifestBuilder::new(revision)
.with_objects(&crl, &HashMap::new())
.build_new_mft(signing_cert, signer)
.map(|m| m.into())?;
Ok(TrustAnchorObjects {
revision,
key_identifier,
base_uri,
revocations,
crl,
manifest,
issued: HashMap::new(),
})
}
/// Publish next revision of the published objects.
/// - Update CRL (times and revocations)
/// - Update Manifest (times and listed objects)
pub fn republish(&mut self, signing_cert: &ReceivedCert, signer: &KrillSigner) -> KrillResult<()> {
self.revision.next(Self::next_update());
let signing_key = signing_cert.key_identifier();
if signing_key != self.key_identifier {
// This would be a bug.. we will need to re-think this when implementing
// signed TALs and TA key rollovers.
Err(Error::custom("TA key changed when republishing"))
} else {
let issuer = signing_cert.subject().clone();
self.crl = CrlBuilder::build(signing_key, issuer, &self.revocations, self.revision, signer)?;
self.manifest = ManifestBuilder::new(self.revision)
.with_objects(&self.crl, &self.issued_certs_objects())
.build_new_mft(signing_cert, signer)
.map(|m| m.into())?;
Ok(())
}
}
pub fn publish_elements(&self) -> KrillResult<Vec<crate::commons::api::rrdp::PublishElement>> {
let mut res = vec![];
let mft_uri = self
.base_uri
.join(ObjectName::mft_for_key(&self.key_identifier).as_ref())
.map_err(|e| Error::Custom(format!("Cannot make uri: {}", e)))?;
res.push(self.manifest.publish_element(mft_uri));
let crl_uri = self
.base_uri
.join(ObjectName::crl_for_key(&self.key_identifier).as_ref())
.map_err(|e| Error::Custom(format!("Cannot make uri: {}", e)))?;
res.push(self.crl.publish_element(crl_uri));
for (name, object) in self.issued_certs_objects() {
let cert_uri = self
.base_uri
.join(name.as_ref())
.map_err(|e| Error::Custom(format!("Cannot make uri: {}", e)))?;
res.push(object.publish_element(cert_uri));
}
Ok(res)
}
fn issued_certs_objects(&self) -> HashMap<ObjectName, PublishedObject> {
self.issued
.iter()
.map(|(ki, cert)| {
let object = PublishedObject::for_cert_info(cert);
let name = ObjectName::cer_for_key(ki);
(name, object)
})
.collect()
}
pub fn manifest(&self) -> &PublishedManifest {
&self.manifest
}
pub fn revision(&self) -> &ObjectSetRevision {
&self.revision
}
pub fn this_update() -> Time {
Time::five_minutes_ago()
}
pub fn next_update() -> Time {
Time::now() + chrono::Duration::weeks(TA_MFT_NEXT_UPDATE_WEEKS)
}
// Adds a new issued certificate, replaces and revokes the previous if present.
pub fn add_issued(&mut self, issued: IssuedCertificate) {
if let Some(previous) = self.issued.insert(issued.key_identifier(), issued) {
self.revocations.add(previous.revocation());
self.revocations.remove_expired();
}
}
// Gets an issued certificate if it is known.
pub fn get_issued(&self, ki: &KeyIdentifier) -> Option<&IssuedCertificate> {
self.issued.get(ki)
}
// Revoke any issued certificate for the given key, and remove it. Returns false
// if there was no such certificate.
pub fn revoke_issued(&mut self, key: &KeyIdentifier) -> bool {
if let Some(issued) = self.issued.remove(key) {
self.revocations.add(issued.revocation());
self.revocations.remove_expired();
true
} else {
false
}
}
}
impl fmt::Display for TrustAnchorObjects {
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
writeln!(f, "-------------------------------------------------------")?;
writeln!(f, " Trust Anchor Objects")?;
writeln!(f, "-------------------------------------------------------")?;
writeln!(f)?;
writeln!(f, "Revision: {}", self.revision.number())?;
writeln!(f, "Next Update: {}", self.revision.next_update().to_rfc3339())?;
writeln!(f)?;
writeln!(f, "Objects:",)?;
for publish in self.publish_elements().map_err(|_| fmt::Error)? {
writeln!(f, "{}", publish.uri())?;
writeln!(f, " ({})", publish.base64().to_hash())?;
}
writeln!(f)?;
writeln!(f, "-------------------------------------------------------")
}
}
//------------ TaCertDetails -------------------------------------------------
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
pub struct TaCertDetails {
cert: ReceivedCert,
tal: TrustAnchorLocator,
}
impl TaCertDetails {
pub fn new(cert: ReceivedCert, tal: TrustAnchorLocator) -> Self {
TaCertDetails { cert, tal }
}
pub fn cert(&self) -> &ReceivedCert {
&self.cert
}
pub fn resources(&self) -> &ResourceSet {
self.cert.resources()
}
pub fn tal(&self) -> &TrustAnchorLocator {
&self.tal
}
}
impl From<TaCertDetails> for ReceivedCert {
fn from(details: TaCertDetails) -> Self {
details.cert
}
}
impl From<TaCertDetails> for TrustAnchorLocator {
fn from(details: TaCertDetails) -> Self {
details.tal
}
}
//------------ TrustAnchorLocator --------------------------------------------
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
pub struct TrustAnchorLocator {
uris: Vec<uri::Https>,
rsync_uri: uri::Rsync,
encoded_ski: Base64,
}
impl TrustAnchorLocator {
/// Creates a new TAL, panics when the provided Cert is not a TA cert.
pub fn new(uris: Vec<uri::Https>, rsync_uri: uri::Rsync, public_key: &PublicKey) -> Self {
let encoded_ski = Base64::from_content(&public_key.to_info_bytes());
TrustAnchorLocator {
uris,
rsync_uri,
encoded_ski,
}
}
pub fn uris(&self) -> &Vec<uri::Https> {
&self.uris
}
pub fn rsync_uri(&self) -> &uri::Rsync {
&self.rsync_uri
}
}
impl std::fmt::Display for TrustAnchorLocator {
fn fmt(&self, f: &mut std::fmt::Formatter) -> std::fmt::Result {
let base64_string = self.encoded_ski.to_string();
for uri in self.uris.iter() {
writeln!(f, "{}", uri)?;
}
writeln!(f, "{}", self.rsync_uri)?;
writeln!(f)?;
let len = base64_string.len();
let wrap = 64;
for i in 0..=(len / wrap) {
if (i * wrap + wrap) < len {
writeln!(f, "{}", &base64_string[i * wrap..i * wrap + wrap])?;
} else {
write!(f, "{}", &base64_string[i * wrap..])?;
}
}
Ok(())
}
}
//------------ TrustAnchorSignerInfo ---------------------------------------
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
pub struct TrustAnchorSignerInfo {
// The ID of the associated signer.
pub id: IdCertInfo,
// Trust Anchor objects to be published
pub objects: TrustAnchorObjects,
// The TA certificate and TAL
pub ta_cert_details: TaCertDetails,
}
impl fmt::Display for TrustAnchorSignerInfo {
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
writeln!(f, "-------------------------------------------------------")?;
writeln!(f, " ID Certificate")?;
writeln!(f, "-------------------------------------------------------")?;
writeln!(f)?;
writeln!(f, "{}", self.id)?;
writeln!(f)?;
writeln!(f, "-------------------------------------------------------")?;
writeln!(f)?;
writeln!(f, "{}", self.objects)?;
writeln!(f)?;
writeln!(f, "-------------------------------------------------------")?;
writeln!(f, " TAL")?;
writeln!(f, "-------------------------------------------------------")?;
writeln!(f)?;
writeln!(f, "{}", self.ta_cert_details.tal())?;
writeln!(f)?;
writeln!(f, "-------------------------------------------------------")?;
Ok(())
}
}
//------------ Nonce -------------------------------------------------------
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
pub struct Nonce(Arc<str>);
impl Nonce {
pub fn new() -> Self {
Nonce(uuid::Uuid::new_v4().to_string().into())
}
}
impl Default for Nonce {
fn default() -> Self {
Nonce::new()
}
}
impl std::fmt::Display for Nonce {
fn fmt(&self, f: &mut std::fmt::Formatter) -> std::fmt::Result {
std::fmt::Display::fmt(&self.0, f)
}
}
//------------ TrustAnchorProxySignerExchange ------------------------------
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
pub struct TrustAnchorProxySignerExchange {
pub time: Time,
pub request: TrustAnchorSignedRequest,
pub response: TrustAnchorSignedResponse,
}
//------------ TrustAnchorSignedMessage ------------------------------------
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
pub struct TrustAnchorSignedMessage {
message: Base64,
}
impl TrustAnchorSignedMessage {
pub fn validate(&self, issuer_key: &PublicKey) -> KrillResult<SignedMessage> {
self.validate_at(issuer_key, Time::now())
}
pub fn validate_at(&self, issuer_key: &PublicKey, time: Time) -> KrillResult<SignedMessage> {
let bytes = self.message.to_bytes();
let signed_message = SignedMessage::decode(bytes, true)
.map_err(|e| Error::Custom(format!("Cannot decode signed message: {}", e)))?;
signed_message
.validate_at(issuer_key, time)
.map_err(|e| Error::Custom(format!("Invalid signed message: {}", e)))?;
Ok(signed_message)
}
}
impl From<SignedMessage> for TrustAnchorSignedMessage {
fn from(signed_msg: SignedMessage) -> Self {
let message = Base64::from_content(&signed_msg.to_captured().into_bytes());
TrustAnchorSignedMessage { message }
}
}
//------------ TrustAnchorSignedRequest ------------------------------------
/// A [`TrustAnchorSignerRequest`] and its signed message as base64 for
/// (re-)validation.
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
pub struct TrustAnchorSignedRequest {
signed: TrustAnchorSignedMessage,
request: TrustAnchorSignerRequest,
}
impl TrustAnchorSignedRequest {
pub fn validate(&self, issuer: &IdCertInfo) -> Result<(), Error> {
let signed_message = self.signed.validate(issuer.public_key())?;
// Verify that the content of the signed message matches the
// clear text request as well.
let signed_bytes = signed_message.content().to_bytes();
let signed_request: TrustAnchorSignerRequest = serde_json::from_slice(&signed_bytes).map_err(|e| {
Error::Custom(format!(
"Cannot deserialize content of signed Trust Anchor request: {}",
e
))
})?;
if self.request != signed_request {
Err(Error::custom(
"Clear text request content does not match the contained signed message in Trust Anchor request",
))
} else {
Ok(())
}
}
/// Get content without validation, handle with care
pub fn content(&self) -> &TrustAnchorSignerRequest {
&self.request
}
}
impl fmt::Display for TrustAnchorSignedRequest {
fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
write!(f, "{}", self.request)
}
}
//------------ TrustAnchorSignerRequest ------------------------------------
/// Request for the Trust Anchor Signer to update the signed
/// objects (new mft, crl). Can contain requests for one or
/// more children to either issue a new certificate, or revoke
/// a key. If there are no requests for a child, then it is
/// assumed that the current issued certificate(s) to the child
/// should not change.
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
pub struct TrustAnchorSignerRequest {
pub nonce: Nonce, // should be matched in response (replay protection)
pub child_requests: Vec<TrustAnchorChildRequests>,
}
impl TrustAnchorSignerRequest {
pub fn sign(&self, signing_key: KeyIdentifier, signer: &KrillSigner) -> Result<TrustAnchorSignedRequest, Error> {
let data = serde_json::to_string_pretty(&self).unwrap();
let data = Bytes::from(data);
signer
.create_ta_signed_message(data, &signing_key)
.map(|msg| TrustAnchorSignedRequest {
request: self.clone(),
signed: msg.into(),
})
.map_err(Error::signer)
}
}
impl fmt::Display for TrustAnchorSignerRequest {
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
writeln!(f, "-------------------------------")?;
writeln!(f, "nonce: {}", self.nonce)?;
writeln!(f, "-------------------------------")?;
writeln!(f)?;
for request in &self.child_requests {
writeln!(f, "-------------------------------")?;
writeln!(f, " child request")?;
writeln!(f, "-------------------------------")?;
writeln!(f, "child: {}", request.child)?;
writeln!(f, "entitlements: {}", request.resources)?;
for (key, child_req) in &request.requests {
match child_req {
ProvisioningRequest::Issuance(_) => writeln!(f, "key: {} (re-)issue", key)?,
ProvisioningRequest::Revocation(_) => writeln!(f, "key: {} revoke", key)?,
}
}
writeln!(f)?;
}
writeln!(f, "NOTE: Use the JSON output for the signer.")?;
Ok(())
}
}
//------------ TrustAnchorChildRequests ------------------------------------
/// Requests for Trust Anchor Child.
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
pub struct TrustAnchorChildRequests {
pub child: ChildHandle,
pub resources: ResourceSet,
pub requests: HashMap<KeyIdentifier, ProvisioningRequest>,
}
//------------ TrustAnchorSignedResponse -----------------------------------
/// A [`TrustAnchorSignerResponse`] and its signed message as base64 for
/// (re-)validation.
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
pub struct TrustAnchorSignedResponse {
signed: TrustAnchorSignedMessage,
response: TrustAnchorSignerResponse,
}
impl TrustAnchorSignedResponse {
pub fn validate(&self, issuer: &IdCertInfo) -> Result<(), Error> {
let signed_message = self.signed.validate(issuer.public_key())?;
// Verify that the content of the signed message matches the
// clear text request as well.
let signed_bytes = signed_message.content().to_bytes();
let signed_response: TrustAnchorSignerResponse = serde_json::from_slice(&signed_bytes).map_err(|e| {
Error::Custom(format!(
"Cannot deserialize content of signed Trust Anchor response: {}",
e
))
})?;
if self.response != signed_response {
Err(Error::custom(
"Clear text request content does not match the contained signed message in Trust Anchor response",
))
} else {
Ok(())
}
}
/// Get content without validation, handle with care
pub fn content(&self) -> &TrustAnchorSignerResponse {
&self.response
}
pub fn into_content(self) -> TrustAnchorSignerResponse {
self.response
}
}
impl fmt::Display for TrustAnchorSignedResponse {
fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
write!(f, "{}", self.response)
}
}
//------------ TrustAnchorSignerResponse -----------------------------------
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
pub struct TrustAnchorSignerResponse {
pub nonce: Nonce, // should match the request (replay protection)
pub objects: TrustAnchorObjects,
pub child_responses: HashMap<ChildHandle, HashMap<KeyIdentifier, ProvisioningResponse>>,
}
impl TrustAnchorSignerResponse {
pub fn sign(&self, signing_key: KeyIdentifier, signer: &KrillSigner) -> Result<TrustAnchorSignedResponse, Error> {
let data = serde_json::to_string_pretty(&self).unwrap();
let data = Bytes::from(data);
signer
.create_ta_signed_message(data, &signing_key)
.map(|msg| TrustAnchorSignedResponse {
response: self.clone(),
signed: msg.into(),
})
.map_err(Error::signer)
}
}
impl fmt::Display for TrustAnchorSignerResponse {
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
writeln!(f, "-------------------------------")?;
writeln!(f, "nonce: {}", self.nonce)?;
writeln!(f, "-------------------------------")?;
writeln!(f)?;
writeln!(f, "{}", self.objects)?;
writeln!(f)?;
for (child, responses) in &self.child_responses {
writeln!(f, "-------------------------------")?;
writeln!(f, " child response")?;
writeln!(f, "-------------------------------")?;
writeln!(f, "child: {}", child)?;
for (key, response) in responses.iter() {
match response {
ProvisioningResponse::Error => writeln!(f, "key: {} ERROR", key)?,
ProvisioningResponse::Issuance(_) => writeln!(f, "key: {} issued", key)?,
ProvisioningResponse::Revocation(_) => writeln!(f, "key: {} revoked", key)?,
}
}
}
writeln!(f)?;
writeln!(f, "NOTE: use the json format for the proxy.")?;
Ok(())
}
}
//------------ TrustAnchorChild --------------------------------------------
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
pub struct TrustAnchorChild {
pub handle: ChildHandle,
pub id: IdCertInfo,
pub resources: ResourceSet,
pub used_keys: HashMap<KeyIdentifier, UsedKeyState>,
pub open_requests: HashMap<KeyIdentifier, ProvisioningRequest>,
pub open_responses: HashMap<KeyIdentifier, ProvisioningResponse>,
}
impl TrustAnchorChild {
pub fn new(handle: ChildHandle, id: IdCertInfo, resources: ResourceSet) -> Self {
TrustAnchorChild {
handle,
id,
resources,
used_keys: HashMap::new(),
open_requests: HashMap::new(),
open_responses: HashMap::new(),
}
}
}
//------------ ProvisioningRequest -----------------------------------------
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
#[allow(clippy::large_enum_variant)]
pub enum ProvisioningRequest {
Issuance(provisioning::IssuanceRequest),
Revocation(provisioning::RevocationRequest),
}
impl ProvisioningRequest {
pub fn key_identifier(&self) -> KeyIdentifier {
match self {
ProvisioningRequest::Issuance(req) => req.csr().public_key().key_identifier(),
ProvisioningRequest::Revocation(req) => req.key(),
}
}
pub fn matches_response(&self, response: &ProvisioningResponse) -> bool {
match self {
ProvisioningRequest::Issuance(_) => !matches!(response, ProvisioningResponse::Revocation(_)),
ProvisioningRequest::Revocation(_) => !matches!(response, ProvisioningResponse::Issuance(_)),
}
}
}
impl std::fmt::Display for ProvisioningRequest {
fn fmt(&self, f: &mut std::fmt::Formatter) -> std::fmt::Result {
match self {
ProvisioningRequest::Issuance(_) => write!(f, "issue certificate for key: {}", self.key_identifier()),
ProvisioningRequest::Revocation(_) => write!(f, "revoke certificates for key: {}", self.key_identifier()),
}
}
}
//------------ ProvisioningResponse ----------------------------------------
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
#[allow(clippy::large_enum_variant)]
pub enum ProvisioningResponse {
Issuance(provisioning::IssuanceResponse),
Revocation(provisioning::RevocationResponse),
Error,
}
impl ProvisioningResponse {
pub fn to_provisioning_message(self, sender: SenderHandle, recipient: RecipientHandle) -> provisioning::Message {
match self {
ProvisioningResponse::Issuance(issuance_response) => {
provisioning::Message::issue_response(sender, recipient, issuance_response)
}
ProvisioningResponse::Revocation(revocation_response) => {
provisioning::Message::revoke_response(sender, recipient, revocation_response)
}
ProvisioningResponse::Error => {
provisioning::Message::not_performed_response(
sender,
recipient,
provisioning::NotPerformedResponse::err_2001(),
)
.unwrap() // safe unwrap, this function always returns Ok.
}
}
}
}
src/daemon/ta/mod.rs
+158
View File
@@ -0,0 +1,158 @@
//! Trust Anchor Support
//!
use rpki::ca::idexchange::CaHandle;
mod common;
pub use self::common::*;
mod proxy;
pub use self::proxy::*;
mod signer;
pub use self::signer::*;
pub const TA_NAME: &str = "ta"; // reserved for TA
//------------ TrustAnchor Handle Types ------------------------------------
pub type TrustAnchorHandle = CaHandle;
pub fn ta_handle() -> CaHandle {
use std::str::FromStr;
CaHandle::from_str(TA_NAME).unwrap()
}
fn ta_resource_class_name() -> rpki::ca::provisioning::ResourceClassName {
"default".into()
}
//----------------- TESTS --------------------------------------------------------------
#[cfg(test)]
mod tests {
use rpki::ca::idexchange::{RepoInfo, ServiceUri};
use super::*;
use std::{sync::Arc, time::Duration};
use crate::{
commons::{
api::{PublicationServerInfo, RepositoryContact},
crypto::KrillSignerBuilder,
eventsourcing::AggregateStore,
},
daemon::config::ConfigDefaults,
test::*,
};
#[test]
fn init_ta() {
test_under_tmp(|d| {
init_logging();
let ta_signer_store: AggregateStore<TrustAnchorSigner> = AggregateStore::disk(&d, "ta_signer").unwrap();
let ta_proxy_store: AggregateStore<TrustAnchorProxy> = AggregateStore::disk(&d, "ta_proxy").unwrap();
// We will import a TA key - this is only (supposed to be) supported for the openssl signer
let signers = ConfigDefaults::openssl_signer_only();
let signer = Arc::new(
KrillSignerBuilder::new(&d, Duration::from_secs(1), &signers)
.build()
.unwrap(),
);
let actor = test_actor();
let proxy_handle = TrustAnchorHandle::new("proxy".into());
let init = TrustAnchorProxy::create_init(proxy_handle.clone(), &signer).unwrap();
ta_proxy_store.add(init).unwrap();
let repository = {
let repo_info = RepoInfo::new(
rsync("rsync://example.krill.cloud/repo/"),
Some(https("https://exmple.krill.cloud/repo/notification.xml")),
);
let repo_key_id = signer.create_key().unwrap();
let repo_key = signer.get_key_info(&repo_key_id).unwrap();
let service_uri = ServiceUri::Https(https("https://example.krill.cloud/rfc8181/ta"));
let server_info = PublicationServerInfo::new(repo_key, service_uri);
RepositoryContact::new(repo_info, server_info)
};
let add_repo_cmd = TrustAnchorProxyCommand::add_repo(&proxy_handle, repository, &actor);
let mut proxy = ta_proxy_store.command(add_repo_cmd).unwrap();
let signer_handle = TrustAnchorHandle::new("signer".into());
let tal_https = vec![https("https://example.krill.cloud/ta/ta.cer")];
let tal_rsync = rsync("rsync://example.krill.cloud/ta/ta.cer");
let import_key_pem = include_str!("../../../test-resources/ta/example-pkcs1.pem");
let signer_init_cmd = TrustAnchorSignerInitCommand {
handle: signer_handle.clone(),
proxy_id: proxy.id().clone(),
repo_info: proxy.repository().unwrap().repo_info().clone(),
tal_https: tal_https.clone(),
tal_rsync: tal_rsync.clone(),
private_key_pem: Some(import_key_pem.to_string()),
signer: signer.clone(),
};
let signer_init = TrustAnchorSigner::create_init(signer_init_cmd).unwrap();
let mut ta_signer = ta_signer_store.add(signer_init).unwrap();
let signer_info = ta_signer.get_signer_info();
let add_signer_cmd = TrustAnchorProxyCommand::add_signer(&proxy_handle, signer_info, &actor);
proxy = ta_proxy_store.command(add_signer_cmd).unwrap();
// The initial signer starts off with a TA certificate
// and a CRL and manifest with revision number 1.
let ta_objects = proxy.get_trust_anchor_objects().unwrap();
assert_eq!(ta_objects.revision().number(), 1);
let ta_cert_details = proxy.get_ta_details().unwrap();
assert_eq!(ta_cert_details.tal().uris(), &tal_https);
assert_eq!(ta_cert_details.tal().rsync_uri(), &tal_rsync);
// We can make a new signer request to make a new manifest and CRL
// even if we do not yet have any issued certificates to publish.
let make_publish_request_cmd = TrustAnchorProxyCommand::make_signer_request(&proxy_handle, &actor);
proxy = ta_proxy_store.command(make_publish_request_cmd).unwrap();
let signed_request = proxy.get_signer_request(&signer).unwrap();
let request_nonce = signed_request.content().nonce.clone();
let ta_signer_process_request_command =
TrustAnchorSignerCommand::make_process_request_command(&signer_handle, signed_request, signer, &actor);
ta_signer = ta_signer_store.command(ta_signer_process_request_command).unwrap();
let exchange = ta_signer.get_exchange(&request_nonce).unwrap();
let ta_proxy_process_signer_response_command =
TrustAnchorProxyCommand::process_signer_response(&proxy_handle, exchange.response.clone(), &actor);
proxy = ta_proxy_store
.command(ta_proxy_process_signer_response_command)
.unwrap();
// The TA should have published again, the revision used for manifest and crl will
// have been updated.
let ta_objects = proxy.get_trust_anchor_objects().unwrap();
assert_eq!(ta_objects.revision().number(), 2);
// We still need to test some higher order functions:
// - add child
// - let the child request a certificate
// - let the child perform a key rollover
// - let the TA publish
//
// This is hard to test at this level. So, will test this as part of the higher
// order functional tests found under /tests. I.e. we will start a full krill
// server with testbed support, which will use the TrustAnchorProxy and Signer.
})
}
}
src/daemon/ta/proxy.rs
+797
View File
@@ -0,0 +1,797 @@
//! Trust Anchor Proxy
//!
//! The Trust Anchor Proxy performs all Trust Anchor responsibilities
/// *except* for signing using the Trust Anchor private key. That function
/// is handled by the Trust Anchor Signer instead.
use super::*;
use std::{collections::HashMap, convert::TryFrom, fmt};
use rpki::{
ca::{
idexchange::{self, ChildHandle},
provisioning::{ResourceClassEntitlements, SigningCert},
},
crypto::KeyIdentifier,
};
use crate::{
commons::{
actor::Actor,
api::{AddChildRequest, IdCertInfo, RepositoryContact},
crypto::{CsrInfo, KrillSigner},
error::Error,
eventsourcing, KrillResult,
},
daemon::{
ca::{Rfc8183Id, UsedKeyState},
config::IssuanceTimingConfig,
},
};
//------------ TrustAnchorProxy --------------------------------------------
/// Krill Trust Anchors are split into the following two components:
/// - Trust Anchor Proxy
/// - Trust Anchor Signer
///
/// The Trust Anchor Proxy performs all Trust Anchor responsibilities
/// *except* for signing using the Trust Anchor private key. That function
/// is handled by the Trust Anchor Signer instead. The reason for this
/// division is that it allows for operations where the signer is kept
/// on a separate offline system. The proxy on the other hand can maintain
/// the communication with child CAs and take care of publication.
///
/// Note however, that the signer can also be be embedded to support test
/// systems as well as functional and regression testing of the proxy-signer
/// communication.
///
/// Another (unrelated) thing to note is that Krill Trust Anchors are, for
/// the moment, set up to always claim all IPv4, IPv6 and ASN resources. This
/// is inline with how the current RIR Trust Anchors are being managed at the
/// moment. That said, we may add support for claiming (and changing) a
/// specific set of resources in future.
#[derive(Clone, Debug, Deserialize, Serialize)]
pub struct TrustAnchorProxy {
// event-sourcing support
handle: TrustAnchorHandle,
version: u64,
// ID certificate used by this proxy
id: IdCertInfo,
// The associated signer. Needs to be added after initialisation.
signer: Option<TrustAnchorSignerInfo>,
// The proxy is responsible for publishing all objects.
repository: Option<RepositoryContact>,
// Typically the Trust Anchor would be set up with a single child, that
// gets a certificate with all resources. This child can then be the
// de-facto *online* trust anchor in setups where the Trust Anchor Signer
// is kept offline. This is useful because signing certificates to many
// children - and especially updating their resources - directly under
// an offline signer would be cumbersome, or at the very least add significant
// delays in operation.
//
// But, there may be use cases for multiple children under the Trust Anchor.
// In particular for testing purposes where the signer is not offline.
//
// For this reason we support any number of child CAs to exist under
// the TA.
child_details: HashMap<ChildHandle, TrustAnchorChild>,
// Track if there is any open signer request. Responses MUST match the
// the nonce. Furthermore, child interactions are suspended when there
// is an open request. We first need to process the response, before we
// can accept new requests from any child.
open_signer_request: Option<Nonce>,
}
//------------ TrustAnchorProxy: Commands and Events -----------------------
pub type TrustAnchorProxyCommand = eventsourcing::SentCommand<TrustAnchorProxyCommandDetails>;
pub type TrustAnchorProxyInitEvent = eventsourcing::StoredEvent<TrustAnchorProxyInitDetails>;
pub type TrustAnchorProxyEvent = eventsourcing::StoredEvent<TrustAnchorProxyEventDetails>;
// Initialisation
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
pub struct TrustAnchorProxyInitDetails {
id: IdCertInfo,
}
impl fmt::Display for TrustAnchorProxyInitDetails {
fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
// note that this is a summary, full details are stored in the init event.
write!(f, "Trust Anchor Proxy was initialised.")
}
}
// Events
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
#[allow(clippy::large_enum_variant)]
pub enum TrustAnchorProxyEventDetails {
// Publication Support
RepositoryAdded(RepositoryContact),
// Proxy -> Signer interactions
SignerAdded(TrustAnchorSignerInfo),
SignerRequestMade(Nonce),
SignerResponseReceived(TrustAnchorSignedResponse),
// Children
ChildAdded(TrustAnchorChild),
ChildRequestAdded(ChildHandle, ProvisioningRequest),
ChildResponseGiven(ChildHandle, KeyIdentifier),
}
impl fmt::Display for TrustAnchorProxyEventDetails {
fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
// note that this is a summary, full details are stored in the json.
match self {
// Publication Support
TrustAnchorProxyEventDetails::RepositoryAdded(repository) => {
write!(
f,
"Added repository with service uri: {}",
repository.server_info().service_uri()
)
}
// Proxy -> Signer interactions
TrustAnchorProxyEventDetails::SignerAdded(signer) => {
write!(f, "Added signer with ID certificate hash: {}", signer.id.hash())
}
TrustAnchorProxyEventDetails::SignerRequestMade(nonce) => {
write!(f, "Created signer request with nonce '{}'", nonce)
}
TrustAnchorProxyEventDetails::SignerResponseReceived(response) => {
write!(f, "Received signer response with nonce '{}'", response.content().nonce)
}
// Children
TrustAnchorProxyEventDetails::ChildAdded(child) => {
write!(f, "Added child: {}, with resources: {}", child.handle, child.resources)
}
TrustAnchorProxyEventDetails::ChildRequestAdded(child_handle, request) => {
write!(f, "Added request for child {}: {}", child_handle, request)
}
TrustAnchorProxyEventDetails::ChildResponseGiven(child_handle, key) => {
write!(f, "Given response to child {} for key: {}", child_handle, key)
}
}
}
}
// Commands
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
#[allow(clippy::large_enum_variant)]
pub enum TrustAnchorProxyCommandDetails {
// Publication Support
AddRepository(RepositoryContact),
// Proxy -> Signer interactions
AddSigner(TrustAnchorSignerInfo),
MakeSignerRequest,
ProcessSignerResponse(TrustAnchorSignedResponse),
// Children
AddChild(AddChildRequest),
AddChildRequest(ChildHandle, ProvisioningRequest),
GiveChildResponse(ChildHandle, KeyIdentifier),
}
impl fmt::Display for TrustAnchorProxyCommandDetails {
fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
// note that this is a summary, full details are stored in the json.
match self {
// Publication Support
TrustAnchorProxyCommandDetails::AddRepository(repository) => {
write!(f, "Add repository at: {}", repository.server_info().service_uri())
}
// Proxy -> Signer interactions
TrustAnchorProxyCommandDetails::AddSigner(signer) => {
write!(f, "Add signer with id certificate hash: {}", signer.id.hash())
}
TrustAnchorProxyCommandDetails::MakeSignerRequest => {
write!(f, "Create new publish request for signer")
}
TrustAnchorProxyCommandDetails::ProcessSignerResponse(response) => {
write!(
f,
"Process signer response. Nonce: {}. Next Update (before): {}",
response.content().nonce,
response.content().objects.revision().next_update().to_rfc3339()
)
}
// Children
TrustAnchorProxyCommandDetails::AddChild(child) => {
write!(f, "Add child: {}", child)
}
TrustAnchorProxyCommandDetails::AddChildRequest(child_handle, request) => {
write!(f, "Add request for child {}: {}", child_handle, request)
}
TrustAnchorProxyCommandDetails::GiveChildResponse(child_handle, key) => {
write!(
f,
"Give (and remove) response to child {} for key {}",
child_handle, key
)
}
}
}
}
impl eventsourcing::WithStorableDetails for TrustAnchorProxyCommandDetails {
fn summary(&self) -> crate::commons::api::CommandSummary {
match self {
// Publication Support
TrustAnchorProxyCommandDetails::AddRepository(repository) => {
crate::commons::api::CommandSummary::new("cmd-ta-proxy-repo-add", &self)
.with_service_uri(repository.server_info().service_uri())
}
// Proxy -> Signer interactions
TrustAnchorProxyCommandDetails::AddSigner(signer) => {
crate::commons::api::CommandSummary::new("cmd-ta-proxy-signer-add", &self)
.with_id_cert_hash(signer.id.hash())
}
TrustAnchorProxyCommandDetails::MakeSignerRequest => {
crate::commons::api::CommandSummary::new("cmd-ta-proxy-pub-req", &self)
}
TrustAnchorProxyCommandDetails::ProcessSignerResponse(response) => {
crate::commons::api::CommandSummary::new("cmd-ta-proxy-pub-res", &self)
.with_arg("nonce", &response.content().nonce)
.with_arg("manifest number", response.content().objects.revision().number())
.with_arg(
"this update",
response.content().objects.revision().this_update().to_rfc3339(),
)
.with_arg(
"next update",
response.content().objects.revision().next_update().to_rfc3339(),
)
}
// Children
TrustAnchorProxyCommandDetails::AddChild(child) => {
crate::commons::api::CommandSummary::new("cmd-ta-proxy-child-add", &self).with_child(child.handle())
}
TrustAnchorProxyCommandDetails::AddChildRequest(child_handle, _request) => {
crate::commons::api::CommandSummary::new("cmd-ta-proxy-child-req", &self).with_child(child_handle)
}
TrustAnchorProxyCommandDetails::GiveChildResponse(child_handle, _response) => {
crate::commons::api::CommandSummary::new("cmd-ta-proxy-child-res", &self).with_child(child_handle)
}
}
}
}
impl TrustAnchorProxyCommand {
pub fn add_repo(id: &TrustAnchorHandle, repository: RepositoryContact, actor: &Actor) -> Self {
TrustAnchorProxyCommand::new(
id,
None,
TrustAnchorProxyCommandDetails::AddRepository(repository),
actor,
)
}
pub fn add_signer(id: &TrustAnchorHandle, signer: TrustAnchorSignerInfo, actor: &Actor) -> Self {
TrustAnchorProxyCommand::new(id, None, TrustAnchorProxyCommandDetails::AddSigner(signer), actor)
}
pub fn make_signer_request(id: &TrustAnchorHandle, actor: &Actor) -> Self {
TrustAnchorProxyCommand::new(id, None, TrustAnchorProxyCommandDetails::MakeSignerRequest, actor)
}
pub fn process_signer_response(id: &TrustAnchorHandle, response: TrustAnchorSignedResponse, actor: &Actor) -> Self {
TrustAnchorProxyCommand::new(
id,
None,
TrustAnchorProxyCommandDetails::ProcessSignerResponse(response),
actor,
)
}
pub fn add_child(id: &TrustAnchorHandle, child: AddChildRequest, actor: &Actor) -> Self {
TrustAnchorProxyCommand::new(id, None, TrustAnchorProxyCommandDetails::AddChild(child), actor)
}
pub fn add_child_request(
id: &TrustAnchorHandle,
child: ChildHandle,
request: ProvisioningRequest,
actor: &Actor,
) -> Self {
TrustAnchorProxyCommand::new(
id,
None,
TrustAnchorProxyCommandDetails::AddChildRequest(child, request),
actor,
)
}
pub fn give_child_response(id: &TrustAnchorHandle, child: ChildHandle, key: KeyIdentifier, actor: &Actor) -> Self {
TrustAnchorProxyCommand::new(
id,
None,
TrustAnchorProxyCommandDetails::GiveChildResponse(child, key),
actor,
)
}
}
impl eventsourcing::CommandDetails for TrustAnchorProxyCommandDetails {
type Event = TrustAnchorProxyEvent;
type StorableDetails = Self;
fn store(&self) -> Self::StorableDetails {
self.clone()
}
}
impl eventsourcing::Aggregate for TrustAnchorProxy {
type Command = TrustAnchorProxyCommand;
type StorableCommandDetails = TrustAnchorProxyCommandDetails;
type Event = TrustAnchorProxyEvent;
type InitEvent = TrustAnchorProxyInitEvent;
type Error = Error;
fn init(event: Self::InitEvent) -> Result<Self, Self::Error> {
let (handle, _version, details) = event.unpack();
Ok(TrustAnchorProxy {
handle,
version: 1,
id: details.id,
repository: None,
signer: None,
child_details: HashMap::new(),
open_signer_request: None,
})
}
fn version(&self) -> u64 {
self.version
}
fn apply(&mut self, event: Self::Event) {
let (handle, _version, details) = event.unpack();
if log_enabled!(log::Level::Trace) {
trace!(
"Applying event to Trust Anchor Proxy '{}', version: {}: {}",
handle,
self.version,
details
);
}
self.version += 1;
match details {
// Publication Support
TrustAnchorProxyEventDetails::RepositoryAdded(repository) => self.repository = Some(repository),
// Proxy -> Signer interactions
TrustAnchorProxyEventDetails::SignerAdded(signer) => self.signer = Some(signer),
TrustAnchorProxyEventDetails::SignerRequestMade(nonce) => self.open_signer_request = Some(nonce),
TrustAnchorProxyEventDetails::SignerResponseReceived(response) => {
let content = response.into_content();
for (child_handle, child_responses) in content.child_responses {
if let Some(child_details) = self.child_details.get_mut(&child_handle) {
for (key_id, response) in child_responses {
match &response {
ProvisioningResponse::Issuance(_) => {
child_details
.used_keys
.insert(key_id, UsedKeyState::Current("default".into()));
}
ProvisioningResponse::Revocation(_) => {
child_details.used_keys.insert(key_id, UsedKeyState::Revoked);
}
_ => {}
}
child_details.open_requests.remove(&key_id);
child_details.open_responses.insert(key_id, response);
}
}
}
// We cannot have an accepted response if we did not have a signer
self.signer.as_mut().unwrap().objects = content.objects;
self.open_signer_request = None;
}
// Children
TrustAnchorProxyEventDetails::ChildAdded(child) => {
self.child_details.insert(child.handle.clone(), child);
}
TrustAnchorProxyEventDetails::ChildRequestAdded(child_handle, request) => {
self.child_details
.get_mut(&child_handle)
.unwrap() // safe - we can only have an event for this child if it exists
.open_requests
.insert(request.key_identifier(), request);
}
TrustAnchorProxyEventDetails::ChildResponseGiven(child_handle, key) => {
self.child_details
.get_mut(&child_handle)
.unwrap() // safe - we can only have an event for this child if it exists
.open_responses
.remove(&key);
}
}
}
fn process_command(&self, command: Self::Command) -> Result<Vec<Self::Event>, Self::Error> {
if log_enabled!(log::Level::Trace) {
trace!(
"Sending command to Trust Anchor Proxy '{}', version: {}: {}",
self.handle,
self.version,
command
);
}
match command.into_details() {
// Publication Support
TrustAnchorProxyCommandDetails::AddRepository(repository) => {
if self.repository.is_none() {
Ok(vec![TrustAnchorProxyEvent::new(
&self.handle,
self.version,
TrustAnchorProxyEventDetails::RepositoryAdded(repository),
)])
} else {
Err(Error::TaProxyAlreadyHasRepository)
}
}
// Proxy -> Signer interactions
TrustAnchorProxyCommandDetails::AddSigner(signer) => {
if self.signer.is_none() {
Ok(vec![TrustAnchorProxyEvent::new(
&self.handle,
self.version,
TrustAnchorProxyEventDetails::SignerAdded(signer),
)])
} else {
Err(Error::TaProxyAlreadyHasSigner)
}
}
TrustAnchorProxyCommandDetails::MakeSignerRequest => {
if self.open_signer_request.is_some() {
Err(Error::TaProxyHasRequest)
} else {
Ok(vec![TrustAnchorProxyEvent::new(
&self.handle,
self.version,
TrustAnchorProxyEventDetails::SignerRequestMade(Nonce::new()),
)])
}
}
TrustAnchorProxyCommandDetails::ProcessSignerResponse(response) => {
let open_request_nonce = self.open_signer_request.as_ref().ok_or(Error::TaProxyHasNoRequest)?;
if &response.content().nonce != open_request_nonce {
// It seems that the user uploaded the wrong the response.
Err(Error::TaProxyRequestNonceMismatch(
response.into_content().nonce,
open_request_nonce.clone(),
))
} else if let Some(signer) = &self.signer {
// Ensure that the response was validly signed.
response.validate(&signer.id)?;
// We accept the response as is. Since children cannot be modified, and requests
// cannot change as long as there is an open signer request we cannot have any
// mismatches between the children and child requests in the proxy vs the
// children and responses received from the signer.
//
// In other words.. we trust that the associated signer functions correctly and
// we have no further defensive coding on this side.
//
// Note that if we would reject the response, then there would be no way of
// telling the signer why. So, this is also a matter of the 'the signer is
// always right'.
Ok(vec![TrustAnchorProxyEvent::new(
&self.handle,
self.version,
TrustAnchorProxyEventDetails::SignerResponseReceived(response),
)])
} else {
// This is rather unexpected.. it implies that we had a request, but no
// signer. Still - return a clean error for this, so unlikely as this may
// be, it can be investigated.
Err(Error::TaProxyHasNoSigner)
}
}
// Children
TrustAnchorProxyCommandDetails::AddChild(child) => {
if self.child_details.contains_key(child.handle()) {
Err(Error::CaChildDuplicate(self.handle.clone(), child.handle().clone()))
} else {
let (handle, resources, id_cert) = child.unpack();
Ok(vec![TrustAnchorProxyEvent::new(
&self.handle,
self.version,
TrustAnchorProxyEventDetails::ChildAdded(TrustAnchorChild::new(
handle,
id_cert.into(),
resources,
)),
)])
}
}
TrustAnchorProxyCommandDetails::AddChildRequest(child_handle, request) => {
// We can do some basic checks on the request, like..
// - CSR is valid
// - CSR does not exceed entitled resources
// - CSR is for correct resource class
// - Revocation is for known key
// - Revocation is for correct resource class
//
// The signer will eventually handle the actual request. So we just
// schedule it as a manner of speaking. The signer will also do these
// checks - although that means that we have some duplication this helps
// to ensure that we can "fail fast" - and on the other hand leave the
// signer to be responsible for the final say (also.. things may have
// changed by the time the signer looks at it, like resource entitlements
// perhaps in future?)
let child = self.get_child_details(&child_handle)?;
let ta_resource_class_name = ta_resource_class_name();
match &request {
ProvisioningRequest::Issuance(issuance) => {
if issuance.class_name() != &ta_resource_class_name {
return Err(Error::Custom(format!(
"TA child certificate sign request uses unknown resource class name '{}'",
issuance.class_name()
)));
}
issuance.limit().apply_to(&child.resources)?; // Errors if request exceeds
CsrInfo::try_from(issuance.csr())?; // Errors if the CSR is invalid
}
ProvisioningRequest::Revocation(revocation) => {
if revocation.class_name() != &ta_resource_class_name {
return Err(Error::Custom(format!(
"TA child revocation request uses unknown resource class name '{}'",
revocation.class_name()
)));
}
if !child.used_keys.contains_key(&revocation.key()) {
return Err(Error::Custom(format!(
"TA child revocation requested for unknown key: {}",
revocation.key()
)));
}
}
}
Ok(vec![TrustAnchorProxyEvent::new(
&self.handle,
self.version,
TrustAnchorProxyEventDetails::ChildRequestAdded(child_handle, request),
)])
}
TrustAnchorProxyCommandDetails::GiveChildResponse(child_handle, key) => {
let child = self.get_child_details(&child_handle)?;
if child.open_responses.contains_key(&key) {
Ok(vec![TrustAnchorProxyEvent::new(
&self.handle,
self.version,
TrustAnchorProxyEventDetails::ChildResponseGiven(child_handle, key),
)])
} else {
// This should not never happen. The command would not be sent, but let's
// return some useful error anyway.
Err(Error::Custom(format!(
"No response found for child {} and key {}",
child_handle, key
)))
}
}
}
}
}
impl TrustAnchorProxy {
/// Creates an initialisation event that can be used to create
/// a new TrustAnchorProxy.
//
// Perhaps we should refactor the eventsourcing support to have
// a create command instead, and let the init event become a
// normal event. But, not changing that now..
pub fn create_init(handle: TrustAnchorHandle, signer: &KrillSigner) -> KrillResult<TrustAnchorProxyInitEvent> {
let id = Rfc8183Id::generate(signer)?;
Ok(TrustAnchorProxyInitEvent::new(
&handle.into_converted(),
0,
TrustAnchorProxyInitDetails { id: id.into() },
))
}
pub fn get_signer_request(&self, signer: &KrillSigner) -> KrillResult<TrustAnchorSignedRequest> {
if let Some(nonce) = self.open_signer_request.as_ref().cloned() {
let mut child_requests = vec![];
for (child, details) in &self.child_details {
if !details.open_requests.is_empty() {
child_requests.push(TrustAnchorChildRequests {
child: child.clone(),
resources: details.resources.clone(),
requests: details.open_requests.clone(),
});
}
}
TrustAnchorSignerRequest { nonce, child_requests }.sign(self.id.public_key().key_identifier(), signer)
} else {
Err(Error::TaProxyHasNoRequest)
}
}
pub fn get_ta_details(&self) -> KrillResult<&TaCertDetails> {
self.signer
.as_ref()
.ok_or(Error::TaNotInitialized)
.map(|signer| &signer.ta_cert_details)
}
pub fn get_trust_anchor_objects(&self) -> KrillResult<&TrustAnchorObjects> {
self.signer
.as_ref()
.ok_or(Error::TaNotInitialized)
.map(|signer| &signer.objects)
}
pub fn id(&self) -> &IdCertInfo {
&self.id
}
pub fn repository(&self) -> Option<&RepositoryContact> {
self.repository.as_ref()
}
pub fn get_child(&self, child: &ChildHandle) -> KrillResult<&TrustAnchorChild> {
match self.child_details.get(child) {
None => Err(Error::CaChildUnknown(self.handle.clone(), child.clone())),
Some(child) => Ok(child),
}
}
}
/// # Publication support
impl TrustAnchorProxy {
/// Returns an RFC 8183 Publisher Request - which can be represented as XML to a
/// repository for this `CertAuth`
pub fn publisher_request(&self) -> idexchange::PublisherRequest {
idexchange::PublisherRequest::new(self.id.base64().clone(), self.handle.convert(), None)
}
}
/// # As a parent
impl TrustAnchorProxy {
/// Get the entitlements for a child.
///
/// This is a simplified version of similar code in [`CertAuth`]. There is no apparent
/// easy abstraction over these two types (a normal CA and a TA proxy). Things are similar,
/// but then.. the details are quite different. So, we accept some re-implementation of
/// similar logic here.
pub fn entitlements(
&self,
child_handle: &ChildHandle,
issuance_timing: &IssuanceTimingConfig,
) -> KrillResult<ResourceClassEntitlements> {
let signer = self.signer.as_ref().ok_or(Error::TaNotInitialized)?;
let child = self.get_child_details(child_handle)?;
let signing_cert = {
let received_cert = signer.ta_cert_details.cert();
let my_cert = received_cert
.to_cert()
.map_err(|e| Error::Custom(format!("Issue with certificate held by TA: {} ", e)))?;
SigningCert::new(received_cert.uri().clone(), my_cert)
};
let mut issued_certs = vec![];
let mut not_after = issuance_timing.new_child_cert_not_after();
let threshold = issuance_timing.new_child_cert_issuance_threshold();
for ki in child.used_keys.keys() {
if let Some(issued) = signer.objects.get_issued(ki) {
issued_certs.push(issued.to_rfc6492_issued_cert().map_err(|e| {
// This should never happen, unless our current issued certificate can no longer be parsed
Error::Custom(format!("Issue with issued certificate held by TA: {} ", e))
})?);
let expires = issued.validity().not_after();
if expires > threshold {
not_after = expires;
}
}
}
Ok(ResourceClassEntitlements::new(
ta_resource_class_name(),
child.resources.clone(),
not_after,
issued_certs,
signing_cert,
))
}
/// Get a response for a child request if there is one.
///
/// Returns an error in case the request does not correspond to the open response.
