diff --git a/.gitignore b/.gitignore index 18de2ff9..5dfdbbd5 100644 --- a/.gitignore +++ b/.gitignore @@ -2,7 +2,7 @@ .idea/ .vscode/ .DS_Store -data +data* krill.log target/ tmp diff --git a/README.md b/README.md index ec8d826d..1c8f2a4d 100644 --- a/README.md +++ b/README.md @@ -31,6 +31,12 @@ in this [blog post](https://blog.nlnetlabs.nl/testing-the-waters-with-krill/). In this release we introduce an API to set up CAs, and signed objects such as ROAs in bulk. +API Changes: + +We removed the repository next update time from the stats and metrics output. +It was inaccurate (usually 8 hours off), and not very informative. More useful +metrics are still provided: last exchange and last successful exchange. If these +times differ, then there is an issue that may need attention. ## 0.12.1 'Safety Belts' diff --git a/src/bin/krillta.rs b/src/bin/krillta.rs new file mode 100644 index 00000000..4362fc8d --- /dev/null +++ b/src/bin/krillta.rs @@ -0,0 +1,30 @@ +extern crate krill; + +use krill::cli::ta_client::*; + +#[tokio::main] +async fn main() { + match TrustAnchorClientCommand::from_args() { + Ok(command) => { + let fmt = command.report_format(); + match TrustAnchorClient::process(command).await { + Ok(response) => match response.report(fmt) { + Ok(Some(msg)) => println!("{}", msg), + Ok(None) => {} + Err(e) => { + eprintln!("{}", e); + ::std::process::exit(1); + } + }, + Err(e) => { + eprintln!("{}", e); + ::std::process::exit(1); + } + } + } + Err(e) => { + eprintln!("{}", e); + ::std::process::exit(1); + } + } +} diff --git a/src/cli/mod.rs b/src/cli/mod.rs index 0d7917ba..8c55d148 100644 --- a/src/cli/mod.rs +++ b/src/cli/mod.rs @@ -4,3 +4,5 @@ pub mod report; mod client; pub use self::client::Error; pub use self::client::KrillClient; + +pub mod ta_client; diff --git a/src/cli/options.rs b/src/cli/options.rs index 6d8f9050..3be7a2f1 100644 --- a/src/cli/options.rs +++ b/src/cli/options.rs @@ -43,15 +43,49 @@ use crate::{ daemon::ca::{ResourceTaggedAttestation, RtaContentRequest, RtaPrepareRequest}, }; -struct GeneralArgs { - server: idexchange::ServiceUri, - token: Token, - format: ReportFormat, - api: bool, +#[derive(Debug)] +pub struct GeneralArgs { + pub server: idexchange::ServiceUri, + pub token: Token, + pub format: ReportFormat, + pub api: bool, } impl GeneralArgs { - fn from_matches(matches: &ArgMatches) -> Result { + pub fn add_args<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { + app.arg( + Arg::with_name(KRILL_CLI_SERVER_ARG) + .short("s") + .long(KRILL_CLI_SERVER_ARG) + .value_name("URI") + .help("The full URI to the Krill server. Or set env: KRILL_CLI_SERVER") + .required(false), + ) + .arg( + Arg::with_name(KRILL_CLI_ADMIN_TOKEN_ARG) + .short("t") + .long(KRILL_CLI_ADMIN_TOKEN_ARG) + .value_name("string") + .help("The secret token for the Krill server. Or set env: KRILL_CLI_TOKEN") + .required(false), + ) + .arg( + Arg::with_name(KRILL_CLI_FORMAT_ARG) + .short("f") + .long(KRILL_CLI_FORMAT_ARG) + .value_name("type") + .help("Report format: none|json|text (default). Or set env: KRILL_CLI_FORMAT") + .required(false), + ) + .arg( + Arg::with_name(KRILL_CLI_API_ARG) + .long(KRILL_CLI_API_ARG) + .help("Only show the API call and exit. Or set env: KRILL_CLI_API=1") + .required(false), + ) + } + + pub fn from_matches(matches: &ArgMatches) -> Result { let server = { let mut server = match env::var(KRILL_CLI_SERVER_ENV) { Ok(server_str) => Some(idexchange::ServiceUri::from_str(&server_str)?), @@ -146,39 +180,6 @@ impl Options { } } - fn add_general_args<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { - app.arg( - Arg::with_name(KRILL_CLI_SERVER_ARG) - .short("s") - .long(KRILL_CLI_SERVER_ARG) - .value_name("URI") - .help("The full URI to the Krill server. Or set env: KRILL_CLI_SERVER") - .required(false), - ) - .arg( - Arg::with_name(KRILL_CLI_ADMIN_TOKEN_ARG) - .short("t") - .long(KRILL_CLI_ADMIN_TOKEN_ARG) - .value_name("string") - .help("The secret token for the Krill server. Or set env: KRILL_CLI_TOKEN") - .required(false), - ) - .arg( - Arg::with_name(KRILL_CLI_FORMAT_ARG) - .short("f") - .long(KRILL_CLI_FORMAT_ARG) - .value_name("type") - .help("Report format: none|json|text (default). Or set env: KRILL_CLI_FORMAT") - .required(false), - ) - .arg( - Arg::with_name(KRILL_CLI_API_ARG) - .long(KRILL_CLI_API_ARG) - .help("Only show the API call and exit. Or set env: KRILL_CLI_API=1") - .required(false), - ) - } - fn add_my_ca_arg<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { app.arg( Arg::with_name(KRILL_CLI_MY_CA_ARG) @@ -290,7 +291,7 @@ impl Options { let mut simple = SubCommand::with_name("simple").about("Use a 3rd party repository for publishing"); - simple = Self::add_general_args(simple); + simple = GeneralArgs::add_args(simple); simple = add_data_dir_arg(simple); simple = add_log_file_arg(simple); @@ -301,7 +302,7 @@ impl Options { let mut with_user = SubCommand::with_name("user").about("Generate a user authentication configuration file fragment"); - with_user = Self::add_general_args(with_user); + with_user = GeneralArgs::add_args(with_user); with_user = add_id_arg(with_user); with_user = add_attr_arg(with_user); @@ -314,7 +315,7 @@ impl Options { fn make_cas_list_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let sub = SubCommand::with_name("list").about("List the current CAs"); - let sub = Self::add_general_args(sub); + let sub = GeneralArgs::add_args(sub); app.subcommand(sub) } @@ -322,7 +323,7 @@ impl Options { fn make_cas_show_ca_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("show").about("Show details of a CA"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); app.subcommand(sub) @@ -331,7 +332,7 @@ impl Options { fn make_cas_show_history_details_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("details").about("Show details for a command in the history of a CA"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); sub = sub.arg( @@ -348,7 +349,7 @@ impl Options { fn make_cas_show_history_list_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("commands").about("Show the commands sent to a CA"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); sub = sub.arg( @@ -398,7 +399,7 @@ impl Options { fn make_cas_add_ca_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("add").about("Add a new CA"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); app.subcommand(sub) @@ -408,7 +409,7 @@ impl Options { let mut sub = SubCommand::with_name("delete") .about("Delete a CA and let it withdraw its objects and request revocation. WARNING: Irreversible!"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); app.subcommand(sub) @@ -417,7 +418,7 @@ impl Options { fn make_cas_children_add_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("add").about("Add a child to a CA"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); sub = Self::add_child_arg(sub); sub = Self::add_resource_args(sub); @@ -436,7 +437,7 @@ impl Options { fn make_cas_children_update_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("update").about("Update an existing child of a CA"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); sub = Self::add_child_arg(sub); sub = Self::add_resource_args(sub); @@ -454,7 +455,7 @@ impl Options { fn make_cas_children_response_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("response").about("Show the RFC 8183 Parent Response XML"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); sub = Self::add_child_arg(sub); @@ -464,7 +465,7 @@ impl Options { fn make_cas_children_info_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("info").about("Show info for a child (id and resources)"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); sub = Self::add_child_arg(sub); @@ -474,7 +475,7 @@ impl Options { fn make_cas_children_remove_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("remove").about("Remove an existing child from a CA"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); sub = Self::add_child_arg(sub); @@ -484,7 +485,7 @@ impl Options { fn make_cas_children_connections_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("connections").about("Show connections stats for children of a CA"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); app.subcommand(sub) @@ -493,7 +494,7 @@ impl Options { fn make_cas_children_suspend_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("suspend").about("Suspend a child CA: hide certificate(s) issued to child"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); sub = Self::add_child_arg(sub); @@ -504,7 +505,7 @@ impl Options { let mut sub = SubCommand::with_name("unsuspend").about("Suspend a child CA: republish certificate(s) issued to child"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); sub = Self::add_child_arg(sub); @@ -529,7 +530,7 @@ impl Options { fn make_cas_parents_request_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("request").about("Show RFC 8183 Child Request XML"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); app.subcommand(sub) @@ -538,7 +539,7 @@ impl Options { fn make_cas_parents_add_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("add").about("Add a parent to, or update a parent of a CA"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); sub = Self::add_parent_arg(sub); sub = sub.arg( @@ -556,7 +557,7 @@ impl Options { fn make_cas_parents_statuses_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("statuses").about("Show overview of all parent statuses of a CA"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); app.subcommand(sub) @@ -565,7 +566,7 @@ impl Options { fn make_cas_parents_contact_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("contact").about("Show contact information for a parent of a CA"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); sub = Self::add_parent_arg(sub); @@ -575,7 +576,7 @@ impl Options { fn make_cas_parents_remove_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("remove").about("Remove an existing parent from a CA"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); sub = Self::add_parent_arg(sub); @@ -597,7 +598,7 @@ impl Options { fn make_cas_keyroll_init_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("init").about("Initialize roll for all keys held by a CA"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); app.subcommand(sub) @@ -606,7 +607,7 @@ impl Options { fn make_cas_keyroll_activate_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("activate").about("Finish roll for all keys held by a CA"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); app.subcommand(sub) @@ -624,7 +625,7 @@ impl Options { fn make_cas_routes_list_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("list").about("Show current authorizations"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); app.subcommand(sub) @@ -633,7 +634,7 @@ impl Options { fn make_cas_routes_update_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("update").about("Update authorizations"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); sub = sub.arg( @@ -690,7 +691,7 @@ impl Options { fn make_cas_routes_bgp_full_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("analyze").about("Show full report of ROAs vs known BGP announcements"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); app.subcommand(sub) } @@ -698,7 +699,7 @@ impl Options { fn make_cas_routes_bgp_suggestions_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("suggest").about("Show ROA suggestions based on known BGP announcements"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); sub = sub @@ -745,7 +746,7 @@ impl Options { fn make_cas_bgpsec_list_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("list").about("Show current BGPSec configurations"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); app.subcommand(sub) @@ -754,7 +755,7 @@ impl Options { fn make_cas_bgpsec_add_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("add").about("Add BGPSec configurations"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); sub = sub @@ -780,7 +781,7 @@ impl Options { fn make_cas_bgpsec_remove_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("remove").about("Remove a BGPSec definition"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); sub = sub @@ -817,7 +818,7 @@ impl Options { fn make_cas_aspas_add_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("add").about("Add or replace an ASPA configuration"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); sub = sub.arg( @@ -835,7 +836,7 @@ impl Options { fn make_cas_aspas_remove_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("remove").about("Remove the ASPA for a customer ASN"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); sub = sub.arg( @@ -853,7 +854,7 @@ impl Options { fn make_cas_aspas_update_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("update").about("Update an existing ASPA configuration"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); sub = sub.arg( @@ -889,7 +890,7 @@ impl Options { fn make_cas_aspas_list_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("list").about("Show current ASPA configurations"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); app.subcommand(sub) @@ -910,7 +911,7 @@ impl Options { fn make_cas_repo_request_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("request").about("Show RFC 8183 Publisher Request XML"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); app.subcommand(sub) @@ -919,7 +920,7 @@ impl Options { fn make_cas_repo_show_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("show").about("Show current repo config"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); app.subcommand(sub) @@ -928,7 +929,7 @@ impl Options { fn make_cas_repo_status_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("status").about("Show current repo status"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); app.subcommand(sub) @@ -937,7 +938,7 @@ impl Options { fn make_cas_repo_configure_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("configure").about("Configure which repository a CA uses"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); sub = sub.arg( Arg::with_name("response") @@ -965,7 +966,7 @@ impl Options { fn make_cas_issues_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("issues").about("Show issues for a CA"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); app.subcommand(sub) @@ -975,7 +976,7 @@ impl Options { fn make_cas_rta_list<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("list").about("List RTAs"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); app.subcommand(sub) @@ -985,7 +986,7 @@ impl Options { fn make_cas_rta_show<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("show").about("Show RTA"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); sub = sub.arg( @@ -1013,7 +1014,7 @@ impl Options { fn make_cas_rta_sign_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("sign").about("Create an RTA signed by a CA"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); sub = Self::add_resource_args(sub); @@ -1062,7 +1063,7 @@ impl Options { fn make_cas_rta_multi_prep_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("prep").about("Prepare keys for multi-signed RTA"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); sub = Self::add_resource_args(sub); @@ -1092,7 +1093,7 @@ impl Options { fn make_cas_rta_multi_sign_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("cosign").about("Co-sign an existing (prepared) RTA"); - sub = Self::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_my_ca_arg(sub); sub = sub.arg( @@ -1141,14 +1142,14 @@ impl Options { let mut refresh = SubCommand::with_name("refresh").about("Force that all CAs ask their parents for updated certificates"); - refresh = Self::add_general_args(refresh); + refresh = GeneralArgs::add_args(refresh); let mut republish = SubCommand::with_name("publish") .about("Force that all CAs create new objects if needed (in which case they will also sync)"); - republish = Self::add_general_args(republish); + republish = GeneralArgs::add_args(republish); let mut resync = SubCommand::with_name("sync").about("Force that all CAs sync with their repo server"); - resync = Self::add_general_args(resync); + resync = GeneralArgs::add_args(resync); sub = sub.subcommand(refresh).subcommand(republish).subcommand(resync); @@ -1157,25 +1158,25 @@ impl Options { fn make_health_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let health = SubCommand::with_name("health").about("Perform an authenticated health check"); - let health = Self::add_general_args(health); + let health = GeneralArgs::add_args(health); app.subcommand(health) } fn make_info_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let info = SubCommand::with_name("info").about("Show server info"); - let info = Self::add_general_args(info); + let info = GeneralArgs::add_args(info); app.subcommand(info) } fn make_publishers_list_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("list").about("List all publishers"); - sub = Options::add_general_args(sub); + sub = GeneralArgs::add_args(sub); app.subcommand(sub) } fn make_publishers_stale_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("stale").about("List all publishers which have not published in a while"); - sub = Options::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = sub.arg( Arg::with_name("seconds") .value_name("seconds") @@ -1223,7 +1224,7 @@ impl Options { fn make_publishers_add_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("add").about("Add a publisher"); - sub = Options::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = sub .arg( @@ -1248,34 +1249,34 @@ impl Options { fn make_publishers_remove_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("remove").about("Remove a publisher"); - sub = Options::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_publisher_arg(sub); app.subcommand(sub) } fn make_publishers_show_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("show").about("Show details for a publisher"); - sub = Options::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_publisher_arg(sub); app.subcommand(sub) } fn make_publishers_response_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("response").about("Show RFC 8183 Repository Response XML"); - sub = Options::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_publisher_arg(sub); app.subcommand(sub) } fn make_publication_server_stats_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("stats").about("Show publication server stats"); - sub = Options::add_general_args(sub); + sub = GeneralArgs::add_args(sub); app.subcommand(sub) } fn make_publication_server_init_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("init").about("Initialize publication server"); - sub = Options::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = Self::add_rsync_base_arg(sub); sub = Self::add_rrdp_base_uri_arg(sub); @@ -1285,13 +1286,13 @@ impl Options { fn make_publication_server_clear_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("clear").about("Clear the publication server so it can re-initialized"); - sub = Options::add_general_args(sub); + sub = GeneralArgs::add_args(sub); app.subcommand(sub) } fn make_publication_server_session_reset_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("session-reset").about("Reset the RRDP session"); - sub = Options::add_general_args(sub); + sub = GeneralArgs::add_args(sub); app.subcommand(sub) } @@ -1320,7 +1321,7 @@ impl Options { fn make_pubserver_delete_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { let mut sub = SubCommand::with_name("delete").about("Delete specific files from the Publication Server"); - sub = Options::add_general_args(sub); + sub = GeneralArgs::add_args(sub); sub = sub.arg( Arg::with_name("base_uri") diff --git a/src/cli/report.rs b/src/cli/report.rs index f04e953f..8292b85f 100644 --- a/src/cli/report.rs +++ b/src/cli/report.rs @@ -10,12 +10,17 @@ use crate::{ api::{ AllCertAuthIssues, AspaDefinitionList, BgpSecCsrInfoList, CaCommandDetails, CaRepoDetails, CertAuthInfo, CertAuthIssues, CertAuthList, ChildCaInfo, ChildrenConnectionStats, CommandHistory, ConfiguredRoas, - ParentCaContact, ParentStatuses, PublisherDetails, PublisherList, RepoStatus, RtaList, RtaPrepResponse, - ServerInfo, + IdCertInfo, ParentCaContact, ParentStatuses, PublisherDetails, PublisherList, RepoStatus, + RepositoryContact, RtaList, RtaPrepResponse, ServerInfo, }, bgp::{BgpAnalysisAdvice, BgpAnalysisReport, BgpAnalysisSuggestion}, }, - daemon::ca::ResourceTaggedAttestation, + daemon::{ + ca::ResourceTaggedAttestation, + ta::{ + TrustAnchorProxySignerExchanges, TrustAnchorSignedRequest, TrustAnchorSignedResponse, TrustAnchorSignerInfo, + }, + }, pubd::RepoStats, }; @@ -162,7 +167,7 @@ impl fmt::Display for ReportError { /// This trait should be implemented by all api responses, so that the /// response can be formatted for users. -trait Report: Serialize + ToString { +pub trait Report: Serialize + ToString { fn text(&self) -> Result { Ok(self.to_string()) } @@ -182,6 +187,8 @@ trait Report: Serialize + ToString { impl Report for CertAuthList {} impl Report for CertAuthInfo {} +impl Report for IdCertInfo {} +impl Report for RepositoryContact {} impl Report for ChildCaInfo {} @@ -244,3 +251,8 @@ impl Report for ServerInfo {} impl Report for ResourceTaggedAttestation {} impl Report for RtaList {} impl Report for RtaPrepResponse {} + +impl Report for TrustAnchorSignerInfo {} +impl Report for TrustAnchorSignedRequest {} +impl Report for TrustAnchorSignedResponse {} +impl Report for TrustAnchorProxySignerExchanges {} diff --git a/src/cli/ta_client.rs b/src/cli/ta_client.rs new file mode 100644 index 00000000..36f67c5f --- /dev/null +++ b/src/cli/ta_client.rs @@ -0,0 +1,1295 @@ +//! Trust Anchor Client for managing the TA Proxy *and* Signer + +use std::{ + convert::TryInto, + env, + fs::File, + io::{self, Read}, + path::PathBuf, + str::FromStr, + sync::Arc, +}; + +use bytes::Bytes; +use clap::{App, Arg, ArgMatches, SubCommand}; +use log::LevelFilter; +use rpki::{ + ca::idexchange::{self, ChildHandle, RepoInfo, ServiceUri}, + repository::resources::ResourceSet, + uri, +}; +use serde::de::DeserializeOwned; + +use crate::{ + cli::report::Report, + commons::{ + actor::Actor, + api::{AddChildRequest, ApiRepositoryContact, CertAuthInfo, IdCertInfo, RepositoryContact, Token}, + crypto::{KrillSigner, KrillSignerBuilder, OpenSslSignerConfig}, + error::Error as KrillError, + eventsourcing::{AggregateStore, AggregateStoreError}, + util::{file, httpclient}, + }, + constants::{ + KRILL_CLI_API_ENV, KRILL_CLI_FORMAT_ENV, KRILL_TA_CLIENT_APP, KRILL_VERSION, OPENSSL_ONE_OFF_SIGNER_NAME, + }, + daemon::{ + config::{LogType, SignerConfig, SignerReference, SignerType}, + ta::{ + TrustAnchorHandle, TrustAnchorProxySignerExchanges, TrustAnchorSignedRequest, TrustAnchorSignedResponse, + TrustAnchorSigner, TrustAnchorSignerCommand, TrustAnchorSignerInfo, TrustAnchorSignerInitCommand, + }, + }, +}; + +use super::{ + options::GeneralArgs, + report::{self, ReportFormat}, +}; + +//------------------------ Client Constants ------------------------------------- +const CONFIG_PATH: &str = "/etc/krillta.conf"; + +//------------------------ Client Error ----------------------------------------- + +#[derive(Debug)] +#[allow(clippy::large_enum_variant)] +pub enum Error { + DataDirMissing, + UnrecognizedMatch, + HttpClientError(httpclient::Error), + KrillError(KrillError), + StorageError(AggregateStoreError), + Other(String), +} + +impl Error { + fn other(msg: &str) -> Self { + Self::Other(msg.to_string()) + } +} + +impl std::fmt::Display for Error { + fn fmt(&self, f: &mut std::fmt::Formatter) -> std::fmt::Result { + match self { + Error::DataDirMissing => write!(f, "Cannot find data dir"), + Error::UnrecognizedMatch => write!(f, "Unrecognised argument. Use 'help'"), + Error::HttpClientError(e) => write!(f, "HTTP client error: {}", e), + Error::KrillError(e) => write!(f, "{}", e), + Error::StorageError(e) => write!(f, "Issue with persistence layer: {}", e), + Error::Other(msg) => write!