/// In that case the manager should probably just clear the open response so that
/// the child can sync again. This should not happen with local Krill CA children
/// as they do not create new requests when there is an open request. We should
/// not support any non-local - i.e. possibly out-of-sync and possibly non-krill
/// child under a krill trust anchor. They can be a child of the trust anchor
/// child though.
pub fn response_for_child(
&self,
child_handle: &ChildHandle,
request: &ProvisioningRequest,
) -> KrillResult<Option<&ProvisioningResponse>> {
let child = self.get_child_details(child_handle)?;
if let Some(response) = child.open_responses.get(&request.key_identifier()) {
if request.matches_response(response) {
Ok(Some(response))
} else {
Err(Error::Custom(format!(
"Response for {} does not match request type.",
child_handle
)))
}
} else {
Ok(None)
}
}
/// Informs whether there is a matching open request for the child.
///
/// If there is a matching request then we do not need to add it. If there is no matching
/// request then we may want to add a new request or replace an existing request - which
/// we just consider 'not matching and now irrelevant' - as long as there is no open request
/// to the signer.
///
/// Returns an error if the child is not known.
pub fn matching_open_request(
&self,
child_handle: &ChildHandle,
request: &ProvisioningRequest,
) -> KrillResult<bool> {
let child = self.get_child_details(child_handle)?;
if let Some(existing) = child.open_requests.get(&request.key_identifier()) {
match (existing, request) {
(ProvisioningRequest::Issuance(existing), ProvisioningRequest::Issuance(request)) => {
Ok(
existing.class_name() == request.class_name() // must be "default" but could differ
&& existing.limit() == request.limit()
&& CsrInfo::try_from(existing.csr())? == CsrInfo::try_from(request.csr())?,
)
}
(ProvisioningRequest::Revocation(existing), ProvisioningRequest::Revocation(request)) => {
Ok(existing.class_name() == request.class_name()) // must be "default" but could differ
}
_ => Ok(false),
}
} else {
Ok(false)
}
}
fn get_child_details(&self, child_handle: &ChildHandle) -> KrillResult<&TrustAnchorChild> {
self.child_details
.get(child_handle)
.ok_or_else(|| Error::CaChildUnknown(self.handle.clone(), child_handle.clone()))
}
}
src/daemon/ta/signer.rs
+545
View File
@@ -0,0 +1,545 @@
//! Trust Anchor Signer
//!
//! Handles signing operations using the (offline) Trust Anchor key.
//! Designed to work with a single associated proxy which is responsible
//! for all other functions, like publishing and talking to child CAs.
//! The proxy makes sign requests for the signer to sign.
use super::*;
use std::{collections::HashMap, convert::TryFrom, fmt, sync::Arc};
use chrono::SecondsFormat;
use rpki::{
ca::{
idexchange::{ChildHandle, RepoInfo},
provisioning::{self, IssuanceResponse, RequestResourceLimit, RevocationResponse},
},
crypto::KeyIdentifier,
repository::{
cert::{KeyUsage, Overclaim, TbsCert},
resources::ResourceSet,
x509::{Serial, Time},
},
uri,
};
use crate::{
commons::{
actor::Actor,
api::{IdCertInfo, ObjectName, ReceivedCert},
crypto::{CsrInfo, KrillSigner, SignSupport},
error::Error,
eventsourcing, KrillResult,
},
daemon::ca::Rfc8183Id,
};
//------------ TrustAnchorSigner -------------------------------------------
/// The Trust Anchor Signer signs requests sent to it by its associated
/// proxy, as long as it can verify that the proxy signed that request.
#[derive(Clone, Debug, Deserialize, Serialize)]
pub struct TrustAnchorSigner {
// event-sourcing support
handle: TrustAnchorHandle,
version: u64,
// ID certificate used by this signer
id: IdCertInfo,
// ID of the associated proxy
proxy_id: IdCertInfo,
// TA certificate and TAL
ta_cert_details: TaCertDetails,
// Objects to be published under the TA certificate
objects: TrustAnchorObjects,
// Proxy Signer Exchanges
exchanges: TrustAnchorProxySignerExchanges,
}
//------------ TrustAnchorSigner: Commands and Events ----------------------
pub type TrustAnchorSignerCommand = eventsourcing::SentCommand<TrustAnchorSignerCommandDetails>;
pub type TrustAnchorSignerInitEvent = eventsourcing::StoredEvent<TrustAnchorSignerInitDetails>;
pub type TrustAnchorSignerEvent = eventsourcing::StoredEvent<TrustAnchorSignerEventDetails>;
// Initialisation
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
pub struct TrustAnchorSignerInitDetails {
id: IdCertInfo,
proxy_id: IdCertInfo,
ta_cert_details: TaCertDetails,
objects: TrustAnchorObjects,
}
impl fmt::Display for TrustAnchorSignerInitDetails {
fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
// note that this is a summary, full details are stored in the init event.
write!(f, "Trust Anchor Signer was initialised.")
}
}
// Events
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
pub enum TrustAnchorSignerEventDetails {
ProxySignerExchangeDone(TrustAnchorProxySignerExchange),
}
impl fmt::Display for TrustAnchorSignerEventDetails {
fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
match self {
TrustAnchorSignerEventDetails::ProxySignerExchangeDone(exchange) => {
write!(
f,
"Proxy signer exchange done on {} for nonce: {}",
exchange.time.to_rfc3339(),
exchange.request.content().nonce
)
}
}
}
}
// Commands
#[derive(Clone, Debug)]
pub enum TrustAnchorSignerCommandDetails {
TrustAnchorSignerRequest(TrustAnchorSignedRequest, Arc<KrillSigner>),
}
impl eventsourcing::CommandDetails for TrustAnchorSignerCommandDetails {
type Event = TrustAnchorSignerEvent;
type StorableDetails = TrustAnchorSignerStorableCommand;
fn store(&self) -> Self::StorableDetails {
self.into()
}
}
impl fmt::Display for TrustAnchorSignerCommandDetails {
fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
TrustAnchorSignerStorableCommand::from(self).fmt(f)
}
}
impl TrustAnchorSignerCommand {
pub fn make_process_request_command(
id: &TrustAnchorHandle,
request: TrustAnchorSignedRequest,
signer: Arc<KrillSigner>,
actor: &Actor,
) -> TrustAnchorSignerCommand {
TrustAnchorSignerCommand::new(
id,
None,
TrustAnchorSignerCommandDetails::TrustAnchorSignerRequest(request, signer),
actor,
)
}
}
// Storable Commands (KrillSigner cannot be de-/serialized)
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
pub enum TrustAnchorSignerStorableCommand {
TrustAnchorSignerRequest(TrustAnchorSignedRequest),
}
impl From<&TrustAnchorSignerCommandDetails> for TrustAnchorSignerStorableCommand {
fn from(details: &TrustAnchorSignerCommandDetails) -> Self {
match details {
TrustAnchorSignerCommandDetails::TrustAnchorSignerRequest(request, _) => {
TrustAnchorSignerStorableCommand::TrustAnchorSignerRequest(request.clone())
}
}
}
}
impl eventsourcing::WithStorableDetails for TrustAnchorSignerStorableCommand {
fn summary(&self) -> crate::commons::api::CommandSummary {
match self {
TrustAnchorSignerStorableCommand::TrustAnchorSignerRequest(request) => {
crate::commons::api::CommandSummary::new("cmd-ta-signer-process-request", &self)
.with_arg("nonce", &request.content().nonce)
}
}
}
}
impl fmt::Display for TrustAnchorSignerStorableCommand {
fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
// note that this is a summary, full details are stored in the json.
match self {
TrustAnchorSignerStorableCommand::TrustAnchorSignerRequest(req) => {
write!(f, "Process signer request with nonce: {}", req.content().nonce)
}
}
}
}
impl eventsourcing::Aggregate for TrustAnchorSigner {
type Command = TrustAnchorSignerCommand;
type StorableCommandDetails = TrustAnchorSignerStorableCommand;
type Event = TrustAnchorSignerEvent;
type InitEvent = TrustAnchorSignerInitEvent;
type Error = Error;
fn init(event: Self::InitEvent) -> Result<Self, Self::Error> {
let (handle, _version, details) = event.unpack();
Ok(TrustAnchorSigner {
handle,
version: 1,
id: details.id,
proxy_id: details.proxy_id,
ta_cert_details: details.ta_cert_details,
objects: details.objects,
exchanges: TrustAnchorProxySignerExchanges::default(),
})
}
fn version(&self) -> u64 {
self.version
}
fn apply(&mut self, event: Self::Event) {
let (handle, _version, details) = event.unpack();
if log_enabled!(log::Level::Trace) {
trace!(
"Applying event to Trust Anchor Signer '{}', version: {}: {}",
handle,
self.version,
details
);
}
self.version += 1;
match details {
TrustAnchorSignerEventDetails::ProxySignerExchangeDone(exchange) => {
self.objects = exchange.response.content().objects.clone();
self.exchanges.0.push(exchange);
}
}
}
fn process_command(&self, command: Self::Command) -> Result<Vec<Self::Event>, Self::Error> {
if log_enabled!(log::Level::Trace) {
trace!(
"Sending command to Trust Anchor Signer '{}', version: {}: {}",
self.handle,
self.version,
command
);
}
match command.into_details() {
TrustAnchorSignerCommandDetails::TrustAnchorSignerRequest(request, signer) => {
self.process_signer_request(request, &signer)
}
}
}
}
impl TrustAnchorSigner {
pub fn get_signer_info(&self) -> TrustAnchorSignerInfo {
TrustAnchorSignerInfo {
id: self.id.clone(),
objects: self.objects.clone(),
ta_cert_details: self.ta_cert_details.clone(),
}
}
pub fn get_associated_proxy_id(&self) -> &IdCertInfo {
&self.proxy_id
}
}
pub struct TrustAnchorSignerInitCommand {
pub handle: TrustAnchorHandle,
pub proxy_id: IdCertInfo,
pub repo_info: RepoInfo,
pub tal_https: Vec<uri::Https>,
pub tal_rsync: uri::Rsync,
pub private_key_pem: Option<String>,
pub signer: Arc<KrillSigner>,
}
impl TrustAnchorSigner {
/// Creates an initialisation event that can be used to create a new Trust Anchor Signer.
pub fn create_init(cmd: TrustAnchorSignerInitCommand) -> KrillResult<TrustAnchorSignerInitEvent> {
let signer = cmd.signer;
let id = Rfc8183Id::generate(&signer)?.into();
let proxy_id = cmd.proxy_id;
let ta_cert_details = Self::create_ta_cert_details(
cmd.repo_info,
cmd.tal_https,
cmd.tal_rsync,
cmd.private_key_pem,
&signer,
)?;
let objects = TrustAnchorObjects::create(ta_cert_details.cert(), &signer)?;
Ok(TrustAnchorSignerInitEvent::new(
&cmd.handle,
0,
TrustAnchorSignerInitDetails {
id,
proxy_id,
ta_cert_details,
objects,
},
))
}
fn create_ta_cert_details(
repo_info: RepoInfo,
tal_https: Vec<uri::Https>,
tal_rsync: uri::Rsync,
private_key_pem: Option<String>,
signer: &KrillSigner,
) -> KrillResult<TaCertDetails> {
let key = match private_key_pem {
None => signer.create_key(),
Some(pem) => signer.import_key(&pem),
}?;
let resources = ResourceSet::all();
let cert = {
let serial: Serial = signer.random_serial()?;
let pub_key = signer.get_key_info(&key).map_err(Error::signer)?;
let name = pub_key.to_subject_name();
let mut cert = TbsCert::new(
serial,
name.clone(),
SignSupport::sign_validity_years(TA_CERTIFICATE_VALIDITY_YEARS),
Some(name),
pub_key.clone(),
KeyUsage::Ca,
Overclaim::Refuse,
);
cert.set_basic_ca(Some(true));
// The TA will publish directly in its root. It only has 1 resource class
// so it does not use namespaces (sub-folders). Furthermore, this should
// facilitate a structure where the TA can publish to the root of the
// rsync repository, and other CAs get their own folders under it. This
// will help recursive rsync fetches.
let ns = "";
cert.set_ca_repository(Some(repo_info.ca_repository(ns)));
cert.set_rpki_manifest(Some(
repo_info.resolve(ns, ObjectName::mft_for_key(&pub_key.key_identifier()).as_ref()),
));
cert.set_rpki_notify(repo_info.rpki_notify().cloned());
cert.set_as_resources(resources.to_as_resources());
cert.set_v4_resources(resources.to_ip_resources_v4());
cert.set_v6_resources(resources.to_ip_resources_v6());
signer.sign_cert(cert, &key)?
};
let tal = TrustAnchorLocator::new(tal_https, tal_rsync.clone(), cert.subject_public_key_info());
let rcvd_cert =
ReceivedCert::create(cert, tal_rsync, resources, RequestResourceLimit::default()).map_err(Error::custom)?;
Ok(TaCertDetails::new(rcvd_cert, tal))
}
/// Process a request.
fn process_signer_request(
&self,
request: TrustAnchorSignedRequest,
signer: &KrillSigner,
) -> KrillResult<Vec<TrustAnchorSignerEvent>> {
// Let's first make sure this request is valid
// and the 'content' is not tampered with.
request.validate(&self.proxy_id)?;
let mut objects = self.objects.clone();
let mut child_responses: HashMap<ChildHandle, HashMap<KeyIdentifier, ProvisioningResponse>> = HashMap::new();
let signing_cert = self.ta_cert_details.cert();
let ta_rcn = ta_resource_class_name();
for child_request in &request.content().child_requests {
let mut responses = HashMap::new();
for (key_id, provisioning_request) in child_request.requests.clone() {
match provisioning_request {
ProvisioningRequest::Issuance(issuance_req) => {
let (rcn, limit, csr) = issuance_req.unpack();
if rcn != ta_rcn {
return Err(Error::Custom(format!(
"TA child request uses unknown resource class name '{}'",
rcn
)));
}
let validity = SignSupport::sign_validity_weeks(TA_ISSUED_CERTIFICATE_VALIDITY_WEEKS);
let issue_resources = limit.apply_to(&child_request.resources)?;
// Create issued certificate
let issued_cert = SignSupport::make_issued_cert(
CsrInfo::try_from(&csr)?,
&issue_resources,
limit.clone(),
signing_cert,
validity,
signer,
)?;
// Create response for certificate
let response = IssuanceResponse::new(
ta_rcn.clone(),
issue_resources,
validity.not_after(),
provisioning::IssuedCert::new(
issued_cert.uri().clone(),
limit,
issued_cert.to_cert().unwrap(), // cannot fail
),
provisioning::SigningCert::new(signing_cert.uri().clone(), signing_cert.to_cert().unwrap()),
);
// extend the objects with the issued certs
objects.add_issued(issued_cert);
// add the response so it can be returned to the child
responses.insert(key_id, ProvisioningResponse::Issuance(response));
}
ProvisioningRequest::Revocation(revocation_req) => {
let response = RevocationResponse::from(&revocation_req);
let (rcn, key) = revocation_req.unpack();
if rcn != ta_rcn {
return Err(Error::Custom(format!(
"TA child request uses unknown resource class name '{}'",
rcn
)));
}
// Try to revoke for this key. Return an error in case of issues.
// Note.. we could make this idempotent instead. I.e. if there is no
// such key, then perhaps we can just consider it revoked and call
// it a day. Then again, we really do not expect that this should
// happen between a krill CA and its local TA (proxy). So.. it's
// most likely best to have an explicit error in this case so the
// issue can be investigated.
if !objects.revoke_issued(&key) {
return Err(Error::Custom(format!(
"TA child requests revocation for unknown key '{}'",
key
)));
}
responses.insert(key_id, ProvisioningResponse::Revocation(response));
}
}
}
child_responses.insert(child_request.child.clone(), responses);
}
objects.republish(signing_cert, signer)?;
let response = TrustAnchorSignerResponse {
nonce: request.content().nonce.clone(),
objects,
child_responses,
}
.sign(self.id.public_key().key_identifier(), signer)?;
let exchange = TrustAnchorProxySignerExchange {
time: Time::now(),
request,
response,
};
Ok(vec![TrustAnchorSignerEvent::new(
&self.handle,
self.version,
TrustAnchorSignerEventDetails::ProxySignerExchangeDone(exchange),
)])
}
/// Get all exchanges
pub fn get_exchanges(&self) -> &TrustAnchorProxySignerExchanges {
&self.exchanges
}
/// Get exchange for nonce
pub fn get_exchange(&self, nonce: &Nonce) -> Option<&TrustAnchorProxySignerExchange> {
self.exchanges.0.iter().find(|ex| &ex.request.content().nonce == nonce)
}
pub fn get_latest_exchange(&self) -> Option<&TrustAnchorProxySignerExchange> {
self.exchanges.0.last()
}
}
#[derive(Clone, Debug, Default, Deserialize, Serialize)]
pub struct TrustAnchorProxySignerExchanges(Vec<TrustAnchorProxySignerExchange>);
impl fmt::Display for TrustAnchorProxySignerExchanges {
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
for exchange in &self.0 {
let revision = exchange.response.content().objects.revision();
writeln!(
f,
"==================================================================================="
)?;
writeln!(f, " Session number: {}", revision.number() - 1)?; // We don't count init mft
writeln!(
f,
" Session date: {}",
exchange.time.to_rfc3339_opts(SecondsFormat::Secs, false)
)?;
writeln!(
f,
" Plan next before: {}",
revision.next_update().to_rfc3339_opts(SecondsFormat::Secs, false)
)?;
writeln!(
f,
"==================================================================================="
)?;
writeln!(f)?;
if !exchange.response.content().child_responses.is_empty() {
writeln!(f, " response | key identifier | child ")?;
writeln!(f, " --------------------------------------------------------------")?;
for (child, response) in &exchange.response.content().child_responses {
for (key, res) in response.iter() {
let res_type = match res {
ProvisioningResponse::Issuance(_) => "issued ",
ProvisioningResponse::Revocation(_) => "revoked ",
ProvisioningResponse::Error => "error ",
};
writeln!(f, " {} | {} | {}", res_type, key, child)?;
}
}
writeln!(f)?;
}
for published in exchange.response.content().objects.publish_elements().unwrap() {
writeln!(f, " {}", published.uri())?;
}
writeln!(f)?;
}
Ok(())
}
}
src/pubd/repository.rs
+12 -3
View File
@@ -42,7 +42,10 @@ use crate::{
PUBSERVER_CONTENT_DIR, PUBSERVER_DFLT, PUBSERVER_DIR, REPOSITORY_DIR, REPOSITORY_RRDP_ARCHIVE_DIR,
REPOSITORY_RRDP_DIR, REPOSITORY_RSYNC_DIR, RRDP_FIRST_SERIAL,
},
daemon::config::{Config, RrdpUpdatesConfig},
daemon::{
config::{Config, RrdpUpdatesConfig},
ta::TA_NAME,
},
pubd::{
publishers::Publisher, RepoAccessCmd, RepoAccessCmdDet, RepositoryAccessEvent, RepositoryAccessEventDetails,
RepositoryAccessIni, RepositoryAccessInitDetails,
@@ -1620,8 +1623,14 @@ impl RepositoryAccess {
}
fn base_uri_for(&self, name: &PublisherHandle) -> KrillResult<uri::Rsync> {
uri::Rsync::from_str(&format!("{}{}/", self.rsync_base, name))
.map_err(|_| Error::Custom(format!("Cannot derive base uri for {}", name)))
if name.as_str() == TA_NAME {
// Let the TA publish directly under the rsync base dir. This
// will be helpful for RPs that still insist on rsync.
Ok(self.rsync_base.clone())
} else {
uri::Rsync::from_str(&format!("{}{}/", self.rsync_base, name))
.map_err(|_| Error::Custom(format!("Cannot derive base uri for {}", name)))
}
}
/// Returns the repository URI information for a publisher.
src/test.rs
+5
View File
@@ -1108,3 +1108,8 @@ pub fn test_id_certificate() -> IdCert {
let data = include_bytes!("../test-resources/oob/id_publisher_ta.cer");
IdCert::decode(Bytes::from_static(data)).unwrap()
}
#[cfg(test)]
pub fn test_actor() -> crate::commons::actor::Actor {
crate::commons::actor::Actor::test_from_def(crate::constants::ACTOR_DEF_KRILL)
}
src/upgrades/mod.rs
+14
View File
@@ -102,6 +102,7 @@ pub enum PrepareUpgradeError {
Unrecognised(String),
CannotLoadAggregate(MyHandle),
IdExchange(String),
OldTaMigration,
Custom(String),
}
@@ -114,6 +115,7 @@ impl fmt::Display for PrepareUpgradeError {
PrepareUpgradeError::Unrecognised(s) => format!("Unrecognised: {}", s),
PrepareUpgradeError::CannotLoadAggregate(h) => format!("Cannot load: {}", h),
PrepareUpgradeError::IdExchange(s) => format!("Could not use exchanged id info: {}", s),
PrepareUpgradeError::OldTaMigration => "Your installation cannot be upgraded to Krill 0.13.0 or later because it includes a CA called \"ta\". These CAs were used for the preliminary Trust Anchor support needed by testbed and benchmark setups. They cannot be migrated to the production grade Trust Anchor support that was introduced in Krill 0.13.0. If you want to continue to use your existing installation we recommend that you downgrade to Krill 0.12.1 or earlier. If you want to operate a testbed using Krill 0.13.0 or later, then you can create a fresh testbed instead of migrating your existing testbed. If you believe that you should not have a CA called \"ta\" - i.e. it may have been left over from an abandoned testbed set up - then you can delete the \"ta\" directory under your krill data \"cas\" directory and restart Krill.".to_string(),
PrepareUpgradeError::Custom(s) => s.clone(),
};
@@ -325,6 +327,18 @@ pub fn prepare_upgrade_data_migrations(mode: UpgradeMode, config: Arc<Config>) -
#[cfg(feature = "hsm")]
record_preexisting_openssl_keys_in_signer_mapper(config.clone())?;
// Check if there is any CA named "ta". If so, then we are trying to upgrade a Krill testbed
// or benchmark set up that uses the old deprecated trust anchor set up. These TAs cannot easily
// be migrated to the new setup in 0.13.0. Well.. it could be done, if there would be a strong use
// case to put in the effort, but there really isn't.
let ca_store_path = config.data_dir.join(CASERVER_DIR);
if ca_store_path.exists() {
let ca_kv_store = KeyValueStore::disk(&config.data_dir, CASERVER_DIR)?;
if ca_kv_store.has_scope("ta".to_string())? {
return Err(PrepareUpgradeError::OldTaMigration);
}
}
match upgrade_versions(config.as_ref()) {
None => Ok(None),
Some(versions) => {
src/upgrades/pre_0_10_0/old_events.rs
+7 -8
View File
@@ -24,7 +24,7 @@ use crate::{
api::{
AspaCustomer, AspaDefinition, AspaProvidersUpdate, CertInfo, IdCertInfo, IssuedCertificate, ObjectName,
ParentCaContact, ParentServerInfo, PublicationServerInfo, ReceivedCert, RepositoryContact, Revocation,
Revocations, RoaAggregateKey, RtaName, SuspendedCert, TaCertDetails, TrustAnchorLocator, UnsuspendedCert,
Revocations, RoaAggregateKey, RtaName, SuspendedCert, UnsuspendedCert,
},
eventsourcing::StoredEvent,
util::ext_serde,
@@ -33,6 +33,7 @@ use crate::{
self, AspaInfo, AspaObjectsUpdates, CaEvt, CaEvtDet, CaObjects, CertifiedKey, ChildCertificateUpdates,
ObjectSetRevision, PreparedRta, PublishedObject, RoaInfo, RoaPayloadJsonMapKey, RoaUpdates, SignedRta,
},
daemon::ta::{TaCertDetails, TrustAnchorLocator},
pubd::{Publisher, RepositoryAccessEvent, RepositoryAccessEventDetails, RepositoryAccessInitDetails},
upgrades::PrepareUpgradeError,
};
@@ -268,10 +269,10 @@ impl TryFrom<OldParentCaContact> for ParentCaContact {
type Error = PrepareUpgradeError;
fn try_from(old: OldParentCaContact) -> Result<Self, Self::Error> {
Ok(match old {
OldParentCaContact::Ta(old) => ParentCaContact::Ta(old.try_into()?),
OldParentCaContact::Rfc6492(old) => ParentCaContact::Rfc6492(old.into()),
})
match old {
OldParentCaContact::Ta(_old) => Err(PrepareUpgradeError::OldTaMigration),
OldParentCaContact::Rfc6492(old) => Ok(ParentCaContact::Rfc6492(old.into())),
}
}
}
@@ -890,9 +891,7 @@ impl TryFrom<OldCaEvtDet> for CaEvtDet {
fn try_from(old: OldCaEvtDet) -> Result<Self, Self::Error> {
Ok(match old {
OldCaEvtDet::TrustAnchorMade { ta_cert_details } => CaEvtDet::TrustAnchorMade {
ta_cert_details: ta_cert_details.try_into()?,
},
OldCaEvtDet::TrustAnchorMade { .. } => return Err(PrepareUpgradeError::OldTaMigration),
OldCaEvtDet::ChildAdded {
child,
id_cert,
src/upgrades/pre_0_9_0/ca_objects_migration.rs
+4 -3
View File
@@ -26,7 +26,7 @@ use crate::{
commons::{
api::{
IdCertInfo, ObjectName, ReceivedCert, RepositoryContact, Revocation, Revocations, RoaAggregateKey,
StorableCaCommand, StoredEffect, TaCertDetails, TrustAnchorLocator,
StorableCaCommand, StoredEffect,
},
crypto::KrillSigner,
eventsourcing::{Aggregate, AggregateStore, CommandKey, KeyStoreKey, KeyValueStore, StoredValueInfo},
@@ -35,11 +35,12 @@ use crate::{
constants::{CASERVER_DIR, KRILL_VERSION},
daemon::{
ca::{
self, ta_handle, CaEvt, CaEvtDet, CaObjects, CaObjectsStore, IniDet, KeyObjectSet, ObjectSetRevision,
PublishedCert, PublishedObject, ResourceClassKeyState, ResourceClassObjects, RoaInfo, RoaPayloadJsonMapKey,
self, CaEvt, CaEvtDet, CaObjects, CaObjectsStore, IniDet, KeyObjectSet, ObjectSetRevision, PublishedCert,
PublishedObject, ResourceClassKeyState, ResourceClassObjects, RoaInfo, RoaPayloadJsonMapKey,
StoredCaCommand,
},
config::Config,
ta::{ta_handle, TaCertDetails, TrustAnchorLocator},
},
pubd::RepositoryManager,
upgrades::pre_0_9_0::{old_commands::*, old_events::*},
src/upgrades/pre_0_9_0/old_commands.rs
+2 -2
View File
@@ -189,7 +189,7 @@ impl WithStorableDetails for OldStorableCaCommand {
impl From<OldStorableCaCommand> for StorableCaCommand {
fn from(old: OldStorableCaCommand) -> Self {
match old {
OldStorableCaCommand::MakeTrustAnchor => StorableCaCommand::MakeTrustAnchor,
OldStorableCaCommand::MakeTrustAnchor => unreachable!("TA migration is not supported and not attempted"),
OldStorableCaCommand::ChildAdd(_child, _ski, _resources) => {
unreachable!("migrated differently")
}
@@ -347,7 +347,7 @@ pub enum OldStorableParentContact {
impl From<OldStorableParentContact> for StorableParentContact {
fn from(old: OldStorableParentContact) -> Self {
match old {
OldStorableParentContact::Ta => StorableParentContact::Ta,
OldStorableParentContact::Ta => unreachable!("TA migration is not supported and not attempted"),
_ => StorableParentContact::Rfc6492,
}
}
src/upgrades/pre_0_9_0/old_events.rs
+4 -4
View File
@@ -121,7 +121,7 @@ impl OldCaEvt {
OldCaEvtDet::ParentAdded(parent, old_contact) => {
let contact = match old_contact {
OldParentCaContact::Rfc6492(res) => ParentCaContact::for_rfc8183_parent_response(res)?,
OldParentCaContact::Ta(details) => ParentCaContact::Ta(details.try_into()?),
OldParentCaContact::Ta(_details) => return Err(PrepareUpgradeError::OldTaMigration),
OldParentCaContact::Embedded => match derived_embedded_ca_info_map.get(&parent.convert()) {
Some(info) => {
let res = info.parent_responses.get(&id.convert()).ok_or_else(|| PrepareUpgradeError::Custom(
@@ -228,9 +228,9 @@ impl TryFrom<OldCaEvtDet> for CaEvtDet {
fn try_from(old: OldCaEvtDet) -> Result<Self, Self::Error> {
Ok(match old {
OldCaEvtDet::TrustAnchorMade(ta_cert_details) => CaEvtDet::TrustAnchorMade {
ta_cert_details: ta_cert_details.try_into()?,
},
OldCaEvtDet::TrustAnchorMade(_) => {
return Err(PrepareUpgradeError::OldTaMigration);
}
OldCaEvtDet::ChildAdded(_child, _details) => {
unreachable!("Add child must be converted with embedded children in mind")
}
test-resources/bulk-ca-import/structure.json
+5 -3
View File
@@ -1,7 +1,9 @@
{
"ta_aia": "rsync://example.krill.cloud/ta/ta.cer",
"ta_uri": "https://example.krill.cloud/ta/ta.cer",
"publication_server_uris": {
"ta": {
"ta_aia": "rsync://example.krill.cloud/ta/ta.cer",
"ta_uri": "https://example.krill.cloud/ta/ta.cer"
},
"publication_server": {
"rrdp_base_uri": "https://example.krill.cloud/repo/",
"rsync_jail": "rsync://example.krill.cloud/repo/"
},
test-resources/krillta.conf
+1
View File
@@ -0,0 +1 @@
data_dir = "./work/data_ta"
test-resources/migrations/v0_6_0/cas/ca/command--1616410737--2--cmd-ca-parent-add.json
+1 -1
View File
@@ -7,7 +7,7 @@
"details": {
"add_parent": [
"ta",
"embedded"
"rfc6492"
]
},
"effect": {
test-resources/migrations/v0_6_0/cas/ca/delta-2.json
+9 -1
View File
@@ -4,7 +4,15 @@
"details": {
"parent_added": [
"ta",
"embedded"
{
"rfc6492": {
"tag": null,
"id_cert": "MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhDOEYzODRBOTJFN0JCNTI4REUxODMxMEFFNDZFRDkxQUM1MUVDMzZEMB4XDTIxMTEyNTEwMjUxNVoXDTM2MTEyNTEwMzAxNVowMzExMC8GA1UEAxMoQzhGMzg0QTkyRTdCQjUyOERFMTgzMTBBRTQ2RUQ5MUFDNTFFQzM2RDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAPEaAhfelHOfU3fHIFpRRJFrW7mkt3SRkbscxISjiafEsGr99HVskJ737chb9DXHZVNsqNUt97V6jseZSzpeKEhsbCIVErNYkJHCCIp9YLpfIwpr+4gnUWRZXXz5zdb0hO6vgVLbIjwLkTOCaPwoGCa/4dq4oLu1+jD0de4tqygEbwWGOTaB1u1wSnVIMAxcSwU6NAOYGQlVI47fANjNWfukmIcezTXBUAqUDQnWyTlAasDdxVtOCuALQDV6FKAZrxdm2bTaJQ3pXbP85ViaBBSnt5YUtU6Wsg/bFTdBYSB86sCc8Bzl+nltcdzaQJlbzUTN5n26+G8ZovSEEUK23SECAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUyPOEqS57tSjeGDEK5G7ZGsUew20wHwYDVR0jBBgwFoAUyPOEqS57tSjeGDEK5G7ZGsUew20wDQYJKoZIhvcNAQELBQADggEBAED8jxoyOyLhwIruzOXJ+/VxAE0MjtFOeLv8fHORlX/aVsA2o2/aG/mIdb0ALHQhFtjjrESSZ6tMjWvmbdGffI65bW9VyHMsLvz7ctGKHtAgU29q84F4zxWbbHJfcl/mzHRcGqjL+ZA2K1USOoUo0E974dX21/8WwjGQpextB1dCNwFBVKOk4r976nvMqaeaQuZFiLEl9Hp4LL7NVXGjS5NCSF/E9N2TQ9ucXWEQJ6Gtc6GpBl9jOpNIir+wsXIjjDs54zR7ouCcpmVDBDDQK5/PsSWQJ/X4wxNECvFBVIu/k9WypP28bc8/HTgo+j2OeqO0oFniCq20Dq9KxJ5qJzY=",
"parent_handle": "ta",
"child_handle": "ca",
"service_uri": "https://localhost:3000/rfc6492/ta"
}
}
]
}
}
test-resources/migrations/v0_6_0/cas/ta/command--1616409877--1--cmd-ca-repo-update.json
-15
View File
@@ -1,15 +0,0 @@
{
"actor": "krill",
"time": "2021-03-22T10:44:37.150133637Z",
"handle": "ta",
"version": 1,
"sequence": 1,
"details": {
"repo_update": null
},
"effect": {
"events": [
1
]
}
}
test-resources/migrations/v0_6_0/cas/ta/command--1616409877--2--cmd-ca-make-ta.json
-13
View File
@@ -1,13 +0,0 @@
{
"actor": "krill",
"time": "2021-03-22T10:44:37.150276043Z",
"handle": "ta",
"version": 2,
"sequence": 2,
"details": "make_trust_anchor",
"effect": {
"events": [
2
]
}
}
test-resources/migrations/v0_6_0/cas/ta/command--1616409877--3--cmd-ca-rcn-receive.json
-22
View File
@@ -1,22 +0,0 @@
{
"actor": "krill",
"time": "2021-03-22T10:44:37.323145796Z",
"handle": "ta",
"version": 3,
"sequence": 3,
"details": {
"update_rcvd_cert": [
"0",
{
"asn": "AS0-AS4294967295",
"v4": "0.0.0.0/0",
"v6": "::/0"
}
]
},
"effect": {
"events": [
3
]
}
}
test-resources/migrations/v0_6_0/cas/ta/command--1616410686--4--cmd-ca-child-add.json
-23
View File
@@ -1,23 +0,0 @@
{
"actor": "krill",
"time": "2021-03-22T10:58:06.015518962Z",
"handle": "ta",
"version": 4,
"sequence": 4,
"details": {
"child_add": [
"ca",
null,
{
"asn": "",
"v4": "192.168.0.0/16",
"v6": ""
}
]
},
"effect": {
"events": [
4
]
}
}
test-resources/migrations/v0_6_0/cas/ta/command--1616410738--5--cmd-ca-child-certify.json
-26
View File
@@ -1,26 +0,0 @@
{
"actor": "krill",
"time": "2021-03-22T10:58:58.682526394Z",
"handle": "ta",
"version": 5,
"sequence": 5,
"details": {
"child_certify": [
"ca",
"0",
{
"asn": "none",
"v4": "none",
"v6": "none"
},
"B497A5F1E84F9089F5F51A899725A7C5B076E03F"
]
},
"effect": {
"events": [
5,
6,
7
]
}
}
test-resources/migrations/v0_6_0/cas/ta/command--1616410864--6--cmd-ca-child-certify.json
-26
View File
@@ -1,26 +0,0 @@
{
"actor": "krill",
"time": "2021-03-22T11:01:04.899126536Z",
"handle": "ta",
"version": 8,
"sequence": 6,
"details": {
"child_certify": [
"ca",
"0",
{
"asn": "none",
"v4": "none",
"v6": "none"
},
"9F50CE97A62D7420ECB0E76400B4D00A9FF80837"
]
},
"effect": {
"events": [
8,
9,
10
]
}
}
test-resources/migrations/v0_6_0/cas/ta/delta-0.json
-10
View File
@@ -1,10 +0,0 @@
{
"id": "ta",
"version": 0,
"details": {
"id": {
"key": "47B37867569D650DFDB6DCC3A639FE2F75A1F8CD",
"cert": "MIIDPDCCAiSgAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyg0N0IzNzg2NzU2OUQ2NTBERkRCNkRDQzNBNjM5RkUyRjc1QTFGOENEMCAXDTIxMDMyMjEwMzkzN1oYDzIxMjEwMzIyMTA0NDM3WjAzMTEwLwYDVQQDEyg0N0IzNzg2NzU2OUQ2NTBERkRCNkRDQzNBNjM5RkUyRjc1QTFGOENEMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlak6G+3yuf8zkX9vAua+qRNYHHVjA7BaTh+nrurCznq3ogwg/Y/5RC6/19BAz0uiK5CaWUiFSi8qC2tul168yQD15l1jzix7A6n224HmgJaYtInVZ4mohQtUaUD8INvQj81t3uaD1xYOEbBqKwdwYl7JPoMCLtzta7yKOxzCTmpuVjUy0nw7vydY4WTCixmO3n/bEOIBn63WcPAkxwPrCklgwcmYHqwnJ1au3aE6OUCElasIsL/TLS/r3mRlVup8NW3CM+lkP2BVBbJWSmm6n4WJXjFSMf4FuR82n1yfmNea4Dk2R68APNviqbNv1FQEo0grrcTc3DcTHTuoWArmdwIDAQABo1kwVzAPBgNVHRMBAf8EBTADAQH/MCAGA1UdDgEBAAQWBBRHs3hnVp1lDf223MOmOf4vdaH4zTAiBgNVHSMBAQAEGDAWgBRHs3hnVp1lDf223MOmOf4vdaH4zTANBgkqhkiG9w0BAQsFAAOCAQEATT2pJ8ssOAlNFpvkxYQ867ocvpC1/e61e4e1qkesTuGSp7QpEXL3cJP5DIprdqdKhrBH9PjGcGH2OoNlSX6K7zEGy9mxnuAIqtnnf+fJCyDfk1kH9Ru8rcVyVjg//tkV5hoxYeTJSEMROMw630JK/1KWiRi3VOZ/aLHBxO/bk8OulX2X3L810JZbx5wpuO7VfTglRO2LA8FtCf12zp98qcSa6RVbDUCAnY4E/aj9ZV1aMthzkwD6BWhy5yXdwIrjDeY4oy53FHXeaF35d/mL+lpYJ1XmKM0Z3cJ52L2fyW2l/vZZYBFYFqzzYqapWjbZGpWMSNt55Lk+oMfTA39DaQ=="
}
}
}
test-resources/migrations/v0_6_0/cas/ta/delta-1.json
-12
View File
@@ -1,12 +0,0 @@
{
"id": "ta",
"version": 1,
"details": {
"repo_updated": {
"embedded": {
"base_uri": "rsync://localhost/repo/ta/",
"rpki_notify": "https://localhost:3000/rrdp/notification.xml"
}
}
}
}
test-resources/migrations/v0_6_0/cas/ta/delta-10.json
-76
View File
@@ -1,76 +0,0 @@
{
"id": "ta",
"version": 10,
"details": {
"object_set_updated": [
"0",
{
"C4893EC25530F2EADFC96E89F476DA1300801AA7": {
"number": 3,
"revocations_delta": {
"added": [
{
"serial": "650748792341242696138123586874381430911663227913",
"expires": "2021-03-23T10:58:58.687824581Z"
}
],
"dropped": []
},
"manifest_info": {
"name": "C4893EC25530F2EADFC96E89F476DA1300801AA7.mft",
"current": {
"content": "MIILvQYJKoZIhvcNAQcCoIILrjCCC6oCAQMxDzANBglghkgBZQMEAgEFADCCAUUGCyqGSIb3DQEJEAEaoIIBNASCATAwggEsAgEDGA8yMDIxMDMyMjEwNTYwNFoYDzIwMjEwMzIzMTEwMTA0WgYJYIZIAWUDBAIBMIH5MFEWLEI0OTdBNUYxRTg0RjkwODlGNUY1MUE4OTk3MjVBN0M1QjA3NkUwM0YuY2VyAyEA/KwLh2STwh7ULlTQytALJBH0+asPU6AGcd024zu3YA8wURYsOUY1MENFOTdBNjJENzQyMEVDQjBFNzY0MDBCNEQwMEE5RkY4MDgzNy5jZXIDIQDuE+o5+KS8SZyHLMsS316ecsy4x8NLD9At1+PN94pJPjBRFixDNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybAMhAJ+kJjmEoMd/eccfTBRE+yWHRntWs+Vv1Ed84xw9PpakoIIImTCCCJUwggd9oAMCAQICFEboVEprFEo3FpMdjXV7STXBBFZQMA0GCSqGSIb3DQEBCwUAMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQkFBRTdCRTkyQkZGNjU2MEUyMjAxOUFEMTY1M0RFMjQ2RjI5Q0FFNDVCMURGNzMwNDU1MjY5NzhGNUUzODhFMTM0OTJGQ0VCOTg4NUI0MDBGOEY1MTE1MEE0QjlGRjkwMzdBQTU3NjkyM0FCQTA4OTA3Mzc4RTQ5QUU2NkJBMjEzRTZFNzEzMjVCMjlEMzg4OEMxOUZGNEFCRERDQkI1RUJBQ0U2NDQwRkRFOTYyOUNCODlEOTkyRjlCRDkwN0VGNEZFNkVFNjM4NzA2NTNBNEQ5NjU4NUNFNTczMzlDNzIzQkY0ODJERDZBQzIzQjhEQUM2N0M5RTBDRjlCMDUyRjlEM0RDNjc0M0YzNTk0NzU0QTA1OUQwNDc2MzM1NDM2MkIyMjU2NzYyNzMxOUIwRUYyOEQ2MEExQjA3OTM4NkI4QkMwRTcyQjhGM0U1NDU4MkMxQzhGMzNFMEU4MzM1OEE2RDAwQUQ5MTAxRDY5QTBBNDVBQjg4RjEwNEY3OTUyRUEzRkRFQTJCM0ZCMUQzNkJBMUM2NjJGMDQ0RjFEODc3NzA0ODBEMzc4M0RBMDcyOUUzQzUxNTdGMDk5RjVFQzBDRkUwMkRFODQ5NDI3RkEyMDRBRjJBMzgxMUVBMTMzNUZFQUMxM0RBRUU0M0U3Q0UzQkQzQjE0Q0RGNTdDRTMwMjAzMDEwMDAxMB4XDTIxMDMyMjEwNTYwNFoXDTIxMDMyOTExMDEwNFowggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBBREExQTVGOThERDA4MUIxQjZDRjE2RTc4NjhCNThCRUEzOTNENzY2NUJDMzJDQjU1OEU3M0UzRTAyQzUzMzQ3NTNEMzAyNzM4RjQ1RjYyQUMzNTkwNThCNDVGRkE4Njc2MUU1QUQ3MjFDODEyRDkyMEE0NTY4NEY4Mjg0MjkwNTU5Qjk1OUVCMUI1MUUwNDNBQjdGQzA1ODk2ODNCQ0VBQ0YxRTEwMDBENTY2NDg2NUY3NDNFRDY4QjJFNTZDMUVFNjhENUVCNTQwMkNEODhERUIwRTVBODlEMjFGMzYwRDg4QjA3MjJCOEJDNTRDQzIwOTExOERDNjI5OUY3NEY1OURBQjhBMUIzMkFEQUUxNTc5OEEyNUU1QTlBOTgyQzgxMTMyRjczMkQ3QTQxQkFFMEJDRTc2NzkxNzYzNjZFMThBRDMzQjU5NzY0REYzOEZGMkIzRTZCMThEN0U0NDU5RkE2RTc3RkI2N0IzOEU1NkFEQjA4RERDMDRGRjBFM0VGMzQzQUVFRkM4MTA4QTk3NzkyOENGRkU0MkQ1QzE1OEUxOEEyRkZEODY4M0YzNURBOUY3QUIzMUIyNzkyMEY5MDQ4RTExMDg2QkM3OERGNzlFRjdFMTA2RDY3N0JDNUM2NDQ2ODM3MDVBNUM4MzhCNzVGRkY0NTAyQjY4RTY5QjAyMDMwMTAwMDEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCtoaX5jdCBsbbPFueGi1i+o5PXZlvDLLVY5z4+AsUzR1PTAnOPRfYqw1kFi0X/qGdh5a1yHIEtkgpFaE+ChCkFWblZ6xtR4EOrf8BYloO86s8eEADVZkhl90PtaLLlbB7mjV61QCzYjesOWonSHzYNiLByK4vFTMIJEY3GKZ909Z2rihsyra4VeYol5ampgsgRMvcy16QbrgvOdnkXY2bhitM7WXZN84/ys+axjX5EWfpud/tns45WrbCN3AT/Dj7zQ67vyBCKl3koz/5C1cFY4Yov/YaD812p96sxsnkg+QSOEQhrx433nvfhBtZ3vFxkRoNwWlyDi3X/9FAraOabAgMBAAGjggGnMIIBozAdBgNVHQ4EFgQUdDlnon3qbCwJZxbiRwvbSWwxLZYwHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgeAMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvMC9DNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybDA8BggrBgEFBQcBAQQwMC4wLAYIKwYBBQUHMAKGIHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvdGEuY2VyMGQGCCsGAQUFBwELBFgwVjBUBggrBgEFBQcwC4ZIcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby90YS8wL0M0ODkzRUMyNTUzMEYyRUFERkM5NkU4OUY0NzZEQTEzMDA4MDFBQTcubWZ0MBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwIQYIKwYBBQUHAQcBAf8EEjAQMAYEAgABBQAwBgQCAAIFADAVBggrBgEFBQcBCAEB/wQGMASgAgUAMA0GCSqGSIb3DQEBCwUAA4IBAQAgUixAEeQXqALJSFKa7jAv6c9eIuQzDdNhebaFzWO/2cnVaxEmzn/EpnRsTabEInZAx0ZGspRepI3aK4Ep0Vo727vihPfKiQri9DyC2xRNAvox6zwtuO71q4NPJcgdlCvjOd4kdT/ZwM/rnuVXgY7BwMLGC6Hnuagrv6LIMpwFXKkctcakS0mYfxm4FyvLNB3a7Ju2foZ4YyrzY4prrUiSDwyaPJnrKwTDTROAvAZ1sbIoOuGp0W8gT1uzminc2r6XrqF8jV8J/5KMm2RaxaIEoJdMiXTXNoV+nLKZFHX+BxCLS/Hq6hw74+OIIibtYX572fSEaKXxjiX2R9k4CmQDMYIBrDCCAagCAQOAFHQ5Z6J96mwsCWcW4kcL20lsMS2WMA0GCWCGSAFlAwQCAQUAoGswGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEaMBwGCSqGSIb3DQEJBTEPFw0yMTAzMjIxMTAxMDRaMC8GCSqGSIb3DQEJBDEiBCDEEBgzS5y6sSFLuZNAkiNicoTA/wvzqUDDFT9IOCU51DANBgkqhkiG9w0BAQEFAASCAQCJNOz8cq7l1tx+mckCMOAmduwKuDWs3TVRLfLvTJlCvNkYVUdZFtYmgmJFmj00SvL08iPbcVcMGqtR8qJ5Vtx5vmtjdQMQ+Jj6U2d3cSikmdG7WXH1fg6Gi+AqXbksFg0aAg4TgcQfcxK35sE8IyMs0HS7H4SOxOskiirngrkPhf8QY5mk132Xl+YMLPGMsDsgxGVKMt1/qfxCYvtqQskRo21sHBPCJtW8eWnpaDAkD93cM2zIYNS6Cq4ijF2IsNb2+pxb94vSnz8pXt8eR59ezjVQ2Xc2atI7Coqjy1cj0jYQXl4XU0P5ngEQvq/mYhjiygq0hpUPuzHL5wJ7W/uM",
"serial": "404810469598974038024323796113457425902295340624",
"expires": "2021-03-23T11:01:04.907150446Z"
},
"next_update": "2021-03-23T11:01:04.907150446Z",
"old": "63b69931826fc885a00c30a653a0530b3e85e8cd051b4d56891360aa9ba04a72"
},
"crl_info": {
"name": "C4893EC25530F2EADFC96E89F476DA1300801AA7.crl",
"current": {
"content": "MIID+jCCAuICAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEXDTIxMDMyMjEwNTYwNFoXDTIxMDMyMzExMDEwNFowTjAlAhQ3wc5Hxl4b0trHFnEsFr0nPCVXQhcNMjEwMzIzMTA0NDM3WjAlAhRx/JXHAP8LOQo9uL05Yg1RLLJECRcNMjEwMzIzMTA1ODU4WqAvMC0wHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwCgYDVR0UBAMCAQMwDQYJKoZIhvcNAQELBQADggEBAHjpd5YJjNYJ/EuWwrmtltaI0U4ySKEJsf07cKCqICjiqnN2Sxvos2cTFxsDw8EdvAfqVyzpU68Zym4EjQxoUxTdsKQkuughKbaZEZi8C8E7sUmS6IoZH/KtYtxGl+dV3SCHf4gORS5ZFEtk84QVKy70MGy5WBjkZCNTWvZ2ZQ6HR8EoBKuqRH8SVXRbXWFWlPYF+X6ZewaMBMSG8XjIeUDYRXG0tJ4h8xnXemR3JGP4WX+wXCQ6Q6aJMOo2TCIU9Jo+rv47BsqSghcgVheFHrewEpeM/ecvuIp7RnJ5ILguBX7K6CD8ngtFZ/U0055qi+R51kRI2HivBAE+Rryouoc=",
"serial": "3",
"expires": "2021-03-23T11:01:04.903319261Z"
},
"old": "f1ea1b60f804869e58c24bfd5c9aa0e147f67e0cff59ff386158e3eec07b33eb"
},
"objects_delta": {
"ca_repo": "rsync://localhost/repo/ta/0",
"added": [
{
"name": "9F50CE97A62D7420ECB0E76400B4D00A9FF80837.cer",
"object": {
"content": "MIIG9zCCBd+gAwIBAgIUbxupwYqnAX4cy0ub1ggDn4onxlgwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEwHhcNMjEwMzIyMTA1NjA0WhcNMjIwMzIyMTEwMTA0WjAzMTEwLwYDVQQDEyg5RjUwQ0U5N0E2MkQ3NDIwRUNCMEU3NjQwMEI0RDAwQTlGRjgwODM3MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr+c5o3kod88LphtXU6UAzmAnrCunhrJvEh2ojXC3bWCska09Nq90ntSQNTWHJZmrzAYMKHHGX4L+0VLoyKB/cFMH5uFNWPFn2gcg/a9Gp9SLCrr2BLF8cCziobX70kZAYsVc9yF+uElE6drCQrmTuXiiQiPFjG+zClC68EuomQW6NPyX6IzLnlM+X3wHKQpmUyFuJNBDonUZfjRDtv1SiHVaAg45Gx2Fent1C+/pveBnv1HiZLolpykwglw9xytCniW/h7j6HPDatn645szN4OVpYd2b4SGrOr8qEEQXo0i6HW2MtO/4C3aR3jwut/LsTTHOVaXdTiqSC+96zXggFQIDAQABo4ICBTCCAgEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUn1DOl6YtdCDssOdkALTQCp/4CDcwHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgEGMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvMC9DNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybDA8BggrBgEFBQcBAQQwMC4wLAYIKwYBBQUHMAKGIHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvdGEuY2VyMIHKBggrBgEFBQcBCwSBvTCBujAoBggrBgEFBQcwBYYccnN5bmM6Ly9sb2NhbGhvc3QvcmVwby9jYS8wLzBUBggrBgEFBQcwCoZIcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby9jYS8wLzlGNTBDRTk3QTYyRDc0MjBFQ0IwRTc2NDAwQjREMDBBOUZGODA4MzcubWZ0MDgGCCsGAQUFBzANhixodHRwczovL2xvY2FsaG9zdDozMDAwL3JyZHAvbm90aWZpY2F0aW9uLnhtbDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMB4GCCsGAQUFBwEHAQH/BA8wDTALBAIAATAFAwMAwKgwDQYJKoZIhvcNAQELBQADggEBAIlVqENjjP6omOtNzq1l2ctP1zcREBQpHgZwDOB9eZ407Re4iY4DcDwLKCFWvI7W0oqGJcIWB5r/Yqevhi4rGinwRewmggfYQYkeXg++27PYbPBN/m5GmKewCIMFnityDDVUj7t+728LUR3q177LP7jZttwHAWI09IKOT8IsP5Zi7NwIPBLK/RlS9RpX2ASkBZk9LAECljBGaYrD/PZZJ84b5nufOY5DJ/5lhJWG0E9Hm19uwS7wTnT4R4CL0hgghYUzaxtMhHW84Zmxa/N5sjY9Del7cOfnl4+/6GQ04jauo77Jr55n+AoRLh5mYUdt7VratdCsJwJjMm5hMj74xeM=",
"serial": "634314883516926404505270299091452995808036111960",
"expires": "2022-03-22T11:01:04Z"
}
}
],
"updated": [
{
"name": "C4893EC25530F2EADFC96E89F476DA1300801AA7.crl",
"object": {
"content": "MIID+jCCAuICAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEXDTIxMDMyMjEwNTYwNFoXDTIxMDMyMzExMDEwNFowTjAlAhQ3wc5Hxl4b0trHFnEsFr0nPCVXQhcNMjEwMzIzMTA0NDM3WjAlAhRx/JXHAP8LOQo9uL05Yg1RLLJECRcNMjEwMzIzMTA1ODU4WqAvMC0wHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwCgYDVR0UBAMCAQMwDQYJKoZIhvcNAQELBQADggEBAHjpd5YJjNYJ/EuWwrmtltaI0U4ySKEJsf07cKCqICjiqnN2Sxvos2cTFxsDw8EdvAfqVyzpU68Zym4EjQxoUxTdsKQkuughKbaZEZi8C8E7sUmS6IoZH/KtYtxGl+dV3SCHf4gORS5ZFEtk84QVKy70MGy5WBjkZCNTWvZ2ZQ6HR8EoBKuqRH8SVXRbXWFWlPYF+X6ZewaMBMSG8XjIeUDYRXG0tJ4h8xnXemR3JGP4WX+wXCQ6Q6aJMOo2TCIU9Jo+rv47BsqSghcgVheFHrewEpeM/ecvuIp7RnJ5ILguBX7K6CD8ngtFZ/U0055qi+R51kRI2HivBAE+Rryouoc=",
"serial": "3",
"expires": "2021-03-23T11:01:04.903319261Z"
},
"old": "f1ea1b60f804869e58c24bfd5c9aa0e147f67e0cff59ff386158e3eec07b33eb"
},
{
"name": "C4893EC25530F2EADFC96E89F476DA1300801AA7.mft",
"object": {
"content": "MIILvQYJKoZIhvcNAQcCoIILrjCCC6oCAQMxDzANBglghkgBZQMEAgEFADCCAUUGCyqGSIb3DQEJEAEaoIIBNASCATAwggEsAgEDGA8yMDIxMDMyMjEwNTYwNFoYDzIwMjEwMzIzMTEwMTA0WgYJYIZIAWUDBAIBMIH5MFEWLEI0OTdBNUYxRTg0RjkwODlGNUY1MUE4OTk3MjVBN0M1QjA3NkUwM0YuY2VyAyEA/KwLh2STwh7ULlTQytALJBH0+asPU6AGcd024zu3YA8wURYsOUY1MENFOTdBNjJENzQyMEVDQjBFNzY0MDBCNEQwMEE5RkY4MDgzNy5jZXIDIQDuE+o5+KS8SZyHLMsS316ecsy4x8NLD9At1+PN94pJPjBRFixDNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybAMhAJ+kJjmEoMd/eccfTBRE+yWHRntWs+Vv1Ed84xw9PpakoIIImTCCCJUwggd9oAMCAQICFEboVEprFEo3FpMdjXV7STXBBFZQMA0GCSqGSIb3DQEBCwUAMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQkFBRTdCRTkyQkZGNjU2MEUyMjAxOUFEMTY1M0RFMjQ2RjI5Q0FFNDVCMURGNzMwNDU1MjY5NzhGNUUzODhFMTM0OTJGQ0VCOTg4NUI0MDBGOEY1MTE1MEE0QjlGRjkwMzdBQTU3NjkyM0FCQTA4OTA3Mzc4RTQ5QUU2NkJBMjEzRTZFNzEzMjVCMjlEMzg4OEMxOUZGNEFCRERDQkI1RUJBQ0U2NDQwRkRFOTYyOUNCODlEOTkyRjlCRDkwN0VGNEZFNkVFNjM4NzA2NTNBNEQ5NjU4NUNFNTczMzlDNzIzQkY0ODJERDZBQzIzQjhEQUM2N0M5RTBDRjlCMDUyRjlEM0RDNjc0M0YzNTk0NzU0QTA1OUQwNDc2MzM1NDM2MkIyMjU2NzYyNzMxOUIwRUYyOEQ2MEExQjA3OTM4NkI4QkMwRTcyQjhGM0U1NDU4MkMxQzhGMzNFMEU4MzM1OEE2RDAwQUQ5MTAxRDY5QTBBNDVBQjg4RjEwNEY3OTUyRUEzRkRFQTJCM0ZCMUQzNkJBMUM2NjJGMDQ0RjFEODc3NzA0ODBEMzc4M0RBMDcyOUUzQzUxNTdGMDk5RjVFQzBDRkUwMkRFODQ5NDI3RkEyMDRBRjJBMzgxMUVBMTMzNUZFQUMxM0RBRUU0M0U3Q0UzQkQzQjE0Q0RGNTdDRTMwMjAzMDEwMDAxMB4XDTIxMDMyMjEwNTYwNFoXDTIxMDMyOTExMDEwNFowggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBBREExQTVGOThERDA4MUIxQjZDRjE2RTc4NjhCNThCRUEzOTNENzY2NUJDMzJDQjU1OEU3M0UzRTAyQzUzMzQ3NTNEMzAyNzM4RjQ1RjYyQUMzNTkwNThCNDVGRkE4Njc2MUU1QUQ3MjFDODEyRDkyMEE0NTY4NEY4Mjg0MjkwNTU5Qjk1OUVCMUI1MUUwNDNBQjdGQzA1ODk2ODNCQ0VBQ0YxRTEwMDBENTY2NDg2NUY3NDNFRDY4QjJFNTZDMUVFNjhENUVCNTQwMkNEODhERUIwRTVBODlEMjFGMzYwRDg4QjA3MjJCOEJDNTRDQzIwOTExOERDNjI5OUY3NEY1OURBQjhBMUIzMkFEQUUxNTc5OEEyNUU1QTlBOTgyQzgxMTMyRjczMkQ3QTQxQkFFMEJDRTc2NzkxNzYzNjZFMThBRDMzQjU5NzY0REYzOEZGMkIzRTZCMThEN0U0NDU5RkE2RTc3RkI2N0IzOEU1NkFEQjA4RERDMDRGRjBFM0VGMzQzQUVFRkM4MTA4QTk3NzkyOENGRkU0MkQ1QzE1OEUxOEEyRkZEODY4M0YzNURBOUY3QUIzMUIyNzkyMEY5MDQ4RTExMDg2QkM3OERGNzlFRjdFMTA2RDY3N0JDNUM2NDQ2ODM3MDVBNUM4MzhCNzVGRkY0NTAyQjY4RTY5QjAyMDMwMTAwMDEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCtoaX5jdCBsbbPFueGi1i+o5PXZlvDLLVY5z4+AsUzR1PTAnOPRfYqw1kFi0X/qGdh5a1yHIEtkgpFaE+ChCkFWblZ6xtR4EOrf8BYloO86s8eEADVZkhl90PtaLLlbB7mjV61QCzYjesOWonSHzYNiLByK4vFTMIJEY3GKZ909Z2rihsyra4VeYol5ampgsgRMvcy16QbrgvOdnkXY2bhitM7WXZN84/ys+axjX5EWfpud/tns45WrbCN3AT/Dj7zQ67vyBCKl3koz/5C1cFY4Yov/YaD812p96sxsnkg+QSOEQhrx433nvfhBtZ3vFxkRoNwWlyDi3X/9FAraOabAgMBAAGjggGnMIIBozAdBgNVHQ4EFgQUdDlnon3qbCwJZxbiRwvbSWwxLZYwHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgeAMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvMC9DNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybDA8BggrBgEFBQcBAQQwMC4wLAYIKwYBBQUHMAKGIHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvdGEuY2VyMGQGCCsGAQUFBwELBFgwVjBUBggrBgEFBQcwC4ZIcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby90YS8wL0M0ODkzRUMyNTUzMEYyRUFERkM5NkU4OUY0NzZEQTEzMDA4MDFBQTcubWZ0MBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwIQYIKwYBBQUHAQcBAf8EEjAQMAYEAgABBQAwBgQCAAIFADAVBggrBgEFBQcBCAEB/wQGMASgAgUAMA0GCSqGSIb3DQEBCwUAA4IBAQAgUixAEeQXqALJSFKa7jAv6c9eIuQzDdNhebaFzWO/2cnVaxEmzn/EpnRsTabEInZAx0ZGspRepI3aK4Ep0Vo727vihPfKiQri9DyC2xRNAvox6zwtuO71q4NPJcgdlCvjOd4kdT/ZwM/rnuVXgY7BwMLGC6Hnuagrv6LIMpwFXKkctcakS0mYfxm4FyvLNB3a7Ju2foZ4YyrzY4prrUiSDwyaPJnrKwTDTROAvAZ1sbIoOuGp0W8gT1uzminc2r6XrqF8jV8J/5KMm2RaxaIEoJdMiXTXNoV+nLKZFHX+BxCLS/Hq6hw74+OIIibtYX572fSEaKXxjiX2R9k4CmQDMYIBrDCCAagCAQOAFHQ5Z6J96mwsCWcW4kcL20lsMS2WMA0GCWCGSAFlAwQCAQUAoGswGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEaMBwGCSqGSIb3DQEJBTEPFw0yMTAzMjIxMTAxMDRaMC8GCSqGSIb3DQEJBDEiBCDEEBgzS5y6sSFLuZNAkiNicoTA/wvzqUDDFT9IOCU51DANBgkqhkiG9w0BAQEFAASCAQCJNOz8cq7l1tx+mckCMOAmduwKuDWs3TVRLfLvTJlCvNkYVUdZFtYmgmJFmj00SvL08iPbcVcMGqtR8qJ5Vtx5vmtjdQMQ+Jj6U2d3cSikmdG7WXH1fg6Gi+AqXbksFg0aAg4TgcQfcxK35sE8IyMs0HS7H4SOxOskiirngrkPhf8QY5mk132Xl+YMLPGMsDsgxGVKMt1/qfxCYvtqQskRo21sHBPCJtW8eWnpaDAkD93cM2zIYNS6Cq4ijF2IsNb2+pxb94vSnz8pXt8eR59ezjVQ2Xc2atI7Coqjy1cj0jYQXl4XU0P5ngEQvq/mYhjiygq0hpUPuzHL5wJ7W/uM",
"serial": "404810469598974038024323796113457425902295340624",
"expires": "2021-03-23T11:01:04.907150446Z"
},
"old": "63b69931826fc885a00c30a653a0530b3e85e8cd051b4d56891360aa9ba04a72"
}
],
"withdrawn": []
}
}
}
]
}
}
test-resources/migrations/v0_6_0/cas/ta/delta-2.json
-20
View File
@@ -1,20 +0,0 @@
{
"id": "ta",
"version": 2,
"details": {
"trust_anchor_made": {
"cert": "MIIIZjCCB06gAwIBAgIUSoqhtx5bgtaf8sRtp/ZeXbmH8SwwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEwIBcNMjEwMzIyMTAzOTM3WhgPMjEyMTAzMjIxMDQ0MzdaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQkFBRTdCRTkyQkZGNjU2MEUyMjAxOUFEMTY1M0RFMjQ2RjI5Q0FFNDVCMURGNzMwNDU1MjY5NzhGNUUzODhFMTM0OTJGQ0VCOTg4NUI0MDBGOEY1MTE1MEE0QjlGRjkwMzdBQTU3NjkyM0FCQTA4OTA3Mzc4RTQ5QUU2NkJBMjEzRTZFNzEzMjVCMjlEMzg4OEMxOUZGNEFCRERDQkI1RUJBQ0U2NDQwRkRFOTYyOUNCODlEOTkyRjlCRDkwN0VGNEZFNkVFNjM4NzA2NTNBNEQ5NjU4NUNFNTczMzlDNzIzQkY0ODJERDZBQzIzQjhEQUM2N0M5RTBDRjlCMDUyRjlEM0RDNjc0M0YzNTk0NzU0QTA1OUQwNDc2MzM1NDM2MkIyMjU2NzYyNzMxOUIwRUYyOEQ2MEExQjA3OTM4NkI4QkMwRTcyQjhGM0U1NDU4MkMxQzhGMzNFMEU4MzM1OEE2RDAwQUQ5MTAxRDY5QTBBNDVBQjg4RjEwNEY3OTUyRUEzRkRFQTJCM0ZCMUQzNkJBMUM2NjJGMDQ0RjFEODc3NzA0ODBEMzc4M0RBMDcyOUUzQzUxNTdGMDk5RjVFQzBDRkUwMkRFODQ5NDI3RkEyMDRBRjJBMzgxMUVBMTMzNUZFQUMxM0RBRUU0M0U3Q0UzQkQzQjE0Q0RGNTdDRTMwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuq576Sv/ZWDiIBmtFlPeJG8pyuRbHfcwRVJpePXjiOE0kvzrmIW0APj1EVCkuf+QN6pXaSOroIkHN45Jrma6IT5ucTJbKdOIjBn/Sr3cu166zmRA/elinLidmS+b2QfvT+buY4cGU6TZZYXOVzOccjv0gt1qwjuNrGfJ4M+bBS+dPcZ0PzWUdUoFnQR2M1Q2KyJWdicxmw7yjWChsHk4a4vA5yuPPlRYLByPM+DoM1im0ArZEB1poKRauI8QT3lS6j/eorP7HTa6HGYvBE8dh3cEgNN4PaBynjxRV/CZ9ewM/gLehJQn+iBK8qOBHqEzX+rBPa7kPnzjvTsUzfV84wIDAQABo4IBdjCCAXIwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgEGMIHJBggrBgEFBQcBCwSBvDCBuTAnBggrBgEFBQcwBYYbcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby90YS8wMFQGCCsGAQUFBzAKhkhyc3luYzovL2xvY2FsaG9zdC9yZXBvL3RhLzAvQzQ4OTNFQzI1NTMwRjJFQURGQzk2RTg5RjQ3NkRBMTMwMDgwMUFBNy5tZnQwOAYIKwYBBQUHMA2GLGh0dHBzOi8vbG9jYWxob3N0OjMwMDAvcnJkcC9ub3RpZmljYXRpb24ueG1sMBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwJwYIKwYBBQUHAQcBAf8EGDAWMAkEAgABMAMDAQAwCQQCAAIwAwMBADAhBggrBgEFBQcBCAEB/wQSMBCgDjAMMAoCAQACBQD/////MA0GCSqGSIb3DQEBCwUAA4IBAQB+onQ8rAvdp73fjkOGCOP8/wvOAoFtUg1rrsc5EhgU1qh3CjjCE+ILlIv6wHLjBeBUP4UamgbafH/DXiaIqY+sID+HLQBrOZfKMQwEZxXNWXmEgqK+4e52Y+wWEEbnxg+0QfiYTrtz06apG4/BLUThshX6nIv5lnIaR3daelGunx89KlNWOOl+5tZOnkim0g4OgBv914Hg/SumT7t4Z9l2+UyMpnM9C5gmroCUMxT121YRucVqmRD4/aWqNu2ihZInKVNuXsxzWtSn33etYIjJD4KrsqEJQLydBWraxDQwo63a/b4lRaIgjIz64ihREfc5xd+av3+hfMT/u9dMrB88",
"resources": {
"asn": "AS0-AS4294967295",
"v4": "0.0.0.0/0",
"v6": "::/0"
},
"tal": {
"uris": [
"https://localhost:3000/ta/ta.cer"
],
"encoded_ski": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuq576Sv/ZWDiIBmtFlPeJG8pyuRbHfcwRVJpePXjiOE0kvzrmIW0APj1EVCkuf+QN6pXaSOroIkHN45Jrma6IT5ucTJbKdOIjBn/Sr3cu166zmRA/elinLidmS+b2QfvT+buY4cGU6TZZYXOVzOccjv0gt1qwjuNrGfJ4M+bBS+dPcZ0PzWUdUoFnQR2M1Q2KyJWdicxmw7yjWChsHk4a4vA5yuPPlRYLByPM+DoM1im0ArZEB1poKRauI8QT3lS6j/eorP7HTa6HGYvBE8dh3cEgNN4PaBynjxRV/CZ9ewM/gLehJQn+iBK8qOBHqEzX+rBPa7kPnzjvTsUzfV84wIDAQAB"
}
}
}
}
test-resources/migrations/v0_6_0/cas/ta/delta-3.json
-68
View File
@@ -1,68 +0,0 @@
{
"id": "ta",
"version": 3,
"details": {
"key_pending_to_active": [
"0",
{
"key_id": "C4893EC25530F2EADFC96E89F476DA1300801AA7",
"incoming_cert": {
"cert": "MIIIZjCCB06gAwIBAgIUSoqhtx5bgtaf8sRtp/ZeXbmH8SwwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEwIBcNMjEwMzIyMTAzOTM3WhgPMjEyMTAzMjIxMDQ0MzdaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQkFBRTdCRTkyQkZGNjU2MEUyMjAxOUFEMTY1M0RFMjQ2RjI5Q0FFNDVCMURGNzMwNDU1MjY5NzhGNUUzODhFMTM0OTJGQ0VCOTg4NUI0MDBGOEY1MTE1MEE0QjlGRjkwMzdBQTU3NjkyM0FCQTA4OTA3Mzc4RTQ5QUU2NkJBMjEzRTZFNzEzMjVCMjlEMzg4OEMxOUZGNEFCRERDQkI1RUJBQ0U2NDQwRkRFOTYyOUNCODlEOTkyRjlCRDkwN0VGNEZFNkVFNjM4NzA2NTNBNEQ5NjU4NUNFNTczMzlDNzIzQkY0ODJERDZBQzIzQjhEQUM2N0M5RTBDRjlCMDUyRjlEM0RDNjc0M0YzNTk0NzU0QTA1OUQwNDc2MzM1NDM2MkIyMjU2NzYyNzMxOUIwRUYyOEQ2MEExQjA3OTM4NkI4QkMwRTcyQjhGM0U1NDU4MkMxQzhGMzNFMEU4MzM1OEE2RDAwQUQ5MTAxRDY5QTBBNDVBQjg4RjEwNEY3OTUyRUEzRkRFQTJCM0ZCMUQzNkJBMUM2NjJGMDQ0RjFEODc3NzA0ODBEMzc4M0RBMDcyOUUzQzUxNTdGMDk5RjVFQzBDRkUwMkRFODQ5NDI3RkEyMDRBRjJBMzgxMUVBMTMzNUZFQUMxM0RBRUU0M0U3Q0UzQkQzQjE0Q0RGNTdDRTMwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuq576Sv/ZWDiIBmtFlPeJG8pyuRbHfcwRVJpePXjiOE0kvzrmIW0APj1EVCkuf+QN6pXaSOroIkHN45Jrma6IT5ucTJbKdOIjBn/Sr3cu166zmRA/elinLidmS+b2QfvT+buY4cGU6TZZYXOVzOccjv0gt1qwjuNrGfJ4M+bBS+dPcZ0PzWUdUoFnQR2M1Q2KyJWdicxmw7yjWChsHk4a4vA5yuPPlRYLByPM+DoM1im0ArZEB1poKRauI8QT3lS6j/eorP7HTa6HGYvBE8dh3cEgNN4PaBynjxRV/CZ9ewM/gLehJQn+iBK8qOBHqEzX+rBPa7kPnzjvTsUzfV84wIDAQABo4IBdjCCAXIwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgEGMIHJBggrBgEFBQcBCwSBvDCBuTAnBggrBgEFBQcwBYYbcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby90YS8wMFQGCCsGAQUFBzAKhkhyc3luYzovL2xvY2FsaG9zdC9yZXBvL3RhLzAvQzQ4OTNFQzI1NTMwRjJFQURGQzk2RTg5RjQ3NkRBMTMwMDgwMUFBNy5tZnQwOAYIKwYBBQUHMA2GLGh0dHBzOi8vbG9jYWxob3N0OjMwMDAvcnJkcC9ub3RpZmljYXRpb24ueG1sMBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwJwYIKwYBBQUHAQcBAf8EGDAWMAkEAgABMAMDAQAwCQQCAAIwAwMBADAhBggrBgEFBQcBCAEB/wQSMBCgDjAMMAoCAQACBQD/////MA0GCSqGSIb3DQEBCwUAA4IBAQB+onQ8rAvdp73fjkOGCOP8/wvOAoFtUg1rrsc5EhgU1qh3CjjCE+ILlIv6wHLjBeBUP4UamgbafH/DXiaIqY+sID+HLQBrOZfKMQwEZxXNWXmEgqK+4e52Y+wWEEbnxg+0QfiYTrtz06apG4/BLUThshX6nIv5lnIaR3daelGunx89KlNWOOl+5tZOnkim0g4OgBv914Hg/SumT7t4Z9l2+UyMpnM9C5gmroCUMxT121YRucVqmRD4/aWqNu2ihZInKVNuXsxzWtSn33etYIjJD4KrsqEJQLydBWraxDQwo63a/b4lRaIgjIz64ihREfc5xd+av3+hfMT/u9dMrB88",
"uri": "rsync://localhost/repo/ta/ta.cer",
"resources": {
"asn": "AS0-AS4294967295",
"v4": "0.0.0.0/0",
"v6": "::/0"
}
},
"current_set": {
"number": 1,
"revocations": [],
"manifest_info": {
"name": "C4893EC25530F2EADFC96E89F476DA1300801AA7.mft",
"current": {
"content": "MIILEgYJKoZIhvcNAQcCoIILAzCCCv8CAQMxDzANBglghkgBZQMEAgEFADCBmwYLKoZIhvcNAQkQARqggYsEgYgwgYUCAQEYDzIwMjEwMzIyMTAzOTM3WhgPMjAyMTAzMjMxMDQ0MzdaBglghkgBZQMEAgEwUzBRFixDNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybAMhAHJnKKbuB0LrBDf1T/n/bAUWodqM5jbVDG/Mx8N7/wMZoIIImTCCCJUwggd9oAMCAQICFDfBzkfGXhvS2scWcSwWvSc8JVdCMA0GCSqGSIb3DQEBCwUAMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQkFBRTdCRTkyQkZGNjU2MEUyMjAxOUFEMTY1M0RFMjQ2RjI5Q0FFNDVCMURGNzMwNDU1MjY5NzhGNUUzODhFMTM0OTJGQ0VCOTg4NUI0MDBGOEY1MTE1MEE0QjlGRjkwMzdBQTU3NjkyM0FCQTA4OTA3Mzc4RTQ5QUU2NkJBMjEzRTZFNzEzMjVCMjlEMzg4OEMxOUZGNEFCRERDQkI1RUJBQ0U2NDQwRkRFOTYyOUNCODlEOTkyRjlCRDkwN0VGNEZFNkVFNjM4NzA2NTNBNEQ5NjU4NUNFNTczMzlDNzIzQkY0ODJERDZBQzIzQjhEQUM2N0M5RTBDRjlCMDUyRjlEM0RDNjc0M0YzNTk0NzU0QTA1OUQwNDc2MzM1NDM2MkIyMjU2NzYyNzMxOUIwRUYyOEQ2MEExQjA3OTM4NkI4QkMwRTcyQjhGM0U1NDU4MkMxQzhGMzNFMEU4MzM1OEE2RDAwQUQ5MTAxRDY5QTBBNDVBQjg4RjEwNEY3OTUyRUEzRkRFQTJCM0ZCMUQzNkJBMUM2NjJGMDQ0RjFEODc3NzA0ODBEMzc4M0RBMDcyOUUzQzUxNTdGMDk5RjVFQzBDRkUwMkRFODQ5NDI3RkEyMDRBRjJBMzgxMUVBMTMzNUZFQUMxM0RBRUU0M0U3Q0UzQkQzQjE0Q0RGNTdDRTMwMjAzMDEwMDAxMB4XDTIxMDMyMjEwMzkzN1oXDTIxMDMyOTEwNDQzN1owggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDA5RTZFNUQ5MzJERTk5MjNENTY5NEVGQjM5Mjg5RTRDMjM5QTk4NkM0RUQwRjBGQ0FBRTgwQkIxODJGRTZBQkFDQTNDNDBDNzQ2NEE1MEY3RjQxQTZDMTM5MTcyMEY5MjVFMjcwNjI1QTI2REMyQjE5NTJCNjdGQUY1RTYyNkI3MENENEE1REQyMTE4MDMxRTJEQjExRjJEOUQ5QkE3NzY2NUM3RUJGNkY2Njc0MzE3RDVGQUMwNUQxNzQxQkRBN0Y3QTMzMEU0NUU2RjU4REFCQTdEMjU2MkI3OUZBNUYwRkJGNTY5OTU3OUNFNUJGNjE1NUNFMzhGRjAwRDhBMjRCRjNGNzdFQjM1NjMzMEUwQjIxNjhBQUYyMTkyQUZEREY4Q0MwQTMzMDAyNTJBMzQxRDBBQ0Y3OUEyNkM1MTk4NzQ1RkM4M0ZBMEJCRkU5NEYxRkJERDhBMzhEQUU0QjI2MDczODkxRjkyMDUxNDExQUZBRjMwREYxOTY0MTJFOEI0RjE1NjBDMjM3MzhBQjc4NDQ1OEREQzExN0I5MzFGMkFFNTQzMzZERjUyNjQ3NzUwRTVFQkE5QkU0MjdEQkI5RkVDQTFFMjAzNkFDM0MwQzkwMzcwQ0I2NTYxMEFGNTRFRDkwRjU2NkE1NTg3OUY4MzJFNTk4MTg2MjcwNEU4NTAyMDMwMTAwMDEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCebl2TLemSPVaU77OSieTCOamGxO0PD8qugLsYL+arrKPEDHRkpQ9/QabBORcg+SXicGJaJtwrGVK2f69eYmtwzUpd0hGAMeLbEfLZ2bp3Zlx+v29mdDF9X6wF0XQb2n96Mw5F5vWNq6fSVit5+l8Pv1aZV5zlv2FVzjj/ANiiS/P3frNWMw4LIWiq8hkq/d+MwKMwAlKjQdCs95omxRmHRfyD+gu/6U8fvdijja5LJgc4kfkgUUEa+vMN8ZZBLotPFWDCNzireERY3cEXuTHyrlQzbfUmR3UOXrqb5Cfbuf7KHiA2rDwMkDcMtlYQr1TtkPVmpVh5+DLlmBhicE6FAgMBAAGjggGnMIIBozAdBgNVHQ4EFgQU2op4jdYM9pDaFxLra/sHryTwgWgwHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgeAMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvMC9DNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybDA8BggrBgEFBQcBAQQwMC4wLAYIKwYBBQUHMAKGIHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvdGEuY2VyMGQGCCsGAQUFBwELBFgwVjBUBggrBgEFBQcwC4ZIcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby90YS8wL0M0ODkzRUMyNTUzMEYyRUFERkM5NkU4OUY0NzZEQTEzMDA4MDFBQTcubWZ0MBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwIQYIKwYBBQUHAQcBAf8EEjAQMAYEAgABBQAwBgQCAAIFADAVBggrBgEFBQcBCAEB/wQGMASgAgUAMA0GCSqGSIb3DQEBCwUAA4IBAQB1tDki+FVdqH93M6O4OC5AA7ZUFDD+nZ9BVTYPbEUMP9Y0mfZk8c8DER6bMNqq3ufTQtDdswfgtnCB6FmVxlmBOmzISfPKSKeBUmLnU0XAKGV7stNgKYkzxaErPnImk87IPuQsSOR4KOpK498ap8AnZWx405UmjeWSPHG9khPu80T+DLvQ9rB39J6LicFx/IqNlAlUNXfWjdzy50yIDB8/UdYVVh3scTNGmgYHbgcM1ySJqvum3ew6Gj4dXCe6OXGdNVVlTLUmJF/VQSCVqz/Z3iXVnjRvi4MgdUD1ceDPMXgGhDUT9PepPBQ9poCs5ghxsTsLoafb8IlEsrQxMYnxMYIBrDCCAagCAQOAFNqKeI3WDPaQ2hcS62v7B68k8IFoMA0GCWCGSAFlAwQCAQUAoGswGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEaMBwGCSqGSIb3DQEJBTEPFw0yMTAzMjIxMDQ0MzdaMC8GCSqGSIb3DQEJBDEiBCCiRUY5oZdYYojj/u15RnxBR9OtuHzOk0JBaF1o1RNf/jANBgkqhkiG9w0BAQEFAASCAQBR5mZ42xRhiHoCbowXfOGDhNlI0yZORoYMflXOPAB2f8o7qTWyELqBkQAHlwMrW/n58E31DDzOqEur//hpHTLnlVEI/zlMTmBFhzAitydkrNfVpBC/YBq1lpsdRVSKJCBNFZqlovJWqga5NEzKBxV8ZpvgWXj5FMSffEm/MGI8cafbUzb/CqVkqbc68pTqaYWeLAsJPkFJ4P12YGJFlOB6XbjsRLXgl96ll6v8cJMqblaovZuMrgYy4TjhLWtd+Sq9JzkokxZtk8egQTrAO6f8DvLOMFc0r5XXIY7HI2xEZaZRiHYGwDr89EYatmVtElRh8qP+s7XohKkmuQ4UmQtM",
"serial": "318316505773253361497376874909930893181779793730",
"expires": "2021-03-23T10:44:37.325554418Z"
},
"next_update": "2021-03-23T10:44:37.325554418Z",
"old": null
},
"crl_info": {
"name": "C4893EC25530F2EADFC96E89F476DA1300801AA7.crl",
"current": {