(f, "{}", msg), + } + } +} + +impl From for Error { + fn from(e: KrillError) -> Self { + Self::KrillError(e) + } +} + +impl From for Error { + fn from(e: report::ReportError) -> Self { + Error::Other(e.to_string()) + } +} + +impl From for Error { + fn from(e: AggregateStoreError) -> Self { + Self::StorageError(e) + } +} + +//------------------------ Client Commands -------------------------------------- + +#[derive(Debug)] +#[allow(clippy::large_enum_variant)] +pub enum TrustAnchorClientCommand { + Proxy(ProxyCommand), + Signer(SignerCommand), +} + +impl TrustAnchorClientCommand { + pub fn report_format(&self) -> report::ReportFormat { + match self { + TrustAnchorClientCommand::Signer(command) => command.format, + TrustAnchorClientCommand::Proxy(command) => command.general.format, + } + } +} + +#[derive(Debug)] +pub struct ProxyCommand { + general: GeneralArgs, + details: ProxyCommandDetails, +} + +#[derive(Debug)] +#[allow(clippy::large_enum_variant)] +pub enum ProxyCommandDetails { + Init, + Id, + RepoRequest, + RepoContact, + RepoConfigure(ApiRepositoryContact), + SignerAdd(TrustAnchorSignerInfo), + SignerMakeRequest, + SignerShowRequest, + SignerProcessResponse(TrustAnchorSignedResponse), + ChildAdd(AddChildRequest), + ChildResponse(ChildHandle), +} + +#[derive(Debug)] +pub struct SignerCommand { + config: Config, + format: ReportFormat, + details: SignerCommandDetails, +} + +#[derive(Debug)] +#[allow(clippy::large_enum_variant)] +pub enum SignerCommandDetails { + Init(SignerInitInfo), + ShowInfo, + ProcessRequest(TrustAnchorSignedRequest), + ShowLastResponse, + ShowExchanges, +} + +#[derive(Debug)] +pub struct SignerInitInfo { + proxy_id: IdCertInfo, + repo_info: RepoInfo, + tal_https: Vec, + tal_rsync: uri::Rsync, + private_key_pem: Option, +} + +impl TrustAnchorClientCommand { + pub fn from_args() -> Result { + let matches = Self::make_matches(); + Self::parse_matches(matches) + } +} + +/// # Create matches for command line parsing +/// +impl TrustAnchorClientCommand { + fn make_matches<'a>() -> ArgMatches<'a> { + let mut app = App::new(KRILL_TA_CLIENT_APP).version(KRILL_VERSION); + + app = Self::make_proxy_sc(app); + app = Self::make_signer_sc(app); + + app.get_matches() + } + + //-- Sub Commands Proxy + + fn make_proxy_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { + let mut sub = SubCommand::with_name("proxy").about("Manage the Trust Anchor Proxy"); + + sub = Self::make_proxy_init_sc(sub); + sub = Self::make_proxy_id_sc(sub); + sub = Self::make_proxy_repo_sc(sub); + sub = Self::make_proxy_signer_sc(sub); + sub = Self::make_proxy_children_sc(sub); + + app.subcommand(sub) + } + + fn make_proxy_init_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { + let mut sub = SubCommand::with_name("init").about("Initialise the proxy"); + sub = GeneralArgs::add_args(sub); + app.subcommand(sub) + } + + fn make_proxy_id_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { + let mut sub = SubCommand::with_name("id").about("Get the proxy ID certificate details"); + sub = GeneralArgs::add_args(sub); + app.subcommand(sub) + } + + fn make_proxy_repo_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { + let mut sub = SubCommand::with_name("repo").about("Manage the repository for proxy"); + sub = Self::make_proxy_repo_request_sc(sub); + sub = Self::make_proxy_repo_contact_sc(sub); + sub = Self::make_proxy_repo_configure_sc(sub); + app.subcommand(sub) + } + + fn make_proxy_repo_request_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { + let mut sub = SubCommand::with_name("request").about("Get RFC 8183 publisher request"); + sub = GeneralArgs::add_args(sub); + app.subcommand(sub) + } + + fn make_proxy_repo_contact_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { + let mut sub = SubCommand::with_name("contact").about("Show the configured repository for the proxy"); + sub = GeneralArgs::add_args(sub); + app.subcommand(sub) + } + + fn make_proxy_repo_configure_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { + let mut sub = SubCommand::with_name("configure").about("Configure (add) the repository for the proxy"); + sub = GeneralArgs::add_args(sub); + + sub = sub.arg( + Arg::with_name("response") + .value_name("file") + .long("response") + .short("r") + .help("The location of the RFC 8183 Publisher Response XML file") + .required(true), + ); + + app.subcommand(sub) + } + + fn make_proxy_signer_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { + let mut sub = SubCommand::with_name("signer").about("Manage interactions with the associated signer"); + sub = Self::make_proxy_signer_init_sc(sub); + sub = Self::make_proxy_signer_make_request_sc(sub); + sub = Self::make_proxy_signer_show_request_sc(sub); + sub = Self::make_proxy_signer_process_response_sc(sub); + app.subcommand(sub) + } + + fn make_proxy_signer_init_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { + let mut sub = SubCommand::with_name("init").about("Initialise signer association"); + + sub = GeneralArgs::add_args(sub); + sub = sub.arg( + Arg::with_name("info") + .value_name("info") + .long("info") + .short("i") + .help("The Trust Anchor Signer info json (as 'signer show')") + .required(true), + ); + + app.subcommand(sub) + } + + fn make_proxy_signer_make_request_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { + let mut sub = SubCommand::with_name("make-request") + .about("Make a NEW request for the signer (fails if a request exists)."); + sub = GeneralArgs::add_args(sub); + app.subcommand(sub) + } + + fn make_proxy_signer_show_request_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { + let mut sub = SubCommand::with_name("show-request") + .about("Show the existing request for the signer (fails if there is no request)."); + sub = GeneralArgs::add_args(sub); + app.subcommand(sub) + } + + fn make_proxy_signer_process_response_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { + let mut sub = SubCommand::with_name("process-response") + .about("Process a response from the signer. Fails it did not match the open request."); + + sub = GeneralArgs::add_args(sub); + sub = sub.arg( + Arg::with_name("response") + .long("response") + .short("r") + .value_name("file") + .help("Path to signer response (JSON)") + .required(true), + ); + app.subcommand(sub) + } + + fn make_proxy_children_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { + let mut sub = SubCommand::with_name("children").about("Manage children under the TA proxy"); + sub = Self::make_proxy_children_add_sc(sub); + sub = Self::make_proxy_children_response_sc(sub); + app.subcommand(sub) + } + + fn make_proxy_children_add_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { + let mut sub = SubCommand::with_name("add").about("Add a child. Recommended: add 1 child with all resources and use that as a parent to other CAs. This way the resources for those children can be updated without the need to have the offline signer sign a new certificate to them."); + + sub = GeneralArgs::add_args(sub); + sub = sub + .arg( + Arg::with_name("info") + .value_name("info") + .long("info") + .short("i") + .help("The Child info json (as 'krillc show --ca ')") + .required(true), + ) + .arg( + Arg::with_name("asn") + .value_name("asn resources") + .long("asn") + .help("The ASN resources for the child. Default: all") + .required(false), + ) + .arg( + Arg::with_name("ipv4") + .value_name("IPv4 resources") + .long("ipv4") + .help("The IPv4 resources for the child. Default: all") + .required(false), + ) + .arg( + Arg::with_name("ipv6") + .value_name("IPv6 resources") + .long("ipv6") + .help("The IPv6 resources for the child. Default: all") + .required(false), + ); + + app.subcommand(sub) + } + + fn make_proxy_children_response_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { + let mut sub = SubCommand::with_name("response").about("Get parent response for child."); + sub = GeneralArgs::add_args(sub); + sub = Self::add_child_arg(sub); + app.subcommand(sub) + } + + //-- Sub Commands Signer + + fn make_signer_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { + let mut sub = SubCommand::with_name("signer").about("Manage the Trust Anchor Signer"); + + sub = Self::make_signer_init_sc(sub); + sub = Self::make_signer_show_sc(sub); + sub = Self::make_signer_process_sc(sub); + sub = Self::make_signer_last_sc(sub); + sub = Self::make_signer_exchanges_sc(sub); + + app.subcommand(sub) + } + + fn make_signer_init_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { + let mut sub = SubCommand::with_name("init").about("Initialise the signer"); + + sub = Self::add_config_arg(sub) + .arg( + Arg::with_name("proxy_id") + .long("proxy_id") + .short("i") + .value_name("path") + .help("Path to Proxy ID json") + .required(true), + ) + .arg( + Arg::with_name("proxy_repository_contact") + .long("proxy_repository_contact") + .short("r") + .value_name("path") + .help("Path to Proxy ID json") + .required(true), + ) + .arg( + Arg::with_name("tal_rsync") + .long("tal_rsync") + .value_name("Rsync URI") + .help("Used for TA certificate on TAL and AIA") + .required(true), + ) + .arg( + Arg::with_name("tal_https") + .long("tal_https") + .value_name("HTTPS URI") + .help("Used for TAL. Multiple allowed.") + .multiple(true) + .required(true), + ) + .arg( + Arg::with_name("private_key_pem") + .long("private_key_pem") + .value_name("path") + .help("[OPTIONAL] Import an existing private key in PEM format") + .required(false), + ); + + app.subcommand(sub) + } + + fn make_signer_show_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { + let mut sub = SubCommand::with_name("show").about("Show the signer info"); + sub = Self::add_config_arg(sub); + sub = Self::add_format_arg(sub); + app.subcommand(sub) + } + + fn make_signer_process_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { + let mut sub = SubCommand::with_name("process").about("Process a proxy request"); + sub = Self::add_config_arg(sub); + sub = Self::add_format_arg(sub); + + sub = sub.arg( + Arg::with_name("request") + .long("request") + .short("r") + .value_name("file") + .help("Path to TA Proxy request file (JSON)") + .required(true), + ); + + app.subcommand(sub) + } + + fn make_signer_last_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { + let mut sub = SubCommand::with_name("last").about("Show last response"); + sub = Self::add_config_arg(sub); + sub = Self::add_format_arg(sub); + app.subcommand(sub) + } + + fn make_signer_exchanges_sc<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { + let mut sub = SubCommand::with_name("exchanges") + .about("Show full history of proxy signer exchanges. Text output shows summary."); + sub = Self::add_config_arg(sub); + sub = Self::add_format_arg(sub); + app.subcommand(sub) + } + + //-- Arguments + + fn add_config_arg<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { + app.arg( + Arg::with_name("config") + .long("config") + .value_name("path") + .short("c") + .help("Path to config file. Defaults to: /etc/krillta.conf") + .required(false), + ) + } + + fn add_format_arg<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { + app.arg( + Arg::with_name("format") + .long("format") + .value_name("type") + .short("f") + .help("Report format: none|json (default)|text. Or set env: KRILL_CLI_FORMAT") + .required(false), + ) + } + + fn add_child_arg<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> { + app.arg( + Arg::with_name("child") + .long("child") + .value_name("name") + .help("Name of the child CA") + .required(true), + ) + } +} + +/// # Parse command line matches +/// +impl TrustAnchorClientCommand { + fn parse_matches(matches: ArgMatches) -> Result { + if let Some(m) = matches.subcommand_matches("proxy") { + Self::parse_matches_proxy(m) + } else if let Some(m) = matches.subcommand_matches("signer") { + Self::parse_matches_signer(m) + } else { + Err(Error::UnrecognizedMatch) + } + } + + //-- Parse Proxy + fn parse_matches_proxy(matches: &ArgMatches) -> Result { + if let Some(m) = matches.subcommand_matches("id") { + Self::parse_matches_proxy_id(m) + } else if let Some(m) = matches.subcommand_matches("init") { + Self::parse_matches_proxy_init(m) + } else if let Some(m) = matches.subcommand_matches("repo") { + Self::parse_matches_proxy_repo(m) + } else if let Some(m) = matches.subcommand_matches("signer") { + Self::parse_matches_proxy_signer(m) + } else if let Some(m) = matches.subcommand_matches("children") { + Self::parse_matches_proxy_children(m) + } else { + Err(Error::UnrecognizedMatch) + } + } + + fn parse_matches_proxy_init(matches: &ArgMatches) -> Result { + let general = GeneralArgs::from_matches(matches).map_err(|e| Error::Other(e.to_string()))?; + let details = ProxyCommandDetails::Init; + + Ok(TrustAnchorClientCommand::Proxy(ProxyCommand { general, details })) + } + + fn parse_matches_proxy_id(matches: &ArgMatches) -> Result { + let general = GeneralArgs::from_matches(matches).map_err(|e| Error::Other(e.to_string()))?; + let details = ProxyCommandDetails::Id; + + Ok(TrustAnchorClientCommand::Proxy(ProxyCommand { general, details })) + } + + fn parse_matches_proxy_repo(matches: &ArgMatches) -> Result { + if let Some(m) = matches.subcommand_matches("request") { + Self::parse_matches_proxy_repo_request(m) + } else if let Some(m) = matches.subcommand_matches("contact") { + Self::parse_matches_proxy_repo_contact(m) + } else if let Some(m) = matches.subcommand_matches("configure") { + Self::parse_matches_proxy_repo_configure(m) + } else { + Err(Error::UnrecognizedMatch) + } + } + + fn parse_matches_proxy_repo_request(matches: &ArgMatches) -> Result { + let general = GeneralArgs::from_matches(matches).map_err(|e| Error::Other(e.to_string()))?; + let details = ProxyCommandDetails::RepoRequest; + + Ok(TrustAnchorClientCommand::Proxy(ProxyCommand { general, details })) + } + + fn parse_matches_proxy_repo_contact(matches: &ArgMatches) -> Result { + let general = GeneralArgs::from_matches(matches).map_err(|e| Error::Other(e.to_string()))?; + let details = ProxyCommandDetails::RepoContact; + + Ok(TrustAnchorClientCommand::Proxy(ProxyCommand { general, details })) + } + + fn parse_matches_proxy_repo_configure(matches: &ArgMatches) -> Result { + let general = GeneralArgs::from_matches(matches).map_err(|e| Error::Other(e.to_string()))?; + + let path = matches.value_of("response").unwrap(); + let bytes = Self::read_file_arg(path)?; + let response = idexchange::RepositoryResponse::parse(bytes.as_ref()) + .map_err(|e| Error::Other(format!