"content": "MIIDrDCCApQCAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEXDTIxMDMyMjEwMzkzN1oXDTIxMDMyMzEwNDQzN1owAKAvMC0wHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwCgYDVR0UBAMCAQEwDQYJKoZIhvcNAQELBQADggEBABgK5J0tzDkE5jEVM1ILweNX4M63xmsrNayCO0EcDFb9YG122JpSIgOAHClP3PBTLvruzmdkqJRDekjlOzmqc2UMLYhbiCHxgM+XkBJWB1hF/2LHNIBACDT3UpRHnXOinCqnuJipHLrhcote9woXIR26rdCdD72oTCGO60VRqtc70k3BSaVs1m+g4P5P652lEfm/QWM1XBlqUS9v9yngDLX6jA6mQbd/a4t2qSmrtK/gURygzW9i3FslFSDOMym+4m4Z0Vlogb9nnx9/cc4WJkHSK9A2Ndjng87+lJCFUfEVXkR16rwfKyE0ZOov9T6FF4M/6MrtQbggSi/oKW77GCU=",
"serial": "1",
"expires": "2021-03-23T10:44:37.323206844Z"
},
"old": null
}
},
"request": null
},
{
"ca_repo": "rsync://localhost/repo/ta/0",
"added": [
{
"name": "C4893EC25530F2EADFC96E89F476DA1300801AA7.mft",
"object": {
"content": "MIILEgYJKoZIhvcNAQcCoIILAzCCCv8CAQMxDzANBglghkgBZQMEAgEFADCBmwYLKoZIhvcNAQkQARqggYsEgYgwgYUCAQEYDzIwMjEwMzIyMTAzOTM3WhgPMjAyMTAzMjMxMDQ0MzdaBglghkgBZQMEAgEwUzBRFixDNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybAMhAHJnKKbuB0LrBDf1T/n/bAUWodqM5jbVDG/Mx8N7/wMZoIIImTCCCJUwggd9oAMCAQICFDfBzkfGXhvS2scWcSwWvSc8JVdCMA0GCSqGSIb3DQEBCwUAMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQkFBRTdCRTkyQkZGNjU2MEUyMjAxOUFEMTY1M0RFMjQ2RjI5Q0FFNDVCMURGNzMwNDU1MjY5NzhGNUUzODhFMTM0OTJGQ0VCOTg4NUI0MDBGOEY1MTE1MEE0QjlGRjkwMzdBQTU3NjkyM0FCQTA4OTA3Mzc4RTQ5QUU2NkJBMjEzRTZFNzEzMjVCMjlEMzg4OEMxOUZGNEFCRERDQkI1RUJBQ0U2NDQwRkRFOTYyOUNCODlEOTkyRjlCRDkwN0VGNEZFNkVFNjM4NzA2NTNBNEQ5NjU4NUNFNTczMzlDNzIzQkY0ODJERDZBQzIzQjhEQUM2N0M5RTBDRjlCMDUyRjlEM0RDNjc0M0YzNTk0NzU0QTA1OUQwNDc2MzM1NDM2MkIyMjU2NzYyNzMxOUIwRUYyOEQ2MEExQjA3OTM4NkI4QkMwRTcyQjhGM0U1NDU4MkMxQzhGMzNFMEU4MzM1OEE2RDAwQUQ5MTAxRDY5QTBBNDVBQjg4RjEwNEY3OTUyRUEzRkRFQTJCM0ZCMUQzNkJBMUM2NjJGMDQ0RjFEODc3NzA0ODBEMzc4M0RBMDcyOUUzQzUxNTdGMDk5RjVFQzBDRkUwMkRFODQ5NDI3RkEyMDRBRjJBMzgxMUVBMTMzNUZFQUMxM0RBRUU0M0U3Q0UzQkQzQjE0Q0RGNTdDRTMwMjAzMDEwMDAxMB4XDTIxMDMyMjEwMzkzN1oXDTIxMDMyOTEwNDQzN1owggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDA5RTZFNUQ5MzJERTk5MjNENTY5NEVGQjM5Mjg5RTRDMjM5QTk4NkM0RUQwRjBGQ0FBRTgwQkIxODJGRTZBQkFDQTNDNDBDNzQ2NEE1MEY3RjQxQTZDMTM5MTcyMEY5MjVFMjcwNjI1QTI2REMyQjE5NTJCNjdGQUY1RTYyNkI3MENENEE1REQyMTE4MDMxRTJEQjExRjJEOUQ5QkE3NzY2NUM3RUJGNkY2Njc0MzE3RDVGQUMwNUQxNzQxQkRBN0Y3QTMzMEU0NUU2RjU4REFCQTdEMjU2MkI3OUZBNUYwRkJGNTY5OTU3OUNFNUJGNjE1NUNFMzhGRjAwRDhBMjRCRjNGNzdFQjM1NjMzMEUwQjIxNjhBQUYyMTkyQUZEREY4Q0MwQTMzMDAyNTJBMzQxRDBBQ0Y3OUEyNkM1MTk4NzQ1RkM4M0ZBMEJCRkU5NEYxRkJERDhBMzhEQUU0QjI2MDczODkxRjkyMDUxNDExQUZBRjMwREYxOTY0MTJFOEI0RjE1NjBDMjM3MzhBQjc4NDQ1OEREQzExN0I5MzFGMkFFNTQzMzZERjUyNjQ3NzUwRTVFQkE5QkU0MjdEQkI5RkVDQTFFMjAzNkFDM0MwQzkwMzcwQ0I2NTYxMEFGNTRFRDkwRjU2NkE1NTg3OUY4MzJFNTk4MTg2MjcwNEU4NTAyMDMwMTAwMDEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCebl2TLemSPVaU77OSieTCOamGxO0PD8qugLsYL+arrKPEDHRkpQ9/QabBORcg+SXicGJaJtwrGVK2f69eYmtwzUpd0hGAMeLbEfLZ2bp3Zlx+v29mdDF9X6wF0XQb2n96Mw5F5vWNq6fSVit5+l8Pv1aZV5zlv2FVzjj/ANiiS/P3frNWMw4LIWiq8hkq/d+MwKMwAlKjQdCs95omxRmHRfyD+gu/6U8fvdijja5LJgc4kfkgUUEa+vMN8ZZBLotPFWDCNzireERY3cEXuTHyrlQzbfUmR3UOXrqb5Cfbuf7KHiA2rDwMkDcMtlYQr1TtkPVmpVh5+DLlmBhicE6FAgMBAAGjggGnMIIBozAdBgNVHQ4EFgQU2op4jdYM9pDaFxLra/sHryTwgWgwHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgeAMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvMC9DNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybDA8BggrBgEFBQcBAQQwMC4wLAYIKwYBBQUHMAKGIHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvdGEuY2VyMGQGCCsGAQUFBwELBFgwVjBUBggrBgEFBQcwC4ZIcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby90YS8wL0M0ODkzRUMyNTUzMEYyRUFERkM5NkU4OUY0NzZEQTEzMDA4MDFBQTcubWZ0MBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwIQYIKwYBBQUHAQcBAf8EEjAQMAYEAgABBQAwBgQCAAIFADAVBggrBgEFBQcBCAEB/wQGMASgAgUAMA0GCSqGSIb3DQEBCwUAA4IBAQB1tDki+FVdqH93M6O4OC5AA7ZUFDD+nZ9BVTYPbEUMP9Y0mfZk8c8DER6bMNqq3ufTQtDdswfgtnCB6FmVxlmBOmzISfPKSKeBUmLnU0XAKGV7stNgKYkzxaErPnImk87IPuQsSOR4KOpK498ap8AnZWx405UmjeWSPHG9khPu80T+DLvQ9rB39J6LicFx/IqNlAlUNXfWjdzy50yIDB8/UdYVVh3scTNGmgYHbgcM1ySJqvum3ew6Gj4dXCe6OXGdNVVlTLUmJF/VQSCVqz/Z3iXVnjRvi4MgdUD1ceDPMXgGhDUT9PepPBQ9poCs5ghxsTsLoafb8IlEsrQxMYnxMYIBrDCCAagCAQOAFNqKeI3WDPaQ2hcS62v7B68k8IFoMA0GCWCGSAFlAwQCAQUAoGswGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEaMBwGCSqGSIb3DQEJBTEPFw0yMTAzMjIxMDQ0MzdaMC8GCSqGSIb3DQEJBDEiBCCiRUY5oZdYYojj/u15RnxBR9OtuHzOk0JBaF1o1RNf/jANBgkqhkiG9w0BAQEFAASCAQBR5mZ42xRhiHoCbowXfOGDhNlI0yZORoYMflXOPAB2f8o7qTWyELqBkQAHlwMrW/n58E31DDzOqEur//hpHTLnlVEI/zlMTmBFhzAitydkrNfVpBC/YBq1lpsdRVSKJCBNFZqlovJWqga5NEzKBxV8ZpvgWXj5FMSffEm/MGI8cafbUzb/CqVkqbc68pTqaYWeLAsJPkFJ4P12YGJFlOB6XbjsRLXgl96ll6v8cJMqblaovZuMrgYy4TjhLWtd+Sq9JzkokxZtk8egQTrAO6f8DvLOMFc0r5XXIY7HI2xEZaZRiHYGwDr89EYatmVtElRh8qP+s7XohKkmuQ4UmQtM",
"serial": "318316505773253361497376874909930893181779793730",
"expires": "2021-03-23T10:44:37.325554418Z"
}
},
{
"name": "C4893EC25530F2EADFC96E89F476DA1300801AA7.crl",
"object": {
"content": "MIIDrDCCApQCAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEXDTIxMDMyMjEwMzkzN1oXDTIxMDMyMzEwNDQzN1owAKAvMC0wHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwCgYDVR0UBAMCAQEwDQYJKoZIhvcNAQELBQADggEBABgK5J0tzDkE5jEVM1ILweNX4M63xmsrNayCO0EcDFb9YG122JpSIgOAHClP3PBTLvruzmdkqJRDekjlOzmqc2UMLYhbiCHxgM+XkBJWB1hF/2LHNIBACDT3UpRHnXOinCqnuJipHLrhcote9woXIR26rdCdD72oTCGO60VRqtc70k3BSaVs1m+g4P5P652lEfm/QWM1XBlqUS9v9yngDLX6jA6mQbd/a4t2qSmrtK/gURygzW9i3FslFSDOMym+4m4Z0Vlogb9nnx9/cc4WJkHSK9A2Ndjng87+lJCFUfEVXkR16rwfKyE0ZOov9T6FF4M/6MrtQbggSi/oKW77GCU=",
"serial": "1",
"expires": "2021-03-23T10:44:37.323206844Z"
}
}
],
"updated": [],
"withdrawn": []
}
]
}
}
test-resources/migrations/v0_6_0/cas/ta/delta-4.json
-18
View File
@@ -1,18 +0,0 @@
{
"id": "ta",
"version": 4,
"details": {
"child_added": [
"ca",
{
"id_cert": null,
"resources": {
"asn": "",
"v4": "192.168.0.0/16",
"v6": ""
},
"used_keys": {}
}
]
}
}
test-resources/migrations/v0_6_0/cas/ta/delta-5.json
-11
View File
@@ -1,11 +0,0 @@
{
"id": "ta",
"version": 5,
"details": {
"child_certificate_issued": [
"ca",
"0",
"B497A5F1E84F9089F5F51A899725A7C5B076E03F"
]
}
}
test-resources/migrations/v0_6_0/cas/ta/delta-6.json
-29
View File
@@ -1,29 +0,0 @@
{
"id": "ta",
"version": 6,
"details": {
"child_certificates_updated": [
"0",
{
"issued": [
{
"uri": "rsync://localhost/repo/ta/0/B497A5F1E84F9089F5F51A899725A7C5B076E03F.cer",
"limit": {
"asn": "none",
"v4": "none",
"v6": "none"
},
"resource_set": {
"asn": "",
"v4": "192.168.0.0/16",
"v6": ""
},
"cert": "MIIG9zCCBd+gAwIBAgIUW3EzhNrQB9M65JrZLCAteneQF68wDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEwHhcNMjEwMzIyMTA1MzU4WhcNMjIwMzIyMTA1ODU4WjAzMTEwLwYDVQQDEyhCNDk3QTVGMUU4NEY5MDg5RjVGNTFBODk5NzI1QTdDNUIwNzZFMDNGMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5bhcVJrttIMsGwYCELCbLtsuH93eTa6F7G2rg5GwddHhJZnWPCKcw5ja0yqpNor5SYzGeqcTsebPoZuzVRG+akS/0IitmH/Uf1YBOk7b8BiAwiotZzlTk+4ZROL56wRhnWtU6JjghBplmMA3yDPWuGabgySRBAU7KyLocILEgnQWKk49P40BUU7mqOEi9dCX9DoRSptNXeBUVG8lWrcC3HH5gGYVxKE+rhxaHz2ncyVC9lLnO6ciLHEzh3xVbQQ5btW+xWvoQHCsUHKyLBBfu0BnqnPE3XM1YKTGj9Srllz4IT4EQXCMyalgu8VsMGLzAex3Q4pksLeUBB0LjLpfWwIDAQABo4ICBTCCAgEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUtJel8ehPkIn19RqJlyWnxbB24D8wHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgEGMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvMC9DNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybDA8BggrBgEFBQcBAQQwMC4wLAYIKwYBBQUHMAKGIHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvdGEuY2VyMIHKBggrBgEFBQcBCwSBvTCBujAoBggrBgEFBQcwBYYccnN5bmM6Ly9sb2NhbGhvc3QvcmVwby9jYS8wLzBUBggrBgEFBQcwCoZIcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby9jYS8wL0I0OTdBNUYxRTg0RjkwODlGNUY1MUE4OTk3MjVBN0M1QjA3NkUwM0YubWZ0MDgGCCsGAQUFBzANhixodHRwczovL2xvY2FsaG9zdDozMDAwL3JyZHAvbm90aWZpY2F0aW9uLnhtbDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMB4GCCsGAQUFBwEHAQH/BA8wDTALBAIAATAFAwMAwKgwDQYJKoZIhvcNAQELBQADggEBAHRBAYyA6gnl0jrTbHYwo3e9Q+2HJfbu4AHrAPMA+o5clSnhSDKJCOKD6hsRZFV8YrvfmZdQmmq8nL3WMFDva3h4LcHIrd0D/gC+Nio6t3zPXInxlCIzMq10Z0Cr8uPIlMe/LFZunQ4zZDGxi0PyeEqMJhgzi/499/HDo2lf/PhvseQEohv7ZT08C1SdMrw9u+eY3TklZrfOen8OPEuWy5AY7uoq4sWDV/rjavZTRL7HcPpwr69DehsAQ34sddhB6PxUkCN01+eh8AOvU+MBKQlXPsx5vxybIHQXJ2aTSq7wVMs8L5TOLRfKIKIshVLHbYBDopRZwTyZ5fO3bGfSvdM=",
"replaces": null
}
],
"removed": []
}
]
}
}
test-resources/migrations/v0_6_0/cas/ta/delta-7.json
-76
View File
@@ -1,76 +0,0 @@
{
"id": "ta",
"version": 7,
"details": {
"object_set_updated": [
"0",
{
"C4893EC25530F2EADFC96E89F476DA1300801AA7": {
"number": 2,
"revocations_delta": {
"added": [
{
"serial": "318316505773253361497376874909930893181779793730",
"expires": "2021-03-23T10:44:37.325554418Z"
}
],
"dropped": []
},
"manifest_info": {
"name": "C4893EC25530F2EADFC96E89F476DA1300801AA7.mft",
"current": {
"content": "MIILZgYJKoZIhvcNAQcCoIILVzCCC1MCAQMxDzANBglghkgBZQMEAgEFADCB7wYLKoZIhvcNAQkQARqggd8EgdwwgdkCAQIYDzIwMjEwMzIyMTA1MzU4WhgPMjAyMTAzMjMxMDU4NThaBglghkgBZQMEAgEwgaYwURYsQjQ5N0E1RjFFODRGOTA4OUY1RjUxQTg5OTcyNUE3QzVCMDc2RTAzRi5jZXIDIQD8rAuHZJPCHtQuVNDK0AskEfT5qw9ToAZx3TbjO7dgDzBRFixDNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybAMhAPHqG2D4BIaeWMJL/VyaoOFH9n4M/1n/OGFY4+7AezProIIImTCCCJUwggd9oAMCAQICFHH8lccA/ws5Cj24vTliDVEsskQJMA0GCSqGSIb3DQEBCwUAMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQkFBRTdCRTkyQkZGNjU2MEUyMjAxOUFEMTY1M0RFMjQ2RjI5Q0FFNDVCMURGNzMwNDU1MjY5NzhGNUUzODhFMTM0OTJGQ0VCOTg4NUI0MDBGOEY1MTE1MEE0QjlGRjkwMzdBQTU3NjkyM0FCQTA4OTA3Mzc4RTQ5QUU2NkJBMjEzRTZFNzEzMjVCMjlEMzg4OEMxOUZGNEFCRERDQkI1RUJBQ0U2NDQwRkRFOTYyOUNCODlEOTkyRjlCRDkwN0VGNEZFNkVFNjM4NzA2NTNBNEQ5NjU4NUNFNTczMzlDNzIzQkY0ODJERDZBQzIzQjhEQUM2N0M5RTBDRjlCMDUyRjlEM0RDNjc0M0YzNTk0NzU0QTA1OUQwNDc2MzM1NDM2MkIyMjU2NzYyNzMxOUIwRUYyOEQ2MEExQjA3OTM4NkI4QkMwRTcyQjhGM0U1NDU4MkMxQzhGMzNFMEU4MzM1OEE2RDAwQUQ5MTAxRDY5QTBBNDVBQjg4RjEwNEY3OTUyRUEzRkRFQTJCM0ZCMUQzNkJBMUM2NjJGMDQ0RjFEODc3NzA0ODBEMzc4M0RBMDcyOUUzQzUxNTdGMDk5RjVFQzBDRkUwMkRFODQ5NDI3RkEyMDRBRjJBMzgxMUVBMTMzNUZFQUMxM0RBRUU0M0U3Q0UzQkQzQjE0Q0RGNTdDRTMwMjAzMDEwMDAxMB4XDTIxMDMyMjEwNTM1OFoXDTIxMDMyOTEwNTg1OFowggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBBNEQyNTRBQTlERDUyMUUzREE4RTZDMjU2NkJFMDU1QjM0QTIzMDk0QTMxOTc3RUZBMDkyOUFFOTY2MkY2M0IwNDdGRDJGNzA0QTRCMjdERkUyMTI5N0IyQUY0NDZEOEVDRTQxRjIwRDY3RkVCODMzQTI5NTI3OEUzQUM5QkRDQ0VGM0UwQkU2QUU3Qjk2MTIzQkI4MzYzQ0I3MkZCQ0M3MEY5NDAwOEZDOTdCQzYxQTYwRUIzRjdEMjkzOUQ5QkVGRjI2NEE4MDg4NzJFMDhFMjZBQjExOTIwQjUxM0NBNTdGQjJGMzFBODBFRTVDMjU2Q0QzRTI2OTBFNEUwNjBEOUI3NzQyOUI2RDM5NkRDMzdDNUI4MzA5RThFQjQ1OUE2QzRBMjgzQTE4ODlERTY3NDVFRTcyNTQwRTk3QkQ0NjgwQUUxNDMwNTQ5QzBCMzE0N0RGOEFDNThCMjVBN0M1MERCRDI5Q0M4RDg1NkFFMkMyMzI4MDk5MkNBMzc3QzJCRDEwQzhGMzNBOUIzMEU5QjNENDZDNkY5QjkyNEQzRjU5Njc5RTI4REI5RTQ1M0FDMTI1QUYyRTBERjRCRjdEQjJDMzMzNTEzMDdBMEZGMjZBMTJDQzc1OEI5NThFQUE2MTAzQTI2OUY1NjkwNUEyMDA5N0RGMTc2MEE0QjAzRDAyMDMwMTAwMDEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCk0lSqndUh49qObCVmvgVbNKIwlKMZd++gkprpZi9jsEf9L3BKSyff4hKXsq9EbY7OQfINZ/64M6KVJ446yb3M7z4L5q57lhI7uDY8ty+8xw+UAI/Je8YaYOs/fSk52b7/JkqAiHLgjiarEZILUTylf7LzGoDuXCVs0+JpDk4GDZt3QpttOW3DfFuDCejrRZpsSig6GIneZ0XuclQOl71GgK4UMFScCzFH34rFiyWnxQ29KcyNhWriwjKAmSyjd8K9EMjzOpsw6bPUbG+bkk0/WWeeKNueRTrBJa8uDfS/fbLDM1Eweg/yahLMdYuVjqphA6Jp9WkFogCX3xdgpLA9AgMBAAGjggGnMIIBozAdBgNVHQ4EFgQUWhArhmNo+WekTJSJoXrVRxlzqCAwHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgeAMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvMC9DNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybDA8BggrBgEFBQcBAQQwMC4wLAYIKwYBBQUHMAKGIHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvdGEuY2VyMGQGCCsGAQUFBwELBFgwVjBUBggrBgEFBQcwC4ZIcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby90YS8wL0M0ODkzRUMyNTUzMEYyRUFERkM5NkU4OUY0NzZEQTEzMDA4MDFBQTcubWZ0MBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwIQYIKwYBBQUHAQcBAf8EEjAQMAYEAgABBQAwBgQCAAIFADAVBggrBgEFBQcBCAEB/wQGMASgAgUAMA0GCSqGSIb3DQEBCwUAA4IBAQCJZVtnjUJvd4MyyLmghVDOQHkqW9ttQ4nw0biccw8S7KbGZN9188+1xTiZWGUFLuG7GnyxC9Flm+JBvQVd3B1dtUL6LRySDxLgOvQB2qdPuRXvk+srNkPHQZe9vx70JFp3XTTTvuERpr7v6PKy3CTilyjsrgrqg2+AEqckNLqOaSOQc0QgwvGaS/Edy02MtKZ18VUjKsehLNo9GYhdpM2UdkBPancS+KIMYHwAxJpfwzS6ni69JS7LnsGTpXk1GesYZkol5ia+BJGA0/s451wkINS1TkwuU0/bI0hweaI5B2sIBjFKhOCETdG5E8XYe7yHDzVd3qPhtgF+giMMXdMxMYIBrDCCAagCAQOAFFoQK4ZjaPlnpEyUiaF61UcZc6ggMA0GCWCGSAFlAwQCAQUAoGswGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEaMBwGCSqGSIb3DQEJBTEPFw0yMTAzMjIxMDU4NThaMC8GCSqGSIb3DQEJBDEiBCBPdP7+1xa9OwfmH0UpzNAQEhfoC32bFGqGHWbae1xyPjANBgkqhkiG9w0BAQEFAASCAQBNp5YjdmGTHp7gDx+OJaJXnSUvynW83eY2PnWEEaIf9VxV/3Xf5OI5H4IVtyXTeyjt77JpK1FVxLPTMmmBEWiLlyhe/9CVnSLnS1N7WkxlHQJzzmLDV1cALJZafK89BhDntde47gNg25WAybStQpsqsJV+9JcfSnffuLTFlBc33pa1eZVSfutWo2zzS2nbVtwv7sD/3J1hRRxxb8GEhSLkY37MOGFWdGCFv7QLhoO1JqVKrKo5PQbE/SZ392r2hv0DOcKLAxJXWU81u3mP8bRQdalcmCNOniwxGZN/n7PHTrt5ErpNpNBGltXgT0D+tD+sdHayqoDSHY2cIele1O17",
"serial": "650748792341242696138123586874381430911663227913",
"expires": "2021-03-23T10:58:58.687824581Z"
},
"next_update": "2021-03-23T10:58:58.687824581Z",
"old": "23fc516d7659e4286b792f13eef161e64510af4dcdac5c63c933a84c17fa42d0"
},
"crl_info": {
"name": "C4893EC25530F2EADFC96E89F476DA1300801AA7.crl",
"current": {
"content": "MIID0zCCArsCAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEXDTIxMDMyMjEwNTM1OFoXDTIxMDMyMzEwNTg1OFowJzAlAhQ3wc5Hxl4b0trHFnEsFr0nPCVXQhcNMjEwMzIzMTA0NDM3WqAvMC0wHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwCgYDVR0UBAMCAQIwDQYJKoZIhvcNAQELBQADggEBAHQTC61pRLu2S6YQUsikPVMeIrab74avyKeew62hXetiEnZss8YLqRXeXdujUG09UT2VgRWjvnHeSRTDbjordp9oGEIQ1BTl/lGjM+TZ0+UWlkZ2HUp2Vx5k75xz3z9v1/F3mkerXedFiq9xKOF3OYzrGGop/Xrzx7TuqLC+edCV9+3g52m6e/A+lps74e5VCqCODOu/cNpbxyVoSTm/jTKZOq4taPw8DFv64h8aLUUVLlp+IRMPJEidlgrahLKbOaO7C9ZA9CGn8Ifh4uBlcCY8+hTfDAgQbMJAUk/ggoJOgkCHqC/IDXdWEYZ2wvBuCcNFLFzySSdM5fL0KNwAlU0=",
"serial": "2",
"expires": "2021-03-23T10:58:58.685222924Z"
},
"old": "726728a6ee0742eb0437f54ff9ff6c0516a1da8ce636d50c6fccc7c37bff0319"
},
"objects_delta": {
"ca_repo": "rsync://localhost/repo/ta/0",
"added": [
{
"name": "B497A5F1E84F9089F5F51A899725A7C5B076E03F.cer",
"object": {
"content": "MIIG9zCCBd+gAwIBAgIUW3EzhNrQB9M65JrZLCAteneQF68wDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEwHhcNMjEwMzIyMTA1MzU4WhcNMjIwMzIyMTA1ODU4WjAzMTEwLwYDVQQDEyhCNDk3QTVGMUU4NEY5MDg5RjVGNTFBODk5NzI1QTdDNUIwNzZFMDNGMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5bhcVJrttIMsGwYCELCbLtsuH93eTa6F7G2rg5GwddHhJZnWPCKcw5ja0yqpNor5SYzGeqcTsebPoZuzVRG+akS/0IitmH/Uf1YBOk7b8BiAwiotZzlTk+4ZROL56wRhnWtU6JjghBplmMA3yDPWuGabgySRBAU7KyLocILEgnQWKk49P40BUU7mqOEi9dCX9DoRSptNXeBUVG8lWrcC3HH5gGYVxKE+rhxaHz2ncyVC9lLnO6ciLHEzh3xVbQQ5btW+xWvoQHCsUHKyLBBfu0BnqnPE3XM1YKTGj9Srllz4IT4EQXCMyalgu8VsMGLzAex3Q4pksLeUBB0LjLpfWwIDAQABo4ICBTCCAgEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUtJel8ehPkIn19RqJlyWnxbB24D8wHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgEGMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvMC9DNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybDA8BggrBgEFBQcBAQQwMC4wLAYIKwYBBQUHMAKGIHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvdGEuY2VyMIHKBggrBgEFBQcBCwSBvTCBujAoBggrBgEFBQcwBYYccnN5bmM6Ly9sb2NhbGhvc3QvcmVwby9jYS8wLzBUBggrBgEFBQcwCoZIcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby9jYS8wL0I0OTdBNUYxRTg0RjkwODlGNUY1MUE4OTk3MjVBN0M1QjA3NkUwM0YubWZ0MDgGCCsGAQUFBzANhixodHRwczovL2xvY2FsaG9zdDozMDAwL3JyZHAvbm90aWZpY2F0aW9uLnhtbDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMB4GCCsGAQUFBwEHAQH/BA8wDTALBAIAATAFAwMAwKgwDQYJKoZIhvcNAQELBQADggEBAHRBAYyA6gnl0jrTbHYwo3e9Q+2HJfbu4AHrAPMA+o5clSnhSDKJCOKD6hsRZFV8YrvfmZdQmmq8nL3WMFDva3h4LcHIrd0D/gC+Nio6t3zPXInxlCIzMq10Z0Cr8uPIlMe/LFZunQ4zZDGxi0PyeEqMJhgzi/499/HDo2lf/PhvseQEohv7ZT08C1SdMrw9u+eY3TklZrfOen8OPEuWy5AY7uoq4sWDV/rjavZTRL7HcPpwr69DehsAQ34sddhB6PxUkCN01+eh8AOvU+MBKQlXPsx5vxybIHQXJ2aTSq7wVMs8L5TOLRfKIKIshVLHbYBDopRZwTyZ5fO3bGfSvdM=",
"serial": "522042632287110169996588701447052353597938341807",
"expires": "2022-03-22T10:58:58Z"
}
}
],
"updated": [
{
"name": "C4893EC25530F2EADFC96E89F476DA1300801AA7.crl",
"object": {
"content": "MIID0zCCArsCAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEXDTIxMDMyMjEwNTM1OFoXDTIxMDMyMzEwNTg1OFowJzAlAhQ3wc5Hxl4b0trHFnEsFr0nPCVXQhcNMjEwMzIzMTA0NDM3WqAvMC0wHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwCgYDVR0UBAMCAQIwDQYJKoZIhvcNAQELBQADggEBAHQTC61pRLu2S6YQUsikPVMeIrab74avyKeew62hXetiEnZss8YLqRXeXdujUG09UT2VgRWjvnHeSRTDbjordp9oGEIQ1BTl/lGjM+TZ0+UWlkZ2HUp2Vx5k75xz3z9v1/F3mkerXedFiq9xKOF3OYzrGGop/Xrzx7TuqLC+edCV9+3g52m6e/A+lps74e5VCqCODOu/cNpbxyVoSTm/jTKZOq4taPw8DFv64h8aLUUVLlp+IRMPJEidlgrahLKbOaO7C9ZA9CGn8Ifh4uBlcCY8+hTfDAgQbMJAUk/ggoJOgkCHqC/IDXdWEYZ2wvBuCcNFLFzySSdM5fL0KNwAlU0=",
"serial": "2",
"expires": "2021-03-23T10:58:58.685222924Z"
},
"old": "726728a6ee0742eb0437f54ff9ff6c0516a1da8ce636d50c6fccc7c37bff0319"
},
{
"name": "C4893EC25530F2EADFC96E89F476DA1300801AA7.mft",
"object": {
"content": "MIILZgYJKoZIhvcNAQcCoIILVzCCC1MCAQMxDzANBglghkgBZQMEAgEFADCB7wYLKoZIhvcNAQkQARqggd8EgdwwgdkCAQIYDzIwMjEwMzIyMTA1MzU4WhgPMjAyMTAzMjMxMDU4NThaBglghkgBZQMEAgEwgaYwURYsQjQ5N0E1RjFFODRGOTA4OUY1RjUxQTg5OTcyNUE3QzVCMDc2RTAzRi5jZXIDIQD8rAuHZJPCHtQuVNDK0AskEfT5qw9ToAZx3TbjO7dgDzBRFixDNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybAMhAPHqG2D4BIaeWMJL/VyaoOFH9n4M/1n/OGFY4+7AezProIIImTCCCJUwggd9oAMCAQICFHH8lccA/ws5Cj24vTliDVEsskQJMA0GCSqGSIb3DQEBCwUAMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQkFBRTdCRTkyQkZGNjU2MEUyMjAxOUFEMTY1M0RFMjQ2RjI5Q0FFNDVCMURGNzMwNDU1MjY5NzhGNUUzODhFMTM0OTJGQ0VCOTg4NUI0MDBGOEY1MTE1MEE0QjlGRjkwMzdBQTU3NjkyM0FCQTA4OTA3Mzc4RTQ5QUU2NkJBMjEzRTZFNzEzMjVCMjlEMzg4OEMxOUZGNEFCRERDQkI1RUJBQ0U2NDQwRkRFOTYyOUNCODlEOTkyRjlCRDkwN0VGNEZFNkVFNjM4NzA2NTNBNEQ5NjU4NUNFNTczMzlDNzIzQkY0ODJERDZBQzIzQjhEQUM2N0M5RTBDRjlCMDUyRjlEM0RDNjc0M0YzNTk0NzU0QTA1OUQwNDc2MzM1NDM2MkIyMjU2NzYyNzMxOUIwRUYyOEQ2MEExQjA3OTM4NkI4QkMwRTcyQjhGM0U1NDU4MkMxQzhGMzNFMEU4MzM1OEE2RDAwQUQ5MTAxRDY5QTBBNDVBQjg4RjEwNEY3OTUyRUEzRkRFQTJCM0ZCMUQzNkJBMUM2NjJGMDQ0RjFEODc3NzA0ODBEMzc4M0RBMDcyOUUzQzUxNTdGMDk5RjVFQzBDRkUwMkRFODQ5NDI3RkEyMDRBRjJBMzgxMUVBMTMzNUZFQUMxM0RBRUU0M0U3Q0UzQkQzQjE0Q0RGNTdDRTMwMjAzMDEwMDAxMB4XDTIxMDMyMjEwNTM1OFoXDTIxMDMyOTEwNTg1OFowggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBBNEQyNTRBQTlERDUyMUUzREE4RTZDMjU2NkJFMDU1QjM0QTIzMDk0QTMxOTc3RUZBMDkyOUFFOTY2MkY2M0IwNDdGRDJGNzA0QTRCMjdERkUyMTI5N0IyQUY0NDZEOEVDRTQxRjIwRDY3RkVCODMzQTI5NTI3OEUzQUM5QkRDQ0VGM0UwQkU2QUU3Qjk2MTIzQkI4MzYzQ0I3MkZCQ0M3MEY5NDAwOEZDOTdCQzYxQTYwRUIzRjdEMjkzOUQ5QkVGRjI2NEE4MDg4NzJFMDhFMjZBQjExOTIwQjUxM0NBNTdGQjJGMzFBODBFRTVDMjU2Q0QzRTI2OTBFNEUwNjBEOUI3NzQyOUI2RDM5NkRDMzdDNUI4MzA5RThFQjQ1OUE2QzRBMjgzQTE4ODlERTY3NDVFRTcyNTQwRTk3QkQ0NjgwQUUxNDMwNTQ5QzBCMzE0N0RGOEFDNThCMjVBN0M1MERCRDI5Q0M4RDg1NkFFMkMyMzI4MDk5MkNBMzc3QzJCRDEwQzhGMzNBOUIzMEU5QjNENDZDNkY5QjkyNEQzRjU5Njc5RTI4REI5RTQ1M0FDMTI1QUYyRTBERjRCRjdEQjJDMzMzNTEzMDdBMEZGMjZBMTJDQzc1OEI5NThFQUE2MTAzQTI2OUY1NjkwNUEyMDA5N0RGMTc2MEE0QjAzRDAyMDMwMTAwMDEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCk0lSqndUh49qObCVmvgVbNKIwlKMZd++gkprpZi9jsEf9L3BKSyff4hKXsq9EbY7OQfINZ/64M6KVJ446yb3M7z4L5q57lhI7uDY8ty+8xw+UAI/Je8YaYOs/fSk52b7/JkqAiHLgjiarEZILUTylf7LzGoDuXCVs0+JpDk4GDZt3QpttOW3DfFuDCejrRZpsSig6GIneZ0XuclQOl71GgK4UMFScCzFH34rFiyWnxQ29KcyNhWriwjKAmSyjd8K9EMjzOpsw6bPUbG+bkk0/WWeeKNueRTrBJa8uDfS/fbLDM1Eweg/yahLMdYuVjqphA6Jp9WkFogCX3xdgpLA9AgMBAAGjggGnMIIBozAdBgNVHQ4EFgQUWhArhmNo+WekTJSJoXrVRxlzqCAwHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgeAMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvMC9DNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybDA8BggrBgEFBQcBAQQwMC4wLAYIKwYBBQUHMAKGIHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvdGEuY2VyMGQGCCsGAQUFBwELBFgwVjBUBggrBgEFBQcwC4ZIcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby90YS8wL0M0ODkzRUMyNTUzMEYyRUFERkM5NkU4OUY0NzZEQTEzMDA4MDFBQTcubWZ0MBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwIQYIKwYBBQUHAQcBAf8EEjAQMAYEAgABBQAwBgQCAAIFADAVBggrBgEFBQcBCAEB/wQGMASgAgUAMA0GCSqGSIb3DQEBCwUAA4IBAQCJZVtnjUJvd4MyyLmghVDOQHkqW9ttQ4nw0biccw8S7KbGZN9188+1xTiZWGUFLuG7GnyxC9Flm+JBvQVd3B1dtUL6LRySDxLgOvQB2qdPuRXvk+srNkPHQZe9vx70JFp3XTTTvuERpr7v6PKy3CTilyjsrgrqg2+AEqckNLqOaSOQc0QgwvGaS/Edy02MtKZ18VUjKsehLNo9GYhdpM2UdkBPancS+KIMYHwAxJpfwzS6ni69JS7LnsGTpXk1GesYZkol5ia+BJGA0/s451wkINS1TkwuU0/bI0hweaI5B2sIBjFKhOCETdG5E8XYe7yHDzVd3qPhtgF+giMMXdMxMYIBrDCCAagCAQOAFFoQK4ZjaPlnpEyUiaF61UcZc6ggMA0GCWCGSAFlAwQCAQUAoGswGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEaMBwGCSqGSIb3DQEJBTEPFw0yMTAzMjIxMDU4NThaMC8GCSqGSIb3DQEJBDEiBCBPdP7+1xa9OwfmH0UpzNAQEhfoC32bFGqGHWbae1xyPjANBgkqhkiG9w0BAQEFAASCAQBNp5YjdmGTHp7gDx+OJaJXnSUvynW83eY2PnWEEaIf9VxV/3Xf5OI5H4IVtyXTeyjt77JpK1FVxLPTMmmBEWiLlyhe/9CVnSLnS1N7WkxlHQJzzmLDV1cALJZafK89BhDntde47gNg25WAybStQpsqsJV+9JcfSnffuLTFlBc33pa1eZVSfutWo2zzS2nbVtwv7sD/3J1hRRxxb8GEhSLkY37MOGFWdGCFv7QLhoO1JqVKrKo5PQbE/SZ392r2hv0DOcKLAxJXWU81u3mP8bRQdalcmCNOniwxGZN/n7PHTrt5ErpNpNBGltXgT0D+tD+sdHayqoDSHY2cIele1O17",
"serial": "650748792341242696138123586874381430911663227913",
"expires": "2021-03-23T10:58:58.687824581Z"
},
"old": "23fc516d7659e4286b792f13eef161e64510af4dcdac5c63c933a84c17fa42d0"
}
],
"withdrawn": []
}
}
}
]
}
}
test-resources/migrations/v0_6_0/cas/ta/delta-8.json
-11
View File
@@ -1,11 +0,0 @@
{
"id": "ta",
"version": 8,
"details": {
"child_certificate_issued": [
"ca",
"0",
"9F50CE97A62D7420ECB0E76400B4D00A9FF80837"
]
}
}
test-resources/migrations/v0_6_0/cas/ta/delta-9.json
-29
View File
@@ -1,29 +0,0 @@
{
"id": "ta",
"version": 9,
"details": {
"child_certificates_updated": [
"0",
{
"issued": [
{
"uri": "rsync://localhost/repo/ta/0/9F50CE97A62D7420ECB0E76400B4D00A9FF80837.cer",
"limit": {
"asn": "none",
"v4": "none",
"v6": "none"
},
"resource_set": {
"asn": "",
"v4": "192.168.0.0/16",
"v6": ""
},
"cert": "MIIG9zCCBd+gAwIBAgIUbxupwYqnAX4cy0ub1ggDn4onxlgwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEwHhcNMjEwMzIyMTA1NjA0WhcNMjIwMzIyMTEwMTA0WjAzMTEwLwYDVQQDEyg5RjUwQ0U5N0E2MkQ3NDIwRUNCMEU3NjQwMEI0RDAwQTlGRjgwODM3MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr+c5o3kod88LphtXU6UAzmAnrCunhrJvEh2ojXC3bWCska09Nq90ntSQNTWHJZmrzAYMKHHGX4L+0VLoyKB/cFMH5uFNWPFn2gcg/a9Gp9SLCrr2BLF8cCziobX70kZAYsVc9yF+uElE6drCQrmTuXiiQiPFjG+zClC68EuomQW6NPyX6IzLnlM+X3wHKQpmUyFuJNBDonUZfjRDtv1SiHVaAg45Gx2Fent1C+/pveBnv1HiZLolpykwglw9xytCniW/h7j6HPDatn645szN4OVpYd2b4SGrOr8qEEQXo0i6HW2MtO/4C3aR3jwut/LsTTHOVaXdTiqSC+96zXggFQIDAQABo4ICBTCCAgEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUn1DOl6YtdCDssOdkALTQCp/4CDcwHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgEGMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvMC9DNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybDA8BggrBgEFBQcBAQQwMC4wLAYIKwYBBQUHMAKGIHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvdGEuY2VyMIHKBggrBgEFBQcBCwSBvTCBujAoBggrBgEFBQcwBYYccnN5bmM6Ly9sb2NhbGhvc3QvcmVwby9jYS8wLzBUBggrBgEFBQcwCoZIcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby9jYS8wLzlGNTBDRTk3QTYyRDc0MjBFQ0IwRTc2NDAwQjREMDBBOUZGODA4MzcubWZ0MDgGCCsGAQUFBzANhixodHRwczovL2xvY2FsaG9zdDozMDAwL3JyZHAvbm90aWZpY2F0aW9uLnhtbDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMB4GCCsGAQUFBwEHAQH/BA8wDTALBAIAATAFAwMAwKgwDQYJKoZIhvcNAQELBQADggEBAIlVqENjjP6omOtNzq1l2ctP1zcREBQpHgZwDOB9eZ407Re4iY4DcDwLKCFWvI7W0oqGJcIWB5r/Yqevhi4rGinwRewmggfYQYkeXg++27PYbPBN/m5GmKewCIMFnityDDVUj7t+728LUR3q177LP7jZttwHAWI09IKOT8IsP5Zi7NwIPBLK/RlS9RpX2ASkBZk9LAECljBGaYrD/PZZJ84b5nufOY5DJ/5lhJWG0E9Hm19uwS7wTnT4R4CL0hgghYUzaxtMhHW84Zmxa/N5sjY9Del7cOfnl4+/6GQ04jauo77Jr55n+AoRLh5mYUdt7VratdCsJwJjMm5hMj74xeM=",
"replaces": null
}
],
"removed": []
}
]
}
}
test-resources/migrations/v0_6_0/cas/ta/info.json
-6
View File
@@ -1,6 +0,0 @@
{
"snapshot_version": 11,
"last_event": 11,
"last_command": 6,
"last_update": "2021-03-22T11:01:04.899126536Z"
}
test-resources/migrations/v0_6_0/cas/ta/snapshot.json
-149
View File
@@ -1,149 +0,0 @@
{
"handle": "ta",
"version": 11,
"id": {
"key": "47B37867569D650DFDB6DCC3A639FE2F75A1F8CD",
"cert": "MIIDPDCCAiSgAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyg0N0IzNzg2NzU2OUQ2NTBERkRCNkRDQzNBNjM5RkUyRjc1QTFGOENEMCAXDTIxMDMyMjEwMzkzN1oYDzIxMjEwMzIyMTA0NDM3WjAzMTEwLwYDVQQDEyg0N0IzNzg2NzU2OUQ2NTBERkRCNkRDQzNBNjM5RkUyRjc1QTFGOENEMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlak6G+3yuf8zkX9vAua+qRNYHHVjA7BaTh+nrurCznq3ogwg/Y/5RC6/19BAz0uiK5CaWUiFSi8qC2tul168yQD15l1jzix7A6n224HmgJaYtInVZ4mohQtUaUD8INvQj81t3uaD1xYOEbBqKwdwYl7JPoMCLtzta7yKOxzCTmpuVjUy0nw7vydY4WTCixmO3n/bEOIBn63WcPAkxwPrCklgwcmYHqwnJ1au3aE6OUCElasIsL/TLS/r3mRlVup8NW3CM+lkP2BVBbJWSmm6n4WJXjFSMf4FuR82n1yfmNea4Dk2R68APNviqbNv1FQEo0grrcTc3DcTHTuoWArmdwIDAQABo1kwVzAPBgNVHRMBAf8EBTADAQH/MCAGA1UdDgEBAAQWBBRHs3hnVp1lDf223MOmOf4vdaH4zTAiBgNVHSMBAQAEGDAWgBRHs3hnVp1lDf223MOmOf4vdaH4zTANBgkqhkiG9w0BAQsFAAOCAQEATT2pJ8ssOAlNFpvkxYQ867ocvpC1/e61e4e1qkesTuGSp7QpEXL3cJP5DIprdqdKhrBH9PjGcGH2OoNlSX6K7zEGy9mxnuAIqtnnf+fJCyDfk1kH9Ru8rcVyVjg//tkV5hoxYeTJSEMROMw630JK/1KWiRi3VOZ/aLHBxO/bk8OulX2X3L810JZbx5wpuO7VfTglRO2LA8FtCf12zp98qcSa6RVbDUCAnY4E/aj9ZV1aMthzkwD6BWhy5yXdwIrjDeY4oy53FHXeaF35d/mL+lpYJ1XmKM0Z3cJ52L2fyW2l/vZZYBFYFqzzYqapWjbZGpWMSNt55Lk+oMfTA39DaQ=="
},
"repository": {
"embedded": {
"base_uri": "rsync://localhost/repo/ta/",
"rpki_notify": "https://localhost:3000/rrdp/notification.xml"
}
},
"repository_pending_withdraw": null,
"parents": {
"ta": {
"ta": {
"cert": "MIIIZjCCB06gAwIBAgIUSoqhtx5bgtaf8sRtp/ZeXbmH8SwwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEwIBcNMjEwMzIyMTAzOTM3WhgPMjEyMTAzMjIxMDQ0MzdaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQkFBRTdCRTkyQkZGNjU2MEUyMjAxOUFEMTY1M0RFMjQ2RjI5Q0FFNDVCMURGNzMwNDU1MjY5NzhGNUUzODhFMTM0OTJGQ0VCOTg4NUI0MDBGOEY1MTE1MEE0QjlGRjkwMzdBQTU3NjkyM0FCQTA4OTA3Mzc4RTQ5QUU2NkJBMjEzRTZFNzEzMjVCMjlEMzg4OEMxOUZGNEFCRERDQkI1RUJBQ0U2NDQwRkRFOTYyOUNCODlEOTkyRjlCRDkwN0VGNEZFNkVFNjM4NzA2NTNBNEQ5NjU4NUNFNTczMzlDNzIzQkY0ODJERDZBQzIzQjhEQUM2N0M5RTBDRjlCMDUyRjlEM0RDNjc0M0YzNTk0NzU0QTA1OUQwNDc2MzM1NDM2MkIyMjU2NzYyNzMxOUIwRUYyOEQ2MEExQjA3OTM4NkI4QkMwRTcyQjhGM0U1NDU4MkMxQzhGMzNFMEU4MzM1OEE2RDAwQUQ5MTAxRDY5QTBBNDVBQjg4RjEwNEY3OTUyRUEzRkRFQTJCM0ZCMUQzNkJBMUM2NjJGMDQ0RjFEODc3NzA0ODBEMzc4M0RBMDcyOUUzQzUxNTdGMDk5RjVFQzBDRkUwMkRFODQ5NDI3RkEyMDRBRjJBMzgxMUVBMTMzNUZFQUMxM0RBRUU0M0U3Q0UzQkQzQjE0Q0RGNTdDRTMwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuq576Sv/ZWDiIBmtFlPeJG8pyuRbHfcwRVJpePXjiOE0kvzrmIW0APj1EVCkuf+QN6pXaSOroIkHN45Jrma6IT5ucTJbKdOIjBn/Sr3cu166zmRA/elinLidmS+b2QfvT+buY4cGU6TZZYXOVzOccjv0gt1qwjuNrGfJ4M+bBS+dPcZ0PzWUdUoFnQR2M1Q2KyJWdicxmw7yjWChsHk4a4vA5yuPPlRYLByPM+DoM1im0ArZEB1poKRauI8QT3lS6j/eorP7HTa6HGYvBE8dh3cEgNN4PaBynjxRV/CZ9ewM/gLehJQn+iBK8qOBHqEzX+rBPa7kPnzjvTsUzfV84wIDAQABo4IBdjCCAXIwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgEGMIHJBggrBgEFBQcBCwSBvDCBuTAnBggrBgEFBQcwBYYbcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby90YS8wMFQGCCsGAQUFBzAKhkhyc3luYzovL2xvY2FsaG9zdC9yZXBvL3RhLzAvQzQ4OTNFQzI1NTMwRjJFQURGQzk2RTg5RjQ3NkRBMTMwMDgwMUFBNy5tZnQwOAYIKwYBBQUHMA2GLGh0dHBzOi8vbG9jYWxob3N0OjMwMDAvcnJkcC9ub3RpZmljYXRpb24ueG1sMBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwJwYIKwYBBQUHAQcBAf8EGDAWMAkEAgABMAMDAQAwCQQCAAIwAwMBADAhBggrBgEFBQcBCAEB/wQSMBCgDjAMMAoCAQACBQD/////MA0GCSqGSIb3DQEBCwUAA4IBAQB+onQ8rAvdp73fjkOGCOP8/wvOAoFtUg1rrsc5EhgU1qh3CjjCE+ILlIv6wHLjBeBUP4UamgbafH/DXiaIqY+sID+HLQBrOZfKMQwEZxXNWXmEgqK+4e52Y+wWEEbnxg+0QfiYTrtz06apG4/BLUThshX6nIv5lnIaR3daelGunx89KlNWOOl+5tZOnkim0g4OgBv914Hg/SumT7t4Z9l2+UyMpnM9C5gmroCUMxT121YRucVqmRD4/aWqNu2ihZInKVNuXsxzWtSn33etYIjJD4KrsqEJQLydBWraxDQwo63a/b4lRaIgjIz64ihREfc5xd+av3+hfMT/u9dMrB88",
"resources": {
"asn": "AS0-AS4294967295",
"v4": "0.0.0.0/0",
"v6": "::/0"
},
"tal": {
"uris": [
"https://localhost:3000/ta/ta.cer"
],
"encoded_ski": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuq576Sv/ZWDiIBmtFlPeJG8pyuRbHfcwRVJpePXjiOE0kvzrmIW0APj1EVCkuf+QN6pXaSOroIkHN45Jrma6IT5ucTJbKdOIjBn/Sr3cu166zmRA/elinLidmS+b2QfvT+buY4cGU6TZZYXOVzOccjv0gt1qwjuNrGfJ4M+bBS+dPcZ0PzWUdUoFnQR2M1Q2KyJWdicxmw7yjWChsHk4a4vA5yuPPlRYLByPM+DoM1im0ArZEB1poKRauI8QT3lS6j/eorP7HTa6HGYvBE8dh3cEgNN4PaBynjxRV/CZ9ewM/gLehJQn+iBK8qOBHqEzX+rBPa7kPnzjvTsUzfV84wIDAQAB"
}
}
}
},
"next_class_name": 1,
"resources": {
"0": {
"name": "0",
"name_space": "0",
"parent_handle": "ta",
"parent_rc_name": "0",
"roas": {
"inner": {}
},
"certificates": {
"inner": {
"9F50CE97A62D7420ECB0E76400B4D00A9FF80837": {
"uri": "rsync://localhost/repo/ta/0/9F50CE97A62D7420ECB0E76400B4D00A9FF80837.cer",
"limit": {
"asn": "none",
"v4": "none",
"v6": "none"
},
"resource_set": {
"asn": "",
"v4": "192.168.0.0/16",
"v6": ""
},
"cert": "MIIG9zCCBd+gAwIBAgIUbxupwYqnAX4cy0ub1ggDn4onxlgwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEwHhcNMjEwMzIyMTA1NjA0WhcNMjIwMzIyMTEwMTA0WjAzMTEwLwYDVQQDEyg5RjUwQ0U5N0E2MkQ3NDIwRUNCMEU3NjQwMEI0RDAwQTlGRjgwODM3MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr+c5o3kod88LphtXU6UAzmAnrCunhrJvEh2ojXC3bWCska09Nq90ntSQNTWHJZmrzAYMKHHGX4L+0VLoyKB/cFMH5uFNWPFn2gcg/a9Gp9SLCrr2BLF8cCziobX70kZAYsVc9yF+uElE6drCQrmTuXiiQiPFjG+zClC68EuomQW6NPyX6IzLnlM+X3wHKQpmUyFuJNBDonUZfjRDtv1SiHVaAg45Gx2Fent1C+/pveBnv1HiZLolpykwglw9xytCniW/h7j6HPDatn645szN4OVpYd2b4SGrOr8qEEQXo0i6HW2MtO/4C3aR3jwut/LsTTHOVaXdTiqSC+96zXggFQIDAQABo4ICBTCCAgEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUn1DOl6YtdCDssOdkALTQCp/4CDcwHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgEGMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvMC9DNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybDA8BggrBgEFBQcBAQQwMC4wLAYIKwYBBQUHMAKGIHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvdGEuY2VyMIHKBggrBgEFBQcBCwSBvTCBujAoBggrBgEFBQcwBYYccnN5bmM6Ly9sb2NhbGhvc3QvcmVwby9jYS8wLzBUBggrBgEFBQcwCoZIcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby9jYS8wLzlGNTBDRTk3QTYyRDc0MjBFQ0IwRTc2NDAwQjREMDBBOUZGODA4MzcubWZ0MDgGCCsGAQUFBzANhixodHRwczovL2xvY2FsaG9zdDozMDAwL3JyZHAvbm90aWZpY2F0aW9uLnhtbDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMB4GCCsGAQUFBwEHAQH/BA8wDTALBAIAATAFAwMAwKgwDQYJKoZIhvcNAQELBQADggEBAIlVqENjjP6omOtNzq1l2ctP1zcREBQpHgZwDOB9eZ407Re4iY4DcDwLKCFWvI7W0oqGJcIWB5r/Yqevhi4rGinwRewmggfYQYkeXg++27PYbPBN/m5GmKewCIMFnityDDVUj7t+728LUR3q177LP7jZttwHAWI09IKOT8IsP5Zi7NwIPBLK/RlS9RpX2ASkBZk9LAECljBGaYrD/PZZJ84b5nufOY5DJ/5lhJWG0E9Hm19uwS7wTnT4R4CL0hgghYUzaxtMhHW84Zmxa/N5sjY9Del7cOfnl4+/6GQ04jauo77Jr55n+AoRLh5mYUdt7VratdCsJwJjMm5hMj74xeM=",
"replaces": null
},
"B497A5F1E84F9089F5F51A899725A7C5B076E03F": {
"uri": "rsync://localhost/repo/ta/0/B497A5F1E84F9089F5F51A899725A7C5B076E03F.cer",
"limit": {
"asn": "none",
"v4": "none",
"v6": "none"
},
"resource_set": {
"asn": "",
"v4": "192.168.0.0/16",
"v6": ""
},
"cert": "MIIG9zCCBd+gAwIBAgIUW3EzhNrQB9M65JrZLCAteneQF68wDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEwHhcNMjEwMzIyMTA1MzU4WhcNMjIwMzIyMTA1ODU4WjAzMTEwLwYDVQQDEyhCNDk3QTVGMUU4NEY5MDg5RjVGNTFBODk5NzI1QTdDNUIwNzZFMDNGMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5bhcVJrttIMsGwYCELCbLtsuH93eTa6F7G2rg5GwddHhJZnWPCKcw5ja0yqpNor5SYzGeqcTsebPoZuzVRG+akS/0IitmH/Uf1YBOk7b8BiAwiotZzlTk+4ZROL56wRhnWtU6JjghBplmMA3yDPWuGabgySRBAU7KyLocILEgnQWKk49P40BUU7mqOEi9dCX9DoRSptNXeBUVG8lWrcC3HH5gGYVxKE+rhxaHz2ncyVC9lLnO6ciLHEzh3xVbQQ5btW+xWvoQHCsUHKyLBBfu0BnqnPE3XM1YKTGj9Srllz4IT4EQXCMyalgu8VsMGLzAex3Q4pksLeUBB0LjLpfWwIDAQABo4ICBTCCAgEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUtJel8ehPkIn19RqJlyWnxbB24D8wHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgEGMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvMC9DNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybDA8BggrBgEFBQcBAQQwMC4wLAYIKwYBBQUHMAKGIHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvdGEuY2VyMIHKBggrBgEFBQcBCwSBvTCBujAoBggrBgEFBQcwBYYccnN5bmM6Ly9sb2NhbGhvc3QvcmVwby9jYS8wLzBUBggrBgEFBQcwCoZIcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby9jYS8wL0I0OTdBNUYxRTg0RjkwODlGNUY1MUE4OTk3MjVBN0M1QjA3NkUwM0YubWZ0MDgGCCsGAQUFBzANhixodHRwczovL2xvY2FsaG9zdDozMDAwL3JyZHAvbm90aWZpY2F0aW9uLnhtbDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMB4GCCsGAQUFBwEHAQH/BA8wDTALBAIAATAFAwMAwKgwDQYJKoZIhvcNAQELBQADggEBAHRBAYyA6gnl0jrTbHYwo3e9Q+2HJfbu4AHrAPMA+o5clSnhSDKJCOKD6hsRZFV8YrvfmZdQmmq8nL3WMFDva3h4LcHIrd0D/gC+Nio6t3zPXInxlCIzMq10Z0Cr8uPIlMe/LFZunQ4zZDGxi0PyeEqMJhgzi/499/HDo2lf/PhvseQEohv7ZT08C1SdMrw9u+eY3TklZrfOen8OPEuWy5AY7uoq4sWDV/rjavZTRL7HcPpwr69DehsAQ34sddhB6PxUkCN01+eh8AOvU+MBKQlXPsx5vxybIHQXJ2aTSq7wVMs8L5TOLRfKIKIshVLHbYBDopRZwTyZ5fO3bGfSvdM=",
"replaces": null
}
}
},
"last_key_change": "2021-03-22T11:47:33.961617073Z",
"key_state": {
"active": {
"key_id": "C4893EC25530F2EADFC96E89F476DA1300801AA7",
"incoming_cert": {
"cert": "MIIIZjCCB06gAwIBAgIUSoqhtx5bgtaf8sRtp/ZeXbmH8SwwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEwIBcNMjEwMzIyMTAzOTM3WhgPMjEyMTAzMjIxMDQ0MzdaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQkFBRTdCRTkyQkZGNjU2MEUyMjAxOUFEMTY1M0RFMjQ2RjI5Q0FFNDVCMURGNzMwNDU1MjY5NzhGNUUzODhFMTM0OTJGQ0VCOTg4NUI0MDBGOEY1MTE1MEE0QjlGRjkwMzdBQTU3NjkyM0FCQTA4OTA3Mzc4RTQ5QUU2NkJBMjEzRTZFNzEzMjVCMjlEMzg4OEMxOUZGNEFCRERDQkI1RUJBQ0U2NDQwRkRFOTYyOUNCODlEOTkyRjlCRDkwN0VGNEZFNkVFNjM4NzA2NTNBNEQ5NjU4NUNFNTczMzlDNzIzQkY0ODJERDZBQzIzQjhEQUM2N0M5RTBDRjlCMDUyRjlEM0RDNjc0M0YzNTk0NzU0QTA1OUQwNDc2MzM1NDM2MkIyMjU2NzYyNzMxOUIwRUYyOEQ2MEExQjA3OTM4NkI4QkMwRTcyQjhGM0U1NDU4MkMxQzhGMzNFMEU4MzM1OEE2RDAwQUQ5MTAxRDY5QTBBNDVBQjg4RjEwNEY3OTUyRUEzRkRFQTJCM0ZCMUQzNkJBMUM2NjJGMDQ0RjFEODc3NzA0ODBEMzc4M0RBMDcyOUUzQzUxNTdGMDk5RjVFQzBDRkUwMkRFODQ5NDI3RkEyMDRBRjJBMzgxMUVBMTMzNUZFQUMxM0RBRUU0M0U3Q0UzQkQzQjE0Q0RGNTdDRTMwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuq576Sv/ZWDiIBmtFlPeJG8pyuRbHfcwRVJpePXjiOE0kvzrmIW0APj1EVCkuf+QN6pXaSOroIkHN45Jrma6IT5ucTJbKdOIjBn/Sr3cu166zmRA/elinLidmS+b2QfvT+buY4cGU6TZZYXOVzOccjv0gt1qwjuNrGfJ4M+bBS+dPcZ0PzWUdUoFnQR2M1Q2KyJWdicxmw7yjWChsHk4a4vA5yuPPlRYLByPM+DoM1im0ArZEB1poKRauI8QT3lS6j/eorP7HTa6HGYvBE8dh3cEgNN4PaBynjxRV/CZ9ewM/gLehJQn+iBK8qOBHqEzX+rBPa7kPnzjvTsUzfV84wIDAQABo4IBdjCCAXIwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgEGMIHJBggrBgEFBQcBCwSBvDCBuTAnBggrBgEFBQcwBYYbcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby90YS8wMFQGCCsGAQUFBzAKhkhyc3luYzovL2xvY2FsaG9zdC9yZXBvL3RhLzAvQzQ4OTNFQzI1NTMwRjJFQURGQzk2RTg5RjQ3NkRBMTMwMDgwMUFBNy5tZnQwOAYIKwYBBQUHMA2GLGh0dHBzOi8vbG9jYWxob3N0OjMwMDAvcnJkcC9ub3RpZmljYXRpb24ueG1sMBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwJwYIKwYBBQUHAQcBAf8EGDAWMAkEAgABMAMDAQAwCQQCAAIwAwMBADAhBggrBgEFBQcBCAEB/wQSMBCgDjAMMAoCAQACBQD/////MA0GCSqGSIb3DQEBCwUAA4IBAQB+onQ8rAvdp73fjkOGCOP8/wvOAoFtUg1rrsc5EhgU1qh3CjjCE+ILlIv6wHLjBeBUP4UamgbafH/DXiaIqY+sID+HLQBrOZfKMQwEZxXNWXmEgqK+4e52Y+wWEEbnxg+0QfiYTrtz06apG4/BLUThshX6nIv5lnIaR3daelGunx89KlNWOOl+5tZOnkim0g4OgBv914Hg/SumT7t4Z9l2+UyMpnM9C5gmroCUMxT121YRucVqmRD4/aWqNu2ihZInKVNuXsxzWtSn33etYIjJD4KrsqEJQLydBWraxDQwo63a/b4lRaIgjIz64ihREfc5xd+av3+hfMT/u9dMrB88",
"uri": "rsync://localhost/repo/ta/ta.cer",
"resources": {
"asn": "AS0-AS4294967295",
"v4": "0.0.0.0/0",
"v6": "::/0"
}
},
"current_set": {
"number": 3,
"revocations": [
{
"serial": "318316505773253361497376874909930893181779793730",
"expires": "2021-03-23T10:44:37.325554418Z"
},
{
"serial": "650748792341242696138123586874381430911663227913",
"expires": "2021-03-23T10:58:58.687824581Z"
}
],
"manifest_info": {
"name": "C4893EC25530F2EADFC96E89F476DA1300801AA7.mft",
"current": {
"content": "MIILvQYJKoZIhvcNAQcCoIILrjCCC6oCAQMxDzANBglghkgBZQMEAgEFADCCAUUGCyqGSIb3DQEJEAEaoIIBNASCATAwggEsAgEDGA8yMDIxMDMyMjEwNTYwNFoYDzIwMjEwMzIzMTEwMTA0WgYJYIZIAWUDBAIBMIH5MFEWLEI0OTdBNUYxRTg0RjkwODlGNUY1MUE4OTk3MjVBN0M1QjA3NkUwM0YuY2VyAyEA/KwLh2STwh7ULlTQytALJBH0+asPU6AGcd024zu3YA8wURYsOUY1MENFOTdBNjJENzQyMEVDQjBFNzY0MDBCNEQwMEE5RkY4MDgzNy5jZXIDIQDuE+o5+KS8SZyHLMsS316ecsy4x8NLD9At1+PN94pJPjBRFixDNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybAMhAJ+kJjmEoMd/eccfTBRE+yWHRntWs+Vv1Ed84xw9PpakoIIImTCCCJUwggd9oAMCAQICFEboVEprFEo3FpMdjXV7STXBBFZQMA0GCSqGSIb3DQEBCwUAMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQkFBRTdCRTkyQkZGNjU2MEUyMjAxOUFEMTY1M0RFMjQ2RjI5Q0FFNDVCMURGNzMwNDU1MjY5NzhGNUUzODhFMTM0OTJGQ0VCOTg4NUI0MDBGOEY1MTE1MEE0QjlGRjkwMzdBQTU3NjkyM0FCQTA4OTA3Mzc4RTQ5QUU2NkJBMjEzRTZFNzEzMjVCMjlEMzg4OEMxOUZGNEFCRERDQkI1RUJBQ0U2NDQwRkRFOTYyOUNCODlEOTkyRjlCRDkwN0VGNEZFNkVFNjM4NzA2NTNBNEQ5NjU4NUNFNTczMzlDNzIzQkY0ODJERDZBQzIzQjhEQUM2N0M5RTBDRjlCMDUyRjlEM0RDNjc0M0YzNTk0NzU0QTA1OUQwNDc2MzM1NDM2MkIyMjU2NzYyNzMxOUIwRUYyOEQ2MEExQjA3OTM4NkI4QkMwRTcyQjhGM0U1NDU4MkMxQzhGMzNFMEU4MzM1OEE2RDAwQUQ5MTAxRDY5QTBBNDVBQjg4RjEwNEY3OTUyRUEzRkRFQTJCM0ZCMUQzNkJBMUM2NjJGMDQ0RjFEODc3NzA0ODBEMzc4M0RBMDcyOUUzQzUxNTdGMDk5RjVFQzBDRkUwMkRFODQ5NDI3RkEyMDRBRjJBMzgxMUVBMTMzNUZFQUMxM0RBRUU0M0U3Q0UzQkQzQjE0Q0RGNTdDRTMwMjAzMDEwMDAxMB4XDTIxMDMyMjEwNTYwNFoXDTIxMDMyOTExMDEwNFowggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBBREExQTVGOThERDA4MUIxQjZDRjE2RTc4NjhCNThCRUEzOTNENzY2NUJDMzJDQjU1OEU3M0UzRTAyQzUzMzQ3NTNEMzAyNzM4RjQ1RjYyQUMzNTkwNThCNDVGRkE4Njc2MUU1QUQ3MjFDODEyRDkyMEE0NTY4NEY4Mjg0MjkwNTU5Qjk1OUVCMUI1MUUwNDNBQjdGQzA1ODk2ODNCQ0VBQ0YxRTEwMDBENTY2NDg2NUY3NDNFRDY4QjJFNTZDMUVFNjhENUVCNTQwMkNEODhERUIwRTVBODlEMjFGMzYwRDg4QjA3MjJCOEJDNTRDQzIwOTExOERDNjI5OUY3NEY1OURBQjhBMUIzMkFEQUUxNTc5OEEyNUU1QTlBOTgyQzgxMTMyRjczMkQ3QTQxQkFFMEJDRTc2NzkxNzYzNjZFMThBRDMzQjU5NzY0REYzOEZGMkIzRTZCMThEN0U0NDU5RkE2RTc3RkI2N0IzOEU1NkFEQjA4RERDMDRGRjBFM0VGMzQzQUVFRkM4MTA4QTk3NzkyOENGRkU0MkQ1QzE1OEUxOEEyRkZEODY4M0YzNURBOUY3QUIzMUIyNzkyMEY5MDQ4RTExMDg2QkM3OERGNzlFRjdFMTA2RDY3N0JDNUM2NDQ2ODM3MDVBNUM4MzhCNzVGRkY0NTAyQjY4RTY5QjAyMDMwMTAwMDEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCtoaX5jdCBsbbPFueGi1i+o5PXZlvDLLVY5z4+AsUzR1PTAnOPRfYqw1kFi0X/qGdh5a1yHIEtkgpFaE+ChCkFWblZ6xtR4EOrf8BYloO86s8eEADVZkhl90PtaLLlbB7mjV61QCzYjesOWonSHzYNiLByK4vFTMIJEY3GKZ909Z2rihsyra4VeYol5ampgsgRMvcy16QbrgvOdnkXY2bhitM7WXZN84/ys+axjX5EWfpud/tns45WrbCN3AT/Dj7zQ67vyBCKl3koz/5C1cFY4Yov/YaD812p96sxsnkg+QSOEQhrx433nvfhBtZ3vFxkRoNwWlyDi3X/9FAraOabAgMBAAGjggGnMIIBozAdBgNVHQ4EFgQUdDlnon3qbCwJZxbiRwvbSWwxLZYwHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgeAMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvMC9DNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybDA8BggrBgEFBQcBAQQwMC4wLAYIKwYBBQUHMAKGIHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvdGEuY2VyMGQGCCsGAQUFBwELBFgwVjBUBggrBgEFBQcwC4ZIcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby90YS8wL0M0ODkzRUMyNTUzMEYyRUFERkM5NkU4OUY0NzZEQTEzMDA4MDFBQTcubWZ0MBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwIQYIKwYBBQUHAQcBAf8EEjAQMAYEAgABBQAwBgQCAAIFADAVBggrBgEFBQcBCAEB/wQGMASgAgUAMA0GCSqGSIb3DQEBCwUAA4IBAQAgUixAEeQXqALJSFKa7jAv6c9eIuQzDdNhebaFzWO/2cnVaxEmzn/EpnRsTabEInZAx0ZGspRepI3aK4Ep0Vo727vihPfKiQri9DyC2xRNAvox6zwtuO71q4NPJcgdlCvjOd4kdT/ZwM/rnuVXgY7BwMLGC6Hnuagrv6LIMpwFXKkctcakS0mYfxm4FyvLNB3a7Ju2foZ4YyrzY4prrUiSDwyaPJnrKwTDTROAvAZ1sbIoOuGp0W8gT1uzminc2r6XrqF8jV8J/5KMm2RaxaIEoJdMiXTXNoV+nLKZFHX+BxCLS/Hq6hw74+OIIibtYX572fSEaKXxjiX2R9k4CmQDMYIBrDCCAagCAQOAFHQ5Z6J96mwsCWcW4kcL20lsMS2WMA0GCWCGSAFlAwQCAQUAoGswGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEaMBwGCSqGSIb3DQEJBTEPFw0yMTAzMjIxMTAxMDRaMC8GCSqGSIb3DQEJBDEiBCDEEBgzS5y6sSFLuZNAkiNicoTA/wvzqUDDFT9IOCU51DANBgkqhkiG9w0BAQEFAASCAQCJNOz8cq7l1tx+mckCMOAmduwKuDWs3TVRLfLvTJlCvNkYVUdZFtYmgmJFmj00SvL08iPbcVcMGqtR8qJ5Vtx5vmtjdQMQ+Jj6U2d3cSikmdG7WXH1fg6Gi+AqXbksFg0aAg4TgcQfcxK35sE8IyMs0HS7H4SOxOskiirngrkPhf8QY5mk132Xl+YMLPGMsDsgxGVKMt1/qfxCYvtqQskRo21sHBPCJtW8eWnpaDAkD93cM2zIYNS6Cq4ijF2IsNb2+pxb94vSnz8pXt8eR59ezjVQ2Xc2atI7Coqjy1cj0jYQXl4XU0P5ngEQvq/mYhjiygq0hpUPuzHL5wJ7W/uM",
"serial": "404810469598974038024323796113457425902295340624",
"expires": "2021-03-23T11:01:04.907150446Z"
},
"next_update": "2021-03-23T11:01:04.907150446Z",
"old": "63b69931826fc885a00c30a653a0530b3e85e8cd051b4d56891360aa9ba04a72"
},
"crl_info": {
"name": "C4893EC25530F2EADFC96E89F476DA1300801AA7.crl",
"current": {
"content": "MIID+jCCAuICAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEXDTIxMDMyMjEwNTYwNFoXDTIxMDMyMzExMDEwNFowTjAlAhQ3wc5Hxl4b0trHFnEsFr0nPCVXQhcNMjEwMzIzMTA0NDM3WjAlAhRx/JXHAP8LOQo9uL05Yg1RLLJECRcNMjEwMzIzMTA1ODU4WqAvMC0wHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwCgYDVR0UBAMCAQMwDQYJKoZIhvcNAQELBQADggEBAHjpd5YJjNYJ/EuWwrmtltaI0U4ySKEJsf07cKCqICjiqnN2Sxvos2cTFxsDw8EdvAfqVyzpU68Zym4EjQxoUxTdsKQkuughKbaZEZi8C8E7sUmS6IoZH/KtYtxGl+dV3SCHf4gORS5ZFEtk84QVKy70MGy5WBjkZCNTWvZ2ZQ6HR8EoBKuqRH8SVXRbXWFWlPYF+X6ZewaMBMSG8XjIeUDYRXG0tJ4h8xnXemR3JGP4WX+wXCQ6Q6aJMOo2TCIU9Jo+rv47BsqSghcgVheFHrewEpeM/ecvuIp7RnJ5ILguBX7K6CD8ngtFZ/U0055qi+R51kRI2HivBAE+Rryouoc=",
"serial": "3",
"expires": "2021-03-23T11:01:04.903319261Z"
},
"old": "f1ea1b60f804869e58c24bfd5c9aa0e147f67e0cff59ff386158e3eec07b33eb"
}
},
"request": null
}
}
}
},
"children": {
"ca": {
"id_cert": null,
"resources": {
"asn": "",
"v4": "192.168.0.0/16",
"v6": ""
},
"used_keys": {
"B497A5F1E84F9089F5F51A899725A7C5B076E03F": {
"current": "0"
},
"9F50CE97A62D7420ECB0E76400B4D00A9FF80837": {
"current": "0"
}
}
}
},
"routes": {
"map": {}
},
"phantom_signer": null
}
test-resources/migrations/v0_8_1/cas/ta/command--1610030922--1--cmd-ca-repo-update.json
-15
View File
@@ -1,15 +0,0 @@
{
"actor": "krill",
"time": "2021-01-07T14:48:42.036604Z",
"handle": "ta",
"version": 1,
"sequence": 1,
"details": {
"repo_update": null
},
"effect": {
"events": [
1
]
}
}
test-resources/migrations/v0_8_1/cas/ta/command--1610030922--2--cmd-ca-make-ta.json
-13
View File
@@ -1,13 +0,0 @@
{
"actor": "krill",
"time": "2021-01-07T14:48:42.038141Z",
"handle": "ta",
"version": 2,
"sequence": 2,
"details": "make_trust_anchor",
"effect": {
"events": [
2
]
}
}
test-resources/migrations/v0_8_1/cas/ta/command--1610030922--3--cmd-ca-rcn-receive.json
-22
View File
@@ -1,22 +0,0 @@
{
"actor": "krill",
"time": "2021-01-07T14:48:42.206675Z",
"handle": "ta",
"version": 3,
"sequence": 3,
"details": {
"update_rcvd_cert": [
"0",
{
"asn": "AS0-AS4294967295",
"v4": "0.0.0.0/0",
"v6": "::/0"
}
]
},
"effect": {
"events": [
3
]
}
}
test-resources/migrations/v0_8_1/cas/ta/command--1610030922--4--cmd-ca-child-add.json
-23
View File
@@ -1,23 +0,0 @@
{
"actor": "krill",
"time": "2021-01-07T14:48:42.421518Z",
"handle": "ta",
"version": 4,
"sequence": 4,
"details": {
"child_add": [
"testbed",
"C27EAEB707CEA225FC5B54EF0AE5B88FA47D2D3A",
{
"asn": "AS0-AS4294967295",
"v4": "0.0.0.0/0",
"v6": "::/0"
}
]
},
"effect": {
"events": [
4
]
}
}
test-resources/migrations/v0_8_1/cas/ta/command--1610030924--5--cmd-ca-child-certify.json
-26
View File
@@ -1,26 +0,0 @@
{
"actor": "anonymous",
"time": "2021-01-07T14:48:44.276202Z",
"handle": "ta",
"version": 5,
"sequence": 5,
"details": {
"child_certify": [
"testbed",
"0",
{
"asn": "none",
"v4": "none",
"v6": "none"
},
"578C2EF4CFC1810860F52DC0D86530B1176FAE2B"
]
},
"effect": {
"events": [
5,
6,
7
]
}
}
test-resources/migrations/v0_8_1/cas/ta/command--1610100840--6--cmd-ca-publish.json
-13
View File
@@ -1,13 +0,0 @@
{
"actor": "krill",
"time": "2021-01-08T10:14:00.682228Z",
"handle": "ta",
"version": 8,
"sequence": 6,
"details": "republish",
"effect": {
"events": [
8
]
}
}
test-resources/migrations/v0_8_1/cas/ta/command--1610537281--7--cmd-ca-publish.json
-13
View File
@@ -1,13 +0,0 @@
{
"actor": "krill",
"time": "2021-01-13T11:28:01.075106Z",
"handle": "ta",
"version": 9,
"sequence": 7,
"details": "republish",
"effect": {
"events": [
9
]
}
}
test-resources/migrations/v0_8_1/cas/ta/delta-0.json
-10
View File
@@ -1,10 +0,0 @@
{
"id": "ta",
"version": 0,
"details": {
"id": {
"key": "D272D0F1E7F20EBE4F3038F29ACFA9774590E835",
"cert": "MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhEMjcyRDBGMUU3RjIwRUJFNEYzMDM4RjI5QUNGQTk3NzQ1OTBFODM1MB4XDTIxMDEwNzE0NDM0MloXDTM2MDEwNzE0NDg0MlowMzExMC8GA1UEAxMoRDI3MkQwRjFFN0YyMEVCRTRGMzAzOEYyOUFDRkE5Nzc0NTkwRTgzNTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN3jacZMe8xlT+AcOVWbj49zwPCzQpzNSwUTPqsYYhAU9mwQXA0tFx0e5VC+qGYCMLJkY1goywEi+qiLJVdlLSmB8LokYcgJKG9EIw3q3JxrfseLVWJjbQAd0VdkG4FvU3LtB+f3Yr1whM6T4AOt070de/9Ox20RioCiSBCEsgfLTmFZsGCzUomtp9krfO7HpBMar08YJ46Bm1h450K79+AbvvhaRctSnrmaxjd/TBi4Q6FtskkcRonBCF1Lcu8eqn1nnfjglflOu/5yOqk+4OXel9b4zx+iooybmjhIhi6istKpYQgzVaAVnpGP3//wF6/zgQsxfHtC74DDA6jvJq8CAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU0nLQ8efyDr5PMDjyms+pd0WQ6DUwHwYDVR0jBBgwFoAU0nLQ8efyDr5PMDjyms+pd0WQ6DUwDQYJKoZIhvcNAQELBQADggEBAMWMRfUSu2C3VznHT+gH7Hg1UobuxZSAlN44kgcWryZa849oPml4OPy3iGKCeEKDxuEAdM/FGXgOUkMSR/psP3ym5FG+RVollSyj25GVgmgmxkV9VaoT4xiJxg3qfHNIeDgReLWYumfHanrpuVw56fhQb+5IEkq4Cw1mrSeoJxtC5Hdij/taylXJ0kP9rEnC5Kh7xGQlvMQXZc+Zn3i+myyHBK8EgUH7un++6b6uxNY+8/2MWN5kO/0sY2QQCgXAfFToiY95emR//c5rud3Wx4oboiS/u4iAObDyV5dCPpHKEP9lG6JWEOkRZYBA5KHydHhYHnKFJ+awvevrr+qn918="
}
}
}
test-resources/migrations/v0_8_1/cas/ta/delta-1.json
-12
View File
@@ -1,12 +0,0 @@
{
"id": "ta",
"version": 1,
"details": {
"repo_updated": {
"embedded": {
"base_uri": "rsync://lostlhost/repo/ta/",
"rpki_notify": "https://localhost:3000/rrdp/notification.xml"
}
}
}
}
test-resources/migrations/v0_8_1/cas/ta/delta-2.json
-20
View File
@@ -1,20 +0,0 @@
{
"id": "ta",
"version": 2,
"details": {
"trust_anchor_made": {
"cert": "MIIIZjCCB06gAwIBAgIUL1jmoavzDeBUl69dks9XgsYxicwwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEwIBcNMjEwMTA3MTQ0MzQyWhgPMjEyMTAxMDcxNDQ4NDJaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQ0QyODM2REI3MjQ0NDMyNzU3OTNGODk5MkYzREMwMzUzRjA2NkRFNzk1QzMzMUMwMjRENUYxOUZGNEQ0OUZCQjdGQzc2MkRENkJENUUxNDIyM0U3MDQyMjYxMzY3MkFEQzVENkRDQkQxRTU5NTJCQTU1OTcwNzM4QzhERDBEMEQ3MjkyREM2NzkzMzYwOEU5RUI1ODJFRjk2NTcxNkIwM0YzMDM1MzY1OURGQTU0MjA1RDczRkI0RENBNzQzOTRDQUYyM0YyNzQyQjJBODExQ0Y5MkI0MjZGNTk0NzZGQkQzMDNBREY3MjI4MjY1MDMzMDBGRENGMjlBNTMxRjY0NDc3N0U1NTE3MDdGQzhDODUyN0QzNzRBMUEyNDEyNkZGMjJGOEY0QkVEOTRDQkRBRTQ2Njc1MzI2RDBEMDI2NDU5ODUyODk4OTk3QzNFNjc3NUFDMTk5RUQxRTc5MEUzMkIwN0FGQjI4N0YyQTdGQzlERjc0RkZGNDg1NzlBMDcyNEYyRDJDNTdDMjdFOEQwREUxMkNENkQ2RTJBRTJFMkMxMjkxNTE4MzdEMTVDRThBREI1NzA1NEJCODU2NUY4RDU4NEU4MzkxODE1RjA0MzZGOUMzOEZERUUxMDVCQjk4RjZDQUQ1MjE5RkUyNkNCQkY2MDNCM0M4N0MxN0FBQ0YwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzSg223JEQydXk/iZLz3ANT8GbeeVwzHAJNXxn/TUn7t/x2Lda9XhQiPnBCJhNnKtxdbcvR5ZUrpVlwc4yN0NDXKS3GeTNgjp61gu+WVxawPzA1NlnfpUIF1z+03KdDlMryPydCsqgRz5K0JvWUdvvTA633IoJlAzAP3PKaUx9kR3flUXB/yMhSfTdKGiQSb/Ivj0vtlMva5GZ1Mm0NAmRZhSiYmXw+Z3WsGZ7R55DjKwevsofyp/yd90//SFeaByTy0sV8J+jQ3hLNbW4q4uLBKRUYN9Fc6K21cFS7hWX41YToORgV8ENvnDj97hBbuY9srVIZ/ibLv2A7PIfBeqzwIDAQABo4IBdjCCAXIwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUhQtAABMRo95Q7W09+snI0Ic/PgMwDgYDVR0PAQH/BAQDAgEGMIHJBggrBgEFBQcBCwSBvDCBuTAnBggrBgEFBQcwBYYbcnN5bmM6Ly9sb3N0bGhvc3QvcmVwby90YS8wMFQGCCsGAQUFBzAKhkhyc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhLzAvODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5tZnQwOAYIKwYBBQUHMA2GLGh0dHBzOi8vbG9jYWxob3N0OjMwMDAvcnJkcC9ub3RpZmljYXRpb24ueG1sMBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwJwYIKwYBBQUHAQcBAf8EGDAWMAkEAgABMAMDAQAwCQQCAAIwAwMBADAhBggrBgEFBQcBCAEB/wQSMBCgDjAMMAoCAQACBQD/////MA0GCSqGSIb3DQEBCwUAA4IBAQCkZ0kAVe2d8sIp9+DUtf4nvXItI2H1ouWZIJnOgBvrWlwTMbfijQxRD04WSLwzOVC39+2bqP9GGDqr9nBOPbpbtQPhYhV4wbvaVLc7wFgIrVrJ/D7fV9HasH6xQpeH1c/plHKPHFQdHGQZU/s3DKwl1cJ4iMxqRbuC3d3LwnMOuviej58EzDW351ZCu8xNxah93VS5Rspw0x2OHhml5xGIg735QKlXKT0gVfFN8CG+AOjzD0l5wKv7Nt7HQ07ikAYj6NZ7/7eiupg9hIyspWif+po7MKzhbR3PrYcLOFp9jAOCdMOY7E3blgZVsQsIZGQO4tTtgdnYURw0I4kx2YQW",
"resources": {
"asn": "AS0-AS4294967295",
"v4": "0.0.0.0/0",
"v6": "::/0"
},
"tal": {
"uris": [
"https://localhost:3000/rrdp/ta/ta.cer"
],
"encoded_ski": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzSg223JEQydXk/iZLz3ANT8GbeeVwzHAJNXxn/TUn7t/x2Lda9XhQiPnBCJhNnKtxdbcvR5ZUrpVlwc4yN0NDXKS3GeTNgjp61gu+WVxawPzA1NlnfpUIF1z+03KdDlMryPydCsqgRz5K0JvWUdvvTA633IoJlAzAP3PKaUx9kR3flUXB/yMhSfTdKGiQSb/Ivj0vtlMva5GZ1Mm0NAmRZhSiYmXw+Z3WsGZ7R55DjKwevsofyp/yd90//SFeaByTy0sV8J+jQ3hLNbW4q4uLBKRUYN9Fc6K21cFS7hWX41YToORgV8ENvnDj97hBbuY9srVIZ/ibLv2A7PIfBeqzwIDAQAB"
}
}
}
}
test-resources/migrations/v0_8_1/cas/ta/delta-3.json
-68
View File
@@ -1,68 +0,0 @@
{
"id": "ta",
"version": 3,
"details": {
"key_pending_to_active": [
"0",
{
"key_id": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03",
"incoming_cert": {
"cert": "MIIIZjCCB06gAwIBAgIUL1jmoavzDeBUl69dks9XgsYxicwwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEwIBcNMjEwMTA3MTQ0MzQyWhgPMjEyMTAxMDcxNDQ4NDJaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQ0QyODM2REI3MjQ0NDMyNzU3OTNGODk5MkYzREMwMzUzRjA2NkRFNzk1QzMzMUMwMjRENUYxOUZGNEQ0OUZCQjdGQzc2MkRENkJENUUxNDIyM0U3MDQyMjYxMzY3MkFEQzVENkRDQkQxRTU5NTJCQTU1OTcwNzM4QzhERDBEMEQ3MjkyREM2NzkzMzYwOEU5RUI1ODJFRjk2NTcxNkIwM0YzMDM1MzY1OURGQTU0MjA1RDczRkI0RENBNzQzOTRDQUYyM0YyNzQyQjJBODExQ0Y5MkI0MjZGNTk0NzZGQkQzMDNBREY3MjI4MjY1MDMzMDBGRENGMjlBNTMxRjY0NDc3N0U1NTE3MDdGQzhDODUyN0QzNzRBMUEyNDEyNkZGMjJGOEY0QkVEOTRDQkRBRTQ2Njc1MzI2RDBEMDI2NDU5ODUyODk4OTk3QzNFNjc3NUFDMTk5RUQxRTc5MEUzMkIwN0FGQjI4N0YyQTdGQzlERjc0RkZGNDg1NzlBMDcyNEYyRDJDNTdDMjdFOEQwREUxMkNENkQ2RTJBRTJFMkMxMjkxNTE4MzdEMTVDRThBREI1NzA1NEJCODU2NUY4RDU4NEU4MzkxODE1RjA0MzZGOUMzOEZERUUxMDVCQjk4RjZDQUQ1MjE5RkUyNkNCQkY2MDNCM0M4N0MxN0FBQ0YwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzSg223JEQydXk/iZLz3ANT8GbeeVwzHAJNXxn/TUn7t/x2Lda9XhQiPnBCJhNnKtxdbcvR5ZUrpVlwc4yN0NDXKS3GeTNgjp61gu+WVxawPzA1NlnfpUIF1z+03KdDlMryPydCsqgRz5K0JvWUdvvTA633IoJlAzAP3PKaUx9kR3flUXB/yMhSfTdKGiQSb/Ivj0vtlMva5GZ1Mm0NAmRZhSiYmXw+Z3WsGZ7R55DjKwevsofyp/yd90//SFeaByTy0sV8J+jQ3hLNbW4q4uLBKRUYN9Fc6K21cFS7hWX41YToORgV8ENvnDj97hBbuY9srVIZ/ibLv2A7PIfBeqzwIDAQABo4IBdjCCAXIwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUhQtAABMRo95Q7W09+snI0Ic/PgMwDgYDVR0PAQH/BAQDAgEGMIHJBggrBgEFBQcBCwSBvDCBuTAnBggrBgEFBQcwBYYbcnN5bmM6Ly9sb3N0bGhvc3QvcmVwby90YS8wMFQGCCsGAQUFBzAKhkhyc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhLzAvODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5tZnQwOAYIKwYBBQUHMA2GLGh0dHBzOi8vbG9jYWxob3N0OjMwMDAvcnJkcC9ub3RpZmljYXRpb24ueG1sMBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwJwYIKwYBBQUHAQcBAf8EGDAWMAkEAgABMAMDAQAwCQQCAAIwAwMBADAhBggrBgEFBQcBCAEB/wQSMBCgDjAMMAoCAQACBQD/////MA0GCSqGSIb3DQEBCwUAA4IBAQCkZ0kAVe2d8sIp9+DUtf4nvXItI2H1ouWZIJnOgBvrWlwTMbfijQxRD04WSLwzOVC39+2bqP9GGDqr9nBOPbpbtQPhYhV4wbvaVLc7wFgIrVrJ/D7fV9HasH6xQpeH1c/plHKPHFQdHGQZU/s3DKwl1cJ4iMxqRbuC3d3LwnMOuviej58EzDW351ZCu8xNxah93VS5Rspw0x2OHhml5xGIg735QKlXKT0gVfFN8CG+AOjzD0l5wKv7Nt7HQ07ikAYj6NZ7/7eiupg9hIyspWif+po7MKzhbR3PrYcLOFp9jAOCdMOY7E3blgZVsQsIZGQO4tTtgdnYURw0I4kx2YQW",
"uri": "rsync://lostlhost/repo/ta/ta.cer",
"resources": {
"asn": "AS0-AS4294967295",
"v4": "0.0.0.0/0",
"v6": "::/0"
}
},
"current_set": {
"number": 1,
"revocations": [],
"manifest_info": {
"name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.mft",
"current": {
"content": "MIILDgYJKoZIhvcNAQcCoIIK/zCCCvsCAQMxDTALBglghkgBZQMEAgEwgZsGCyqGSIb3DQEJEAEaoIGLBIGIMIGFAgEBGA8yMDIxMDEwNzE0NDM0MloYDzIwMjEwMTA4MTQ0ODQyWgYJYIZIAWUDBAIBMFMwURYsODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwDIQBXMtxEZAK2j3yWhvJ8kdnJVY3JzDGX8tOPAwdVQIiubaCCCJkwggiVMIIHfaADAgECAhR7d20umSmlUcdHOHFN7onxJPoZ/TANBgkqhkiG9w0BAQsFADCCAi0xggIpMIICJQYDVQQDE4ICHDMwODIwMTBBMDI4MjAxMDEwMENEMjgzNkRCNzI0NDQzMjc1NzkzRjg5OTJGM0RDMDM1M0YwNjZERTc5NUMzMzFDMDI0RDVGMTlGRjRENDlGQkI3RkM3NjJERDZCRDVFMTQyMjNFNzA0MjI2MTM2NzJBREM1RDZEQ0JEMUU1OTUyQkE1NTk3MDczOEM4REQwRDBENzI5MkRDNjc5MzM2MDhFOUVCNTgyRUY5NjU3MTZCMDNGMzAzNTM2NTlERkE1NDIwNUQ3M0ZCNERDQTc0Mzk0Q0FGMjNGMjc0MkIyQTgxMUNGOTJCNDI2RjU5NDc2RkJEMzAzQURGNzIyODI2NTAzMzAwRkRDRjI5QTUzMUY2NDQ3NzdFNTUxNzA3RkM4Qzg1MjdEMzc0QTFBMjQxMjZGRjIyRjhGNEJFRDk0Q0JEQUU0NjY3NTMyNkQwRDAyNjQ1OTg1Mjg5ODk5N0MzRTY3NzVBQzE5OUVEMUU3OTBFMzJCMDdBRkIyODdGMkE3RkM5REY3NEZGRjQ4NTc5QTA3MjRGMkQyQzU3QzI3RThEMERFMTJDRDZENkUyQUUyRTJDMTI5MTUxODM3RDE1Q0U4QURCNTcwNTRCQjg1NjVGOEQ1ODRFODM5MTgxNUYwNDM2RjlDMzhGREVFMTA1QkI5OEY2Q0FENTIxOUZFMjZDQkJGNjAzQjNDODdDMTdBQUNGMDIwMzAxMDAwMTAeFw0yMTAxMDcxNDQzNDJaFw0yMTAxMTQxNDQ4NDJaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQjVBRjI5QUY3ODIxM0YyNTZERTg2OUI4ODhEQzRENEY0OUI2NkE4QzM1RjkwMkY5QjFDNTY2RUI5QUNFODU5MDMyRTM4MkI0NkIzNzRBRDg2MjczMDNENEZBRDg5MEI2RDQ3NTBFOTFBNUIyMDU3OTBEMjU0Q0VDRkYzRjlCRTU3RUY3Qzc4RDZBMEUxMTQ4RUNCMkQzMjY0OEE4NDUwQ0E4Nzc4N0Y5MTkwQkFDMUFFQjA2RDcyODZBNDlBN0Q2QjYyMUVBQUExMDc2NUJFQzUwMUM0NTcxMzA4QTZDNUZBNTM5MjdGNzYzN0U5RkQxMDAyMzE4QTBGNjRGMkU3MzgyMUE3RTRGNzBERTQ3MjA5NjA3MzRCOTlCOTRENUI2QkQzQjE4M0NFQUY1MjQxNUVEN0Y1NTJBMDIxQTM1NjJEOTVGREYxNjJDNkU5MTNCNzlFMzcxMUJENDkyQzZERjFBNzk5QTUxRDA1RDQwRTU0RkZDQTU3Q0I0OUNCNEM5QkI2MDBFMkVEMDQxNkZGMTRBNTlGNDRFNTMzQzU1ODI2RTkyMDM3M0I4MzFDMzA5MEYzMDUwNjA0Qzg4QURFNUNDODVFNUMyQ0NFM0M2NTE2MkFBQ0VDMjk1QjI2Q0U2MDFBNTM1MjAxMjI1MTlDN0Y2ODQ3NzI1MDI2RTlFMTEwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAta8pr3ghPyVt6Gm4iNxNT0m2aow1+QL5scVm65rOhZAy44K0azdK2GJzA9T62JC21HUOkaWyBXkNJUzs/z+b5X73x41qDhFI7LLTJkioRQyod4f5GQusGusG1yhqSafWtiHqqhB2W+xQHEVxMIpsX6U5J/djfp/RACMYoPZPLnOCGn5PcN5HIJYHNLmblNW2vTsYPOr1JBXtf1UqAho1Ytlf3xYsbpE7eeNxG9SSxt8aeZpR0F1A5U/8pXy0nLTJu2AOLtBBb/FKWfROUzxVgm6SA3O4McMJDzBQYEyIreXMheXCzOPGUWKqzsKVsmzmAaU1IBIlGcf2hHclAm6eEQIDAQABo4IBpzCCAaMwHQYDVR0OBBYEFDHUwV2kk93zGIbpVc6wgx5WA7yHMB8GA1UdIwQYMBaAFIULQAATEaPeUO1tPfrJyNCHPz4DMA4GA1UdDwEB/wQEAwIHgDBZBgNVHR8EUjBQME6gTKBKhkhyc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhLzAvODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwwPAYIKwYBBQUHAQEEMDAuMCwGCCsGAQUFBzAChiByc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhL3RhLmNlcjBkBggrBgEFBQcBCwRYMFYwVAYIKwYBBQUHMAuGSHJzeW5jOi8vbG9zdGxob3N0L3JlcG8vdGEvMC84NTBCNDAwMDEzMTFBM0RFNTBFRDZEM0RGQUM5QzhEMDg3M0YzRTAzLm1mdDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCEGCCsGAQUFBwEHAQH/BBIwEDAGBAIAAQUAMAYEAgACBQAwFQYIKwYBBQUHAQgBAf8EBjAEoAIFADANBgkqhkiG9w0BAQsFAAOCAQEAloqK+RhQFAtfSVI+nWBr1fyHFKVEhSMEdpGYSwzG5xBOh6iMnXM9ti4I2Olrh3rmLCx8tb76SNmm/8UsaRv0tierluN+ZxR62v271eFunAcUmGPkGY2E/u79tNGQZ1jRJCFeiN7K6fQmOzUyUilr7qifHQGLCDGiu9S21M2SJFu+RAXEUGWnDJ6CbQ/sbH6Psi0Twuo18ADBX9tPTfQEAPP/QK+wwueIdVT8Ve9l9/YpvWzSdopgCW00W4i3p14IQ90I41A+9LPmthLqX4iFYiLfaH4bY6qwfpGBlBA+iyJzSHpoKFsm75uvnUhYkUYZ7F53o6krQWg0umbV/t4LFzGCAaowggGmAgEDgBQx1MFdpJPd8xiG6VXOsIMeVgO8hzALBglghkgBZQMEAgGgazAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQARowHAYJKoZIhvcNAQkFMQ8XDTIxMDEwNzE0NDg0MlowLwYJKoZIhvcNAQkEMSIEIMLV0vz/dR2wTz93ouxGAhfLQSyOkjhlxzZfklGCB7lBMA0GCSqGSIb3DQEBAQUABIIBAGFI8XpsEwcuFdmWRjex0snxtn1ViZRe1lowZmgF32G43vCbmUq3TW7lMoHfQKnY69AvCTFVIMdR34AyLs6tZOZcvp81/He+XmYEuP7w19BRjYjeP356XRuLLUb8poGjR6vwQAQ1vgP+mvRq2twGJuwkvng3CQHxcI5Wt5WG/TJTfgdc368uMJO1861Hz24p3hCt4iqto1lXHKI4mUbLbGXbWCaxw2F3mtD/Vr5th6HO1MKrGrufwaXRSZsKCyIrYYtiQD/EMNag0m9tAToez3geIyASQsOS86rQ+BlgUrOiiyoVsgByDZh75aK2vQZmsodNnWqGuiGlYIPq0QgB6FQ=",
"serial": "704869164585700966467604688662219012818071067133",
"expires": "2021-01-08T14:48:42.210471Z"
},
"next_update": "2021-01-08T14:48:42.210471Z",
"old": null
},
"crl_info": {
"name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.crl",
"current": {