("Cannot parse repository response: {}", e)))?; + + let details = ProxyCommandDetails::RepoConfigure(ApiRepositoryContact::new(response)); + + Ok(TrustAnchorClientCommand::Proxy(ProxyCommand { general, details })) + } + + fn parse_matches_proxy_signer(matches: &ArgMatches) -> Result { + if let Some(m) = matches.subcommand_matches("init") { + Self::parse_matches_proxy_signer_init(m) + } else if let Some(m) = matches.subcommand_matches("make-request") { + Self::parse_matches_proxy_signer_make_request(m) + } else if let Some(m) = matches.subcommand_matches("show-request") { + Self::parse_matches_proxy_signer_show_request(m) + } else if let Some(m) = matches.subcommand_matches("process-response") { + Self::parse_matches_proxy_signer_process_response(m) + } else { + Err(Error::UnrecognizedMatch) + } + } + + fn parse_matches_proxy_signer_init(matches: &ArgMatches) -> Result { + let general = GeneralArgs::from_matches(matches).map_err(|e| Error::Other(e.to_string()))?; + + let info = Self::read_json(matches.value_of("info").unwrap())?; + + Ok(TrustAnchorClientCommand::Proxy(ProxyCommand { + general, + details: ProxyCommandDetails::SignerAdd(info), + })) + } + + fn parse_matches_proxy_signer_make_request(matches: &ArgMatches) -> Result { + let general = GeneralArgs::from_matches(matches).map_err(|e| Error::Other(e.to_string()))?; + + Ok(TrustAnchorClientCommand::Proxy(ProxyCommand { + general, + details: ProxyCommandDetails::SignerMakeRequest, + })) + } + + fn parse_matches_proxy_signer_show_request(matches: &ArgMatches) -> Result { + let general = GeneralArgs::from_matches(matches).map_err(|e| Error::Other(e.to_string()))?; + + Ok(TrustAnchorClientCommand::Proxy(ProxyCommand { + general, + details: ProxyCommandDetails::SignerShowRequest, + })) + } + + fn parse_matches_proxy_signer_process_response(matches: &ArgMatches) -> Result { + let general = GeneralArgs::from_matches(matches).map_err(|e| Error::Other(e.to_string()))?; + let response = Self::read_json(matches.value_of("response").unwrap())?; + + Ok(TrustAnchorClientCommand::Proxy(ProxyCommand { + general, + details: ProxyCommandDetails::SignerProcessResponse(response), + })) + } + + fn parse_matches_proxy_children(matches: &ArgMatches) -> Result { + if let Some(m) = matches.subcommand_matches("add") { + Self::parse_matches_proxy_children_add(m) + } else if let Some(m) = matches.subcommand_matches("response") { + Self::parse_matches_proxy_children_response(m) + } else { + Err(Error::UnrecognizedMatch) + } + } + + fn parse_matches_proxy_children_add(matches: &ArgMatches) -> Result { + let general = GeneralArgs::from_matches(matches).map_err(|e| Error::Other(e.to_string()))?; + + let info: CertAuthInfo = Self::read_json(matches.value_of("info").unwrap())?; + let resources: ResourceSet = { + let asn = matches.value_of("asn").unwrap_or("AS0-AS4294967295"); + let ipv4 = matches.value_of("ipv4").unwrap_or("0.0.0.0/0"); + let ipv6 = matches.value_of("ipv6").unwrap_or("::/0"); + ResourceSet::from_strs(asn, ipv4, ipv6) + .map_err(|e| Error::Other(format!("Cannot parse resources: {}", e)))? + }; + + Ok(TrustAnchorClientCommand::Proxy(ProxyCommand { + general, + details: ProxyCommandDetails::ChildAdd(AddChildRequest::new( + info.handle().convert(), + resources, + info.id_cert().try_into()?, + )), + })) + } + + fn parse_matches_proxy_children_response(matches: &ArgMatches) -> Result { + let general = GeneralArgs::from_matches(matches).map_err(|e| Error::Other(e.to_string()))?; + let child = Self::parse_child_arg(matches)?; + + Ok(TrustAnchorClientCommand::Proxy(ProxyCommand { + general, + details: ProxyCommandDetails::ChildResponse(child), + })) + } + + fn parse_child_arg(matches: &ArgMatches) -> Result { + let child_str = matches.value_of("child").unwrap(); + ChildHandle::from_str(child_str).map_err(|e| Error::Other(format!("Invalid child name: {}", e))) + } + + fn read_file_arg(path_str: &str) -> Result { + let path = PathBuf::from(path_str); + file::read(&path).map_err(|e| Error::Other(format!("Can't read: {}. Error: {}", path_str, e))) + } + + // Read json from a path argument + fn read_json(path: &str) -> Result { + let bytes = Self::read_file_arg(path)?; + + serde_json::from_slice(&bytes).map_err(|e| Error::Other(format!("Cannot deserialize file {}: {}", path, e))) + } + + //-- Parse Signer + fn parse_matches_signer(matches: &ArgMatches) -> Result { + if let Some(m) = matches.subcommand_matches("init") { + Self::parse_matches_signer_init(m) + } else if let Some(m) = matches.subcommand_matches("show") { + Self::parse_matches_signer_show(m) + } else if let Some(m) = matches.subcommand_matches("process") { + Self::parse_matches_signer_process(m) + } else if let Some(m) = matches.subcommand_matches("last") { + Self::parse_matches_signer_last_response(m) + } else if let Some(m) = matches.subcommand_matches("exchanges") { + Self::parse_matches_signer_exchanges(m) + } else { + Err(Error::UnrecognizedMatch) + } + } + + fn parse_matches_signer_init(matches: &ArgMatches) -> Result { + let config = Self::parse_config(matches)?; + let format = ReportFormat::None; + + let proxy_id = Self::read_json(matches.value_of("proxy_id").unwrap())?; + + let repo_info = { + let repo_contact: RepositoryContact = + Self::read_json(matches.value_of("proxy_repository_contact").unwrap())?; + repo_contact.into() + }; + + let tal_https = { + let uri_strs = matches.values_of("tal_https").unwrap(); + let mut uris = vec![]; + for uri_str in uri_strs { + uris.push( + uri::Https::from_str(uri_str) + .map_err(|_| Error::Other(format!("Invalid https URI: {}", uri_str)))?, + ); + } + uris + }; + + let tal_rsync = { + let rsync_str = matches.value_of("tal_rsync").unwrap(); + uri::Rsync::from_str(rsync_str).map_err(|_| Error::Other(format!("Invalid rsync uri: {}", rsync_str)))? + }; + + let private_key_pem = if let Some(path) = matches.value_of("private_key_pem") { + let bytes = Self::read_file_arg(path)?; + let pem = std::str::from_utf8(&bytes).map_err(|_| Error::other("invalid UTF8 in private_key_pem file"))?; + Some(pem.to_string()) + } else { + None + }; + + let info = SignerInitInfo { + proxy_id, + repo_info, + tal_https, + tal_rsync, + private_key_pem, + }; + let details = SignerCommandDetails::Init(info); + + Ok(TrustAnchorClientCommand::Signer(SignerCommand { + config, + format, + details, + })) + } + + fn parse_matches_signer_show(matches: &ArgMatches) -> Result { + let config = Self::parse_config(matches)?; + let format = Self::parse_format(matches)?; + + Ok(TrustAnchorClientCommand::Signer(SignerCommand { + config, + format, + details: SignerCommandDetails::ShowInfo, + })) + } + + fn parse_matches_signer_process(matches: &ArgMatches) -> Result { + let config = Self::parse_config(matches)?; + let format = Self::parse_format(matches)?; + let request = Self::read_json(matches.value_of("request").unwrap())?; + + Ok(TrustAnchorClientCommand::Signer(SignerCommand { + config, + format, + details: SignerCommandDetails::ProcessRequest(request), + })) + } + + fn parse_matches_signer_last_response(matches: &ArgMatches) -> Result { + let config = Self::parse_config(matches)?; + let format = Self::parse_format(matches)?; + + Ok(TrustAnchorClientCommand::Signer(SignerCommand { + config, + format, + details: SignerCommandDetails::ShowLastResponse, + })) + } + + fn parse_matches_signer_exchanges(matches: &ArgMatches) -> Result { + let config = Self::parse_config(matches)?; + let format = Self::parse_format(matches)?; + let details = SignerCommandDetails::ShowExchanges; + + Ok(TrustAnchorClientCommand::Signer(SignerCommand { + config, + format, + details, + })) + } + + fn parse_config(matches: &ArgMatches) -> Result { + let config_path = matches.value_of("config").unwrap_or(CONFIG_PATH); + Config::parse(config_path) + } + + fn parse_format(matches: &ArgMatches) -> Result { + let mut format = match env::var(KRILL_CLI_FORMAT_ENV) { + Ok(fmt_str) => Some(ReportFormat::from_str(&fmt_str)?), + Err(_) => None, + }; + + if let Some(fmt_str) = matches.value_of("format") { + format = Some(ReportFormat::from_str(fmt_str)?); + } + + Ok(format.unwrap_or(ReportFormat::Json)) + } +} + +//------------------------ TrustAnchorClient ------------------------------------ + +pub struct TrustAnchorClient; + +impl TrustAnchorClient { + pub async fn process(command: TrustAnchorClientCommand) -> Result { + match command { + TrustAnchorClientCommand::Proxy(proxy_command) => { + let client = ProxyClient::create(proxy_command.general); + + match proxy_command.details { + ProxyCommandDetails::Init => client.post_empty("api/v1/ta/proxy/init").await, + ProxyCommandDetails::Id => { + let id_cert = client.get_json("api/v1/ta/proxy/id").await?; + Ok(TrustAnchorClientApiResponse::IdCert(id_cert)) + } + ProxyCommandDetails::RepoRequest => { + let publisher_request = client.get_json("api/v1/ta/proxy/repo/request.json").await?; + Ok(TrustAnchorClientApiResponse::PublisherRequest(publisher_request)) + } + ProxyCommandDetails::RepoContact => { + let contact = client.get_json("api/v1/ta/proxy/repo").await?; + Ok(TrustAnchorClientApiResponse::RepositoryContact(contact)) + } + ProxyCommandDetails::RepoConfigure(repo_response) => { + client.post_json("api/v1/ta/proxy/repo", repo_response).await + } + ProxyCommandDetails::SignerAdd(info) => client.post_json("api/v1/ta/proxy/signer/add", info).await, + ProxyCommandDetails::SignerMakeRequest => { + let request = client + .post_empty_with_response("api/v1/ta/proxy/signer/request") + .await?; + Ok(TrustAnchorClientApiResponse::SignerRequest(request)) + } + ProxyCommandDetails::SignerShowRequest => { + let request = client.get_json("api/v1/ta/proxy/signer/request").await?; + Ok(TrustAnchorClientApiResponse::SignerRequest(request)) + } + ProxyCommandDetails::SignerProcessResponse(response) => { + client.post_json("api/v1/ta/proxy/signer/response", response).await + } + ProxyCommandDetails::ChildAdd(child) => { + let response = client + .post_json_with_response("api/v1/ta/proxy/children", child) + .await?; + Ok(TrustAnchorClientApiResponse::ParentResponse(response)) + } + ProxyCommandDetails::ChildResponse(child) => { + let uri_path = format!("api/v1/ta/proxy/children/{}/parent_response.json", child); + let response = client.get_json(&uri_path).await?; + Ok(TrustAnchorClientApiResponse::ParentResponse(response)) + } + } + } + TrustAnchorClientCommand::Signer(signer_command) => { + let signer_manager = TrustAnchorSignerManager::create(signer_command.config)?; + + match signer_command.details { + SignerCommandDetails::Init(info) => signer_manager.init(info), + SignerCommandDetails::ShowInfo => signer_manager.show(), + SignerCommandDetails::ProcessRequest(request) => signer_manager.process(request), + SignerCommandDetails::ShowLastResponse => signer_manager.show_last_response(), + SignerCommandDetails::ShowExchanges => signer_manager.show_exchanges(), + } + } + } + } +} + +#[allow(clippy::large_enum_variant)] +pub enum TrustAnchorClientApiResponse { + IdCert(IdCertInfo), + PublisherRequest(idexchange::PublisherRequest), + RepositoryContact(RepositoryContact), + TrustAnchorProxySignerInfo(TrustAnchorSignerInfo), + ParentResponse(idexchange::ParentResponse), + SignerRequest(TrustAnchorSignedRequest), + SignerResponse(TrustAnchorSignedResponse), + ProxySignerExchanges(TrustAnchorProxySignerExchanges), + Empty, +} + +impl TrustAnchorClientApiResponse { + pub fn report(&self, fmt: report::ReportFormat) -> Result, report::ReportError> { + if fmt == report::ReportFormat::None { + Ok(None) + } else { + match self { + TrustAnchorClientApiResponse::IdCert(id_cert) => id_cert.report(fmt).map(Some), + TrustAnchorClientApiResponse::PublisherRequest(pr) => pr.report(fmt).map(Some), + TrustAnchorClientApiResponse::RepositoryContact(contact) => contact.report(fmt).map(Some), + TrustAnchorClientApiResponse::TrustAnchorProxySignerInfo(info) => info.report(fmt).map(Some), + TrustAnchorClientApiResponse::ParentResponse(response) => response.report(fmt).map(Some), + TrustAnchorClientApiResponse::SignerRequest(request) => request.report(fmt).map(Some), + TrustAnchorClientApiResponse::SignerResponse(response) => response.report(fmt).map(Some), + TrustAnchorClientApiResponse::ProxySignerExchanges(exchanges) => exchanges.report(fmt).map(Some), + TrustAnchorClientApiResponse::Empty => Ok(None), + } + } + } +} + +//------------------------ ProxyClient ------------------------------------------ + +pub struct ProxyClient { + server: ServiceUri, + token: Token, +} + +impl ProxyClient { + fn create(general: GeneralArgs) -> Self { + let client = ProxyClient { + server: general.server, + token: general.token, + }; + + if general.api { + // passing the api option in the env, so that the call + // to the back-end will just print and exit. + env::set_var(KRILL_CLI_API_ENV, "1") + } + + client + } + + async fn post_empty(&self, path: &str) -> Result { + let uri = self.resolve_uri(path); + httpclient::post_empty(&uri, Some(&self.token)) + .await + .map(|_| TrustAnchorClientApiResponse::Empty) + .map_err(Error::HttpClientError) + } + + async fn post_empty_with_response(&self, path: &str) -> Result { + let uri = self.resolve_uri(path); + httpclient::post_empty_with_response(&uri, Some(&self.token)) + .await + .map_err(Error::HttpClientError) + } + + async fn post_json(&self, path: &str, data: impl serde::Serialize) -> Result { + let uri = self.resolve_uri(path); + httpclient::post_json(&uri, data, Some(&self.token)) + .await + .map(|_| TrustAnchorClientApiResponse::Empty) + .map_err(Error::HttpClientError) + } + + async fn post_json_with_response( + &self, + path: &str, + data: impl serde::Serialize, + ) -> Result { + let uri = self.resolve_uri(path); + httpclient::post_json_with_response(&uri, data, Some(&self.token)) + .await + .map_err(Error::HttpClientError) + } + + async fn get_json(&self, path: &str) -> Result { + let uri = self.resolve_uri(path); + httpclient::get_json(&uri, Some(&self.token)) + .await + .map_err(Error::HttpClientError) + } + + fn resolve_uri(&self, path: &str) -> String { + format!("{}{}", self.server, path) + } +} + +//------------------------ TrustAnchorSignerManager ----------------------------- + +struct TrustAnchorSignerManager { + store: AggregateStore, + ta_handle: TrustAnchorHandle, + signer: Arc, + actor: Actor, +} + +impl TrustAnchorSignerManager { + fn create(config: Config) -> Result { + let store = AggregateStore::disk(&config.data_dir, "signer").map_err(KrillError::AggregateStoreError)?; + let ta_handle = TrustAnchorHandle::new("ta".into()); + let signer = config.signer()?; + let actor = Actor::krillta(); + + Ok(TrustAnchorSignerManager { + store, + ta_handle, + signer, + actor, + }) + } + + fn init(&self, info: SignerInitInfo) -> Result { + if self.store.has(&self.ta_handle)? { + Err(Error::other("Trust Anchor Signer was already initialised.")) + } else { + let signer_init_command = TrustAnchorSignerInitCommand { + handle: self.ta_handle.clone(), + proxy_id: info.proxy_id, + repo_info: info.repo_info, + tal_https: info.tal_https, + tal_rsync: info.tal_rsync, + private_key_pem: info.private_key_pem, + signer: self.signer.clone(), + }; + + let signer_init_event = TrustAnchorSigner::create_init(signer_init_command)?; + self.store.add(signer_init_event)?; + + Ok(TrustAnchorClientApiResponse::Empty) + } + } + + fn show(&self) -> Result { + let ta_signer = self.get_signer()?; + let info = ta_signer.get_signer_info(); + Ok(TrustAnchorClientApiResponse::TrustAnchorProxySignerInfo(info)) + } + + fn process(&self, request: TrustAnchorSignedRequest) -> Result { + let cmd = TrustAnchorSignerCommand::make_process_request_command( + &self.ta_handle, + request, + self.signer.clone(), + &self.actor, + ); + self.store.command(cmd)?; + + self.show_last_response() + } + + fn show_last_response(&self) -> Result { + self.get_signer()? + .get_latest_exchange() + .map(|exchange| TrustAnchorClientApiResponse::SignerResponse(exchange.response.clone())) + .ok_or_else(|| Error::other("No response found.")) + } + + fn show_exchanges(&self) -> Result { + let signer = self.get_signer()?; + // In this context it's okay to clone the exchanges. + // If we are afraid that this would become too expensive, then we will + // need to rethink the model where we return data in the enum that we + // use. We can't have references and lifetimes because the signer will + // be gone.. + // + // But, again, in this context this should never be huge with exchanges + // happening every couple of months. So, it should all be fine. + let exchanges = signer.get_exchanges().clone(); + Ok(TrustAnchorClientApiResponse::ProxySignerExchanges(exchanges)) + } + + fn get_signer(&self) -> Result, Error> { + if self.store.has(&self.ta_handle)? { + self.store.get_latest(&self.ta_handle).map_err(Error::StorageError) + } else { + Err(Error::other("Trust Anchor Signer is not initialised.")) + } + } +} + +//------------------------ Config ----------------------------------------------- + +#[derive(Clone, Debug, Deserialize)] +pub struct Config { + data_dir: PathBuf, + + #[serde(default = "crate::daemon::config::ConfigDefaults::log_type")] + log_type: LogType, + + #[serde( + default = "crate::daemon::config::ConfigDefaults::log_level", + deserialize_with = "crate::commons::util::ext_serde::de_level_filter" + )] + pub log_level: LevelFilter, + + // Signer support. Ported from main Krill. + #[serde(default, deserialize_with = "crate::daemon::config::deserialize_signer_ref")] + pub default_signer: SignerReference, + + #[serde(default, deserialize_with = "crate::daemon::config::deserialize_signer_ref")] + pub one_off_signer: SignerReference, + + #[serde(default = "crate::daemon::config::ConfigDefaults::signer_probe_retry_seconds")] + pub signer_probe_retry_seconds: u64, + + #[serde(default = "crate::daemon::config::ConfigDefaults::signers")] + pub signers: Vec, +} + +impl Config { + fn parse(file_path: &str) -> Result { + let mut v = Vec::new(); + + let mut file = File::open(file_path) + .map_err(|e| Error::Other(format!("Could not read config file '{}': {}", file_path, e)))?; + + file.read_to_end(&mut v) + .map_err(|e| Error::Other(format!("Could not read config file '{}': {}", file_path, e)))?; + + Self::parse_slice(v.as_slice()) + } + + fn parse_slice(slice: &[u8]) -> Result { + let mut config: Config = + toml::from_slice(slice).map_err(|e| Error::Other(format!("Error parsing config file: {}", e)))?; + + if !config.data_dir.exists() { + file::create_dir_all(&config.data_dir).map_err(KrillError::IoError)?; + } + + config.resolve_signers(); + config.init_logging()?; + + Ok(config) + } + + fn resolve_signers(&mut self) { + if self.signers.len() == 1 && !self.default_signer.is_named() { + self.default_signer = SignerReference::new(&self.signers[0].name); + } + + let default_signer_idx = self.find_signer_reference(&self.default_signer).unwrap(); + self.default_signer = SignerReference::Index(default_signer_idx); + + let openssl_signer_idx = self.find_openssl_signer(); + let one_off_signer_idx = self.find_signer_reference(&self.one_off_signer); + + // Use the specified one-off signer, if set, else: + // - Use an existing OpenSSL signer config, + // - Or create a new OpenSSL signer config. + let one_off_signer_idx = match (one_off_signer_idx, openssl_signer_idx) { + (Some(one_off_signer_idx), _) => one_off_signer_idx, + (None, Some(openssl_signer_idx)) => openssl_signer_idx, + (None, None) => self.add_openssl_signer(OPENSSL_ONE_OFF_SIGNER_NAME), + }; + + self.one_off_signer = SignerReference::Index(one_off_signer_idx); + } + + fn add_openssl_signer(&mut self, name: &str) -> usize { + let signer_config = SignerConfig::new(name.to_string(), SignerType::OpenSsl(OpenSslSignerConfig::default())); + self.signers.push(signer_config); + self.signers.len() - 1 + } + + fn find_signer_reference(&self, signer_ref: &SignerReference) -> Option { + match signer_ref { + SignerReference::Name(None) => None, + SignerReference::Name(Some(name)) => self.signers.iter().position(|s| &s.name == name), + SignerReference::Index(idx) => Some(*idx), + } + } + + fn find_openssl_signer(&self) -> Option { + self.signers + .iter() + .position(|s| matches!(s.signer_type, SignerType::OpenSsl(_))) + } + + // Signer support + fn signer(&self) -> Result, Error> { + // Assumes that Config::verify() has already ensured that the signer configuration is valid and that + // Config::resolve() has been used to update signer name references to resolve to the corresponding signer + // configurations. + let probe_interval = std::time::Duration::from_secs(self.signer_probe_retry_seconds); + let signer = KrillSignerBuilder::new(&self.data_dir, probe_interval, &self.signers) + .with_default_signer(self.default_signer()) + .with_one_off_signer(self.one_off_signer()) + .build() + .map_err(|e| Error::Other(format!("Could not create KrillSigner: {}", e)))?; + + Ok(Arc::new(signer)) + } + + /// Returns a reference to the default signer configuration. + /// + /// Assumes that the configuration is valid. Will panic otherwise. + fn default_signer(&self) -> &SignerConfig { + &self.signers[self.default_signer.idx()] + } + + /// Returns a reference to the one off signer configuration. + /// + /// Assumes that the configuration is valid. Will panic otherwise. + fn one_off_signer(&self) -> &SignerConfig { + &self.signers[self.one_off_signer.idx()] + } + + fn init_logging(&self) -> Result<(), Error> { + match self.log_type { + LogType::File => self.file_logger(), + LogType::Stderr => self.stderr_logger(), + LogType::Syslog => Err(Error::other("syslog is not support for the TA client")), + } + } + + fn file_logger(&self) -> Result<(), Error> { + let path = self.data_dir.join("krillta.log"); + let log_file = fern::log_file(&path) + .map_err(|e| Error::Other(format!("Failed to open log file '{}': {}", path.display(), e)))?; + + self.fern_logger() + .chain(log_file) + .apply() + .map_err(|e| Error::Other(format!("Failed to init file logging: {}", e))) + } + + /// Creates a stderr logger. + fn stderr_logger(&self) -> Result<(), Error> { + self.fern_logger() + .chain(io::stderr()) + .apply() + .map_err(|e| Error::Other(format!("Failed to init stderr logging: {}", e))) + } + + /// Creates and returns a fern logger with log level tweaks + fn fern_logger(&self) -> fern::Dispatch { + // suppress overly noisy logging + let framework_level = self.log_level.min(LevelFilter::Warn); + let krill_framework_level = self.log_level.min(LevelFilter::Debug); + + let show_target = self.log_level == LevelFilter::Trace || self.log_level == LevelFilter::Debug; + + fern::Dispatch::new() + .format(move |out, message, record| { + if show_target { + out.finish(format_args!( + "{} [{}] [{}] {}", + chrono::Local::now().format("%Y-%m-%d %H:%M:%S"), + record.level(), + record.target(), + message + )) + } else { + out.finish(format_args!( + "{} [{}] {}", + chrono::Local::now().format("%Y-%m-%d %H:%M:%S"), + record.level(), + message + )) + } + }) + .level(self.log_level) + .level_for("rustls", framework_level) + .level_for("hyper", framework_level) + .level_for("mio", framework_level) + .level_for("reqwest", framework_level) + .level_for("tokio_reactor", framework_level) + .level_for("tokio_util::codec::framed_read", framework_level) + .level_for("want", framework_level) + .level_for("tracing::span", framework_level) + .level_for("krill::commons::eventsourcing", krill_framework_level) + .level_for("krill::commons::util::file", krill_framework_level) + } +} + +#[cfg(test)] +mod tests { + use super::*; + + use crate::test::*; + + #[test] + fn initialise_default_signers() { + test_under_tmp(|d| { + let config_string = format!