"content": "MIIDrDCCApQCAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEXDTIxMDEwNzE0NDM0MloXDTIxMDEwODE0NDg0MlowAKAvMC0wHwYDVR0jBBgwFoAUhQtAABMRo95Q7W09+snI0Ic/PgMwCgYDVR0UBAMCAQEwDQYJKoZIhvcNAQELBQADggEBABlhhKHSGBgrdHU5qG/QQQB9W6tPvcWFj8Ln5Rd7kQB5kUCt870KAs2sgVscnVXimHJPpDDi09oKaisYLNlDZb//vgOhJiU4etBqhpBHtpjAWGNqejvS/BVv0n5mlKmrsefq946RoPxMHejL28QwKpyWaRdaCsT1xSDp0+9uu/1DobucgO5vfNtYYoSVazqtx3F0M6GUh5diWtCBIHEmghHGmn16+LPdvs/AAR8z2d31q9RpaT7UI0FITme1j9rIoBHKL0OxXoPb8L/baRS5FG9NnYPgvRJ7d4AJc7T14WxdeEs+y1Kwq/V4cNX1259BFfNLXJrBX0BtAm0erKmMBEo=",
"serial": "1",
"expires": "2021-01-08T14:48:42.206964Z"
},
"old": null
}
},
"request": null
},
{
"ca_repo": "rsync://lostlhost/repo/ta/0",
"added": [
{
"name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.mft",
"object": {
"content": "MIILDgYJKoZIhvcNAQcCoIIK/zCCCvsCAQMxDTALBglghkgBZQMEAgEwgZsGCyqGSIb3DQEJEAEaoIGLBIGIMIGFAgEBGA8yMDIxMDEwNzE0NDM0MloYDzIwMjEwMTA4MTQ0ODQyWgYJYIZIAWUDBAIBMFMwURYsODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwDIQBXMtxEZAK2j3yWhvJ8kdnJVY3JzDGX8tOPAwdVQIiubaCCCJkwggiVMIIHfaADAgECAhR7d20umSmlUcdHOHFN7onxJPoZ/TANBgkqhkiG9w0BAQsFADCCAi0xggIpMIICJQYDVQQDE4ICHDMwODIwMTBBMDI4MjAxMDEwMENEMjgzNkRCNzI0NDQzMjc1NzkzRjg5OTJGM0RDMDM1M0YwNjZERTc5NUMzMzFDMDI0RDVGMTlGRjRENDlGQkI3RkM3NjJERDZCRDVFMTQyMjNFNzA0MjI2MTM2NzJBREM1RDZEQ0JEMUU1OTUyQkE1NTk3MDczOEM4REQwRDBENzI5MkRDNjc5MzM2MDhFOUVCNTgyRUY5NjU3MTZCMDNGMzAzNTM2NTlERkE1NDIwNUQ3M0ZCNERDQTc0Mzk0Q0FGMjNGMjc0MkIyQTgxMUNGOTJCNDI2RjU5NDc2RkJEMzAzQURGNzIyODI2NTAzMzAwRkRDRjI5QTUzMUY2NDQ3NzdFNTUxNzA3RkM4Qzg1MjdEMzc0QTFBMjQxMjZGRjIyRjhGNEJFRDk0Q0JEQUU0NjY3NTMyNkQwRDAyNjQ1OTg1Mjg5ODk5N0MzRTY3NzVBQzE5OUVEMUU3OTBFMzJCMDdBRkIyODdGMkE3RkM5REY3NEZGRjQ4NTc5QTA3MjRGMkQyQzU3QzI3RThEMERFMTJDRDZENkUyQUUyRTJDMTI5MTUxODM3RDE1Q0U4QURCNTcwNTRCQjg1NjVGOEQ1ODRFODM5MTgxNUYwNDM2RjlDMzhGREVFMTA1QkI5OEY2Q0FENTIxOUZFMjZDQkJGNjAzQjNDODdDMTdBQUNGMDIwMzAxMDAwMTAeFw0yMTAxMDcxNDQzNDJaFw0yMTAxMTQxNDQ4NDJaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQjVBRjI5QUY3ODIxM0YyNTZERTg2OUI4ODhEQzRENEY0OUI2NkE4QzM1RjkwMkY5QjFDNTY2RUI5QUNFODU5MDMyRTM4MkI0NkIzNzRBRDg2MjczMDNENEZBRDg5MEI2RDQ3NTBFOTFBNUIyMDU3OTBEMjU0Q0VDRkYzRjlCRTU3RUY3Qzc4RDZBMEUxMTQ4RUNCMkQzMjY0OEE4NDUwQ0E4Nzc4N0Y5MTkwQkFDMUFFQjA2RDcyODZBNDlBN0Q2QjYyMUVBQUExMDc2NUJFQzUwMUM0NTcxMzA4QTZDNUZBNTM5MjdGNzYzN0U5RkQxMDAyMzE4QTBGNjRGMkU3MzgyMUE3RTRGNzBERTQ3MjA5NjA3MzRCOTlCOTRENUI2QkQzQjE4M0NFQUY1MjQxNUVEN0Y1NTJBMDIxQTM1NjJEOTVGREYxNjJDNkU5MTNCNzlFMzcxMUJENDkyQzZERjFBNzk5QTUxRDA1RDQwRTU0RkZDQTU3Q0I0OUNCNEM5QkI2MDBFMkVEMDQxNkZGMTRBNTlGNDRFNTMzQzU1ODI2RTkyMDM3M0I4MzFDMzA5MEYzMDUwNjA0Qzg4QURFNUNDODVFNUMyQ0NFM0M2NTE2MkFBQ0VDMjk1QjI2Q0U2MDFBNTM1MjAxMjI1MTlDN0Y2ODQ3NzI1MDI2RTlFMTEwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAta8pr3ghPyVt6Gm4iNxNT0m2aow1+QL5scVm65rOhZAy44K0azdK2GJzA9T62JC21HUOkaWyBXkNJUzs/z+b5X73x41qDhFI7LLTJkioRQyod4f5GQusGusG1yhqSafWtiHqqhB2W+xQHEVxMIpsX6U5J/djfp/RACMYoPZPLnOCGn5PcN5HIJYHNLmblNW2vTsYPOr1JBXtf1UqAho1Ytlf3xYsbpE7eeNxG9SSxt8aeZpR0F1A5U/8pXy0nLTJu2AOLtBBb/FKWfROUzxVgm6SA3O4McMJDzBQYEyIreXMheXCzOPGUWKqzsKVsmzmAaU1IBIlGcf2hHclAm6eEQIDAQABo4IBpzCCAaMwHQYDVR0OBBYEFDHUwV2kk93zGIbpVc6wgx5WA7yHMB8GA1UdIwQYMBaAFIULQAATEaPeUO1tPfrJyNCHPz4DMA4GA1UdDwEB/wQEAwIHgDBZBgNVHR8EUjBQME6gTKBKhkhyc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhLzAvODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwwPAYIKwYBBQUHAQEEMDAuMCwGCCsGAQUFBzAChiByc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhL3RhLmNlcjBkBggrBgEFBQcBCwRYMFYwVAYIKwYBBQUHMAuGSHJzeW5jOi8vbG9zdGxob3N0L3JlcG8vdGEvMC84NTBCNDAwMDEzMTFBM0RFNTBFRDZEM0RGQUM5QzhEMDg3M0YzRTAzLm1mdDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCEGCCsGAQUFBwEHAQH/BBIwEDAGBAIAAQUAMAYEAgACBQAwFQYIKwYBBQUHAQgBAf8EBjAEoAIFADANBgkqhkiG9w0BAQsFAAOCAQEAloqK+RhQFAtfSVI+nWBr1fyHFKVEhSMEdpGYSwzG5xBOh6iMnXM9ti4I2Olrh3rmLCx8tb76SNmm/8UsaRv0tierluN+ZxR62v271eFunAcUmGPkGY2E/u79tNGQZ1jRJCFeiN7K6fQmOzUyUilr7qifHQGLCDGiu9S21M2SJFu+RAXEUGWnDJ6CbQ/sbH6Psi0Twuo18ADBX9tPTfQEAPP/QK+wwueIdVT8Ve9l9/YpvWzSdopgCW00W4i3p14IQ90I41A+9LPmthLqX4iFYiLfaH4bY6qwfpGBlBA+iyJzSHpoKFsm75uvnUhYkUYZ7F53o6krQWg0umbV/t4LFzGCAaowggGmAgEDgBQx1MFdpJPd8xiG6VXOsIMeVgO8hzALBglghkgBZQMEAgGgazAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQARowHAYJKoZIhvcNAQkFMQ8XDTIxMDEwNzE0NDg0MlowLwYJKoZIhvcNAQkEMSIEIMLV0vz/dR2wTz93ouxGAhfLQSyOkjhlxzZfklGCB7lBMA0GCSqGSIb3DQEBAQUABIIBAGFI8XpsEwcuFdmWRjex0snxtn1ViZRe1lowZmgF32G43vCbmUq3TW7lMoHfQKnY69AvCTFVIMdR34AyLs6tZOZcvp81/He+XmYEuP7w19BRjYjeP356XRuLLUb8poGjR6vwQAQ1vgP+mvRq2twGJuwkvng3CQHxcI5Wt5WG/TJTfgdc368uMJO1861Hz24p3hCt4iqto1lXHKI4mUbLbGXbWCaxw2F3mtD/Vr5th6HO1MKrGrufwaXRSZsKCyIrYYtiQD/EMNag0m9tAToez3geIyASQsOS86rQ+BlgUrOiiyoVsgByDZh75aK2vQZmsodNnWqGuiGlYIPq0QgB6FQ=",
"serial": "704869164585700966467604688662219012818071067133",
"expires": "2021-01-08T14:48:42.210471Z"
}
},
{
"name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.crl",
"object": {
"content": "MIIDrDCCApQCAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEXDTIxMDEwNzE0NDM0MloXDTIxMDEwODE0NDg0MlowAKAvMC0wHwYDVR0jBBgwFoAUhQtAABMRo95Q7W09+snI0Ic/PgMwCgYDVR0UBAMCAQEwDQYJKoZIhvcNAQELBQADggEBABlhhKHSGBgrdHU5qG/QQQB9W6tPvcWFj8Ln5Rd7kQB5kUCt870KAs2sgVscnVXimHJPpDDi09oKaisYLNlDZb//vgOhJiU4etBqhpBHtpjAWGNqejvS/BVv0n5mlKmrsefq946RoPxMHejL28QwKpyWaRdaCsT1xSDp0+9uu/1DobucgO5vfNtYYoSVazqtx3F0M6GUh5diWtCBIHEmghHGmn16+LPdvs/AAR8z2d31q9RpaT7UI0FITme1j9rIoBHKL0OxXoPb8L/baRS5FG9NnYPgvRJ7d4AJc7T14WxdeEs+y1Kwq/V4cNX1259BFfNLXJrBX0BtAm0erKmMBEo=",
"serial": "1",
"expires": "2021-01-08T14:48:42.206964Z"
}
}
],
"updated": [],
"withdrawn": []
}
]
}
}
test-resources/migrations/v0_8_1/cas/ta/delta-4.json
-18
View File
@@ -1,18 +0,0 @@
{
"id": "ta",
"version": 4,
"details": {
"child_added": [
"testbed",
{
"id_cert": "MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhDMjdFQUVCNzA3Q0VBMjI1RkM1QjU0RUYwQUU1Qjg4RkE0N0QyRDNBMB4XDTIxMDEwNzE0NDM0MloXDTM2MDEwNzE0NDg0MlowMzExMC8GA1UEAxMoQzI3RUFFQjcwN0NFQTIyNUZDNUI1NEVGMEFFNUI4OEZBNDdEMkQzQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMyjKrgOjfJzCe/jzSqBKBHLNOfGlLPcGxcXjNO0KZYKYahtolEmF1tY36xxEiVZbV/p568RFV5fB7rzBc6kPnCABZzDW5RMF5g4JrNc09ZkmUYxfDj5F6OiE0iTsOhHfNm+K3l3NKWjtFuFf2+8HGoyd3toKw4KjBOPsYYOmGiECW2mAU/69VfxndJru34b3p145MzkHBCmvU0UoByItKa3IvCgEMDtT/M7nNG9IJYry8t9RycA1mlRQE7GiqAZGdXaJr+rextdGGKAiZNPmcdDi8vAInxdMW5njVyxx1aMIXHKNUAJ7XykEE3AjOsR/yixEEgalramiFaJnnHkBUECAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUwn6utwfOoiX8W1TvCuW4j6R9LTowHwYDVR0jBBgwFoAUwn6utwfOoiX8W1TvCuW4j6R9LTowDQYJKoZIhvcNAQELBQADggEBABeYST0jZYqp26k933IiKXBFyECObIMbS/Fto5oqIvS+UZYbOF8an/ivTGmOlkyNRXbVYhIW9HTXN4Zb25kBnu1y/u5gy05CkA+9lzrsdIdGvlwJHSLQDQVh7tZE45pNPBIiTbhBmM8/9Jw+GzZn75+PqUvnNh1uZT2Bi4bPMyNt0Jk4+2xci4DF9gZlLsNVy5kEDGyMr5n6ECALhAUjAcE+jeB16QChrdV32HEzHVk4nejb/w2IcrKDhT72738R33wzJWBH2VYo4dPZFFecbDEO/D7wfkC+A/15mKKPQS1rdcAXqeeuI9XKc1EmBaQ4DJNFtclWLtHdl4q6XozbRVQ=",
"resources": {
"asn": "AS0-AS4294967295",
"v4": "0.0.0.0/0",
"v6": "::/0"
},
"used_keys": {}
}
]
}
}
test-resources/migrations/v0_8_1/cas/ta/delta-5.json
-11
View File
@@ -1,11 +0,0 @@
{
"id": "ta",
"version": 5,
"details": {
"child_certificate_issued": [
"testbed",
"0",
"578C2EF4CFC1810860F52DC0D86530B1176FAE2B"
]
}
}
test-resources/migrations/v0_8_1/cas/ta/delta-6.json
-29
View File
@@ -1,29 +0,0 @@
{
"id": "ta",
"version": 6,
"details": {
"child_certificates_updated": [
"0",
{
"issued": [
{
"uri": "rsync://lostlhost/repo/ta/0/578C2EF4CFC1810860F52DC0D86530B1176FAE2B.cer",
"limit": {
"asn": "none",
"v4": "none",
"v6": "none"
},
"resource_set": {
"asn": "AS0-AS4294967295",
"v4": "0.0.0.0/0",
"v6": "::/0"
},
"cert": "MIIHLTCCBhWgAwIBAgIUI/SFnDjXvYPFZXmeG9gQPoh0CFYwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEwHhcNMjEwMTA3MTQ0MzQ0WhcNMjIwMTA2MTQ0ODQ0WjAzMTEwLwYDVQQDEyg1NzhDMkVGNENGQzE4MTA4NjBGNTJEQzBEODY1MzBCMTE3NkZBRTJCMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtmHy7qwTc91JeWA4ClyPrnIsGegWpdCJwfJvmXgsTxIjld+m42CzrwjdaIfTiBy3lH4tLUDlGi71TFdJBQnHdX0od3c2i1QBKqYaLFomOFEDxaafA3khAAyQqsxIHA1XAoz4E8sw3E6VbwxRL0k7/6dlfBZgSvSgsL7SLTsgZ7RibcxCm5yB5i+XzMa51cHVIKW6LNMlbl/89RT2RO4cSVFm5aHixpE9WlII8OAwy5cXC9jZQaQey7Xz4WPmYB682CZv5az0tg+mucpJvQ1zViTYee4fv2vLE9Xo+jF0aGNwMxDGRJoIEUmGjiYwnbq3ICjHV6knV7GTvzN+H2zxrQIDAQABo4ICOzCCAjcwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUV4wu9M/BgQhg9S3A2GUwsRdvriswHwYDVR0jBBgwFoAUhQtAABMRo95Q7W09+snI0Ic/PgMwDgYDVR0PAQH/BAQDAgEGMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9zdGxob3N0L3JlcG8vdGEvMC84NTBCNDAwMDEzMTFBM0RFNTBFRDZEM0RGQUM5QzhEMDg3M0YzRTAzLmNybDA8BggrBgEFBQcBAQQwMC4wLAYIKwYBBQUHMAKGIHJzeW5jOi8vbG9zdGxob3N0L3JlcG8vdGEvdGEuY2VyMIHUBggrBgEFBQcBCwSBxzCBxDAtBggrBgEFBQcwBYYhcnN5bmM6Ly9sb3N0bGhvc3QvcmVwby90ZXN0YmVkLzAvMFkGCCsGAQUFBzAKhk1yc3luYzovL2xvc3RsaG9zdC9yZXBvL3Rlc3RiZWQvMC81NzhDMkVGNENGQzE4MTA4NjBGNTJEQzBEODY1MzBCMTE3NkZBRTJCLm1mdDA4BggrBgEFBQcwDYYsaHR0cHM6Ly9sb2NhbGhvc3Q6MzAwMC9ycmRwL25vdGlmaWNhdGlvbi54bWwwGAYDVR0gAQH/BA4wDDAKBggrBgEFBQcOAjAnBggrBgEFBQcBBwEB/wQYMBYwCQQCAAEwAwMBADAJBAIAAjADAwEAMCEGCCsGAQUFBwEIAQH/BBIwEKAOMAwwCgIBAAIFAP////8wDQYJKoZIhvcNAQELBQADggEBALDZ4wTeOjHCs6FTTEJzZrJWUAU4kev2AwSN/FyEIxxfG507FPhd0W3jVL2ya/Rg5QwyCebjCPAk8Jz55pn7Nh87/USImmc4U+myRn+QiFUmz4Iv0kC0chpOGyPhbmvAw4Lv1Yy4RAZG3oagB2YtxAH8P5vPVuRcbgsVPsi/kgr3kkwXkaI+g2RQnuC3B2JDtpNLvyXcJNvylgsHsG8IbTioKJGe+h4cgotx+/lU1wr3PmSL+QxzGSbCBQyrYnbsaPGEPXpxPE4I1oV8VBUaSzpkNTt7o0qjgpyC+AryUqUJQDWL79dYCL2Yh+5mqWeAi+nPP94jzON7dHWIF5Vat/Q=",
"replaces": null
}
],
"removed": []
}
]
}
}
test-resources/migrations/v0_8_1/cas/ta/delta-7.json
-76
View File
@@ -1,76 +0,0 @@
{
"id": "ta",
"version": 7,
"details": {
"object_set_updated": [
"0",
{
"850B40001311A3DE50ED6D3DFAC9C8D0873F3E03": {
"number": 2,
"revocations_delta": {
"added": [
{
"serial": "704869164585700966467604688662219012818071067133",
"expires": "2021-01-08T14:48:42.210471Z"
}
],
"dropped": []
},
"manifest_info": {
"name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.mft",
"current": {
"content": "MIILYgYJKoZIhvcNAQcCoIILUzCCC08CAQMxDTALBglghkgBZQMEAgEwge8GCyqGSIb3DQEJEAEaoIHfBIHcMIHZAgECGA8yMDIxMDEwNzE0NDM0NFoYDzIwMjEwMTA4MTQ0ODQ0WgYJYIZIAWUDBAIBMIGmMFEWLDU3OEMyRUY0Q0ZDMTgxMDg2MEY1MkRDMEQ4NjUzMEIxMTc2RkFFMkIuY2VyAyEAxEtBwJWKNOD10U9HPPQoCbxBV85EZ7gIwUeHRvLkSiwwURYsODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwDIQB08CqSE/ymIcOrYNvnQ7V8pAclEo+HMQufY+46SgrllqCCCJkwggiVMIIHfaADAgECAhQnawikV2iOnwjjP45V32cn7+cSRTANBgkqhkiG9w0BAQsFADCCAi0xggIpMIICJQYDVQQDE4ICHDMwODIwMTBBMDI4MjAxMDEwMENEMjgzNkRCNzI0NDQzMjc1NzkzRjg5OTJGM0RDMDM1M0YwNjZERTc5NUMzMzFDMDI0RDVGMTlGRjRENDlGQkI3RkM3NjJERDZCRDVFMTQyMjNFNzA0MjI2MTM2NzJBREM1RDZEQ0JEMUU1OTUyQkE1NTk3MDczOEM4REQwRDBENzI5MkRDNjc5MzM2MDhFOUVCNTgyRUY5NjU3MTZCMDNGMzAzNTM2NTlERkE1NDIwNUQ3M0ZCNERDQTc0Mzk0Q0FGMjNGMjc0MkIyQTgxMUNGOTJCNDI2RjU5NDc2RkJEMzAzQURGNzIyODI2NTAzMzAwRkRDRjI5QTUzMUY2NDQ3NzdFNTUxNzA3RkM4Qzg1MjdEMzc0QTFBMjQxMjZGRjIyRjhGNEJFRDk0Q0JEQUU0NjY3NTMyNkQwRDAyNjQ1OTg1Mjg5ODk5N0MzRTY3NzVBQzE5OUVEMUU3OTBFMzJCMDdBRkIyODdGMkE3RkM5REY3NEZGRjQ4NTc5QTA3MjRGMkQyQzU3QzI3RThEMERFMTJDRDZENkUyQUUyRTJDMTI5MTUxODM3RDE1Q0U4QURCNTcwNTRCQjg1NjVGOEQ1ODRFODM5MTgxNUYwNDM2RjlDMzhGREVFMTA1QkI5OEY2Q0FENTIxOUZFMjZDQkJGNjAzQjNDODdDMTdBQUNGMDIwMzAxMDAwMTAeFw0yMTAxMDcxNDQzNDRaFw0yMTAxMTQxNDQ4NDRaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwRjEyOTNDRjU2NzIyMEI3NjFFMDMxREYzMjYxNUMzODg5RDRDM0Y0REQ4MjlDODQ5QkY0NkM5MkU2OEU3RTNGQUEzNUQwRjRCMjNEOTdFMDI0RjFBMTdGQzdGRjJDQjc4Mjc1QzlBQTkxRjkwNzdDQkExMTgzODg2NUIzQkMyQzc5NjFFNzFEMzI5MTU0NDg4MEU4M0FEQUM0QTlEQTcyNjBCRENFQTJEMThDNkE0NTg1ODFEQkM3QkJDOEE2MDM1OENFNkNCMDAxNDAxMjQ1NjdGNTNFNUZBNzIxQUIxMjRDRDM5RTU3OEZDQzVBQUQ1ODM4ODBBM0Y2OEZFNjBEOTlCNDk0NkE5RUZDRjlGQkE3QjlCODA2OEJGQTA3MzYzMUYxQkQ0MENEODk4MDFFMzMzQjQwRERDNzA4OEQxQkREQzdGODVEQ0NDOTJEMzU4MjA1RUEwRUQ4REI1MzhGOTBENDQ1NkE2MzQ3MEE4OEFGQzgxMEE4ODIwM0JCQkVDQzAxOTMzNTI3OTVENzlBNTk3NTgwRTNEOThGQThENDU0N0NBNzA3MzIxQkY3NkFFNUJBMkJEMkNGMkRFNzg5QTc0QjE0QUI4NEFDOTJGRTU0OTZGMkNCMEEzOTQ4RDhBNkMxMTZGNDdDODhFNzBFOEVCQUQ0OTc1NTBCMjBFNjEwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA8Sk89WciC3YeAx3zJhXDiJ1MP03YKchJv0bJLmjn4/qjXQ9LI9l+Ak8aF/x/8st4J1yaqR+Qd8uhGDiGWzvCx5YecdMpFUSIDoOtrEqdpyYL3OotGMakWFgdvHu8imA1jObLABQBJFZ/U+X6chqxJM055Xj8xarVg4gKP2j+YNmbSUap78+funubgGi/oHNjHxvUDNiYAeMztA3ccIjRvdx/hdzMktNYIF6g7Y21OPkNRFamNHCoivyBCoggO7vswBkzUnldeaWXWA49mPqNRUfKcHMhv3auW6K9LPLeeJp0sUq4Sskv5UlvLLCjlI2KbBFvR8iOcOjrrUl1ULIOYQIDAQABo4IBpzCCAaMwHQYDVR0OBBYEFJ1dHFTs7iozEMCP8QqFGf07zNFPMB8GA1UdIwQYMBaAFIULQAATEaPeUO1tPfrJyNCHPz4DMA4GA1UdDwEB/wQEAwIHgDBZBgNVHR8EUjBQME6gTKBKhkhyc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhLzAvODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwwPAYIKwYBBQUHAQEEMDAuMCwGCCsGAQUFBzAChiByc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhL3RhLmNlcjBkBggrBgEFBQcBCwRYMFYwVAYIKwYBBQUHMAuGSHJzeW5jOi8vbG9zdGxob3N0L3JlcG8vdGEvMC84NTBCNDAwMDEzMTFBM0RFNTBFRDZEM0RGQUM5QzhEMDg3M0YzRTAzLm1mdDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCEGCCsGAQUFBwEHAQH/BBIwEDAGBAIAAQUAMAYEAgACBQAwFQYIKwYBBQUHAQgBAf8EBjAEoAIFADANBgkqhkiG9w0BAQsFAAOCAQEAM1N8ovx0VcmGS1Vu3+Idj9P4jFHDmgO4f7snYAuX4LaKzGMaUgNnIQzbdQqy1eh9NlTdS+7h/2f3IZJ6ldTzx37q/MeaJjwunCc5jy5ZdaaNlfERE4dEG2LC+T17TEuyY9EiMne8W6eMGArYjIrEhGoWxCASraVeMSEUkd7NdpuWBZxDoqxlEqUa0cUfSRnK5gfD92X6Ipq6KNY0oWlZgI75O1ZHkv3PyXTtQV0Fcx+tc5C0ECKTPPPjAiSpEF8F3i1PMxC8Pl7kuUAd8XqLfxqTNjyg7Ij5f7kpFnjZdv3iYvlmtqoe0c4i2fEY9Udl6V+23n74rCVx/UOPYWsLKjGCAaowggGmAgEDgBSdXRxU7O4qMxDAj/EKhRn9O8zRTzALBglghkgBZQMEAgGgazAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQARowHAYJKoZIhvcNAQkFMQ8XDTIxMDEwNzE0NDg0NFowLwYJKoZIhvcNAQkEMSIEIEB6MQIpv0PdmLUu+3Ovg/GxVUpeK0iNjc0J6zzfPh2CMA0GCSqGSIb3DQEBAQUABIIBAL9z4mT5dbLw0AFloafj/zd3RAeiWYM94qVzjcDtyNy+ENzb6IsU/rS7sWAeYINnJUtHURE5VwKGcOnAoHy8HhJSoQaxPRhauJ4laH50bAC340AqlskP8G1tR/Vcss0UubpCqAHd0xcHxfy6Qx/vsxDfu6aYm0/QWDvocwQti/zyTipYbT3S9D6PIpxzWGGgNpUXO9Pvl8m+hyas53IRS1aOUMHyROrnsNkEJWGc33Gt63oWOLmzYorjkaKh3fr1iUweU+7XvoF6HsLsRU42a/mC0c2hOFXapNAPRR0NKQVQ/xGX/elUh7/AhXciNWx2iGrNDzgyDZK5kDSgJAZcqh4=",
"serial": "225037572619153874445885581769491657235049681477",
"expires": "2021-01-08T14:48:44.284625Z"
},
"next_update": "2021-01-08T14:48:44.284625Z",
"old": "e5de6e92cba5edbf709e22622f784ab0929ef81adc26da7d949350c1219141fd"
},
"crl_info": {
"name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.crl",
"current": {
"content": "MIID0zCCArsCAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEXDTIxMDEwNzE0NDM0NFoXDTIxMDEwODE0NDg0NFowJzAlAhR7d20umSmlUcdHOHFN7onxJPoZ/RcNMjEwMTA4MTQ0ODQyWqAvMC0wHwYDVR0jBBgwFoAUhQtAABMRo95Q7W09+snI0Ic/PgMwCgYDVR0UBAMCAQIwDQYJKoZIhvcNAQELBQADggEBALjhm0ocAsj7rl6ERaaeSfhrPcN9oBMMZMzuPwnoOblfNfI1Xuk0H7vSjTQRrnFVbPmfL/OdFNQep/mu68Kv6n1wX0f47ALuRQZkpZQU4bBoOHdf1gBPmpLZEwFA8+VO4KVN7m8P8qqQgBYNw3XVqurY2QvHb7fco8EjirOsvd3IUTmtK/NlTq8mz5IhUyVFT0xFSR3h4rrqC0KIGO5KLh2IoC+pAv4AAAqTJxRL3Mk2jgNeRvIjUbdIx1r9RuoxXQcRpsJ0DUNNZmaPFDLI6bBxAcXY3JJyZRZ+04Bvoxej5bVAbG697li+kyw1uH1T10t9gC3l4xZ1aAnlneTsAuQ=",
"serial": "2",
"expires": "2021-01-08T14:48:44.280906Z"
},
"old": "5732dc446402b68f7c9686f27c91d9c9558dc9cc3197f2d38f0307554088ae6d"
},
"objects_delta": {
"ca_repo": "rsync://lostlhost/repo/ta/0",
"added": [
{
"name": "578C2EF4CFC1810860F52DC0D86530B1176FAE2B.cer",
"object": {
"content": "MIIHLTCCBhWgAwIBAgIUI/SFnDjXvYPFZXmeG9gQPoh0CFYwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEwHhcNMjEwMTA3MTQ0MzQ0WhcNMjIwMTA2MTQ0ODQ0WjAzMTEwLwYDVQQDEyg1NzhDMkVGNENGQzE4MTA4NjBGNTJEQzBEODY1MzBCMTE3NkZBRTJCMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtmHy7qwTc91JeWA4ClyPrnIsGegWpdCJwfJvmXgsTxIjld+m42CzrwjdaIfTiBy3lH4tLUDlGi71TFdJBQnHdX0od3c2i1QBKqYaLFomOFEDxaafA3khAAyQqsxIHA1XAoz4E8sw3E6VbwxRL0k7/6dlfBZgSvSgsL7SLTsgZ7RibcxCm5yB5i+XzMa51cHVIKW6LNMlbl/89RT2RO4cSVFm5aHixpE9WlII8OAwy5cXC9jZQaQey7Xz4WPmYB682CZv5az0tg+mucpJvQ1zViTYee4fv2vLE9Xo+jF0aGNwMxDGRJoIEUmGjiYwnbq3ICjHV6knV7GTvzN+H2zxrQIDAQABo4ICOzCCAjcwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUV4wu9M/BgQhg9S3A2GUwsRdvriswHwYDVR0jBBgwFoAUhQtAABMRo95Q7W09+snI0Ic/PgMwDgYDVR0PAQH/BAQDAgEGMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9zdGxob3N0L3JlcG8vdGEvMC84NTBCNDAwMDEzMTFBM0RFNTBFRDZEM0RGQUM5QzhEMDg3M0YzRTAzLmNybDA8BggrBgEFBQcBAQQwMC4wLAYIKwYBBQUHMAKGIHJzeW5jOi8vbG9zdGxob3N0L3JlcG8vdGEvdGEuY2VyMIHUBggrBgEFBQcBCwSBxzCBxDAtBggrBgEFBQcwBYYhcnN5bmM6Ly9sb3N0bGhvc3QvcmVwby90ZXN0YmVkLzAvMFkGCCsGAQUFBzAKhk1yc3luYzovL2xvc3RsaG9zdC9yZXBvL3Rlc3RiZWQvMC81NzhDMkVGNENGQzE4MTA4NjBGNTJEQzBEODY1MzBCMTE3NkZBRTJCLm1mdDA4BggrBgEFBQcwDYYsaHR0cHM6Ly9sb2NhbGhvc3Q6MzAwMC9ycmRwL25vdGlmaWNhdGlvbi54bWwwGAYDVR0gAQH/BA4wDDAKBggrBgEFBQcOAjAnBggrBgEFBQcBBwEB/wQYMBYwCQQCAAEwAwMBADAJBAIAAjADAwEAMCEGCCsGAQUFBwEIAQH/BBIwEKAOMAwwCgIBAAIFAP////8wDQYJKoZIhvcNAQELBQADggEBALDZ4wTeOjHCs6FTTEJzZrJWUAU4kev2AwSN/FyEIxxfG507FPhd0W3jVL2ya/Rg5QwyCebjCPAk8Jz55pn7Nh87/USImmc4U+myRn+QiFUmz4Iv0kC0chpOGyPhbmvAw4Lv1Yy4RAZG3oagB2YtxAH8P5vPVuRcbgsVPsi/kgr3kkwXkaI+g2RQnuC3B2JDtpNLvyXcJNvylgsHsG8IbTioKJGe+h4cgotx+/lU1wr3PmSL+QxzGSbCBQyrYnbsaPGEPXpxPE4I1oV8VBUaSzpkNTt7o0qjgpyC+AryUqUJQDWL79dYCL2Yh+5mqWeAi+nPP94jzON7dHWIF5Vat/Q=",
"serial": "205267697900910974577834931369136136825544640598",
"expires": "2022-01-06T14:48:44.276694Z"
}
}
],
"updated": [
{
"name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.crl",
"object": {
"content": "MIID0zCCArsCAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEXDTIxMDEwNzE0NDM0NFoXDTIxMDEwODE0NDg0NFowJzAlAhR7d20umSmlUcdHOHFN7onxJPoZ/RcNMjEwMTA4MTQ0ODQyWqAvMC0wHwYDVR0jBBgwFoAUhQtAABMRo95Q7W09+snI0Ic/PgMwCgYDVR0UBAMCAQIwDQYJKoZIhvcNAQELBQADggEBALjhm0ocAsj7rl6ERaaeSfhrPcN9oBMMZMzuPwnoOblfNfI1Xuk0H7vSjTQRrnFVbPmfL/OdFNQep/mu68Kv6n1wX0f47ALuRQZkpZQU4bBoOHdf1gBPmpLZEwFA8+VO4KVN7m8P8qqQgBYNw3XVqurY2QvHb7fco8EjirOsvd3IUTmtK/NlTq8mz5IhUyVFT0xFSR3h4rrqC0KIGO5KLh2IoC+pAv4AAAqTJxRL3Mk2jgNeRvIjUbdIx1r9RuoxXQcRpsJ0DUNNZmaPFDLI6bBxAcXY3JJyZRZ+04Bvoxej5bVAbG697li+kyw1uH1T10t9gC3l4xZ1aAnlneTsAuQ=",
"serial": "2",
"expires": "2021-01-08T14:48:44.280906Z"
},
"old": "5732dc446402b68f7c9686f27c91d9c9558dc9cc3197f2d38f0307554088ae6d"
},
{
"name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.mft",
"object": {
"content": "MIILYgYJKoZIhvcNAQcCoIILUzCCC08CAQMxDTALBglghkgBZQMEAgEwge8GCyqGSIb3DQEJEAEaoIHfBIHcMIHZAgECGA8yMDIxMDEwNzE0NDM0NFoYDzIwMjEwMTA4MTQ0ODQ0WgYJYIZIAWUDBAIBMIGmMFEWLDU3OEMyRUY0Q0ZDMTgxMDg2MEY1MkRDMEQ4NjUzMEIxMTc2RkFFMkIuY2VyAyEAxEtBwJWKNOD10U9HPPQoCbxBV85EZ7gIwUeHRvLkSiwwURYsODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwDIQB08CqSE/ymIcOrYNvnQ7V8pAclEo+HMQufY+46SgrllqCCCJkwggiVMIIHfaADAgECAhQnawikV2iOnwjjP45V32cn7+cSRTANBgkqhkiG9w0BAQsFADCCAi0xggIpMIICJQYDVQQDE4ICHDMwODIwMTBBMDI4MjAxMDEwMENEMjgzNkRCNzI0NDQzMjc1NzkzRjg5OTJGM0RDMDM1M0YwNjZERTc5NUMzMzFDMDI0RDVGMTlGRjRENDlGQkI3RkM3NjJERDZCRDVFMTQyMjNFNzA0MjI2MTM2NzJBREM1RDZEQ0JEMUU1OTUyQkE1NTk3MDczOEM4REQwRDBENzI5MkRDNjc5MzM2MDhFOUVCNTgyRUY5NjU3MTZCMDNGMzAzNTM2NTlERkE1NDIwNUQ3M0ZCNERDQTc0Mzk0Q0FGMjNGMjc0MkIyQTgxMUNGOTJCNDI2RjU5NDc2RkJEMzAzQURGNzIyODI2NTAzMzAwRkRDRjI5QTUzMUY2NDQ3NzdFNTUxNzA3RkM4Qzg1MjdEMzc0QTFBMjQxMjZGRjIyRjhGNEJFRDk0Q0JEQUU0NjY3NTMyNkQwRDAyNjQ1OTg1Mjg5ODk5N0MzRTY3NzVBQzE5OUVEMUU3OTBFMzJCMDdBRkIyODdGMkE3RkM5REY3NEZGRjQ4NTc5QTA3MjRGMkQyQzU3QzI3RThEMERFMTJDRDZENkUyQUUyRTJDMTI5MTUxODM3RDE1Q0U4QURCNTcwNTRCQjg1NjVGOEQ1ODRFODM5MTgxNUYwNDM2RjlDMzhGREVFMTA1QkI5OEY2Q0FENTIxOUZFMjZDQkJGNjAzQjNDODdDMTdBQUNGMDIwMzAxMDAwMTAeFw0yMTAxMDcxNDQzNDRaFw0yMTAxMTQxNDQ4NDRaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwRjEyOTNDRjU2NzIyMEI3NjFFMDMxREYzMjYxNUMzODg5RDRDM0Y0REQ4MjlDODQ5QkY0NkM5MkU2OEU3RTNGQUEzNUQwRjRCMjNEOTdFMDI0RjFBMTdGQzdGRjJDQjc4Mjc1QzlBQTkxRjkwNzdDQkExMTgzODg2NUIzQkMyQzc5NjFFNzFEMzI5MTU0NDg4MEU4M0FEQUM0QTlEQTcyNjBCRENFQTJEMThDNkE0NTg1ODFEQkM3QkJDOEE2MDM1OENFNkNCMDAxNDAxMjQ1NjdGNTNFNUZBNzIxQUIxMjRDRDM5RTU3OEZDQzVBQUQ1ODM4ODBBM0Y2OEZFNjBEOTlCNDk0NkE5RUZDRjlGQkE3QjlCODA2OEJGQTA3MzYzMUYxQkQ0MENEODk4MDFFMzMzQjQwRERDNzA4OEQxQkREQzdGODVEQ0NDOTJEMzU4MjA1RUEwRUQ4REI1MzhGOTBENDQ1NkE2MzQ3MEE4OEFGQzgxMEE4ODIwM0JCQkVDQzAxOTMzNTI3OTVENzlBNTk3NTgwRTNEOThGQThENDU0N0NBNzA3MzIxQkY3NkFFNUJBMkJEMkNGMkRFNzg5QTc0QjE0QUI4NEFDOTJGRTU0OTZGMkNCMEEzOTQ4RDhBNkMxMTZGNDdDODhFNzBFOEVCQUQ0OTc1NTBCMjBFNjEwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA8Sk89WciC3YeAx3zJhXDiJ1MP03YKchJv0bJLmjn4/qjXQ9LI9l+Ak8aF/x/8st4J1yaqR+Qd8uhGDiGWzvCx5YecdMpFUSIDoOtrEqdpyYL3OotGMakWFgdvHu8imA1jObLABQBJFZ/U+X6chqxJM055Xj8xarVg4gKP2j+YNmbSUap78+funubgGi/oHNjHxvUDNiYAeMztA3ccIjRvdx/hdzMktNYIF6g7Y21OPkNRFamNHCoivyBCoggO7vswBkzUnldeaWXWA49mPqNRUfKcHMhv3auW6K9LPLeeJp0sUq4Sskv5UlvLLCjlI2KbBFvR8iOcOjrrUl1ULIOYQIDAQABo4IBpzCCAaMwHQYDVR0OBBYEFJ1dHFTs7iozEMCP8QqFGf07zNFPMB8GA1UdIwQYMBaAFIULQAATEaPeUO1tPfrJyNCHPz4DMA4GA1UdDwEB/wQEAwIHgDBZBgNVHR8EUjBQME6gTKBKhkhyc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhLzAvODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwwPAYIKwYBBQUHAQEEMDAuMCwGCCsGAQUFBzAChiByc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhL3RhLmNlcjBkBggrBgEFBQcBCwRYMFYwVAYIKwYBBQUHMAuGSHJzeW5jOi8vbG9zdGxob3N0L3JlcG8vdGEvMC84NTBCNDAwMDEzMTFBM0RFNTBFRDZEM0RGQUM5QzhEMDg3M0YzRTAzLm1mdDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCEGCCsGAQUFBwEHAQH/BBIwEDAGBAIAAQUAMAYEAgACBQAwFQYIKwYBBQUHAQgBAf8EBjAEoAIFADANBgkqhkiG9w0BAQsFAAOCAQEAM1N8ovx0VcmGS1Vu3+Idj9P4jFHDmgO4f7snYAuX4LaKzGMaUgNnIQzbdQqy1eh9NlTdS+7h/2f3IZJ6ldTzx37q/MeaJjwunCc5jy5ZdaaNlfERE4dEG2LC+T17TEuyY9EiMne8W6eMGArYjIrEhGoWxCASraVeMSEUkd7NdpuWBZxDoqxlEqUa0cUfSRnK5gfD92X6Ipq6KNY0oWlZgI75O1ZHkv3PyXTtQV0Fcx+tc5C0ECKTPPPjAiSpEF8F3i1PMxC8Pl7kuUAd8XqLfxqTNjyg7Ij5f7kpFnjZdv3iYvlmtqoe0c4i2fEY9Udl6V+23n74rCVx/UOPYWsLKjGCAaowggGmAgEDgBSdXRxU7O4qMxDAj/EKhRn9O8zRTzALBglghkgBZQMEAgGgazAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQARowHAYJKoZIhvcNAQkFMQ8XDTIxMDEwNzE0NDg0NFowLwYJKoZIhvcNAQkEMSIEIEB6MQIpv0PdmLUu+3Ovg/GxVUpeK0iNjc0J6zzfPh2CMA0GCSqGSIb3DQEBAQUABIIBAL9z4mT5dbLw0AFloafj/zd3RAeiWYM94qVzjcDtyNy+ENzb6IsU/rS7sWAeYINnJUtHURE5VwKGcOnAoHy8HhJSoQaxPRhauJ4laH50bAC340AqlskP8G1tR/Vcss0UubpCqAHd0xcHxfy6Qx/vsxDfu6aYm0/QWDvocwQti/zyTipYbT3S9D6PIpxzWGGgNpUXO9Pvl8m+hyas53IRS1aOUMHyROrnsNkEJWGc33Gt63oWOLmzYorjkaKh3fr1iUweU+7XvoF6HsLsRU42a/mC0c2hOFXapNAPRR0NKQVQ/xGX/elUh7/AhXciNWx2iGrNDzgyDZK5kDSgJAZcqh4=",
"serial": "225037572619153874445885581769491657235049681477",
"expires": "2021-01-08T14:48:44.284625Z"
},
"old": "e5de6e92cba5edbf709e22622f784ab0929ef81adc26da7d949350c1219141fd"
}
],
"withdrawn": []
}
}
}
]
}
}
test-resources/migrations/v0_8_1/cas/ta/delta-8.json
-67
View File
@@ -1,67 +0,0 @@
{
"id": "ta",
"version": 8,
"details": {
"object_set_updated": [
"0",
{
"850B40001311A3DE50ED6D3DFAC9C8D0873F3E03": {
"number": 3,
"revocations_delta": {
"added": [
{
"serial": "225037572619153874445885581769491657235049681477",
"expires": "2021-01-08T14:48:44.284625Z"
}
],
"dropped": []
},
"manifest_info": {
"name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.mft",
"current": {
"content": "MIILYgYJKoZIhvcNAQcCoIILUzCCC08CAQMxDTALBglghkgBZQMEAgEwge8GCyqGSIb3DQEJEAEaoIHfBIHcMIHZAgEDGA8yMDIxMDEwODEwMDkwMFoYDzIwMjEwMTA5MTAxNDAwWgYJYIZIAWUDBAIBMIGmMFEWLDU3OEMyRUY0Q0ZDMTgxMDg2MEY1MkRDMEQ4NjUzMEIxMTc2RkFFMkIuY2VyAyEAxEtBwJWKNOD10U9HPPQoCbxBV85EZ7gIwUeHRvLkSiwwURYsODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwDIQC37X6mEM/vwf5RoCc16p8tA+RQ73e8jY1EfS5RwKFjaaCCCJkwggiVMIIHfaADAgECAhQjWm2ZXzc6wPlYcnawHzfXxPaFdDANBgkqhkiG9w0BAQsFADCCAi0xggIpMIICJQYDVQQDE4ICHDMwODIwMTBBMDI4MjAxMDEwMENEMjgzNkRCNzI0NDQzMjc1NzkzRjg5OTJGM0RDMDM1M0YwNjZERTc5NUMzMzFDMDI0RDVGMTlGRjRENDlGQkI3RkM3NjJERDZCRDVFMTQyMjNFNzA0MjI2MTM2NzJBREM1RDZEQ0JEMUU1OTUyQkE1NTk3MDczOEM4REQwRDBENzI5MkRDNjc5MzM2MDhFOUVCNTgyRUY5NjU3MTZCMDNGMzAzNTM2NTlERkE1NDIwNUQ3M0ZCNERDQTc0Mzk0Q0FGMjNGMjc0MkIyQTgxMUNGOTJCNDI2RjU5NDc2RkJEMzAzQURGNzIyODI2NTAzMzAwRkRDRjI5QTUzMUY2NDQ3NzdFNTUxNzA3RkM4Qzg1MjdEMzc0QTFBMjQxMjZGRjIyRjhGNEJFRDk0Q0JEQUU0NjY3NTMyNkQwRDAyNjQ1OTg1Mjg5ODk5N0MzRTY3NzVBQzE5OUVEMUU3OTBFMzJCMDdBRkIyODdGMkE3RkM5REY3NEZGRjQ4NTc5QTA3MjRGMkQyQzU3QzI3RThEMERFMTJDRDZENkUyQUUyRTJDMTI5MTUxODM3RDE1Q0U4QURCNTcwNTRCQjg1NjVGOEQ1ODRFODM5MTgxNUYwNDM2RjlDMzhGREVFMTA1QkI5OEY2Q0FENTIxOUZFMjZDQkJGNjAzQjNDODdDMTdBQUNGMDIwMzAxMDAwMTAeFw0yMTAxMDgxMDA5MDBaFw0yMTAxMTUxMDE0MDBaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwRTY5MEM3N0ZGQjdDRUM4MTJDNEU0MERENjZCQzFGRjFDRUYxNTEyNDJGQkZDQjdDRTlCMEVCRDI2RjFFODVDODczNjUxMjRBQzgxNDc1NjQwNTkwOTM5MjQyMEEwQjNGQTAwQkFFREZGRjYxRjI2OTVGRUVFMURFQ0FGOTRBNDlENjk0MEE4RkRDNjZENTBDNDk4RUNBRThGNTc0RDE3MkIyRjM2QTQyM0MzRUMzQUE5REU4MUQwODQ1MENGNUM3MTgyNTQ4RDlENjc2MjBEMkE1NUEzRUFDMzIwOEIxOEYzMTRGQkQ0RjlBRDYwOEUzNDFDNkM1MTBBNEUwQzI2OEIxN0JCMEYxNkJEM0ZDMkE3MUQ1NDk2QkRDMDkwMzU4MUM0OUU2NzREN0ZBNjEyNkE0Q0E2OUQyOEUyMzE2MUNDQjQ4NzI3OTIzRjdBRTk2OUExOTQ4QzcxQTlEN0M3RDNGQTJCNDk4QUI1Q0VBNDY2RTFGREQ5RTc5MTM2NDdEMjdERUE1RjJCNjNFODQwMkUxODFDREFBQkIwNjI5RkRBQjczRDYxNDE2RkI5ODc1NUE3NUUxMDM5NTkyQTFBQjI1RDNFOEVDQTk3OEY2QzlBOTEyNURCREQyNkVGRjkxQzg4QzVFRkRDODFBM0NGQTE4OEI3QzJFNEUwOEVFRTMwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5pDHf/t87IEsTkDdZrwf8c7xUSQvv8t86bDr0m8ehchzZRJKyBR1ZAWQk5JCCgs/oAuu3/9h8mlf7uHeyvlKSdaUCo/cZtUMSY7K6PV00XKy82pCPD7Dqp3oHQhFDPXHGCVI2dZ2INKlWj6sMgixjzFPvU+a1gjjQcbFEKTgwmixe7Dxa9P8KnHVSWvcCQNYHEnmdNf6YSakymnSjiMWHMtIcnkj966WmhlIxxqdfH0/orSYq1zqRm4f3Z55E2R9J96l8rY+hALhgc2quwYp/atz1hQW+5h1WnXhA5WSoasl0+jsqXj2yakSXb3Sbv+RyIxe/cgaPPoYi3wuTgju4wIDAQABo4IBpzCCAaMwHQYDVR0OBBYEFMphmbm7uju6IFEDJ/Za+oR3U0LfMB8GA1UdIwQYMBaAFIULQAATEaPeUO1tPfrJyNCHPz4DMA4GA1UdDwEB/wQEAwIHgDBZBgNVHR8EUjBQME6gTKBKhkhyc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhLzAvODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwwPAYIKwYBBQUHAQEEMDAuMCwGCCsGAQUFBzAChiByc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhL3RhLmNlcjBkBggrBgEFBQcBCwRYMFYwVAYIKwYBBQUHMAuGSHJzeW5jOi8vbG9zdGxob3N0L3JlcG8vdGEvMC84NTBCNDAwMDEzMTFBM0RFNTBFRDZEM0RGQUM5QzhEMDg3M0YzRTAzLm1mdDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCEGCCsGAQUFBwEHAQH/BBIwEDAGBAIAAQUAMAYEAgACBQAwFQYIKwYBBQUHAQgBAf8EBjAEoAIFADANBgkqhkiG9w0BAQsFAAOCAQEAT0bPz1vBIglKCwuK1sZZMSGvy9HoybARxrHljqT5nhZdbsRNLbfTI4i6UFNVJrpuoI/XHE+spLCs3LAMoZiiNT5/iCnQVOvoDhIJfFPbvBdPMJk10IQqZNQMRK4u+GEBxMBsZgVEdzOxVOd/DHhO9u3vTh9/2mV3KKG0yGoQ7a6v7SbP8zENMFFW1ddSIhz0wamTR83pkSYV5JT4TzNzMcFX5euUkrzUbefhdiYLWHm0tcVzWG8jsdOKgP84/akH55AqHuEXW+UKALRtwOHWrrHOBJYlk4SSOrFFS/0mObJJh2nDsgn2ITL4KeEOvtb33TkOPXjJ4nkgr/OMrHQpvTGCAaowggGmAgEDgBTKYZm5u7o7uiBRAyf2WvqEd1NC3zALBglghkgBZQMEAgGgazAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQARowHAYJKoZIhvcNAQkFMQ8XDTIxMDEwODEwMTQwMFowLwYJKoZIhvcNAQkEMSIEINMjfuzhmAzjvl2phUcJHM2/FURvm2mj74+x1XoDd4BlMA0GCSqGSIb3DQEBAQUABIIBAJHEyo1jqzQyf00Ie8HxXq8/vEg6T27zB+rpNLLXJt8lwU4DrLMgqGIE6JKGKzrZJ6On5NGMBBKUsuTgzBQamvnRs1fIS2codTOCFkSjPVtdIdmPMn6h7eQkyszEDgNlqUwOyKOC8++6aUfn4KOSUpLLnW/MhoCQZcAvAAXNiFwhYXWb8m8tgktOEj1OG4RzXqW8HuOmN+4x0Dblle5nOjG/StQRT866eBInZ33pX8p/9T7ht7NvT0dHWGuP1EZMLkIK+VY3EKM3/gS/sbTwaFYEej5Xqy2v13omvVqgbaUfcWgebFC+1BCajE/pr7cDp35rmKBCfI23HfPqbpFeUnE=",
"serial": "201831291475634267796886973706723420667525891444",
"expires": "2021-01-09T10:14:00.687129Z"
},
"next_update": "2021-01-09T10:14:00.687129Z",
"old": "074af04412634623062b29e67235eda88241377bd35100449f786d74e1f6101c"
},
"crl_info": {
"name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.crl",
"current": {
"content": "MIID+jCCAuICAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEXDTIxMDEwODEwMDkwMFoXDTIxMDEwOTEwMTQwMFowTjAlAhR7d20umSmlUcdHOHFN7onxJPoZ/RcNMjEwMTA4MTQ0ODQyWjAlAhQnawikV2iOnwjjP45V32cn7+cSRRcNMjEwMTA4MTQ0ODQ0WqAvMC0wHwYDVR0jBBgwFoAUhQtAABMRo95Q7W09+snI0Ic/PgMwCgYDVR0UBAMCAQMwDQYJKoZIhvcNAQELBQADggEBAIagHE9PVrWASG9vGjw4n1SBOrC4f5wj8GZSUFYabHn5gJ/PFIWsS88QwIa5U+cgWfnVsD9xxALaopGCDtU7XLbW/4E16AB9erRKJrH0wMcFDHPRlxG8qaDNg3LVyOkQtari45t/uqJ3INR1xZEYSDXg8XlscaVdEZFTC1gy3qqGG/ZmtdJfVWtapSjIFBbpyZqMMdMC8C4R7Yqyxl79/WWIhgy3GHeAwgr8+I+RNSyGeaOc8lwbukk1CqzIU2YJaOhxQrJ2hBEOco8D2UVY9GTHbCXcHX2rhFs6WJs3BamPm/r8S0ORGndoIKcLy6fZUbmQ+K5tjF4H44RO7a+1cD0=",