("data_dir = \"{}\"", d.to_string_lossy()); + let config = Config::parse_slice(config_string.as_bytes()).unwrap(); + config.signer().unwrap(); + }) + } +} diff --git a/src/commons/actor.rs b/src/commons/actor.rs index 9791a77c..8ca2d8df 100644 --- a/src/commons/actor.rs +++ b/src/commons/actor.rs @@ -138,6 +138,15 @@ impl PartialEq for Actor { } impl Actor { + /// Only for krillta + /// + /// Mo authorizer framework exists for krillta. It is designed as a + /// CLI. Sysadmins should ensure that only trusted people can execute + /// the CLI (and/or read / write its data). + pub fn krillta() -> Actor { + Self::test_from_def(crate::constants::ACTOR_DEF_KRILLTA) + } + /// Only for use in testing pub fn test_from_def(actor_def: ActorDef) -> Actor { Actor { diff --git a/src/commons/api/admin.rs b/src/commons/api/admin.rs index 64a5b1e6..5de3510a 100644 --- a/src/commons/api/admin.rs +++ b/src/commons/api/admin.rs @@ -16,13 +16,11 @@ use rpki::{ }; use crate::commons::{ - api::{rrdp::PublishElement, IdCertInfo, Timestamp, TrustAnchorLocator}, + api::{rrdp::PublishElement, IdCertInfo, Timestamp}, error::Error, KrillResult, }; -use super::ReceivedCert; - //------------ Token ------------------------------------------------------ #[derive(Clone, Debug, Deserialize, Eq, Hash, PartialEq, Serialize)] @@ -297,6 +295,12 @@ impl PartialEq for RepositoryContact { impl Eq for RepositoryContact {} +impl From for RepoInfo { + fn from(contact: RepositoryContact) -> Self { + contact.repo_info + } +} + //------------ ParentCaReq --------------------------------------------------- /// This type defines all parent ca details needed to add a parent to a CA @@ -331,32 +335,6 @@ impl ParentCaReq { } } -//------------ TaCertDetails ------------------------------------------------- - -#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] -pub struct TaCertDetails { - cert: ReceivedCert, - tal: TrustAnchorLocator, -} - -impl TaCertDetails { - pub fn new(cert: ReceivedCert, tal: TrustAnchorLocator) -> Self { - TaCertDetails { cert, tal } - } - - pub fn cert(&self) -> &ReceivedCert { - &self.cert - } - - pub fn resources(&self) -> &ResourceSet { - self.cert.resources() - } - - pub fn tal(&self) -> &TrustAnchorLocator { - &self.tal - } -} - //------------ ParentServerInfo ---------------------------------------------- #[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] @@ -427,7 +405,11 @@ impl fmt::Display for ParentServerInfo { #[serde(rename_all = "snake_case")] #[serde(tag = "type")] pub enum ParentCaContact { - Ta(TaCertDetails), + // Note this used to include other, now deprecated, options. + // This is still an enum for backward compatibility without the need for + // a data migration of past events, and.. because theoretically we may + // need other options in future if there is an alternative to RFC 6492 + // one day. Oh.. and having the "type" tag doesn't really hurt that much.. Rfc6492(ParentServerInfo), } @@ -452,32 +434,15 @@ impl ParentCaContact { })) } - pub fn for_ta(ta_cert_details: TaCertDetails) -> Self { - ParentCaContact::Ta(ta_cert_details) - } - - pub fn parent_server_info(&self) -> Option<&ParentServerInfo> { + pub fn parent_server_info(&self) -> &ParentServerInfo { match &self { - ParentCaContact::Ta(_) => None, - ParentCaContact::Rfc6492(info) => Some(info), + ParentCaContact::Rfc6492(info) => info, } } - pub fn to_ta_cert(&self) -> &ReceivedCert { + pub fn parent_uri(&self) -> &idexchange::ServiceUri { match &self { - ParentCaContact::Ta(details) => details.cert(), - _ => panic!("Not a TA parent"), - } - } - - pub fn is_ta(&self) -> bool { - matches!(*self, ParentCaContact::Ta(_)) - } - - pub fn parent_uri(&self) -> Option<&idexchange::ServiceUri> { - match &self { - ParentCaContact::Ta(_) => None, - ParentCaContact::Rfc6492(parent) => Some(parent.service_uri()), + ParentCaContact::Rfc6492(parent) => parent.service_uri(), } } } @@ -485,7 +450,6 @@ impl ParentCaContact { impl fmt::Display for ParentCaContact { fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result { match self { - ParentCaContact::Ta(details) => details.tal().fmt(f), ParentCaContact::Rfc6492(response) => response.fmt(f), } } @@ -495,14 +459,12 @@ impl fmt::Display for ParentCaContact { #[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] #[serde(rename_all = "snake_case")] pub enum StorableParentContact { - Ta, Rfc6492, } impl fmt::Display for StorableParentContact { fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result { match self { - StorableParentContact::Ta => write!(f, "This CA is a TA"), StorableParentContact::Rfc6492 => write!(f, "RFC 6492 Parent"), } } @@ -511,7 +473,6 @@ impl fmt::Display for StorableParentContact { impl From for StorableParentContact { fn from(parent: ParentCaContact) -> Self { match parent { - ParentCaContact::Ta(_) => StorableParentContact::Ta, ParentCaContact::Rfc6492(_) => StorableParentContact::Rfc6492, } } @@ -564,6 +525,10 @@ impl AddChildRequest { } } + pub fn handle(&self) -> &ChildHandle { + &self.handle + } + pub fn unpack(self) -> (ChildHandle, ResourceSet, IdCert) { (self.handle, self.resources, self.id_cert) } diff --git a/src/commons/api/ca.rs b/src/commons/api/ca.rs index cc686a48..d5f5156c 100644 --- a/src/commons/api/ca.rs +++ b/src/commons/api/ca.rs @@ -2,6 +2,7 @@ //! can have access without needing to depend on the full krill_ca module. use std::collections::HashMap; +use std::convert::TryFrom; use std::ops::{self}; use std::str::FromStr; use std::sync::Arc; @@ -9,6 +10,7 @@ use std::{fmt, str}; use bytes::Bytes; use chrono::{Duration, TimeZone, Utc}; +use rpki::ca::publication::{PublishDelta, PublishDeltaElement}; use rpki::repository::x509::{Name, Validity}; use serde::{Deserialize, Serialize}; @@ -37,6 +39,7 @@ use rpki::{ }; use crate::commons::crypto::CsrInfo; +use crate::commons::error; use crate::daemon::ca::BgpSecCertInfo; use crate::{ commons::{ @@ -49,7 +52,7 @@ use crate::{ daemon::ca::RoaPayloadJsonMapKey, }; -use super::BgpSecAsnKey; +use super::{rrdp, BgpSecAsnKey}; //------------ IdCertInfo ---------------------------------------------------- @@ -116,6 +119,21 @@ impl From for IdCertInfo { } } +impl TryFrom<&IdCertInfo> for IdCert { + type Error = error::Error; + + fn try_from(info: &IdCertInfo) -> Result { + IdCert::decode(info.base64.to_bytes().as_ref()) + .map_err(|e| error::Error::Custom(format!("Could not decode IdCertInfo into IdCert: {}", e))) + } +} + +impl fmt::Display for IdCertInfo { + fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { + writeln!(f, "{}", self.pem()) + } +} + //------------ ChildState ---------------------------------------------------- #[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)] @@ -486,54 +504,6 @@ impl fmt::Display for InvalidCert { impl std::error::Error for InvalidCert {} -//------------ TrustAnchorLocator -------------------------------------------- - -#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] -pub struct TrustAnchorLocator { - uris: Vec, - rsync_uri: uri::Rsync, - encoded_ski: Base64, -} - -impl TrustAnchorLocator { - /// Creates a new TAL, panics when the provided Cert is not a TA cert. - pub fn new(uris: Vec, rsync_uri: uri::Rsync, public_key: &PublicKey) -> Self { - let encoded_ski = Base64::from_content(&public_key.to_info_bytes()); - - TrustAnchorLocator { - uris, - rsync_uri, - encoded_ski, - } - } -} - -impl fmt::Display for TrustAnchorLocator { - fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result { - let base64_string = self.encoded_ski.to_string(); - - for uri in self.uris.iter() { - writeln!(f, "{}", uri)?; - } - writeln!(f, "{}", self.rsync_uri)?; - - writeln!(f)?; - - let len = base64_string.len(); - let wrap = 64; - - for i in 0..=(len / wrap) { - if (i * wrap + wrap) < len { - writeln!(f, "{}", &base64_string[i * wrap..i * wrap + wrap])?; - } else { - write!(f, "{}", &base64_string[i * wrap..])?; - } - } - - Ok(()) - } -} - //------------ PendingKeyInfo ------------------------------------------------ #[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] @@ -930,11 +900,8 @@ pub struct ParentInfo { } impl ParentInfo { - pub fn new(handle: ParentHandle, contact: ParentCaContact) -> Self { - let kind = match contact { - ParentCaContact::Ta(_) => ParentKindInfo::Ta, - ParentCaContact::Rfc6492(_) => ParentKindInfo::Rfc6492, - }; + pub fn new(handle: ParentHandle) -> Self { + let kind = ParentKindInfo::Rfc6492; ParentInfo { handle, kind } } } @@ -1192,30 +1159,14 @@ impl ParentStatus { //------------ RepoStatus ---------------------------------------------------- -#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)] pub struct RepoStatus { last_exchange: Option, last_success: Option, - next_exchange_before: Timestamp, published: Vec, } -impl Default for RepoStatus { - fn default() -> Self { - RepoStatus { - last_exchange: None, - last_success: None, - next_exchange_before: Timestamp::now_plus_hours(1), - published: vec![], - } - } -} - impl RepoStatus { - pub fn next_exchange_before(&self) -> Timestamp { - self.next_exchange_before - } - pub fn last_exchange(&self) -> Option<&ParentExchange> { self.last_exchange.as_ref() } @@ -1237,22 +1188,37 @@ impl RepoStatus { uri, result: ExchangeResult::Failure(error), }); - self.next_exchange_before = timestamp.plus_minutes(5); } - pub fn set_published(&mut self, uri: ServiceUri, published: Vec, next_update: Timestamp) { + pub fn update_published(&mut self, uri: ServiceUri, delta: PublishDelta) { let timestamp = Timestamp::now(); self.last_exchange = Some(ParentExchange { timestamp, uri, result: ExchangeResult::Success, }); - self.published = published; + + for element in delta.into_elements() { + match element { + PublishDeltaElement::Publish(publish) => { + self.published.push(publish.into()); + } + PublishDeltaElement::Update(update) => { + let update = rrdp::UpdateElement::from(update); + self.published.retain(|el| el.uri() != update.uri()); + self.published.push(update.into_publish()); + } + PublishDeltaElement::Withdraw(withdraw) => { + let (_tag, uri, _hash) = withdraw.unpack(); + self.published.retain(|el| el.uri() != &uri); + } + } + } + self.last_success = Some(timestamp); - self.next_exchange_before = next_update; } - pub fn set_last_updated(&mut self, uri: ServiceUri, next_update: Timestamp) { + pub fn set_last_updated(&mut self, uri: ServiceUri) { let timestamp = Timestamp::now(); self.last_exchange = Some(ParentExchange { timestamp, @@ -1260,7 +1226,6 @@ impl RepoStatus { result: ExchangeResult::Success, }); self.last_success = Some(timestamp); - self.next_exchange_before = next_update; } } @@ -1277,11 +1242,6 @@ impl fmt::Display for RepoStatus { if let Some(success) = self.last_success() { writeln!(f, "Last successful contact: {}", success.to_rfc3339())?; } - writeln!( - f, - "Next contact on or before: {}", - self.next_exchange_before().to_rfc3339() - )?; } } Ok(()) @@ -1680,10 +1640,7 @@ impl CertAuthInfo { children: Vec, suspended_children: Vec, ) -> Self { - let parents = parents - .into_iter() - .map(|(handle, contact)| ParentInfo::new(handle, contact)) - .collect(); + let parents = parents.into_iter().map(|(handle, _)| ParentInfo::new(handle)).collect(); let empty = ResourceSet::default(); let resources = resource_classes.values().fold(ResourceSet::default(), |res, rci| { @@ -2214,7 +2171,7 @@ mod test { use rpki::crypto::PublicKeyFormat; - use crate::{commons::crypto::OpenSslSigner, test}; + use crate::{commons::crypto::OpenSslSigner, daemon::ta::TrustAnchorLocator, test}; use super::*; diff --git a/src/commons/api/history.rs b/src/commons/api/history.rs index ed8b4f4a..1ac2de8d 100644 --- a/src/commons/api/history.rs +++ b/src/commons/api/history.rs @@ -9,6 +9,7 @@ use rpki::{ }, crypto::KeyIdentifier, repository::{resources::ResourceSet, x509::Time}, + rrdp::Hash, }; use crate::{ @@ -261,6 +262,10 @@ impl CommandSummary { self.with_arg("key", ki) } + pub fn with_id_cert_hash(self, hash: &Hash) -> Self { + self.with_arg("id_cert_hash", hash) + } + pub fn with_parent_contact(self, contact: &StorableParentContact) -> Self { self.with_arg("parent_contact", contact) } @@ -407,7 +412,6 @@ impl Default for CommandHistoryCriteria { #[serde(rename_all = "snake_case")] #[serde(tag = "type")] pub enum StorableCaCommand { - MakeTrustAnchor, ChildAdd { child: ChildHandle, ski: String, @@ -513,7 +517,6 @@ pub struct StorableRcEntitlement { impl WithStorableDetails for StorableCaCommand { fn summary(&self) -> CommandSummary { match self { - StorableCaCommand::MakeTrustAnchor => CommandSummary::new("cmd-ca-make-ta", &self), StorableCaCommand::ChildAdd { child, ski, resources } => CommandSummary::new("cmd-ca-child-add", &self) .with_child(child) .with_id_ski(ski.as_ref()) @@ -628,11 +631,6 @@ impl WithStorableDetails for StorableCaCommand { impl fmt::Display for StorableCaCommand { fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result { match self { - // ------------------------------------------------------------ - // Becoming a trust anchor - // ------------------------------------------------------------ - StorableCaCommand::MakeTrustAnchor => write!(f, "Turn into Trust Anchor"), - // ------------------------------------------------------------ // Being a parent // ------------------------------------------------------------ diff --git a/src/commons/api/import.rs b/src/commons/api/import.rs index da54a6be..3f6aa3ea 100644 --- a/src/commons/api/import.rs +++ b/src/commons/api/import.rs @@ -11,8 +11,8 @@ use rpki::{ }; use crate::{ - commons::api::PublicationServerUris, - daemon::{ca::ta_handle, config}, + commons::{api::PublicationServerUris, error::Error, KrillResult}, + daemon::{config, ta::ta_handle}, }; use super::RoaConfiguration; @@ -21,10 +21,24 @@ use super::RoaConfiguration; /// set up when the import API is used. #[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] pub struct Structure { + #[serde(skip_serializing_if = "Option::is_none")] + pub ta: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub publication_server: Option, + #[serde(skip_serializing_if = "Vec::is_empty", default = "Vec::new")] + pub cas: Vec, +} + +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +pub struct ImportTa { pub ta_aia: uri::Rsync, pub ta_uri: uri::Https, - pub publication_server_uris: PublicationServerUris, - pub cas: Vec, +} + +impl ImportTa { + pub fn into_uris(self) -> (uri::Rsync, Vec) { + (self.ta_aia, vec![self.ta_uri]) + } } impl Structure { @@ -35,9 +49,8 @@ impl Structure { cas: Vec, ) -> Self { Structure { - ta_aia, - ta_uri, - publication_server_uris, + ta: Some(ImportTa { ta_aia, ta_uri }), + publication_server: Some(publication_server_uris), cas, } } @@ -45,7 +58,7 @@ impl Structure { /// Check that all parents are valid for the CAs in this structure /// in the order in which they appear, and that the parent CAs have /// the resources for each child CA. - pub fn validate_ca_hierarchy(&self) -> Result<(), String> { + pub fn validate_ca_hierarchy(&self, mut existing_cas: HashMap) -> KrillResult<()> { // Note we define the parent child relationship in the child only. // So, the child refers to one or more parents that should have already // been seen in the import structure. @@ -57,30 +70,42 @@ impl Structure { // We will always have a TA, with ALL resources in this setup. This // TA is not mentioned in the CAs part of this structure. So, we // will mark it as implicitly seen. - let mut seen: HashMap = HashMap::new(); - seen.insert(ta_handle().into_converted(), ResourceSet::all()); + let ta_handle = ta_handle(); + existing_cas.insert(ta_handle.convert(), ResourceSet::all()); + for ca in &self.cas { + if ca.handle == ta_handle { + return Err(Error::Custom(format!("CA name {} is reserved.", ta_handle))); + } + + if existing_cas.contains_key(&ca.handle.convert()) { + return Err(Error::Custom(format!( + "CA with name {} already exists. Check import and server state!", + ca.handle + ))); + } + let mut ca_resources = ResourceSet::empty(); for ca_parent in &ca.parents { - if let Some(seen_parent_resources) = seen.get(ca_parent.handle()) { + if let Some(seen_parent_resources) = existing_cas.get(ca_parent.handle()) { if seen_parent_resources.contains(&ca_parent.resources) { ca_resources = ca_resources.union(&ca_parent.resources); } else { - return Err(format!( + return Err(Error::Custom(format!( "CA '{}' under parent '{}' claims resources not held by parent.", ca.handle, ca_parent.handle() - )); + ))); } } else { - return Err(format!( + return Err(Error::Custom(format!( "CA '{}' wants parent '{}', but this parent CA does not appear before this CA.", ca.handle, ca_parent.handle() - )); + ))); } } - seen.insert(ca.handle.convert(), ca_resources); + existing_cas.insert(ca.handle.convert(), ca_resources); } Ok(()) } @@ -153,6 +178,6 @@ mod tests { let json = include_str!("../../../test-resources/bulk-ca-import/structure.json"); let structure: Structure = serde_json::from_str(json).unwrap(); - assert!(structure.validate_ca_hierarchy().is_ok()); + assert!(structure.validate_ca_hierarchy(HashMap::new()).is_ok()); } } diff --git a/src/commons/crypto/signing/dispatch/krillsigner.rs b/src/commons/crypto/signing/dispatch/krillsigner.rs index 0d9cde64..d24acf6f 100644 --- a/src/commons/crypto/signing/dispatch/krillsigner.rs +++ b/src/commons/crypto/signing/dispatch/krillsigner.rs @@ -1,11 +1,13 @@ use std::{path::Path, sync::Arc, time::Duration}; +use bytes::Bytes; use rpki::{ ca::{ csr::{Csr, RpkiCaCsr}, idcert::IdCert, idexchange::RepoInfo, provisioning, publication, + sigmsg::SignedMessage, }, crypto::{KeyIdentifier, PublicKey, PublicKeyFormat, RpkiSignature, RpkiSignatureAlgorithm, Signer}, repository::{ @@ -31,13 +33,16 @@ use crate::{ signerprovider::{SignerFlags, SignerProvider}, signerrouter::SignerRouter, }, - CryptoResult, OpenSslSigner, + CryptoResult, OpenSslSigner, SignSupport, }, error::Error, KrillResult, }, constants::ID_CERTIFICATE_VALIDITY_YEARS, - daemon::config::{SignerConfig, SignerType}, + daemon::{ + config::{SignerConfig, SignerType}, + ta::TA_SIGNED_MESSAGE_DAYS, + }, }; #[cfg(feature = "hsm")] @@ -199,6 +204,10 @@ impl KrillSigner { .map_err(crypto::Error::signer) } + pub fn import_key(&self, pem: &str) -> CryptoResult { + self.router.import_key(pem).map_err(crypto::Error::signer) + } + /// Creates a new self-signed (TA) IdCert pub fn create_self_signed_id_cert(&self) -> CryptoResult { let key = self.create_key()?; @@ -316,6 +325,12 @@ impl KrillSigner { ) -> CryptoResult { publication::PublicationCms::create(message, signing_key, &self.router).map_err(crypto::Error::signing) } + + pub fn create_ta_signed_message(&self, data: Bytes, signing_key: &KeyIdentifier) -> CryptoResult { + let validity = SignSupport::sign_validity_days(TA_SIGNED_MESSAGE_DAYS); + + SignedMessage::create(data, validity, signing_key, &self.router).map_err(crypto::Error::signing) + } } impl KrillSigner { diff --git a/src/commons/crypto/signing/dispatch/signerprovider.rs b/src/commons/crypto/signing/dispatch/signerprovider.rs index 61435204..47974413 100644 --- a/src/commons/crypto/signing/dispatch/signerprovider.rs +++ b/src/commons/crypto/signing/dispatch/signerprovider.rs @@ -182,6 +182,20 @@ impl SignerProvider { } } + /// Import an existing private key. Only supported for OpenSslSigner. Other + /// signers will return an error. + pub fn import_key(&self, pem: &str) -> Result { + match self { + SignerProvider::OpenSsl(_, signer) => signer.import_key(pem), + #[cfg(feature = "hsm")] + SignerProvider::Kmip(_, _) => Err(SignerError::other("import key not supported for kmip")), + #[cfg(feature = "hsm")] + SignerProvider::Pkcs11(_, _) => Err(SignerError::other("import key not supported for Pkcs11")), + #[cfg(all(test, feature = "hsm"))] + SignerProvider::Mock(_, _) => Err(SignerError::other("import key not supported for mock signer")), + } + } + pub fn get_key_info(&self, key: &KeyIdentifier) -> Result> { match self { SignerProvider::OpenSsl(_, signer) => signer.get_key_info(key), diff --git a/src/commons/crypto/signing/dispatch/signerrouter.rs b/src/commons/crypto/signing/dispatch/signerrouter.rs index 263e5b02..41a6c063 100644 --- a/src/commons/crypto/signing/dispatch/signerrouter.rs +++ b/src/commons/crypto/signing/dispatch/signerrouter.rs @@ -190,6 +190,13 @@ impl SignerRouter { Ok(()) } } + + /// Import an existing private RSA key. Will only work for the OpenSslSigner. + /// Returns an error if another signer is used. + pub fn import_key(&self, pem: &str) -> Result { + self.bind_ready_signers(); + self.default_signer.import_key(pem) + } } /// When the "hsm" feature is enabled we can no longer assume that signers are immediately and always available as was diff --git a/src/commons/crypto/signing/misc.rs b/src/commons/crypto/signing/misc.rs index d6239b95..17f63048 100644 --- a/src/commons/crypto/signing/misc.rs +++ b/src/commons/crypto/signing/misc.rs @@ -73,6 +73,10 @@ impl CsrInfo { (self.ca_repository, self.rpki_manifest, self.rpki_notify, self.key) } + pub fn key(&self) -> &PublicKey { + &self.key + } + pub fn key_id(&self) -> KeyIdentifier { self.key.key_identifier() } @@ -113,11 +117,10 @@ impl SignSupport { csr: CsrInfo, resources: &ResourceSet, limit: RequestResourceLimit, - signing_key: &CertifiedKey, + signing_cert: &ReceivedCert, validity: Validity, signer: &KrillSigner, ) -> KrillResult { - let signing_cert = signing_key.incoming_cert(); let resources = limit.apply_to(resources)?; if !signing_cert.resources().contains(&resources) { return Err(Error::MissingResources); @@ -126,7 +129,7 @@ impl SignSupport { let request = CertRequest::Ca(csr, validity); let tbs = Self::make_tbs_cert(&resources, signing_cert, request, signer)?; - let cert = signer.sign_cert(tbs, signing_key.key_id())?; + let cert = signer.sign_cert(tbs, &signing_cert.key_identifier())?; let uri = signing_cert.uri_for_object(&cert); @@ -223,6 +226,14 @@ impl SignSupport { Ok(cert) } + /// Returns a validity period from 5 minutes ago (in case of NTP mess-up), to + /// X weeks from now. + pub fn sign_validity_years(years: i32) -> Validity { + let from = Time::five_minutes_ago(); + let until = Time::years_from_now(years); + Validity::new(from, until) + } + /// Returns a validity period from 5 minutes ago (in case of NTP mess-up), to /// X weeks from now. pub fn sign_validity_weeks(weeks: i64) -> Validity { diff --git a/src/commons/crypto/signing/signers/softsigner.rs b/src/commons/crypto/signing/signers/softsigner.rs index ca38cd7d..83eeb59f 100644 --- a/src/commons/crypto/signing/signers/softsigner.rs +++ b/src/commons/crypto/signing/signers/softsigner.rs @@ -152,7 +152,10 @@ impl OpenSslSigner { fn build_key(&self) -> Result { let kp = OpenSslKeyPair::build()?; + self.store_key(kp) + } + fn store_key(&self, kp: OpenSslKeyPair) -> Result { let pk = &kp.subject_public_key_info()?; let key_id = pk.key_identifier(); @@ -228,6 +231,16 @@ impl OpenSslSigner { pub fn create_key(&self, _algorithm: PublicKeyFormat) -> Result { let key_id = self.build_key()?; self.remember_key_id(&key_id)?; + + Ok(key_id) + } + + /// Import an existing RSA key pair from the PEM encoded private key + pub fn import_key(&self, pem: &str) -> Result { + let kp = OpenSslKeyPair::from_pem(pem)?; + let key_id = self.store_key(kp)?; + self.remember_key_id(&key_id)?; + Ok(key_id) } @@ -296,13 +309,7 @@ impl<'de> Deserialize<'de> for OpenSslKeyPair { D: Deserializer<'de>, { match String::deserialize(d) { - Ok(base64) => { - let bytes = base64::decode(&base64).map_err(de::Error::custom)?; - - let pkey = PKey::private_key_from_der(&bytes).map_err(de::Error::custom)?; - - Ok(OpenSslKeyPair { pkey }) - } + Ok(base64) => Self::from_base64(&base64).map_err(de::Error::custom), Err(err) => Err(err), } } @@ -323,6 +330,22 @@ impl OpenSslKeyPair { PublicKey::decode(bytes).map_err(SignerError::other) } + + /// Can be used to import an existing RSA key pair from + /// the pem encoded private key. + pub fn from_pem(pem: &str) -> Result { + PKey::private_key_from_pem(pem.as_bytes()) + .map(|pkey| OpenSslKeyPair { pkey }) + .map_err(|e| SignerError::Other(format!("Invalid private key: {}", e))) + } + + fn from_base64(base64: &str) -> Result { + let bytes = base64::decode(base64).map_err(|_| SignerError::other("Cannot parse private key base64"))?; + + PKey::private_key_from_der(&bytes) + .map(|pkey| OpenSslKeyPair { pkey }) + .map_err(|e| SignerError::Other(format!("Invalid private key: {}", e))) + } } //------------ Tests --------------------------------------------------------- @@ -354,4 +377,30 @@ pub mod tests { // not implement Eq and PartialEq. assert_eq!(json, json_from_des); } + + #[test] + fn import_existing_pkcs1_openssl_key() { + test::test_under_tmp(|d| { + // The following key was generated using openssl on the command + let pem = include_str!("../../../../../test-resources/ta/example-pkcs1.pem"); + let signer = OpenSslSigner::build(&d, "dummy", None).unwrap(); + + let ki = signer.import_key(pem).unwrap(); + signer.get_key_info(&ki).unwrap(); + signer.destroy_key(&ki).unwrap(); + }) + } + + #[test] + fn import_existing_pkcs8_openssl_key() { + test::test_under_tmp(|d| { + // The following key was generated using openssl on the command + let pem = include_str!