"serial": "3",
"expires": "2021-01-09T10:14:00.682699Z"
},
"old": "74f02a9213fca621c3ab60dbe743b57ca40725128f87310b9f63ee3a4a0ae596"
},
"objects_delta": {
"ca_repo": "rsync://lostlhost/repo/ta/0",
"added": [],
"updated": [
{
"name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.crl",
"object": {
"content": "MIID+jCCAuICAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEXDTIxMDEwODEwMDkwMFoXDTIxMDEwOTEwMTQwMFowTjAlAhR7d20umSmlUcdHOHFN7onxJPoZ/RcNMjEwMTA4MTQ0ODQyWjAlAhQnawikV2iOnwjjP45V32cn7+cSRRcNMjEwMTA4MTQ0ODQ0WqAvMC0wHwYDVR0jBBgwFoAUhQtAABMRo95Q7W09+snI0Ic/PgMwCgYDVR0UBAMCAQMwDQYJKoZIhvcNAQELBQADggEBAIagHE9PVrWASG9vGjw4n1SBOrC4f5wj8GZSUFYabHn5gJ/PFIWsS88QwIa5U+cgWfnVsD9xxALaopGCDtU7XLbW/4E16AB9erRKJrH0wMcFDHPRlxG8qaDNg3LVyOkQtari45t/uqJ3INR1xZEYSDXg8XlscaVdEZFTC1gy3qqGG/ZmtdJfVWtapSjIFBbpyZqMMdMC8C4R7Yqyxl79/WWIhgy3GHeAwgr8+I+RNSyGeaOc8lwbukk1CqzIU2YJaOhxQrJ2hBEOco8D2UVY9GTHbCXcHX2rhFs6WJs3BamPm/r8S0ORGndoIKcLy6fZUbmQ+K5tjF4H44RO7a+1cD0=",
"serial": "3",
"expires": "2021-01-09T10:14:00.682699Z"
},
"old": "74f02a9213fca621c3ab60dbe743b57ca40725128f87310b9f63ee3a4a0ae596"
},
{
"name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.mft",
"object": {
"content": "MIILYgYJKoZIhvcNAQcCoIILUzCCC08CAQMxDTALBglghkgBZQMEAgEwge8GCyqGSIb3DQEJEAEaoIHfBIHcMIHZAgEDGA8yMDIxMDEwODEwMDkwMFoYDzIwMjEwMTA5MTAxNDAwWgYJYIZIAWUDBAIBMIGmMFEWLDU3OEMyRUY0Q0ZDMTgxMDg2MEY1MkRDMEQ4NjUzMEIxMTc2RkFFMkIuY2VyAyEAxEtBwJWKNOD10U9HPPQoCbxBV85EZ7gIwUeHRvLkSiwwURYsODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwDIQC37X6mEM/vwf5RoCc16p8tA+RQ73e8jY1EfS5RwKFjaaCCCJkwggiVMIIHfaADAgECAhQjWm2ZXzc6wPlYcnawHzfXxPaFdDANBgkqhkiG9w0BAQsFADCCAi0xggIpMIICJQYDVQQDE4ICHDMwODIwMTBBMDI4MjAxMDEwMENEMjgzNkRCNzI0NDQzMjc1NzkzRjg5OTJGM0RDMDM1M0YwNjZERTc5NUMzMzFDMDI0RDVGMTlGRjRENDlGQkI3RkM3NjJERDZCRDVFMTQyMjNFNzA0MjI2MTM2NzJBREM1RDZEQ0JEMUU1OTUyQkE1NTk3MDczOEM4REQwRDBENzI5MkRDNjc5MzM2MDhFOUVCNTgyRUY5NjU3MTZCMDNGMzAzNTM2NTlERkE1NDIwNUQ3M0ZCNERDQTc0Mzk0Q0FGMjNGMjc0MkIyQTgxMUNGOTJCNDI2RjU5NDc2RkJEMzAzQURGNzIyODI2NTAzMzAwRkRDRjI5QTUzMUY2NDQ3NzdFNTUxNzA3RkM4Qzg1MjdEMzc0QTFBMjQxMjZGRjIyRjhGNEJFRDk0Q0JEQUU0NjY3NTMyNkQwRDAyNjQ1OTg1Mjg5ODk5N0MzRTY3NzVBQzE5OUVEMUU3OTBFMzJCMDdBRkIyODdGMkE3RkM5REY3NEZGRjQ4NTc5QTA3MjRGMkQyQzU3QzI3RThEMERFMTJDRDZENkUyQUUyRTJDMTI5MTUxODM3RDE1Q0U4QURCNTcwNTRCQjg1NjVGOEQ1ODRFODM5MTgxNUYwNDM2RjlDMzhGREVFMTA1QkI5OEY2Q0FENTIxOUZFMjZDQkJGNjAzQjNDODdDMTdBQUNGMDIwMzAxMDAwMTAeFw0yMTAxMDgxMDA5MDBaFw0yMTAxMTUxMDE0MDBaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwRTY5MEM3N0ZGQjdDRUM4MTJDNEU0MERENjZCQzFGRjFDRUYxNTEyNDJGQkZDQjdDRTlCMEVCRDI2RjFFODVDODczNjUxMjRBQzgxNDc1NjQwNTkwOTM5MjQyMEEwQjNGQTAwQkFFREZGRjYxRjI2OTVGRUVFMURFQ0FGOTRBNDlENjk0MEE4RkRDNjZENTBDNDk4RUNBRThGNTc0RDE3MkIyRjM2QTQyM0MzRUMzQUE5REU4MUQwODQ1MENGNUM3MTgyNTQ4RDlENjc2MjBEMkE1NUEzRUFDMzIwOEIxOEYzMTRGQkQ0RjlBRDYwOEUzNDFDNkM1MTBBNEUwQzI2OEIxN0JCMEYxNkJEM0ZDMkE3MUQ1NDk2QkRDMDkwMzU4MUM0OUU2NzREN0ZBNjEyNkE0Q0E2OUQyOEUyMzE2MUNDQjQ4NzI3OTIzRjdBRTk2OUExOTQ4QzcxQTlEN0M3RDNGQTJCNDk4QUI1Q0VBNDY2RTFGREQ5RTc5MTM2NDdEMjdERUE1RjJCNjNFODQwMkUxODFDREFBQkIwNjI5RkRBQjczRDYxNDE2RkI5ODc1NUE3NUUxMDM5NTkyQTFBQjI1RDNFOEVDQTk3OEY2QzlBOTEyNURCREQyNkVGRjkxQzg4QzVFRkRDODFBM0NGQTE4OEI3QzJFNEUwOEVFRTMwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5pDHf/t87IEsTkDdZrwf8c7xUSQvv8t86bDr0m8ehchzZRJKyBR1ZAWQk5JCCgs/oAuu3/9h8mlf7uHeyvlKSdaUCo/cZtUMSY7K6PV00XKy82pCPD7Dqp3oHQhFDPXHGCVI2dZ2INKlWj6sMgixjzFPvU+a1gjjQcbFEKTgwmixe7Dxa9P8KnHVSWvcCQNYHEnmdNf6YSakymnSjiMWHMtIcnkj966WmhlIxxqdfH0/orSYq1zqRm4f3Z55E2R9J96l8rY+hALhgc2quwYp/atz1hQW+5h1WnXhA5WSoasl0+jsqXj2yakSXb3Sbv+RyIxe/cgaPPoYi3wuTgju4wIDAQABo4IBpzCCAaMwHQYDVR0OBBYEFMphmbm7uju6IFEDJ/Za+oR3U0LfMB8GA1UdIwQYMBaAFIULQAATEaPeUO1tPfrJyNCHPz4DMA4GA1UdDwEB/wQEAwIHgDBZBgNVHR8EUjBQME6gTKBKhkhyc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhLzAvODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwwPAYIKwYBBQUHAQEEMDAuMCwGCCsGAQUFBzAChiByc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhL3RhLmNlcjBkBggrBgEFBQcBCwRYMFYwVAYIKwYBBQUHMAuGSHJzeW5jOi8vbG9zdGxob3N0L3JlcG8vdGEvMC84NTBCNDAwMDEzMTFBM0RFNTBFRDZEM0RGQUM5QzhEMDg3M0YzRTAzLm1mdDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCEGCCsGAQUFBwEHAQH/BBIwEDAGBAIAAQUAMAYEAgACBQAwFQYIKwYBBQUHAQgBAf8EBjAEoAIFADANBgkqhkiG9w0BAQsFAAOCAQEAT0bPz1vBIglKCwuK1sZZMSGvy9HoybARxrHljqT5nhZdbsRNLbfTI4i6UFNVJrpuoI/XHE+spLCs3LAMoZiiNT5/iCnQVOvoDhIJfFPbvBdPMJk10IQqZNQMRK4u+GEBxMBsZgVEdzOxVOd/DHhO9u3vTh9/2mV3KKG0yGoQ7a6v7SbP8zENMFFW1ddSIhz0wamTR83pkSYV5JT4TzNzMcFX5euUkrzUbefhdiYLWHm0tcVzWG8jsdOKgP84/akH55AqHuEXW+UKALRtwOHWrrHOBJYlk4SSOrFFS/0mObJJh2nDsgn2ITL4KeEOvtb33TkOPXjJ4nkgr/OMrHQpvTGCAaowggGmAgEDgBTKYZm5u7o7uiBRAyf2WvqEd1NC3zALBglghkgBZQMEAgGgazAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQARowHAYJKoZIhvcNAQkFMQ8XDTIxMDEwODEwMTQwMFowLwYJKoZIhvcNAQkEMSIEINMjfuzhmAzjvl2phUcJHM2/FURvm2mj74+x1XoDd4BlMA0GCSqGSIb3DQEBAQUABIIBAJHEyo1jqzQyf00Ie8HxXq8/vEg6T27zB+rpNLLXJt8lwU4DrLMgqGIE6JKGKzrZJ6On5NGMBBKUsuTgzBQamvnRs1fIS2codTOCFkSjPVtdIdmPMn6h7eQkyszEDgNlqUwOyKOC8++6aUfn4KOSUpLLnW/MhoCQZcAvAAXNiFwhYXWb8m8tgktOEj1OG4RzXqW8HuOmN+4x0Dblle5nOjG/StQRT866eBInZ33pX8p/9T7ht7NvT0dHWGuP1EZMLkIK+VY3EKM3/gS/sbTwaFYEej5Xqy2v13omvVqgbaUfcWgebFC+1BCajE/pr7cDp35rmKBCfI23HfPqbpFeUnE=",
"serial": "201831291475634267796886973706723420667525891444",
"expires": "2021-01-09T10:14:00.687129Z"
},
"old": "074af04412634623062b29e67235eda88241377bd35100449f786d74e1f6101c"
}
],
"withdrawn": []
}
}
}
]
}
}
test-resources/migrations/v0_8_1/cas/ta/delta-9.json
-80
View File
@@ -1,80 +0,0 @@
{
"id": "ta",
"version": 9,
"details": {
"object_set_updated": [
"0",
{
"850B40001311A3DE50ED6D3DFAC9C8D0873F3E03": {
"number": 4,
"revocations_delta": {
"added": [
{
"serial": "201831291475634267796886973706723420667525891444",
"expires": "2021-01-09T10:14:00.687129Z"
}
],
"dropped": [
{
"serial": "704869164585700966467604688662219012818071067133",
"expires": "2021-01-08T14:48:42.210471Z"
},
{
"serial": "225037572619153874445885581769491657235049681477",
"expires": "2021-01-08T14:48:44.284625Z"
},
{
"serial": "201831291475634267796886973706723420667525891444",
"expires": "2021-01-09T10:14:00.687129Z"
}
]
},
"manifest_info": {
"name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.mft",
"current": {
"content": "MIILYgYJKoZIhvcNAQcCoIILUzCCC08CAQMxDTALBglghkgBZQMEAgEwge8GCyqGSIb3DQEJEAEaoIHfBIHcMIHZAgEEGA8yMDIxMDExMzExMjMwMVoYDzIwMjEwMTE0MTEyODAxWgYJYIZIAWUDBAIBMIGmMFEWLDg1MEI0MDAwMTMxMUEzREU1MEVENkQzREZBQzlDOEQwODczRjNFMDMuY3JsAyEA6mNo+nxZrIChzTmZT8JK3Aj1o0JHc8tyRh0B9/kPiMswURYsNTc4QzJFRjRDRkMxODEwODYwRjUyREMwRDg2NTMwQjExNzZGQUUyQi5jZXIDIQDES0HAlYo04PXRT0c89CgJvEFXzkRnuAjBR4dG8uRKLKCCCJkwggiVMIIHfaADAgECAhRFqiSIGoF+Nq3QuPFW3aEexfnerTANBgkqhkiG9w0BAQsFADCCAi0xggIpMIICJQYDVQQDE4ICHDMwODIwMTBBMDI4MjAxMDEwMENEMjgzNkRCNzI0NDQzMjc1NzkzRjg5OTJGM0RDMDM1M0YwNjZERTc5NUMzMzFDMDI0RDVGMTlGRjRENDlGQkI3RkM3NjJERDZCRDVFMTQyMjNFNzA0MjI2MTM2NzJBREM1RDZEQ0JEMUU1OTUyQkE1NTk3MDczOEM4REQwRDBENzI5MkRDNjc5MzM2MDhFOUVCNTgyRUY5NjU3MTZCMDNGMzAzNTM2NTlERkE1NDIwNUQ3M0ZCNERDQTc0Mzk0Q0FGMjNGMjc0MkIyQTgxMUNGOTJCNDI2RjU5NDc2RkJEMzAzQURGNzIyODI2NTAzMzAwRkRDRjI5QTUzMUY2NDQ3NzdFNTUxNzA3RkM4Qzg1MjdEMzc0QTFBMjQxMjZGRjIyRjhGNEJFRDk0Q0JEQUU0NjY3NTMyNkQwRDAyNjQ1OTg1Mjg5ODk5N0MzRTY3NzVBQzE5OUVEMUU3OTBFMzJCMDdBRkIyODdGMkE3RkM5REY3NEZGRjQ4NTc5QTA3MjRGMkQyQzU3QzI3RThEMERFMTJDRDZENkUyQUUyRTJDMTI5MTUxODM3RDE1Q0U4QURCNTcwNTRCQjg1NjVGOEQ1ODRFODM5MTgxNUYwNDM2RjlDMzhGREVFMTA1QkI5OEY2Q0FENTIxOUZFMjZDQkJGNjAzQjNDODdDMTdBQUNGMDIwMzAxMDAwMTAeFw0yMTAxMTMxMTIzMDFaFw0yMTAxMjAxMTI4MDFaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwOUNGOTAzRERFMzI4M0JBN0I1RDcyQUY5RUNFRjk4N0Q4NTU3MTFGOUQ5MDhCMzY3NjczOTkyNTA5OTgxRDE4NjNCQzcxMUU3Njg1QzE4ODk2Rjc1OTI2NjU0ODczRjZENUM3NjcyNUQzQTY5RTEyRjk1MEE2ODE0OUY4Q0UyMzQwNDUyRjIzMUE5RkM4NjFCRjAzMUVCM0IzMEQ0OUYzRkFGRkQ4RkJEOUYwQ0EzQkUwNzk0MEJCRUI3ODg5NTFFMTk3OUZDQjdGOTkwQUMzMUQ2MkU4MTBBRkY0MUQyMTNFRDJEOTNFOUQ0QTAzREU0RUE0N0Y3RDcwOUQ3OEI5RDFFODExRDU3NDhGRThCRDM0ODZEQ0JFNDQyRUIyMjE4OEI4OEUyMjQzMDBGODBFQzQwMEMyRkYxNzFCMTAzOEEzQTZFOTc0QUY4N0M4QzFBQjQ2RDQxOTIxMkI3MkMzODQzMjRFMEJFNTJFNTBDNzk3OUM1MkRCMzk4NUU0OTI2OENGNDE0RTQzODdGNzFCNjRFNTUxRjc2NzVFNTZDMjIxRTk2RERFRjZFNjI1QkFDMkJENzFDQUY2RTZEMTFEMEYwRDFGQkJDOUYyNTZENENBQTkxRDg0QTkwOTcyRTFFOERBNzQyOTFEMjNCMDUyMjRBOEFEREE3MkNDREI3MTEwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnPkD3eMoO6e11yr57O+YfYVXEfnZCLNnZzmSUJmB0YY7xxHnaFwYiW91kmZUhz9tXHZyXTpp4S+VCmgUn4ziNARS8jGp/IYb8DHrOzDUnz+v/Y+9nwyjvgeUC763iJUeGXn8t/mQrDHWLoEK/0HSE+0tk+nUoD3k6kf31wnXi50egR1XSP6L00hty+RC6yIYi4jiJDAPgOxADC/xcbEDijpul0r4fIwatG1BkhK3LDhDJOC+UuUMeXnFLbOYXkkmjPQU5Dh/cbZOVR92deVsIh6W3e9uYlusK9ccr25tEdDw0fu8nyVtTKqR2EqQly4ejadCkdI7BSJKit2nLM23EQIDAQABo4IBpzCCAaMwHQYDVR0OBBYEFFV4uJxrfdfmI9KQmdKtbB7YqNLZMB8GA1UdIwQYMBaAFIULQAATEaPeUO1tPfrJyNCHPz4DMA4GA1UdDwEB/wQEAwIHgDBZBgNVHR8EUjBQME6gTKBKhkhyc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhLzAvODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwwPAYIKwYBBQUHAQEEMDAuMCwGCCsGAQUFBzAChiByc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhL3RhLmNlcjBkBggrBgEFBQcBCwRYMFYwVAYIKwYBBQUHMAuGSHJzeW5jOi8vbG9zdGxob3N0L3JlcG8vdGEvMC84NTBCNDAwMDEzMTFBM0RFNTBFRDZEM0RGQUM5QzhEMDg3M0YzRTAzLm1mdDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCEGCCsGAQUFBwEHAQH/BBIwEDAGBAIAAQUAMAYEAgACBQAwFQYIKwYBBQUHAQgBAf8EBjAEoAIFADANBgkqhkiG9w0BAQsFAAOCAQEABP8eMGdPiQFqKVl61O0k3Tno4oQnjPob76oLwJguZLYD6ALVRJEjK9N/0UW89oy+c9ITfaECa18cufklZm50VnEqDvItS4KmEEKgjM0rLZDMWoRvOhXTR3Uhv8hVrwMJZqnqji7UfrdBuh/Eig/zuQrHotQQhznr6D011jGZ2LwPRn+sORB8k126fiCeykaCrqEmaxlJej67dei1SmhnILTYI46miTYlprQre1bFixXFv6Ev5+1r+sT8sY8duHb6mcpUiCNaiQKMeqsbN9vg45b+oxWe5Xj3ibitB3Kbf7oYNlHTsPlHi2jtXo0in1ODdsDYpHVqNfyNW96IaLDbiDGCAaowggGmAgEDgBRVeLica33X5iPSkJnSrWwe2KjS2TALBglghkgBZQMEAgGgazAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQARowHAYJKoZIhvcNAQkFMQ8XDTIxMDExMzExMjgwMVowLwYJKoZIhvcNAQkEMSIEIJ8/HRUwo5c7LyfB4n6fXORpin5RdHwPnSlOtgAMAPm4MA0GCSqGSIb3DQEBAQUABIIBAEIlbSqYXbPacK6z/BHe6nwpO8WwktajgVLXz+POTY8h8BQW5bUSk7ITYJZiDRNACjTwdAlp+GlAcY5PftWyhy+OnGObGOg9nqCBtEWP3OykWpZgm+MdmGPpDLRKRFivAiq5W/UUXzJqUCg1aMQBWrhWqrubviIFKSttqneWSCG+wRJqc1wirbz9ry7+flA3TF/s5X1CxvzoxdxPJsFrKH7ufmKxAIBzAdYXwYKv+mVnfXpApKkh9QxEHl96FGhqPHW386k0AdG1VPgDThNV6VEEDoaTXAUm/5QALCo4+eNcdP7HLdLXsfkSbP1S70A+clUG56q6hAxRwMHJyVSjJAs=",
"serial": "397714672226522871823541187130996691739866685101",
"expires": "2021-01-14T11:28:01.080728Z"
},
"next_update": "2021-01-14T11:28:01.080728Z",
"old": "f9c4504820ea0c83b264a25302c76d5c3b6961bc788bbd3cf4b08f69c670bbe1"
},
"crl_info": {
"name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.crl",
"current": {
"content": "MIIDrDCCApQCAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEXDTIxMDExMzExMjMwMVoXDTIxMDExNDExMjgwMVowAKAvMC0wHwYDVR0jBBgwFoAUhQtAABMRo95Q7W09+snI0Ic/PgMwCgYDVR0UBAMCAQQwDQYJKoZIhvcNAQELBQADggEBAD26Wa9JDK8ej4ADSPsZkwcFWgT7C+1t3oFA9EAxXQBNu7myhNBcNpaHO9sdKpOaouXmbE7vAWV9PfLpDtjtmxLhUYeBmjUB8RdXqxGr5aT+78a0tQjsIt/LFeolNf/J5qQZBUnwldWrO2C8qW7iFyiWEvLlfgnKD5yqhZvFhYD+UoN4pyyLGgqZJzAbXtcMab0AkGDQqLNvsyNF3CNHz136Fic3fIMum4Tp8HlyB2CYiMesBFcwgWtuCp5GzDmXr6PSC2lWxkefnsxbG6mb4cVctPNTEHTjUoC6sNKlHaaRsq/gyCBIs8ylt7RJl5cwzwL1UQZnT6RDwKGDDA/d41k=",
"serial": "4",
"expires": "2021-01-14T11:28:01.075690Z"
},
"old": "b7ed7ea610cfefc1fe51a02735ea9f2d03e450ef77bc8d8d447d2e51c0a16369"
},
"objects_delta": {
"ca_repo": "rsync://lostlhost/repo/ta/0",
"added": [],
"updated": [
{
"name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.crl",
"object": {
"content": "MIIDrDCCApQCAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEXDTIxMDExMzExMjMwMVoXDTIxMDExNDExMjgwMVowAKAvMC0wHwYDVR0jBBgwFoAUhQtAABMRo95Q7W09+snI0Ic/PgMwCgYDVR0UBAMCAQQwDQYJKoZIhvcNAQELBQADggEBAD26Wa9JDK8ej4ADSPsZkwcFWgT7C+1t3oFA9EAxXQBNu7myhNBcNpaHO9sdKpOaouXmbE7vAWV9PfLpDtjtmxLhUYeBmjUB8RdXqxGr5aT+78a0tQjsIt/LFeolNf/J5qQZBUnwldWrO2C8qW7iFyiWEvLlfgnKD5yqhZvFhYD+UoN4pyyLGgqZJzAbXtcMab0AkGDQqLNvsyNF3CNHz136Fic3fIMum4Tp8HlyB2CYiMesBFcwgWtuCp5GzDmXr6PSC2lWxkefnsxbG6mb4cVctPNTEHTjUoC6sNKlHaaRsq/gyCBIs8ylt7RJl5cwzwL1UQZnT6RDwKGDDA/d41k=",
"serial": "4",
"expires": "2021-01-14T11:28:01.075690Z"
},
"old": "b7ed7ea610cfefc1fe51a02735ea9f2d03e450ef77bc8d8d447d2e51c0a16369"
},
{
"name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.mft",
"object": {
"content": "MIILYgYJKoZIhvcNAQcCoIILUzCCC08CAQMxDTALBglghkgBZQMEAgEwge8GCyqGSIb3DQEJEAEaoIHfBIHcMIHZAgEEGA8yMDIxMDExMzExMjMwMVoYDzIwMjEwMTE0MTEyODAxWgYJYIZIAWUDBAIBMIGmMFEWLDg1MEI0MDAwMTMxMUEzREU1MEVENkQzREZBQzlDOEQwODczRjNFMDMuY3JsAyEA6mNo+nxZrIChzTmZT8JK3Aj1o0JHc8tyRh0B9/kPiMswURYsNTc4QzJFRjRDRkMxODEwODYwRjUyREMwRDg2NTMwQjExNzZGQUUyQi5jZXIDIQDES0HAlYo04PXRT0c89CgJvEFXzkRnuAjBR4dG8uRKLKCCCJkwggiVMIIHfaADAgECAhRFqiSIGoF+Nq3QuPFW3aEexfnerTANBgkqhkiG9w0BAQsFADCCAi0xggIpMIICJQYDVQQDE4ICHDMwODIwMTBBMDI4MjAxMDEwMENEMjgzNkRCNzI0NDQzMjc1NzkzRjg5OTJGM0RDMDM1M0YwNjZERTc5NUMzMzFDMDI0RDVGMTlGRjRENDlGQkI3RkM3NjJERDZCRDVFMTQyMjNFNzA0MjI2MTM2NzJBREM1RDZEQ0JEMUU1OTUyQkE1NTk3MDczOEM4REQwRDBENzI5MkRDNjc5MzM2MDhFOUVCNTgyRUY5NjU3MTZCMDNGMzAzNTM2NTlERkE1NDIwNUQ3M0ZCNERDQTc0Mzk0Q0FGMjNGMjc0MkIyQTgxMUNGOTJCNDI2RjU5NDc2RkJEMzAzQURGNzIyODI2NTAzMzAwRkRDRjI5QTUzMUY2NDQ3NzdFNTUxNzA3RkM4Qzg1MjdEMzc0QTFBMjQxMjZGRjIyRjhGNEJFRDk0Q0JEQUU0NjY3NTMyNkQwRDAyNjQ1OTg1Mjg5ODk5N0MzRTY3NzVBQzE5OUVEMUU3OTBFMzJCMDdBRkIyODdGMkE3RkM5REY3NEZGRjQ4NTc5QTA3MjRGMkQyQzU3QzI3RThEMERFMTJDRDZENkUyQUUyRTJDMTI5MTUxODM3RDE1Q0U4QURCNTcwNTRCQjg1NjVGOEQ1ODRFODM5MTgxNUYwNDM2RjlDMzhGREVFMTA1QkI5OEY2Q0FENTIxOUZFMjZDQkJGNjAzQjNDODdDMTdBQUNGMDIwMzAxMDAwMTAeFw0yMTAxMTMxMTIzMDFaFw0yMTAxMjAxMTI4MDFaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwOUNGOTAzRERFMzI4M0JBN0I1RDcyQUY5RUNFRjk4N0Q4NTU3MTFGOUQ5MDhCMzY3NjczOTkyNTA5OTgxRDE4NjNCQzcxMUU3Njg1QzE4ODk2Rjc1OTI2NjU0ODczRjZENUM3NjcyNUQzQTY5RTEyRjk1MEE2ODE0OUY4Q0UyMzQwNDUyRjIzMUE5RkM4NjFCRjAzMUVCM0IzMEQ0OUYzRkFGRkQ4RkJEOUYwQ0EzQkUwNzk0MEJCRUI3ODg5NTFFMTk3OUZDQjdGOTkwQUMzMUQ2MkU4MTBBRkY0MUQyMTNFRDJEOTNFOUQ0QTAzREU0RUE0N0Y3RDcwOUQ3OEI5RDFFODExRDU3NDhGRThCRDM0ODZEQ0JFNDQyRUIyMjE4OEI4OEUyMjQzMDBGODBFQzQwMEMyRkYxNzFCMTAzOEEzQTZFOTc0QUY4N0M4QzFBQjQ2RDQxOTIxMkI3MkMzODQzMjRFMEJFNTJFNTBDNzk3OUM1MkRCMzk4NUU0OTI2OENGNDE0RTQzODdGNzFCNjRFNTUxRjc2NzVFNTZDMjIxRTk2RERFRjZFNjI1QkFDMkJENzFDQUY2RTZEMTFEMEYwRDFGQkJDOUYyNTZENENBQTkxRDg0QTkwOTcyRTFFOERBNzQyOTFEMjNCMDUyMjRBOEFEREE3MkNDREI3MTEwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnPkD3eMoO6e11yr57O+YfYVXEfnZCLNnZzmSUJmB0YY7xxHnaFwYiW91kmZUhz9tXHZyXTpp4S+VCmgUn4ziNARS8jGp/IYb8DHrOzDUnz+v/Y+9nwyjvgeUC763iJUeGXn8t/mQrDHWLoEK/0HSE+0tk+nUoD3k6kf31wnXi50egR1XSP6L00hty+RC6yIYi4jiJDAPgOxADC/xcbEDijpul0r4fIwatG1BkhK3LDhDJOC+UuUMeXnFLbOYXkkmjPQU5Dh/cbZOVR92deVsIh6W3e9uYlusK9ccr25tEdDw0fu8nyVtTKqR2EqQly4ejadCkdI7BSJKit2nLM23EQIDAQABo4IBpzCCAaMwHQYDVR0OBBYEFFV4uJxrfdfmI9KQmdKtbB7YqNLZMB8GA1UdIwQYMBaAFIULQAATEaPeUO1tPfrJyNCHPz4DMA4GA1UdDwEB/wQEAwIHgDBZBgNVHR8EUjBQME6gTKBKhkhyc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhLzAvODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwwPAYIKwYBBQUHAQEEMDAuMCwGCCsGAQUFBzAChiByc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhL3RhLmNlcjBkBggrBgEFBQcBCwRYMFYwVAYIKwYBBQUHMAuGSHJzeW5jOi8vbG9zdGxob3N0L3JlcG8vdGEvMC84NTBCNDAwMDEzMTFBM0RFNTBFRDZEM0RGQUM5QzhEMDg3M0YzRTAzLm1mdDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCEGCCsGAQUFBwEHAQH/BBIwEDAGBAIAAQUAMAYEAgACBQAwFQYIKwYBBQUHAQgBAf8EBjAEoAIFADANBgkqhkiG9w0BAQsFAAOCAQEABP8eMGdPiQFqKVl61O0k3Tno4oQnjPob76oLwJguZLYD6ALVRJEjK9N/0UW89oy+c9ITfaECa18cufklZm50VnEqDvItS4KmEEKgjM0rLZDMWoRvOhXTR3Uhv8hVrwMJZqnqji7UfrdBuh/Eig/zuQrHotQQhznr6D011jGZ2LwPRn+sORB8k126fiCeykaCrqEmaxlJej67dei1SmhnILTYI46miTYlprQre1bFixXFv6Ev5+1r+sT8sY8duHb6mcpUiCNaiQKMeqsbN9vg45b+oxWe5Xj3ibitB3Kbf7oYNlHTsPlHi2jtXo0in1ODdsDYpHVqNfyNW96IaLDbiDGCAaowggGmAgEDgBRVeLica33X5iPSkJnSrWwe2KjS2TALBglghkgBZQMEAgGgazAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQARowHAYJKoZIhvcNAQkFMQ8XDTIxMDExMzExMjgwMVowLwYJKoZIhvcNAQkEMSIEIJ8/HRUwo5c7LyfB4n6fXORpin5RdHwPnSlOtgAMAPm4MA0GCSqGSIb3DQEBAQUABIIBAEIlbSqYXbPacK6z/BHe6nwpO8WwktajgVLXz+POTY8h8BQW5bUSk7ITYJZiDRNACjTwdAlp+GlAcY5PftWyhy+OnGObGOg9nqCBtEWP3OykWpZgm+MdmGPpDLRKRFivAiq5W/UUXzJqUCg1aMQBWrhWqrubviIFKSttqneWSCG+wRJqc1wirbz9ry7+flA3TF/s5X1CxvzoxdxPJsFrKH7ufmKxAIBzAdYXwYKv+mVnfXpApKkh9QxEHl96FGhqPHW386k0AdG1VPgDThNV6VEEDoaTXAUm/5QALCo4+eNcdP7HLdLXsfkSbP1S70A+clUG56q6hAxRwMHJyVSjJAs=",
"serial": "397714672226522871823541187130996691739866685101",
"expires": "2021-01-14T11:28:01.080728Z"
},
"old": "f9c4504820ea0c83b264a25302c76d5c3b6961bc788bbd3cf4b08f69c670bbe1"
}
],
"withdrawn": []
}
}
}
]
}
}
test-resources/migrations/v0_8_1/cas/ta/info.json
-6
View File
@@ -1,6 +0,0 @@
{
"snapshot_version": 10,
"last_event": 9,
"last_command": 7,
"last_update": "2021-01-13T11:28:01.074918Z"
}
test-resources/migrations/v0_8_1/cas/ta/snapshot-bk.json
-99
View File
@@ -1,99 +0,0 @@
{
"handle": "ta",
"version": 5,
"id": {
"key": "D272D0F1E7F20EBE4F3038F29ACFA9774590E835",
"cert": "MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhEMjcyRDBGMUU3RjIwRUJFNEYzMDM4RjI5QUNGQTk3NzQ1OTBFODM1MB4XDTIxMDEwNzE0NDM0MloXDTM2MDEwNzE0NDg0MlowMzExMC8GA1UEAxMoRDI3MkQwRjFFN0YyMEVCRTRGMzAzOEYyOUFDRkE5Nzc0NTkwRTgzNTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN3jacZMe8xlT+AcOVWbj49zwPCzQpzNSwUTPqsYYhAU9mwQXA0tFx0e5VC+qGYCMLJkY1goywEi+qiLJVdlLSmB8LokYcgJKG9EIw3q3JxrfseLVWJjbQAd0VdkG4FvU3LtB+f3Yr1whM6T4AOt070de/9Ox20RioCiSBCEsgfLTmFZsGCzUomtp9krfO7HpBMar08YJ46Bm1h450K79+AbvvhaRctSnrmaxjd/TBi4Q6FtskkcRonBCF1Lcu8eqn1nnfjglflOu/5yOqk+4OXel9b4zx+iooybmjhIhi6istKpYQgzVaAVnpGP3//wF6/zgQsxfHtC74DDA6jvJq8CAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU0nLQ8efyDr5PMDjyms+pd0WQ6DUwHwYDVR0jBBgwFoAU0nLQ8efyDr5PMDjyms+pd0WQ6DUwDQYJKoZIhvcNAQELBQADggEBAMWMRfUSu2C3VznHT+gH7Hg1UobuxZSAlN44kgcWryZa849oPml4OPy3iGKCeEKDxuEAdM/FGXgOUkMSR/psP3ym5FG+RVollSyj25GVgmgmxkV9VaoT4xiJxg3qfHNIeDgReLWYumfHanrpuVw56fhQb+5IEkq4Cw1mrSeoJxtC5Hdij/taylXJ0kP9rEnC5Kh7xGQlvMQXZc+Zn3i+myyHBK8EgUH7un++6b6uxNY+8/2MWN5kO/0sY2QQCgXAfFToiY95emR//c5rud3Wx4oboiS/u4iAObDyV5dCPpHKEP9lG6JWEOkRZYBA5KHydHhYHnKFJ+awvevrr+qn918="
},
"repository": {
"embedded": {
"base_uri": "rsync://lostlhost/repo/ta/",
"rpki_notify": "https://localhost:3000/rrdp/notification.xml"
}
},
"repository_pending_withdraw": null,
"parents": {
"ta": {
"ta": {
"cert": "MIIIZjCCB06gAwIBAgIUL1jmoavzDeBUl69dks9XgsYxicwwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEwIBcNMjEwMTA3MTQ0MzQyWhgPMjEyMTAxMDcxNDQ4NDJaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQ0QyODM2REI3MjQ0NDMyNzU3OTNGODk5MkYzREMwMzUzRjA2NkRFNzk1QzMzMUMwMjRENUYxOUZGNEQ0OUZCQjdGQzc2MkRENkJENUUxNDIyM0U3MDQyMjYxMzY3MkFEQzVENkRDQkQxRTU5NTJCQTU1OTcwNzM4QzhERDBEMEQ3MjkyREM2NzkzMzYwOEU5RUI1ODJFRjk2NTcxNkIwM0YzMDM1MzY1OURGQTU0MjA1RDczRkI0RENBNzQzOTRDQUYyM0YyNzQyQjJBODExQ0Y5MkI0MjZGNTk0NzZGQkQzMDNBREY3MjI4MjY1MDMzMDBGRENGMjlBNTMxRjY0NDc3N0U1NTE3MDdGQzhDODUyN0QzNzRBMUEyNDEyNkZGMjJGOEY0QkVEOTRDQkRBRTQ2Njc1MzI2RDBEMDI2NDU5ODUyODk4OTk3QzNFNjc3NUFDMTk5RUQxRTc5MEUzMkIwN0FGQjI4N0YyQTdGQzlERjc0RkZGNDg1NzlBMDcyNEYyRDJDNTdDMjdFOEQwREUxMkNENkQ2RTJBRTJFMkMxMjkxNTE4MzdEMTVDRThBREI1NzA1NEJCODU2NUY4RDU4NEU4MzkxODE1RjA0MzZGOUMzOEZERUUxMDVCQjk4RjZDQUQ1MjE5RkUyNkNCQkY2MDNCM0M4N0MxN0FBQ0YwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzSg223JEQydXk/iZLz3ANT8GbeeVwzHAJNXxn/TUn7t/x2Lda9XhQiPnBCJhNnKtxdbcvR5ZUrpVlwc4yN0NDXKS3GeTNgjp61gu+WVxawPzA1NlnfpUIF1z+03KdDlMryPydCsqgRz5K0JvWUdvvTA633IoJlAzAP3PKaUx9kR3flUXB/yMhSfTdKGiQSb/Ivj0vtlMva5GZ1Mm0NAmRZhSiYmXw+Z3WsGZ7R55DjKwevsofyp/yd90//SFeaByTy0sV8J+jQ3hLNbW4q4uLBKRUYN9Fc6K21cFS7hWX41YToORgV8ENvnDj97hBbuY9srVIZ/ibLv2A7PIfBeqzwIDAQABo4IBdjCCAXIwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUhQtAABMRo95Q7W09+snI0Ic/PgMwDgYDVR0PAQH/BAQDAgEGMIHJBggrBgEFBQcBCwSBvDCBuTAnBggrBgEFBQcwBYYbcnN5bmM6Ly9sb3N0bGhvc3QvcmVwby90YS8wMFQGCCsGAQUFBzAKhkhyc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhLzAvODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5tZnQwOAYIKwYBBQUHMA2GLGh0dHBzOi8vbG9jYWxob3N0OjMwMDAvcnJkcC9ub3RpZmljYXRpb24ueG1sMBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwJwYIKwYBBQUHAQcBAf8EGDAWMAkEAgABMAMDAQAwCQQCAAIwAwMBADAhBggrBgEFBQcBCAEB/wQSMBCgDjAMMAoCAQACBQD/////MA0GCSqGSIb3DQEBCwUAA4IBAQCkZ0kAVe2d8sIp9+DUtf4nvXItI2H1ouWZIJnOgBvrWlwTMbfijQxRD04WSLwzOVC39+2bqP9GGDqr9nBOPbpbtQPhYhV4wbvaVLc7wFgIrVrJ/D7fV9HasH6xQpeH1c/plHKPHFQdHGQZU/s3DKwl1cJ4iMxqRbuC3d3LwnMOuviej58EzDW351ZCu8xNxah93VS5Rspw0x2OHhml5xGIg735QKlXKT0gVfFN8CG+AOjzD0l5wKv7Nt7HQ07ikAYj6NZ7/7eiupg9hIyspWif+po7MKzhbR3PrYcLOFp9jAOCdMOY7E3blgZVsQsIZGQO4tTtgdnYURw0I4kx2YQW",
"resources": {
"asn": "AS0-AS4294967295",
"v4": "0.0.0.0/0",
"v6": "::/0"
},
"tal": {
"uris": [
"https://localhost:3000/rrdp/ta/ta.cer"
],
"encoded_ski": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzSg223JEQydXk/iZLz3ANT8GbeeVwzHAJNXxn/TUn7t/x2Lda9XhQiPnBCJhNnKtxdbcvR5ZUrpVlwc4yN0NDXKS3GeTNgjp61gu+WVxawPzA1NlnfpUIF1z+03KdDlMryPydCsqgRz5K0JvWUdvvTA633IoJlAzAP3PKaUx9kR3flUXB/yMhSfTdKGiQSb/Ivj0vtlMva5GZ1Mm0NAmRZhSiYmXw+Z3WsGZ7R55DjKwevsofyp/yd90//SFeaByTy0sV8J+jQ3hLNbW4q4uLBKRUYN9Fc6K21cFS7hWX41YToORgV8ENvnDj97hBbuY9srVIZ/ibLv2A7PIfBeqzwIDAQAB"
}
}
}
},
"next_class_name": 1,
"resources": {
"0": {
"name": "0",
"name_space": "0",
"parent_handle": "ta",
"parent_rc_name": "0",
"roas": {},
"certificates": {
"inner": {}
},
"last_key_change": "2021-01-07T14:48:42.205924Z",
"key_state": {
"active": {
"key_id": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03",
"incoming_cert": {
"cert": "MIIIZjCCB06gAwIBAgIUL1jmoavzDeBUl69dks9XgsYxicwwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEwIBcNMjEwMTA3MTQ0MzQyWhgPMjEyMTAxMDcxNDQ4NDJaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQ0QyODM2REI3MjQ0NDMyNzU3OTNGODk5MkYzREMwMzUzRjA2NkRFNzk1QzMzMUMwMjRENUYxOUZGNEQ0OUZCQjdGQzc2MkRENkJENUUxNDIyM0U3MDQyMjYxMzY3MkFEQzVENkRDQkQxRTU5NTJCQTU1OTcwNzM4QzhERDBEMEQ3MjkyREM2NzkzMzYwOEU5RUI1ODJFRjk2NTcxNkIwM0YzMDM1MzY1OURGQTU0MjA1RDczRkI0RENBNzQzOTRDQUYyM0YyNzQyQjJBODExQ0Y5MkI0MjZGNTk0NzZGQkQzMDNBREY3MjI4MjY1MDMzMDBGRENGMjlBNTMxRjY0NDc3N0U1NTE3MDdGQzhDODUyN0QzNzRBMUEyNDEyNkZGMjJGOEY0QkVEOTRDQkRBRTQ2Njc1MzI2RDBEMDI2NDU5ODUyODk4OTk3QzNFNjc3NUFDMTk5RUQxRTc5MEUzMkIwN0FGQjI4N0YyQTdGQzlERjc0RkZGNDg1NzlBMDcyNEYyRDJDNTdDMjdFOEQwREUxMkNENkQ2RTJBRTJFMkMxMjkxNTE4MzdEMTVDRThBREI1NzA1NEJCODU2NUY4RDU4NEU4MzkxODE1RjA0MzZGOUMzOEZERUUxMDVCQjk4RjZDQUQ1MjE5RkUyNkNCQkY2MDNCM0M4N0MxN0FBQ0YwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzSg223JEQydXk/iZLz3ANT8GbeeVwzHAJNXxn/TUn7t/x2Lda9XhQiPnBCJhNnKtxdbcvR5ZUrpVlwc4yN0NDXKS3GeTNgjp61gu+WVxawPzA1NlnfpUIF1z+03KdDlMryPydCsqgRz5K0JvWUdvvTA633IoJlAzAP3PKaUx9kR3flUXB/yMhSfTdKGiQSb/Ivj0vtlMva5GZ1Mm0NAmRZhSiYmXw+Z3WsGZ7R55DjKwevsofyp/yd90//SFeaByTy0sV8J+jQ3hLNbW4q4uLBKRUYN9Fc6K21cFS7hWX41YToORgV8ENvnDj97hBbuY9srVIZ/ibLv2A7PIfBeqzwIDAQABo4IBdjCCAXIwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUhQtAABMRo95Q7W09+snI0Ic/PgMwDgYDVR0PAQH/BAQDAgEGMIHJBggrBgEFBQcBCwSBvDCBuTAnBggrBgEFBQcwBYYbcnN5bmM6Ly9sb3N0bGhvc3QvcmVwby90YS8wMFQGCCsGAQUFBzAKhkhyc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhLzAvODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5tZnQwOAYIKwYBBQUHMA2GLGh0dHBzOi8vbG9jYWxob3N0OjMwMDAvcnJkcC9ub3RpZmljYXRpb24ueG1sMBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwJwYIKwYBBQUHAQcBAf8EGDAWMAkEAgABMAMDAQAwCQQCAAIwAwMBADAhBggrBgEFBQcBCAEB/wQSMBCgDjAMMAoCAQACBQD/////MA0GCSqGSIb3DQEBCwUAA4IBAQCkZ0kAVe2d8sIp9+DUtf4nvXItI2H1ouWZIJnOgBvrWlwTMbfijQxRD04WSLwzOVC39+2bqP9GGDqr9nBOPbpbtQPhYhV4wbvaVLc7wFgIrVrJ/D7fV9HasH6xQpeH1c/plHKPHFQdHGQZU/s3DKwl1cJ4iMxqRbuC3d3LwnMOuviej58EzDW351ZCu8xNxah93VS5Rspw0x2OHhml5xGIg735QKlXKT0gVfFN8CG+AOjzD0l5wKv7Nt7HQ07ikAYj6NZ7/7eiupg9hIyspWif+po7MKzhbR3PrYcLOFp9jAOCdMOY7E3blgZVsQsIZGQO4tTtgdnYURw0I4kx2YQW",
"uri": "rsync://lostlhost/repo/ta/ta.cer",
"resources": {
"asn": "AS0-AS4294967295",
"v4": "0.0.0.0/0",
"v6": "::/0"
}
},
"current_set": {
"number": 1,
"revocations": [],
"manifest_info": {
"name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.mft",
"current": {
"content": "MIILDgYJKoZIhvcNAQcCoIIK/zCCCvsCAQMxDTALBglghkgBZQMEAgEwgZsGCyqGSIb3DQEJEAEaoIGLBIGIMIGFAgEBGA8yMDIxMDEwNzE0NDM0MloYDzIwMjEwMTA4MTQ0ODQyWgYJYIZIAWUDBAIBMFMwURYsODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwDIQBXMtxEZAK2j3yWhvJ8kdnJVY3JzDGX8tOPAwdVQIiubaCCCJkwggiVMIIHfaADAgECAhR7d20umSmlUcdHOHFN7onxJPoZ/TANBgkqhkiG9w0BAQsFADCCAi0xggIpMIICJQYDVQQDE4ICHDMwODIwMTBBMDI4MjAxMDEwMENEMjgzNkRCNzI0NDQzMjc1NzkzRjg5OTJGM0RDMDM1M0YwNjZERTc5NUMzMzFDMDI0RDVGMTlGRjRENDlGQkI3RkM3NjJERDZCRDVFMTQyMjNFNzA0MjI2MTM2NzJBREM1RDZEQ0JEMUU1OTUyQkE1NTk3MDczOEM4REQwRDBENzI5MkRDNjc5MzM2MDhFOUVCNTgyRUY5NjU3MTZCMDNGMzAzNTM2NTlERkE1NDIwNUQ3M0ZCNERDQTc0Mzk0Q0FGMjNGMjc0MkIyQTgxMUNGOTJCNDI2RjU5NDc2RkJEMzAzQURGNzIyODI2NTAzMzAwRkRDRjI5QTUzMUY2NDQ3NzdFNTUxNzA3RkM4Qzg1MjdEMzc0QTFBMjQxMjZGRjIyRjhGNEJFRDk0Q0JEQUU0NjY3NTMyNkQwRDAyNjQ1OTg1Mjg5ODk5N0MzRTY3NzVBQzE5OUVEMUU3OTBFMzJCMDdBRkIyODdGMkE3RkM5REY3NEZGRjQ4NTc5QTA3MjRGMkQyQzU3QzI3RThEMERFMTJDRDZENkUyQUUyRTJDMTI5MTUxODM3RDE1Q0U4QURCNTcwNTRCQjg1NjVGOEQ1ODRFODM5MTgxNUYwNDM2RjlDMzhGREVFMTA1QkI5OEY2Q0FENTIxOUZFMjZDQkJGNjAzQjNDODdDMTdBQUNGMDIwMzAxMDAwMTAeFw0yMTAxMDcxNDQzNDJaFw0yMTAxMTQxNDQ4NDJaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQjVBRjI5QUY3ODIxM0YyNTZERTg2OUI4ODhEQzRENEY0OUI2NkE4QzM1RjkwMkY5QjFDNTY2RUI5QUNFODU5MDMyRTM4MkI0NkIzNzRBRDg2MjczMDNENEZBRDg5MEI2RDQ3NTBFOTFBNUIyMDU3OTBEMjU0Q0VDRkYzRjlCRTU3RUY3Qzc4RDZBMEUxMTQ4RUNCMkQzMjY0OEE4NDUwQ0E4Nzc4N0Y5MTkwQkFDMUFFQjA2RDcyODZBNDlBN0Q2QjYyMUVBQUExMDc2NUJFQzUwMUM0NTcxMzA4QTZDNUZBNTM5MjdGNzYzN0U5RkQxMDAyMzE4QTBGNjRGMkU3MzgyMUE3RTRGNzBERTQ3MjA5NjA3MzRCOTlCOTRENUI2QkQzQjE4M0NFQUY1MjQxNUVEN0Y1NTJBMDIxQTM1NjJEOTVGREYxNjJDNkU5MTNCNzlFMzcxMUJENDkyQzZERjFBNzk5QTUxRDA1RDQwRTU0RkZDQTU3Q0I0OUNCNEM5QkI2MDBFMkVEMDQxNkZGMTRBNTlGNDRFNTMzQzU1ODI2RTkyMDM3M0I4MzFDMzA5MEYzMDUwNjA0Qzg4QURFNUNDODVFNUMyQ0NFM0M2NTE2MkFBQ0VDMjk1QjI2Q0U2MDFBNTM1MjAxMjI1MTlDN0Y2ODQ3NzI1MDI2RTlFMTEwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAta8pr3ghPyVt6Gm4iNxNT0m2aow1+QL5scVm65rOhZAy44K0azdK2GJzA9T62JC21HUOkaWyBXkNJUzs/z+b5X73x41qDhFI7LLTJkioRQyod4f5GQusGusG1yhqSafWtiHqqhB2W+xQHEVxMIpsX6U5J/djfp/RACMYoPZPLnOCGn5PcN5HIJYHNLmblNW2vTsYPOr1JBXtf1UqAho1Ytlf3xYsbpE7eeNxG9SSxt8aeZpR0F1A5U/8pXy0nLTJu2AOLtBBb/FKWfROUzxVgm6SA3O4McMJDzBQYEyIreXMheXCzOPGUWKqzsKVsmzmAaU1IBIlGcf2hHclAm6eEQIDAQABo4IBpzCCAaMwHQYDVR0OBBYEFDHUwV2kk93zGIbpVc6wgx5WA7yHMB8GA1UdIwQYMBaAFIULQAATEaPeUO1tPfrJyNCHPz4DMA4GA1UdDwEB/wQEAwIHgDBZBgNVHR8EUjBQME6gTKBKhkhyc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhLzAvODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwwPAYIKwYBBQUHAQEEMDAuMCwGCCsGAQUFBzAChiByc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhL3RhLmNlcjBkBggrBgEFBQcBCwRYMFYwVAYIKwYBBQUHMAuGSHJzeW5jOi8vbG9zdGxob3N0L3JlcG8vdGEvMC84NTBCNDAwMDEzMTFBM0RFNTBFRDZEM0RGQUM5QzhEMDg3M0YzRTAzLm1mdDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCEGCCsGAQUFBwEHAQH/BBIwEDAGBAIAAQUAMAYEAgACBQAwFQYIKwYBBQUHAQgBAf8EBjAEoAIFADANBgkqhkiG9w0BAQsFAAOCAQEAloqK+RhQFAtfSVI+nWBr1fyHFKVEhSMEdpGYSwzG5xBOh6iMnXM9ti4I2Olrh3rmLCx8tb76SNmm/8UsaRv0tierluN+ZxR62v271eFunAcUmGPkGY2E/u79tNGQZ1jRJCFeiN7K6fQmOzUyUilr7qifHQGLCDGiu9S21M2SJFu+RAXEUGWnDJ6CbQ/sbH6Psi0Twuo18ADBX9tPTfQEAPP/QK+wwueIdVT8Ve9l9/YpvWzSdopgCW00W4i3p14IQ90I41A+9LPmthLqX4iFYiLfaH4bY6qwfpGBlBA+iyJzSHpoKFsm75uvnUhYkUYZ7F53o6krQWg0umbV/t4LFzGCAaowggGmAgEDgBQx1MFdpJPd8xiG6VXOsIMeVgO8hzALBglghkgBZQMEAgGgazAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQARowHAYJKoZIhvcNAQkFMQ8XDTIxMDEwNzE0NDg0MlowLwYJKoZIhvcNAQkEMSIEIMLV0vz/dR2wTz93ouxGAhfLQSyOkjhlxzZfklGCB7lBMA0GCSqGSIb3DQEBAQUABIIBAGFI8XpsEwcuFdmWRjex0snxtn1ViZRe1lowZmgF32G43vCbmUq3TW7lMoHfQKnY69AvCTFVIMdR34AyLs6tZOZcvp81/He+XmYEuP7w19BRjYjeP356XRuLLUb8poGjR6vwQAQ1vgP+mvRq2twGJuwkvng3CQHxcI5Wt5WG/TJTfgdc368uMJO1861Hz24p3hCt4iqto1lXHKI4mUbLbGXbWCaxw2F3mtD/Vr5th6HO1MKrGrufwaXRSZsKCyIrYYtiQD/EMNag0m9tAToez3geIyASQsOS86rQ+BlgUrOiiyoVsgByDZh75aK2vQZmsodNnWqGuiGlYIPq0QgB6FQ=",
"serial": "704869164585700966467604688662219012818071067133",
"expires": "2021-01-08T14:48:42.210471Z"
},
"next_update": "2021-01-08T14:48:42.210471Z",
"old": null
},
"crl_info": {
"name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.crl",
"current": {
"content": "MIIDrDCCApQCAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEXDTIxMDEwNzE0NDM0MloXDTIxMDEwODE0NDg0MlowAKAvMC0wHwYDVR0jBBgwFoAUhQtAABMRo95Q7W09+snI0Ic/PgMwCgYDVR0UBAMCAQEwDQYJKoZIhvcNAQELBQADggEBABlhhKHSGBgrdHU5qG/QQQB9W6tPvcWFj8Ln5Rd7kQB5kUCt870KAs2sgVscnVXimHJPpDDi09oKaisYLNlDZb//vgOhJiU4etBqhpBHtpjAWGNqejvS/BVv0n5mlKmrsefq946RoPxMHejL28QwKpyWaRdaCsT1xSDp0+9uu/1DobucgO5vfNtYYoSVazqtx3F0M6GUh5diWtCBIHEmghHGmn16+LPdvs/AAR8z2d31q9RpaT7UI0FITme1j9rIoBHKL0OxXoPb8L/baRS5FG9NnYPgvRJ7d4AJc7T14WxdeEs+y1Kwq/V4cNX1259BFfNLXJrBX0BtAm0erKmMBEo=",
"serial": "1",
"expires": "2021-01-08T14:48:42.206964Z"
},
"old": null
}
},
"request": null
}
}
}
},
"children": {
"testbed": {
"id_cert": "MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhDMjdFQUVCNzA3Q0VBMjI1RkM1QjU0RUYwQUU1Qjg4RkE0N0QyRDNBMB4XDTIxMDEwNzE0NDM0MloXDTM2MDEwNzE0NDg0MlowMzExMC8GA1UEAxMoQzI3RUFFQjcwN0NFQTIyNUZDNUI1NEVGMEFFNUI4OEZBNDdEMkQzQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMyjKrgOjfJzCe/jzSqBKBHLNOfGlLPcGxcXjNO0KZYKYahtolEmF1tY36xxEiVZbV/p568RFV5fB7rzBc6kPnCABZzDW5RMF5g4JrNc09ZkmUYxfDj5F6OiE0iTsOhHfNm+K3l3NKWjtFuFf2+8HGoyd3toKw4KjBOPsYYOmGiECW2mAU/69VfxndJru34b3p145MzkHBCmvU0UoByItKa3IvCgEMDtT/M7nNG9IJYry8t9RycA1mlRQE7GiqAZGdXaJr+rextdGGKAiZNPmcdDi8vAInxdMW5njVyxx1aMIXHKNUAJ7XykEE3AjOsR/yixEEgalramiFaJnnHkBUECAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUwn6utwfOoiX8W1TvCuW4j6R9LTowHwYDVR0jBBgwFoAUwn6utwfOoiX8W1TvCuW4j6R9LTowDQYJKoZIhvcNAQELBQADggEBABeYST0jZYqp26k933IiKXBFyECObIMbS/Fto5oqIvS+UZYbOF8an/ivTGmOlkyNRXbVYhIW9HTXN4Zb25kBnu1y/u5gy05CkA+9lzrsdIdGvlwJHSLQDQVh7tZE45pNPBIiTbhBmM8/9Jw+GzZn75+PqUvnNh1uZT2Bi4bPMyNt0Jk4+2xci4DF9gZlLsNVy5kEDGyMr5n6ECALhAUjAcE+jeB16QChrdV32HEzHVk4nejb/w2IcrKDhT72738R33wzJWBH2VYo4dPZFFecbDEO/D7wfkC+A/15mKKPQS1rdcAXqeeuI9XKc1EmBaQ4DJNFtclWLtHdl4q6XozbRVQ=",
"resources": {
"asn": "AS0-AS4294967295",
"v4": "0.0.0.0/0",
"v6": "::/0"
},
"used_keys": {}
}
},
"routes": {
"map": {}
}
}
test-resources/migrations/v0_8_1/cas/ta/snapshot.json
-124
View File
@@ -1,124 +0,0 @@
{
"handle": "ta",
"version": 10,
"id": {
"key": "D272D0F1E7F20EBE4F3038F29ACFA9774590E835",
"cert": "MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhEMjcyRDBGMUU3RjIwRUJFNEYzMDM4RjI5QUNGQTk3NzQ1OTBFODM1MB4XDTIxMDEwNzE0NDM0MloXDTM2MDEwNzE0NDg0MlowMzExMC8GA1UEAxMoRDI3MkQwRjFFN0YyMEVCRTRGMzAzOEYyOUFDRkE5Nzc0NTkwRTgzNTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN3jacZMe8xlT+AcOVWbj49zwPCzQpzNSwUTPqsYYhAU9mwQXA0tFx0e5VC+qGYCMLJkY1goywEi+qiLJVdlLSmB8LokYcgJKG9EIw3q3JxrfseLVWJjbQAd0VdkG4FvU3LtB+f3Yr1whM6T4AOt070de/9Ox20RioCiSBCEsgfLTmFZsGCzUomtp9krfO7HpBMar08YJ46Bm1h450K79+AbvvhaRctSnrmaxjd/TBi4Q6FtskkcRonBCF1Lcu8eqn1nnfjglflOu/5yOqk+4OXel9b4zx+iooybmjhIhi6istKpYQgzVaAVnpGP3//wF6/zgQsxfHtC74DDA6jvJq8CAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU0nLQ8efyDr5PMDjyms+pd0WQ6DUwHwYDVR0jBBgwFoAU0nLQ8efyDr5PMDjyms+pd0WQ6DUwDQYJKoZIhvcNAQELBQADggEBAMWMRfUSu2C3VznHT+gH7Hg1UobuxZSAlN44kgcWryZa849oPml4OPy3iGKCeEKDxuEAdM/FGXgOUkMSR/psP3ym5FG+RVollSyj25GVgmgmxkV9VaoT4xiJxg3qfHNIeDgReLWYumfHanrpuVw56fhQb+5IEkq4Cw1mrSeoJxtC5Hdij/taylXJ0kP9rEnC5Kh7xGQlvMQXZc+Zn3i+myyHBK8EgUH7un++6b6uxNY+8/2MWN5kO/0sY2QQCgXAfFToiY95emR//c5rud3Wx4oboiS/u4iAObDyV5dCPpHKEP9lG6JWEOkRZYBA5KHydHhYHnKFJ+awvevrr+qn918="
},
"repository": {
"embedded": {
"base_uri": "rsync://lostlhost/repo/ta/",
"rpki_notify": "https://localhost:3000/rrdp/notification.xml"
}
},
"repository_pending_withdraw": null,
"parents": {
"ta": {
"ta": {
"cert": "MIIIZjCCB06gAwIBAgIUL1jmoavzDeBUl69dks9XgsYxicwwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEwIBcNMjEwMTA3MTQ0MzQyWhgPMjEyMTAxMDcxNDQ4NDJaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQ0QyODM2REI3MjQ0NDMyNzU3OTNGODk5MkYzREMwMzUzRjA2NkRFNzk1QzMzMUMwMjRENUYxOUZGNEQ0OUZCQjdGQzc2MkRENkJENUUxNDIyM0U3MDQyMjYxMzY3MkFEQzVENkRDQkQxRTU5NTJCQTU1OTcwNzM4QzhERDBEMEQ3MjkyREM2NzkzMzYwOEU5RUI1ODJFRjk2NTcxNkIwM0YzMDM1MzY1OURGQTU0MjA1RDczRkI0RENBNzQzOTRDQUYyM0YyNzQyQjJBODExQ0Y5MkI0MjZGNTk0NzZGQkQzMDNBREY3MjI4MjY1MDMzMDBGRENGMjlBNTMxRjY0NDc3N0U1NTE3MDdGQzhDODUyN0QzNzRBMUEyNDEyNkZGMjJGOEY0QkVEOTRDQkRBRTQ2Njc1MzI2RDBEMDI2NDU5ODUyODk4OTk3QzNFNjc3NUFDMTk5RUQxRTc5MEUzMkIwN0FGQjI4N0YyQTdGQzlERjc0RkZGNDg1NzlBMDcyNEYyRDJDNTdDMjdFOEQwREUxMkNENkQ2RTJBRTJFMkMxMjkxNTE4MzdEMTVDRThBREI1NzA1NEJCODU2NUY4RDU4NEU4MzkxODE1RjA0MzZGOUMzOEZERUUxMDVCQjk4RjZDQUQ1MjE5RkUyNkNCQkY2MDNCM0M4N0MxN0FBQ0YwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzSg223JEQydXk/iZLz3ANT8GbeeVwzHAJNXxn/TUn7t/x2Lda9XhQiPnBCJhNnKtxdbcvR5ZUrpVlwc4yN0NDXKS3GeTNgjp61gu+WVxawPzA1NlnfpUIF1z+03KdDlMryPydCsqgRz5K0JvWUdvvTA633IoJlAzAP3PKaUx9kR3flUXB/yMhSfTdKGiQSb/Ivj0vtlMva5GZ1Mm0NAmRZhSiYmXw+Z3WsGZ7R55DjKwevsofyp/yd90//SFeaByTy0sV8J+jQ3hLNbW4q4uLBKRUYN9Fc6K21cFS7hWX41YToORgV8ENvnDj97hBbuY9srVIZ/ibLv2A7PIfBeqzwIDAQABo4IBdjCCAXIwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUhQtAABMRo95Q7W09+snI0Ic/PgMwDgYDVR0PAQH/BAQDAgEGMIHJBggrBgEFBQcBCwSBvDCBuTAnBggrBgEFBQcwBYYbcnN5bmM6Ly9sb3N0bGhvc3QvcmVwby90YS8wMFQGCCsGAQUFBzAKhkhyc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhLzAvODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5tZnQwOAYIKwYBBQUHMA2GLGh0dHBzOi8vbG9jYWxob3N0OjMwMDAvcnJkcC9ub3RpZmljYXRpb24ueG1sMBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwJwYIKwYBBQUHAQcBAf8EGDAWMAkEAgABMAMDAQAwCQQCAAIwAwMBADAhBggrBgEFBQcBCAEB/wQSMBCgDjAMMAoCAQACBQD/////MA0GCSqGSIb3DQEBCwUAA4IBAQCkZ0kAVe2d8sIp9+DUtf4nvXItI2H1ouWZIJnOgBvrWlwTMbfijQxRD04WSLwzOVC39+2bqP9GGDqr9nBOPbpbtQPhYhV4wbvaVLc7wFgIrVrJ/D7fV9HasH6xQpeH1c/plHKPHFQdHGQZU/s3DKwl1cJ4iMxqRbuC3d3LwnMOuviej58EzDW351ZCu8xNxah93VS5Rspw0x2OHhml5xGIg735QKlXKT0gVfFN8CG+AOjzD0l5wKv7Nt7HQ07ikAYj6NZ7/7eiupg9hIyspWif+po7MKzhbR3PrYcLOFp9jAOCdMOY7E3blgZVsQsIZGQO4tTtgdnYURw0I4kx2YQW",
"resources": {
"asn": "AS0-AS4294967295",
"v4": "0.0.0.0/0",
"v6": "::/0"
},
"tal": {
"uris": [
"https://localhost:3000/rrdp/ta/ta.cer"
],
"encoded_ski": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzSg223JEQydXk/iZLz3ANT8GbeeVwzHAJNXxn/TUn7t/x2Lda9XhQiPnBCJhNnKtxdbcvR5ZUrpVlwc4yN0NDXKS3GeTNgjp61gu+WVxawPzA1NlnfpUIF1z+03KdDlMryPydCsqgRz5K0JvWUdvvTA633IoJlAzAP3PKaUx9kR3flUXB/yMhSfTdKGiQSb/Ivj0vtlMva5GZ1Mm0NAmRZhSiYmXw+Z3WsGZ7R55DjKwevsofyp/yd90//SFeaByTy0sV8J+jQ3hLNbW4q4uLBKRUYN9Fc6K21cFS7hWX41YToORgV8ENvnDj97hBbuY9srVIZ/ibLv2A7PIfBeqzwIDAQAB"
}
}
}
},
"next_class_name": 1,
"resources": {
"0": {
"name": "0",
"name_space": "0",
"parent_handle": "ta",
"parent_rc_name": "0",
"roas": {},
"certificates": {
"inner": {
"578C2EF4CFC1810860F52DC0D86530B1176FAE2B": {
"uri": "rsync://lostlhost/repo/ta/0/578C2EF4CFC1810860F52DC0D86530B1176FAE2B.cer",
"limit": {
"asn": "none",
"v4": "none",
"v6": "none"
},
"resource_set": {
"asn": "AS0-AS4294967295",
"v4": "0.0.0.0/0",
"v6": "::/0"
},
"cert": "MIIHLTCCBhWgAwIBAgIUI/SFnDjXvYPFZXmeG9gQPoh0CFYwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEwHhcNMjEwMTA3MTQ0MzQ0WhcNMjIwMTA2MTQ0ODQ0WjAzMTEwLwYDVQQDEyg1NzhDMkVGNENGQzE4MTA4NjBGNTJEQzBEODY1MzBCMTE3NkZBRTJCMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtmHy7qwTc91JeWA4ClyPrnIsGegWpdCJwfJvmXgsTxIjld+m42CzrwjdaIfTiBy3lH4tLUDlGi71TFdJBQnHdX0od3c2i1QBKqYaLFomOFEDxaafA3khAAyQqsxIHA1XAoz4E8sw3E6VbwxRL0k7/6dlfBZgSvSgsL7SLTsgZ7RibcxCm5yB5i+XzMa51cHVIKW6LNMlbl/89RT2RO4cSVFm5aHixpE9WlII8OAwy5cXC9jZQaQey7Xz4WPmYB682CZv5az0tg+mucpJvQ1zViTYee4fv2vLE9Xo+jF0aGNwMxDGRJoIEUmGjiYwnbq3ICjHV6knV7GTvzN+H2zxrQIDAQABo4ICOzCCAjcwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUV4wu9M/BgQhg9S3A2GUwsRdvriswHwYDVR0jBBgwFoAUhQtAABMRo95Q7W09+snI0Ic/PgMwDgYDVR0PAQH/BAQDAgEGMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9zdGxob3N0L3JlcG8vdGEvMC84NTBCNDAwMDEzMTFBM0RFNTBFRDZEM0RGQUM5QzhEMDg3M0YzRTAzLmNybDA8BggrBgEFBQcBAQQwMC4wLAYIKwYBBQUHMAKGIHJzeW5jOi8vbG9zdGxob3N0L3JlcG8vdGEvdGEuY2VyMIHUBggrBgEFBQcBCwSBxzCBxDAtBggrBgEFBQcwBYYhcnN5bmM6Ly9sb3N0bGhvc3QvcmVwby90ZXN0YmVkLzAvMFkGCCsGAQUFBzAKhk1yc3luYzovL2xvc3RsaG9zdC9yZXBvL3Rlc3RiZWQvMC81NzhDMkVGNENGQzE4MTA4NjBGNTJEQzBEODY1MzBCMTE3NkZBRTJCLm1mdDA4BggrBgEFBQcwDYYsaHR0cHM6Ly9sb2NhbGhvc3Q6MzAwMC9ycmRwL25vdGlmaWNhdGlvbi54bWwwGAYDVR0gAQH/BA4wDDAKBggrBgEFBQcOAjAnBggrBgEFBQcBBwEB/wQYMBYwCQQCAAEwAwMBADAJBAIAAjADAwEAMCEGCCsGAQUFBwEIAQH/BBIwEKAOMAwwCgIBAAIFAP////8wDQYJKoZIhvcNAQELBQADggEBALDZ4wTeOjHCs6FTTEJzZrJWUAU4kev2AwSN/FyEIxxfG507FPhd0W3jVL2ya/Rg5QwyCebjCPAk8Jz55pn7Nh87/USImmc4U+myRn+QiFUmz4Iv0kC0chpOGyPhbmvAw4Lv1Yy4RAZG3oagB2YtxAH8P5vPVuRcbgsVPsi/kgr3kkwXkaI+g2RQnuC3B2JDtpNLvyXcJNvylgsHsG8IbTioKJGe+h4cgotx+/lU1wr3PmSL+QxzGSbCBQyrYnbsaPGEPXpxPE4I1oV8VBUaSzpkNTt7o0qjgpyC+AryUqUJQDWL79dYCL2Yh+5mqWeAi+nPP94jzON7dHWIF5Vat/Q=",
"replaces": null
}
}
},
"last_key_change": "2021-01-07T14:48:42.205924Z",
"key_state": {
"active": {
"key_id": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03",
"incoming_cert": {
"cert": "MIIIZjCCB06gAwIBAgIUL1jmoavzDeBUl69dks9XgsYxicwwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEwIBcNMjEwMTA3MTQ0MzQyWhgPMjEyMTAxMDcxNDQ4NDJaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQ0QyODM2REI3MjQ0NDMyNzU3OTNGODk5MkYzREMwMzUzRjA2NkRFNzk1QzMzMUMwMjRENUYxOUZGNEQ0OUZCQjdGQzc2MkRENkJENUUxNDIyM0U3MDQyMjYxMzY3MkFEQzVENkRDQkQxRTU5NTJCQTU1OTcwNzM4QzhERDBEMEQ3MjkyREM2NzkzMzYwOEU5RUI1ODJFRjk2NTcxNkIwM0YzMDM1MzY1OURGQTU0MjA1RDczRkI0RENBNzQzOTRDQUYyM0YyNzQyQjJBODExQ0Y5MkI0MjZGNTk0NzZGQkQzMDNBREY3MjI4MjY1MDMzMDBGRENGMjlBNTMxRjY0NDc3N0U1NTE3MDdGQzhDODUyN0QzNzRBMUEyNDEyNkZGMjJGOEY0QkVEOTRDQkRBRTQ2Njc1MzI2RDBEMDI2NDU5ODUyODk4OTk3QzNFNjc3NUFDMTk5RUQxRTc5MEUzMkIwN0FGQjI4N0YyQTdGQzlERjc0RkZGNDg1NzlBMDcyNEYyRDJDNTdDMjdFOEQwREUxMkNENkQ2RTJBRTJFMkMxMjkxNTE4MzdEMTVDRThBREI1NzA1NEJCODU2NUY4RDU4NEU4MzkxODE1RjA0MzZGOUMzOEZERUUxMDVCQjk4RjZDQUQ1MjE5RkUyNkNCQkY2MDNCM0M4N0MxN0FBQ0YwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzSg223JEQydXk/iZLz3ANT8GbeeVwzHAJNXxn/TUn7t/x2Lda9XhQiPnBCJhNnKtxdbcvR5ZUrpVlwc4yN0NDXKS3GeTNgjp61gu+WVxawPzA1NlnfpUIF1z+03KdDlMryPydCsqgRz5K0JvWUdvvTA633IoJlAzAP3PKaUx9kR3flUXB/yMhSfTdKGiQSb/Ivj0vtlMva5GZ1Mm0NAmRZhSiYmXw+Z3WsGZ7R55DjKwevsofyp/yd90//SFeaByTy0sV8J+jQ3hLNbW4q4uLBKRUYN9Fc6K21cFS7hWX41YToORgV8ENvnDj97hBbuY9srVIZ/ibLv2A7PIfBeqzwIDAQABo4IBdjCCAXIwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUhQtAABMRo95Q7W09+snI0Ic/PgMwDgYDVR0PAQH/BAQDAgEGMIHJBggrBgEFBQcBCwSBvDCBuTAnBggrBgEFBQcwBYYbcnN5bmM6Ly9sb3N0bGhvc3QvcmVwby90YS8wMFQGCCsGAQUFBzAKhkhyc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhLzAvODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5tZnQwOAYIKwYBBQUHMA2GLGh0dHBzOi8vbG9jYWxob3N0OjMwMDAvcnJkcC9ub3RpZmljYXRpb24ueG1sMBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwJwYIKwYBBQUHAQcBAf8EGDAWMAkEAgABMAMDAQAwCQQCAAIwAwMBADAhBggrBgEFBQcBCAEB/wQSMBCgDjAMMAoCAQACBQD/////MA0GCSqGSIb3DQEBCwUAA4IBAQCkZ0kAVe2d8sIp9+DUtf4nvXItI2H1ouWZIJnOgBvrWlwTMbfijQxRD04WSLwzOVC39+2bqP9GGDqr9nBOPbpbtQPhYhV4wbvaVLc7wFgIrVrJ/D7fV9HasH6xQpeH1c/plHKPHFQdHGQZU/s3DKwl1cJ4iMxqRbuC3d3LwnMOuviej58EzDW351ZCu8xNxah93VS5Rspw0x2OHhml5xGIg735QKlXKT0gVfFN8CG+AOjzD0l5wKv7Nt7HQ07ikAYj6NZ7/7eiupg9hIyspWif+po7MKzhbR3PrYcLOFp9jAOCdMOY7E3blgZVsQsIZGQO4tTtgdnYURw0I4kx2YQW",
"uri": "rsync://lostlhost/repo/ta/ta.cer",
"resources": {
"asn": "AS0-AS4294967295",
"v4": "0.0.0.0/0",
"v6": "::/0"
}
},
"current_set": {
"number": 4,
"revocations": [
{
"serial": "201831291475634267796886973706723420667525891444",
"expires": "2021-01-09T10:14:00.687129Z"
}
],
"manifest_info": {
"name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.mft",
"current": {
"content": "MIILYgYJKoZIhvcNAQcCoIILUzCCC08CAQMxDTALBglghkgBZQMEAgEwge8GCyqGSIb3DQEJEAEaoIHfBIHcMIHZAgEEGA8yMDIxMDExMzExMjMwMVoYDzIwMjEwMTE0MTEyODAxWgYJYIZIAWUDBAIBMIGmMFEWLDg1MEI0MDAwMTMxMUEzREU1MEVENkQzREZBQzlDOEQwODczRjNFMDMuY3JsAyEA6mNo+nxZrIChzTmZT8JK3Aj1o0JHc8tyRh0B9/kPiMswURYsNTc4QzJFRjRDRkMxODEwODYwRjUyREMwRDg2NTMwQjExNzZGQUUyQi5jZXIDIQDES0HAlYo04PXRT0c89CgJvEFXzkRnuAjBR4dG8uRKLKCCCJkwggiVMIIHfaADAgECAhRFqiSIGoF+Nq3QuPFW3aEexfnerTANBgkqhkiG9w0BAQsFADCCAi0xggIpMIICJQYDVQQDE4ICHDMwODIwMTBBMDI4MjAxMDEwMENEMjgzNkRCNzI0NDQzMjc1NzkzRjg5OTJGM0RDMDM1M0YwNjZERTc5NUMzMzFDMDI0RDVGMTlGRjRENDlGQkI3RkM3NjJERDZCRDVFMTQyMjNFNzA0MjI2MTM2NzJBREM1RDZEQ0JEMUU1OTUyQkE1NTk3MDczOEM4REQwRDBENzI5MkRDNjc5MzM2MDhFOUVCNTgyRUY5NjU3MTZCMDNGMzAzNTM2NTlERkE1NDIwNUQ3M0ZCNERDQTc0Mzk0Q0FGMjNGMjc0MkIyQTgxMUNGOTJCNDI2RjU5NDc2RkJEMzAzQURGNzIyODI2NTAzMzAwRkRDRjI5QTUzMUY2NDQ3NzdFNTUxNzA3RkM4Qzg1MjdEMzc0QTFBMjQxMjZGRjIyRjhGNEJFRDk0Q0JEQUU0NjY3NTMyNkQwRDAyNjQ1OTg1Mjg5ODk5N0MzRTY3NzVBQzE5OUVEMUU3OTBFMzJCMDdBRkIyODdGMkE3RkM5REY3NEZGRjQ4NTc5QTA3MjRGMkQyQzU3QzI3RThEMERFMTJDRDZENkUyQUUyRTJDMTI5MTUxODM3RDE1Q0U4QURCNTcwNTRCQjg1NjVGOEQ1ODRFODM5MTgxNUYwNDM2RjlDMzhGREVFMTA1QkI5OEY2Q0FENTIxOUZFMjZDQkJGNjAzQjNDODdDMTdBQUNGMDIwMzAxMDAwMTAeFw0yMTAxMTMxMTIzMDFaFw0yMTAxMjAxMTI4MDFaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwOUNGOTAzRERFMzI4M0JBN0I1RDcyQUY5RUNFRjk4N0Q4NTU3MTFGOUQ5MDhCMzY3NjczOTkyNTA5OTgxRDE4NjNCQzcxMUU3Njg1QzE4ODk2Rjc1OTI2NjU0ODczRjZENUM3NjcyNUQzQTY5RTEyRjk1MEE2ODE0OUY4Q0UyMzQwNDUyRjIzMUE5RkM4NjFCRjAzMUVCM0IzMEQ0OUYzRkFGRkQ4RkJEOUYwQ0EzQkUwNzk0MEJCRUI3ODg5NTFFMTk3OUZDQjdGOTkwQUMzMUQ2MkU4MTBBRkY0MUQyMTNFRDJEOTNFOUQ0QTAzREU0RUE0N0Y3RDcwOUQ3OEI5RDFFODExRDU3NDhGRThCRDM0ODZEQ0JFNDQyRUIyMjE4OEI4OEUyMjQzMDBGODBFQzQwMEMyRkYxNzFCMTAzOEEzQTZFOTc0QUY4N0M4QzFBQjQ2RDQxOTIxMkI3MkMzODQzMjRFMEJFNTJFNTBDNzk3OUM1MkRCMzk4NUU0OTI2OENGNDE0RTQzODdGNzFCNjRFNTUxRjc2NzVFNTZDMjIxRTk2RERFRjZFNjI1QkFDMkJENzFDQUY2RTZEMTFEMEYwRDFGQkJDOUYyNTZENENBQTkxRDg0QTkwOTcyRTFFOERBNzQyOTFEMjNCMDUyMjRBOEFEREE3MkNDREI3MTEwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnPkD3eMoO6e11yr57O+YfYVXEfnZCLNnZzmSUJmB0YY7xxHnaFwYiW91kmZUhz9tXHZyXTpp4S+VCmgUn4ziNARS8jGp/IYb8DHrOzDUnz+v/Y+9nwyjvgeUC763iJUeGXn8t/mQrDHWLoEK/0HSE+0tk+nUoD3k6kf31wnXi50egR1XSP6L00hty+RC6yIYi4jiJDAPgOxADC/xcbEDijpul0r4fIwatG1BkhK3LDhDJOC+UuUMeXnFLbOYXkkmjPQU5Dh/cbZOVR92deVsIh6W3e9uYlusK9ccr25tEdDw0fu8nyVtTKqR2EqQly4ejadCkdI7BSJKit2nLM23EQIDAQABo4IBpzCCAaMwHQYDVR0OBBYEFFV4uJxrfdfmI9KQmdKtbB7YqNLZMB8GA1UdIwQYMBaAFIULQAATEaPeUO1tPfrJyNCHPz4DMA4GA1UdDwEB/wQEAwIHgDBZBgNVHR8EUjBQME6gTKBKhkhyc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhLzAvODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwwPAYIKwYBBQUHAQEEMDAuMCwGCCsGAQUFBzAChiByc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhL3RhLmNlcjBkBggrBgEFBQcBCwRYMFYwVAYIKwYBBQUHMAuGSHJzeW5jOi8vbG9zdGxob3N0L3JlcG8vdGEvMC84NTBCNDAwMDEzMTFBM0RFNTBFRDZEM0RGQUM5QzhEMDg3M0YzRTAzLm1mdDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCEGCCsGAQUFBwEHAQH/BBIwEDAGBAIAAQUAMAYEAgACBQAwFQYIKwYBBQUHAQgBAf8EBjAEoAIFADANBgkqhkiG9w0BAQsFAAOCAQEABP8eMGdPiQFqKVl61O0k3Tno4oQnjPob76oLwJguZLYD6ALVRJEjK9N/0UW89oy+c9ITfaECa18cufklZm50VnEqDvItS4KmEEKgjM0rLZDMWoRvOhXTR3Uhv8hVrwMJZqnqji7UfrdBuh/Eig/zuQrHotQQhznr6D011jGZ2LwPRn+sORB8k126fiCeykaCrqEmaxlJej67dei1SmhnILTYI46miTYlprQre1bFixXFv6Ev5+1r+sT8sY8duHb6mcpUiCNaiQKMeqsbN9vg45b+oxWe5Xj3ibitB3Kbf7oYNlHTsPlHi2jtXo0in1ODdsDYpHVqNfyNW96IaLDbiDGCAaowggGmAgEDgBRVeLica33X5iPSkJnSrWwe2KjS2TALBglghkgBZQMEAgGgazAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQARowHAYJKoZIhvcNAQkFMQ8XDTIxMDExMzExMjgwMVowLwYJKoZIhvcNAQkEMSIEIJ8/HRUwo5c7LyfB4n6fXORpin5RdHwPnSlOtgAMAPm4MA0GCSqGSIb3DQEBAQUABIIBAEIlbSqYXbPacK6z/BHe6nwpO8WwktajgVLXz+POTY8h8BQW5bUSk7ITYJZiDRNACjTwdAlp+GlAcY5PftWyhy+OnGObGOg9nqCBtEWP3OykWpZgm+MdmGPpDLRKRFivAiq5W/UUXzJqUCg1aMQBWrhWqrubviIFKSttqneWSCG+wRJqc1wirbz9ry7+flA3TF/s5X1CxvzoxdxPJsFrKH7ufmKxAIBzAdYXwYKv+mVnfXpApKkh9QxEHl96FGhqPHW386k0AdG1VPgDThNV6VEEDoaTXAUm/5QALCo4+eNcdP7HLdLXsfkSbP1S70A+clUG56q6hAxRwMHJyVSjJAs=",
"serial": "397714672226522871823541187130996691739866685101",
"expires": "2021-01-14T11:28:01.080728Z"
},
"next_update": "2021-01-14T11:28:01.080728Z",
"old": "f9c4504820ea0c83b264a25302c76d5c3b6961bc788bbd3cf4b08f69c670bbe1"
},
"crl_info": {
"name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.crl",
"current": {
"content": "MIIDrDCCApQCAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEXDTIxMDExMzExMjMwMVoXDTIxMDExNDExMjgwMVowAKAvMC0wHwYDVR0jBBgwFoAUhQtAABMRo95Q7W09+snI0Ic/PgMwCgYDVR0UBAMCAQQwDQYJKoZIhvcNAQELBQADggEBAD26Wa9JDK8ej4ADSPsZkwcFWgT7C+1t3oFA9EAxXQBNu7myhNBcNpaHO9sdKpOaouXmbE7vAWV9PfLpDtjtmxLhUYeBmjUB8RdXqxGr5aT+78a0tQjsIt/LFeolNf/J5qQZBUnwldWrO2C8qW7iFyiWEvLlfgnKD5yqhZvFhYD+UoN4pyyLGgqZJzAbXtcMab0AkGDQqLNvsyNF3CNHz136Fic3fIMum4Tp8HlyB2CYiMesBFcwgWtuCp5GzDmXr6PSC2lWxkefnsxbG6mb4cVctPNTEHTjUoC6sNKlHaaRsq/gyCBIs8ylt7RJl5cwzwL1UQZnT6RDwKGDDA/d41k=",
"serial": "4",
"expires": "2021-01-14T11:28:01.075690Z"
},
"old": "b7ed7ea610cfefc1fe51a02735ea9f2d03e450ef77bc8d8d447d2e51c0a16369"
}
},
"request": null
}
}
}
},
"children": {
"testbed": {
"id_cert": "MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhDMjdFQUVCNzA3Q0VBMjI1RkM1QjU0RUYwQUU1Qjg4RkE0N0QyRDNBMB4XDTIxMDEwNzE0NDM0MloXDTM2MDEwNzE0NDg0MlowMzExMC8GA1UEAxMoQzI3RUFFQjcwN0NFQTIyNUZDNUI1NEVGMEFFNUI4OEZBNDdEMkQzQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMyjKrgOjfJzCe/jzSqBKBHLNOfGlLPcGxcXjNO0KZYKYahtolEmF1tY36xxEiVZbV/p568RFV5fB7rzBc6kPnCABZzDW5RMF5g4JrNc09ZkmUYxfDj5F6OiE0iTsOhHfNm+K3l3NKWjtFuFf2+8HGoyd3toKw4KjBOPsYYOmGiECW2mAU/69VfxndJru34b3p145MzkHBCmvU0UoByItKa3IvCgEMDtT/M7nNG9IJYry8t9RycA1mlRQE7GiqAZGdXaJr+rextdGGKAiZNPmcdDi8vAInxdMW5njVyxx1aMIXHKNUAJ7XykEE3AjOsR/yixEEgalramiFaJnnHkBUECAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUwn6utwfOoiX8W1TvCuW4j6R9LTowHwYDVR0jBBgwFoAUwn6utwfOoiX8W1TvCuW4j6R9LTowDQYJKoZIhvcNAQELBQADggEBABeYST0jZYqp26k933IiKXBFyECObIMbS/Fto5oqIvS+UZYbOF8an/ivTGmOlkyNRXbVYhIW9HTXN4Zb25kBnu1y/u5gy05CkA+9lzrsdIdGvlwJHSLQDQVh7tZE45pNPBIiTbhBmM8/9Jw+GzZn75+PqUvnNh1uZT2Bi4bPMyNt0Jk4+2xci4DF9gZlLsNVy5kEDGyMr5n6ECALhAUjAcE+jeB16QChrdV32HEzHVk4nejb/w2IcrKDhT72738R33wzJWBH2VYo4dPZFFecbDEO/D7wfkC+A/15mKKPQS1rdcAXqeeuI9XKc1EmBaQ4DJNFtclWLtHdl4q6XozbRVQ=",
"resources": {
"asn": "AS0-AS4294967295",
"v4": "0.0.0.0/0",
"v6": "::/0"
},
"used_keys": {
"578C2EF4CFC1810860F52DC0D86530B1176FAE2B": {
"current": "0"
}
}
}
},
"routes": {
"map": {}
}
}
test-resources/migrations/v0_9_5/cas/ta/command--1645792256--1--cmd-ca-repo-update.json
-17
View File
@@ -1,17 +0,0 @@
{
"actor": "krill",
"time": "2022-02-25T12:30:56.405477897Z",
"handle": "ta",
"version": 1,
"sequence": 1,
"details": {
"type": "repo_update",
"service_uri": "https://testbed.krill.cloud/rfc8181/ta/"
},
"effect": {
"result": "success",
"events": [
1
]
}
}
test-resources/migrations/v0_9_5/cas/ta/command--1645792256--2--cmd-ca-make-ta.json
-16
View File
@@ -1,16 +0,0 @@
{
"actor": "krill",
"time": "2022-02-25T12:30:56.410915529Z",
"handle": "ta",
"version": 2,
"sequence": 2,
"details": {
"type": "make_trust_anchor"
},
"effect": {
"result": "success",
"events": [
2
]
}
}
test-resources/migrations/v0_9_5/cas/ta/command--1645792256--3--cmd-ca-rcn-receive.json
-22
View File
@@ -1,22 +0,0 @@
{
"actor": "krill",
"time": "2022-02-25T12:30:56.784994924Z",
"handle": "ta",
"version": 3,
"sequence": 3,
"details": {
"type": "update_rcvd_cert",
"resource_class_name": "0",
"resources": {
"asn": "AS0-AS4294967295",
"v4": "0.0.0.0/0",
"v6": "::/0"
}
},
"effect": {
"result": "success",
"events": [
3
]
}
}
test-resources/migrations/v0_9_5/cas/ta/command--1645792257--4--cmd-ca-child-add.json
-23
View File
@@ -1,23 +0,0 @@
{
"actor": "krill",
"time": "2022-02-25T12:30:57.075046022Z",
"handle": "ta",
"version": 4,
"sequence": 4,
"details": {
"type": "child_add",
"child": "testbed",
"ski": "DFFC9F34DD8239B816B4352C04586CE53CD7383D",
"resources": {
"asn": "AS0-AS4294967295",
"v4": "0.0.0.0/0",
"v6": "::/0"
}
},
"effect": {
"result": "success",
"events": [
4
]
}
}
test-resources/migrations/v0_9_5/cas/ta/command--1645792261--5--cmd-ca-child-certify.json
-25
View File
@@ -1,25 +0,0 @@
{
"actor": "anonymous",
"time": "2022-02-25T12:31:01.544268360Z",
"handle": "ta",
"version": 5,
"sequence": 5,
"details": {
"type": "child_certify",
"child": "testbed",
"resource_class_name": "0",
"limit": {
"asn": "none",
"v4": "none",
"v6": "none"
},
"ki": "62BC88453E78424F7F886712A4B904A07B98BEE7"
},
"effect": {
"result": "success",
"events": [
5,
6
]
}
}
test-resources/migrations/v0_9_5/cas/ta/delta-0.json
-9
View File
@@ -1,9 +0,0 @@
{
"id": "ta",
"version": 0,
"details": {
"id": {
"cert": "MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEygxOTU0MzVCMEIwQ0VDOTA0NDJBNjc3RkJFM0NGRUQwRDIwOEU3MThCMB4XDTIyMDIyNTEyMjU1NloXDTM3MDIyNTEyMzA1NlowMzExMC8GA1UEAxMoMTk1NDM1QjBCMENFQzkwNDQyQTY3N0ZCRTNDRkVEMEQyMDhFNzE4QjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL+gRHahtBp+xnhOCX6U839Ela8t9plrcv/673NV9qWd4RjZrqGa06gMjhw/2kt0lK9EEt2UqTamSJdbWYMtqi6fyxRRaSRJ4uuOUGGIIO85gJ5EbQCctZwvvUdNcMRPqBR1Ked6CYNaMibDWUUhIy4qbDhG3OgsOHg6IG1rGhJriTgUaT5NKzDX8tge/iSOIFK/ltXzeHhbzo9BzDRJnoFNZgs7rTZ14t8xScUPZsJWsLP4o62hLmYgLMMQY4Vb96KpR3z4edKYn4svd3UGIt0hPiVHnig7ZZn7d/wSbvugNMxGiHCPNJgJnwRv5tzRuBaj094bwIUdNsRCKr0olo8CAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUGVQ1sLDOyQRCpnf748/tDSCOcYswHwYDVR0jBBgwFoAUGVQ1sLDOyQRCpnf748/tDSCOcYswDQYJKoZIhvcNAQELBQADggEBAJuslEa2y/uLG2O5N/luTxFbd0HhJtbaGucP7WS7VtO8Zv/Egidd12uLyep1z4FszbSm5J0lYXeJd+Kqql3/IZfpGo4vvO5AOUFnskssFzCMoTMenI/08SdyWzDv+VvUAQee9l4IP3kOgGzJlO9U+6MEPqvsd/0irRnthq+KC5jAPT6RWLTUxMQb8bFFH92/IYe9KEYWwzhFhMXPMQmmrQc0uUXvoNjaniqEf9dH1PqYdoLvIXggkjMEw8aaj8GJEdYPuUqEDliX0QutvxXUV20EgnTqPUUzsMS2vM++eB9sf9OgBlGxrLqiuN1rY/cL/4i17r4wn3CdMUWXhMwzdSc="
}
}
}
test-resources/migrations/v0_9_5/cas/ta/delta-1.json
-19
View File
@@ -1,19 +0,0 @@
{
"id": "ta",
"version": 1,
"details": {
"type": "repo_updated",
"contact": {
"repository_response": {
"tag": null,
"publisher_handle": "ta",
"id_cert": "MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyg2QThBOUFEMTA5MjdGOUUzRTMyRDg3MjczQTg1NUIzRDBDMzRDNjFGMB4XDTIyMDIyNTEyMjU1NloXDTM3MDIyNTEyMzA1NlowMzExMC8GA1UEAxMoNkE4QTlBRDEwOTI3RjlFM0UzMkQ4NzI3M0E4NTVCM0QwQzM0QzYxRjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMt42y6PtPChcJqopCCQZkl/amGqyPwhF1QbISlnyehKVjnPfp4ITO1831bA4B7vgtKYqaFMxbrEocBw4BHv7b0hzmIVffrZ0vFYd5kODKQ/5lK9CwnBYRvBCPBu2KwIWWC1soHHdiPpM/dOVoXxmKk46aSclvFaPAn2CGrXU3Sx04yplWcMOB+9PX4ELmrgttKxJYHXMNVz89XNADWC/vgivZTic5h46PPMZIn0cKILkKdwUx05BcNzVgx2GAzvwspyhyYiT9EXBsgYaNDl0ENWZu7NLbhxLj3WXRNxd/AIWmpsDDqBiIq7n6DOqiebHu/3kapgrb7cv1L1MywhRHUCAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUaoqa0Qkn+ePjLYcnOoVbPQw0xh8wHwYDVR0jBBgwFoAUaoqa0Qkn+ePjLYcnOoVbPQw0xh8wDQYJKoZIhvcNAQELBQADggEBAIH8R3/14PK1qy1D7HOqN5FbYEO2brwSPKb0UdqNC1o8zLLJ5qGNCWoAvck+pkAJsxOPxgvzvYlwlUzuCToiXFUnDBYPXzI6u8kziJFchRIOFmaQxL+1LKhV66hgXi7r85+3nB0UMrfARzgUjXcZ9WIIQOwtSYq7yTcMHf8na7GJRelvH4B1lNht5AW6fQeRPBHleZZ3DQQc18mX2cPdm/uoegnTlTpM9dRhFTcZeezwkZvEkYG/i9rSMxVmFd1E4gN2e0CPsxdJxZ9oMNubyNToW146Y7v+M5OTibfrIqQKvsBC3BuTZRbXB9093HVmJTff33/zFYexfM3X740MhOo=",
"service_uri": "https://testbed.krill.cloud/rfc8181/ta/",
"repo_info": {
"base_uri": "rsync://testbed.krill.cloud/repo/ta/",
"rpki_notify": "https://testbed.krill.cloud/rrdp/notification.xml"
}
}
}
}
}
test-resources/migrations/v0_9_5/cas/ta/delta-2.json
-21
View File
@@ -1,21 +0,0 @@
{
"id": "ta",
"version": 2,
"details": {
"type": "trust_anchor_made",
"ta_cert_details": {
"cert": "MIIIfzCCB2egAwIBAgIUEBe+IpSz9etWpgVDQxkZJG/a48QwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCMjY5RjRENjA3RkUzRDJCMzMxQkNERDMwNDZFNTEzM0RCODJGNkM3NEJGQzRFMkE3MzBBNDYyMTg5NUUwMDk1MTk3M0I0NzY2ODIxMDJGQjNERDQyOTJFMEE4QTZCNDI4QkEyQ0I3QTRFNDJFMzFEQTFBM0U5RjFEQjgxQ0FGMDk0MDg3ODVFNDgwNkQ1OTkyN0M1MjQ1QzBDRkI5ODQyMDFCNkMxNjhBNzEzN0VBMTczOTgzRTczMDUyNERDODFCMjMzOUJDMzY1RENDMTE4REQ2QTk0NzI2RURGNzQyM0VFM0M2RTQ5RUQzRDc2QjcyMTY2NDVGMUQ5MUNCOEQ4ODZBMjQ3MTc0NENGNUVEMzIzODBEREJBRTA0QkIzQkFENTY3OTNGRDgzMTk2OTBEQzFENTZBNUZENDNBRjdFNEJCQUZGNEM4RjVFOEIwMzQ1QkYyOUU0NzA2RjAzRDg5Q0NGNTZBRjZEQkIwMkQwRThBMDZFMjJFQkFBNEJENjQ2N0JBQjVCQjI5NDlGNjRDRTZGQTM2QTJBNjlDQTQ1QkJFQjRCNzJFMjUwM0I5QTAyNDJGQjY1MEMyNUU2QjVDMDUyMkZGNTAxRjA3QTM1MTU0MkREQzdGNUUyQjVDMDlFMkEzNjk2NjZCRTVBMzc3OEMwRkUxN0UzMkNGNjVBMTAyMDMwMTAwMDEwIBcNMjIwMjI1MTIyNTU2WhgPMjEyMjAyMjUxMjMwNTZaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQjI2OUY0RDYwN0ZFM0QyQjMzMUJDREQzMDQ2RTUxMzNEQjgyRjZDNzRCRkM0RTJBNzMwQTQ2MjE4OTVFMDA5NTE5NzNCNDc2NjgyMTAyRkIzREQ0MjkyRTBBOEE2QjQyOEJBMkNCN0E0RTQyRTMxREExQTNFOUYxREI4MUNBRjA5NDA4Nzg1RTQ4MDZENTk5MjdDNTI0NUMwQ0ZCOTg0MjAxQjZDMTY4QTcxMzdFQTE3Mzk4M0U3MzA1MjREQzgxQjIzMzlCQzM2NURDQzExOERENkE5NDcyNkVERjc0MjNFRTNDNkU0OUVEM0Q3NkI3MjE2NjQ1RjFEOTFDQjhEODg2QTI0NzE3NDRDRjVFRDMyMzgwRERCQUUwNEJCM0JBRDU2NzkzRkQ4MzE5NjkwREMxRDU2QTVGRDQzQUY3RTRCQkFGRjRDOEY1RThCMDM0NUJGMjlFNDcwNkYwM0Q4OUNDRjU2QUY2REJCMDJEMEU4QTA2RTIyRUJBQTRCRDY0NjdCQUI1QkIyOTQ5RjY0Q0U2RkEzNkEyQTY5Q0E0NUJCRUI0QjcyRTI1MDNCOUEwMjQyRkI2NTBDMjVFNkI1QzA1MjJGRjUwMUYwN0EzNTE1NDJEREM3RjVFMkI1QzA5RTJBMzY5NjY2QkU1QTM3NzhDMEZFMTdFMzJDRjY1QTEwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsmn01gf+PSszG83TBG5RM9uC9sdL/E4qcwpGIYleAJUZc7R2aCEC+z3UKS4KimtCi6LLek5C4x2ho+nx24HK8JQIeF5IBtWZJ8UkXAz7mEIBtsFopxN+oXOYPnMFJNyBsjObw2XcwRjdapRybt90I+48bkntPXa3IWZF8dkcuNiGokcXRM9e0yOA3brgS7O61WeT/YMZaQ3B1Wpf1Dr35Luv9Mj16LA0W/KeRwbwPYnM9Wr227AtDooG4i66pL1kZ7q1uylJ9kzm+jaippykW760ty4lA7mgJC+2UMJea1wFIv9QHwejUVQt3H9eK1wJ4qNpZmvlo3eMD+F+Ms9loQIDAQABo4IBjzCCAYswDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUqXWSXyH8qWbZMdVswhLerEMTwPwwDgYDVR0PAQH/BAQDAgEGMIHiBggrBgEFBQcBCwSB1TCB0jAxBggrBgEFBQcwBYYlcnN5bmM6Ly90ZXN0YmVkLmtyaWxsLmNsb3VkL3JlcG8vdGEvMDBeBggrBgEFBQcwCoZScnN5bmM6Ly90ZXN0YmVkLmtyaWxsLmNsb3VkL3JlcG8vdGEvMC9BOTc1OTI1RjIxRkNBOTY2RDkzMUQ1NkNDMjEyREVBQzQzMTNDMEZDLm1mdDA9BggrBgEFBQcwDYYxaHR0cHM6Ly90ZXN0YmVkLmtyaWxsLmNsb3VkL3JyZHAvbm90aWZpY2F0aW9uLnhtbDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCcGCCsGAQUFBwEHAQH/BBgwFjAJBAIAATADAwEAMAkEAgACMAMDAQAwIQYIKwYBBQUHAQgBAf8EEjAQoA4wDDAKAgEAAgUA/////zANBgkqhkiG9w0BAQsFAAOCAQEAOcRy21AK7ctJFkgTGnzwSaSCNLKwZ6JWkfJym9DqTYe/lKgyLKHidTeAvU8AmCsHqB3y1KKbHzoRjXHVhFWZZNZVglz9vDxW81081S2RQvfkwI1vHNHaEF64K5FSRv8SpOt/h5ZtaqpD+/p7BevLS7KPu3/PvBSphK1UV2eZomeYGjUstKTT2nj96x3JZO844pM7XCWYqLPIeWj7SmqXWUoiszuL+XjtObfKvutnaMuBX/LdOgASZqFurl3F/DPiTQS4kaIFnwoAzxsvCVata17+KWRNfOzp+jLLTK/anQjRNujuvgee9wmB4UnKkqdsq7KtOBiKkitDtthPqZePGA==",
"resources": {
"asn": "AS0-AS4294967295",
"v4": "0.0.0.0/0",
"v6": "::/0"
},
"tal": {
"uris": [
"https://testbed.krill.cloud/ta/ta.cer"
],
"encoded_ski": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsmn01gf+PSszG83TBG5RM9uC9sdL/E4qcwpGIYleAJUZc7R2aCEC+z3UKS4KimtCi6LLek5C4x2ho+nx24HK8JQIeF5IBtWZJ8UkXAz7mEIBtsFopxN+oXOYPnMFJNyBsjObw2XcwRjdapRybt90I+48bkntPXa3IWZF8dkcuNiGokcXRM9e0yOA3brgS7O61WeT/YMZaQ3B1Wpf1Dr35Luv9Mj16LA0W/KeRwbwPYnM9Wr227AtDooG4i66pL1kZ7q1uylJ9kzm+jaippykW760ty4lA7mgJC+2UMJea1wFIv9QHwejUVQt3H9eK1wJ4qNpZmvlo3eMD+F+Ms9loQIDAQAB"
}
}
}
}

Some files were not shown because too many files have changed in this diff Show More