("../../../../../test-resources/ta/example-pkcs8.pem"); + let signer = OpenSslSigner::build(&d, "dummy", None).unwrap(); + + let ki = signer.import_key(pem).unwrap(); + signer.get_key_info(&ki).unwrap(); + signer.destroy_key(&ki).unwrap(); + }) + } } diff --git a/src/commons/error.rs b/src/commons/error.rs index f8755d7a..0de428f7 100644 --- a/src/commons/error.rs +++ b/src/commons/error.rs @@ -23,7 +23,7 @@ use crate::{ eventsourcing::{AggregateStoreError, KeyValueError}, util::httpclient, }, - daemon::{ca::RoaPayloadJsonMapKey, http::tls_keys}, + daemon::{ca::RoaPayloadJsonMapKey, http::tls_keys, ta}, upgrades::PrepareUpgradeError, }; @@ -289,7 +289,8 @@ pub enum Error { KeyUseNoOldKey, KeyUseNoIssuedCert, KeyUseNoMatch(KeyIdentifier), - KeyRollNotAllowed, + KeyRollInProgress, + KeyRollActivatePendingRequests, //----------------------------------------------------------------- // Resource Issues @@ -299,11 +300,19 @@ pub enum Error { MissingResources, //----------------------------------------------------------------- - // Embedded (test) TA issues + // TA issues //----------------------------------------------------------------- TaNotAllowed, TaNameReserved, + TaNotInitialized, TaAlreadyInitialized, + TaProxyAlreadyHasRepository, + TaProxyHasNoRepository, + TaProxyHasNoSigner, + TaProxyAlreadyHasSigner, + TaProxyHasNoRequest, + TaProxyHasRequest, + TaProxyRequestNonceMismatch(ta::Nonce, ta::Nonce), //----------------------------------------------------------------- // Resource Tagged Attestation issues @@ -470,7 +479,8 @@ impl fmt::Display for Error { Error::KeyUseNoOldKey => write!(f, "No old key in resource class"), Error::KeyUseNoIssuedCert => write!(f, "No issued cert matching pub key"), Error::KeyUseNoMatch(ki) => write!(f, "No key found matching key identifier: '{}'", ki), - Error::KeyRollNotAllowed => write!(f, "Key roll in progress"), + Error::KeyRollInProgress => write!(f, "Key roll in progress"), + Error::KeyRollActivatePendingRequests => write!(f, "Cannot activate key while there are still pending requests."), //----------------------------------------------------------------- // Resource Issues @@ -485,7 +495,15 @@ impl fmt::Display for Error { //----------------------------------------------------------------- Error::TaNotAllowed => write!(f, "Functionality not supported for Trust Anchor"), Error::TaNameReserved => write!(f, "Name reserved for embedded Trust Anchor"), + Error::TaNotInitialized => write!(f, "TrustAnchor was not initialized"), Error::TaAlreadyInitialized => write!(f, "TrustAnchor was already initialized"), + Error::TaProxyAlreadyHasRepository => write!(f, "Trust Anchor Proxy already has repository"), + Error::TaProxyHasNoRepository => write!(f, "Trust Anchor Proxy has no repository"), + Error::TaProxyHasNoSigner => write!(f, "Trust Anchor Proxy has no associated signer"), + Error::TaProxyAlreadyHasSigner => write!(f, "Trust Anchor Proxy already has associated signer"), + Error::TaProxyHasNoRequest => write!(f, "Trust Anchor Proxy has no signer request"), + Error::TaProxyHasRequest => write!(f, "Trust Anchor Proxy already has signer request"), + Error::TaProxyRequestNonceMismatch(rcvd, expected) => write!(f, "Trust Anchor Response nonce '{}' does not match open Request nonce '{}'", rcvd, expected), //----------------------------------------------------------------- // Resource Tagged Attestation issues @@ -889,7 +907,8 @@ impl Error { Error::KeyUseNoOldKey => ErrorResponse::new("key-no-old", &self), Error::KeyUseNoIssuedCert => ErrorResponse::new("key-no-cert", &self), Error::KeyUseNoMatch(ki) => ErrorResponse::new("key-no-match", &self).with_key_identifier(ki), - Error::KeyRollNotAllowed => ErrorResponse::new("key-roll-disallowed", &self), + Error::KeyRollInProgress => ErrorResponse::new("key-roll-disallowed", &self), + Error::KeyRollActivatePendingRequests => ErrorResponse::new("key-roll-pending-requests", &self), //----------------------------------------------------------------- // Resource Issues (label: rc-*) @@ -903,7 +922,15 @@ impl Error { //----------------------------------------------------------------- Error::TaNotAllowed => ErrorResponse::new("ta-not-allowed", &self), Error::TaNameReserved => ErrorResponse::new("ta-name-reserved", &self), + Error::TaNotInitialized => ErrorResponse::new("ta-not-initialized", &self), Error::TaAlreadyInitialized => ErrorResponse::new("ta-initialized", &self), + Error::TaProxyAlreadyHasRepository => ErrorResponse::new("ta-has-repository", &self), + Error::TaProxyHasNoRepository => ErrorResponse::new("ta-has-no-repository", &self), + Error::TaProxyHasNoSigner => ErrorResponse::new("ta-has-no-signer", &self), + Error::TaProxyAlreadyHasSigner => ErrorResponse::new("ta-has-signer", &self), + Error::TaProxyHasNoRequest => ErrorResponse::new("ta-has-no-signer-req", &self), + Error::TaProxyHasRequest => ErrorResponse::new("ta-has-signer-req", &self), + Error::TaProxyRequestNonceMismatch(_rcvd, _expected) => ErrorResponse::new("ta-proxy-response-nonce", &self), //----------------------------------------------------------------- // Resource Tagged Attestation issues diff --git a/src/commons/util/httpclient.rs b/src/commons/util/httpclient.rs index 791f726c..27cce32a 100644 --- a/src/commons/util/httpclient.rs +++ b/src/commons/util/httpclient.rs @@ -189,19 +189,28 @@ pub async fn post_json_with_opt_response( /// Performs a POST with no data to the given URI and expects and empty 200 OK response. pub async fn post_empty(uri: &str, token: Option<&Token>) -> Result<(), Error> { + let res = do_empty_post(uri, token).await?; + empty_response(uri, res).await +} + +/// Performs a POST with no data to the given URI and expects a response. +pub async fn post_empty_with_response(uri: &str, token: Option<&Token>) -> Result { + let res = do_empty_post(uri, token).await?; + process_json_response(uri, res).await +} + +async fn do_empty_post(uri: &str, token: Option<&Token>) -> Result { if env::var(KRILL_CLI_API_ENV).is_ok() { report_post_and_exit(uri, None, token, ""); } let headers = headers(uri, Some(JSON_CONTENT), token)?; - let res = client(uri)? + client(uri)? .post(uri) .headers(headers) .send() .await - .map_err(|e| Error::execute(uri, e))?; - - empty_response(uri, res).await + .map_err(|e| Error::execute(uri, e)) } /// Posts binary data, and expects a binary response. Includes the full krill version diff --git a/src/constants.rs b/src/constants.rs index 96615fbf..62d05c87 100644 --- a/src/constants.rs +++ b/src/constants.rs @@ -7,8 +7,9 @@ pub const KRILL_VERSION_PATCH: &str = env!("CARGO_PKG_VERSION_PATCH"); pub const KRILL_SERVER_APP: &str = "Krill"; pub const KRILL_UP_APP: &str = "Krill Upgrade Helper"; pub const KRILL_CLIENT_APP: &str = "Krill Client"; +pub const KRILL_TA_CLIENT_APP: &str = "Krill Trust Anchor Client"; -pub const KRILL_DEFAULT_CONFIG_FILE: &str = "./defaults/krill.conf"; +pub const KRILL_DEFAULT_CONFIG_FILE: &str = "/etc/krill.conf"; const KRILL_ENV_TEST: &str = "KRILL_TEST"; const KRILL_ENV_TEST_ANN: &str = "KRILL_TEST_ANN"; @@ -40,6 +41,8 @@ pub const KEYS_DIR: &str = "keys"; pub const SIGNERS_DIR: &str = "signers"; pub const CASERVER_DIR: &str = "cas"; +pub const TA_PROXY_SERVER_DIR: &str = "ta_proxy"; +pub const TA_SIGNER_SERVER_DIR: &str = "ta_signer"; pub const CA_OBJECTS_DIR: &str = "ca_objects"; pub const PUBSERVER_DFLT: &str = "0"; @@ -91,6 +94,7 @@ pub const OPENID_CONNECT_HTTP_CLIENT_TIMEOUT_SECS: u64 = 30; pub const NO_RESOURCE: NoResourceType = NoResourceType; pub const ACTOR_DEF_KRILL: ActorDef = ActorDef::system("krill", "admin"); +pub const ACTOR_DEF_KRILLTA: ActorDef = ActorDef::system("krillta", "admin"); pub const ACTOR_DEF_ANON: ActorDef = ActorDef::anonymous(); pub const ACTOR_DEF_ADMIN_TOKEN: ActorDef = ActorDef::system("admin-token", "admin"); pub const ACTOR_DEF_TESTBED: ActorDef = ActorDef::system("testbed", "testbed"); @@ -114,8 +118,8 @@ pub const DEFAULT_SIGNER_NAME: &str = "Default OpenSSL signer"; #[cfg(all(feature = "hsm-tests-kmip", feature = "hsm-tests-pkcs11"))] pub const DEFAULT_SIGNER_NAME: &str = "Default OpenSSL signer"; #[cfg(all(feature = "hsm-tests-kmip", not(feature = "hsm-tests-pkcs11")))] -pub const DEFAULT_KMIP_SIGNER_NAME: &str = "(test mode) Default KMIP signer"; +pub const DEFAULT_SIGNER_NAME: &str = "(test mode) Default KMIP signer"; #[cfg(all(feature = "hsm-tests-pkcs11", not(feature = "hsm-tests-kmip")))] -pub const DEFAULT_PKCS11_SIGNER_NAME: &str = "(test mode) Default PKCS#11 signer"; +pub const DEFAULT_SIGNER_NAME: &str = "(test mode) Default PKCS#11 signer"; pub const OPENSSL_ONE_OFF_SIGNER_NAME: &str = "OpenSSL one-off signer"; diff --git a/src/daemon/auth/providers/config_file/provider.rs b/src/daemon/auth/providers/config_file/provider.rs index 455a4feb..326c943c 100644 --- a/src/daemon/auth/providers/config_file/provider.rs +++ b/src/daemon/auth/providers/config_file/provider.rs @@ -159,7 +159,7 @@ impl ConfigFileAuthProvider { ) .unwrap(); - if hex::encode(hashed_hash) == user_password_hash.as_ref() { + if hex::encode(hashed_hash) == user_password_hash { // And now finally check the user, so that both known and unknown user code paths do the same work // and don't result in an obvious timing difference between the two scenarios which could potentially // be used to discover user names. diff --git a/src/daemon/ca/certauth.rs b/src/daemon/ca/certauth.rs index 2e862c37..0568393d 100644 --- a/src/daemon/ca/certauth.rs +++ b/src/daemon/ca/certauth.rs @@ -15,12 +15,11 @@ use rpki::{ }, crypto::{KeyIdentifier, PublicKey}, repository::{ - cert::{Cert, KeyUsage, Overclaim, TbsCert}, + cert::Cert, resources::ResourceSet, rta::RtaBuilder, - x509::{Serial, Time, Validity}, + x509::{Time, Validity}, }, - uri, }; use crate::{ @@ -29,8 +28,7 @@ use crate::{ AspaCustomer, AspaDefinitionList, AspaDefinitionUpdates, AspaProvidersUpdate, BgpSecAsnKey, BgpSecCsrInfoList, BgpSecDefinitionUpdates, CertAuthInfo, ConfiguredRoa, IdCertInfo, IssuedCertificate, ObjectName, ParentCaContact, ReceivedCert, RepositoryContact, Revocation, RoaConfiguration, - RoaConfigurationUpdates, RtaList, RtaName, RtaPrepResponse, StorableCaCommand, TaCertDetails, - TrustAnchorLocator, + RoaConfigurationUpdates, RtaList, RtaName, RtaPrepResponse, StorableCaCommand, }, crypto::{CsrInfo, KrillSigner}, error::{Error, RoaDeltaError}, @@ -40,10 +38,9 @@ use crate::{ constants::test_mode_enabled, daemon::{ ca::{ - events::ChildCertificateUpdates, ta_handle, AspaDefinitions, BgpSecDefinitions, CaEvt, CaEvtDet, - ChildDetails, Cmd, CmdDet, DropReason, Ini, PreparedRta, ResourceClass, ResourceTaggedAttestation, - Rfc8183Id, RoaPayloadJsonMapKey, Routes, RtaContentRequest, RtaPrepareRequest, Rtas, SignedRta, - StoredBgpSecCsr, + events::ChildCertificateUpdates, AspaDefinitions, BgpSecDefinitions, CaEvt, CaEvtDet, ChildDetails, Cmd, + CmdDet, DropReason, Ini, PreparedRta, ResourceClass, ResourceTaggedAttestation, Rfc8183Id, + RoaPayloadJsonMapKey, Routes, RtaContentRequest, RtaPrepareRequest, Rtas, SignedRta, StoredBgpSecCsr, }, config::{Config, IssuanceTimingConfig}, }, @@ -133,18 +130,6 @@ impl Aggregate for CertAuth { fn apply(&mut self, event: CaEvt) { self.version += 1; match event.into_details() { - //----------------------------------------------------------------------- - // Being a trust anchor - //----------------------------------------------------------------------- - CaEvtDet::TrustAnchorMade { ta_cert_details } => { - let key_id = ta_cert_details.cert().key_identifier(); - self.parents - .insert(ta_handle().into_converted(), ParentCaContact::Ta(ta_cert_details)); - let rcn = ResourceClassName::from(self.next_class_name); - self.next_class_name += 1; - self.resources.insert(rcn.clone(), ResourceClass::for_ta(rcn, key_id)); - } - //----------------------------------------------------------------------- // Being a parent //----------------------------------------------------------------------- @@ -416,9 +401,6 @@ impl Aggregate for CertAuth { } match command.into_details() { - // trust anchor - CmdDet::MakeTrustAnchor(uris, rsync_uri, signer) => self.trust_anchor_make(uris, rsync_uri, signer), - // being a parent CmdDet::ChildAdd(child, id_cert, resources) => self.child_add(child, id_cert, resources), CmdDet::ChildUpdateResources(child, res) => self.child_update_resources(&child, res), @@ -599,75 +581,6 @@ impl CertAuth { } } -/// # Being a Trust Anchor -/// -impl CertAuth { - fn trust_anchor_make( - &self, - uris: Vec, - rsync_uri: uri::Rsync, - signer: Arc, - ) -> KrillResult> { - if !self.resources.is_empty() { - return Err(Error::custom("Cannot turn CA with resources into TA")); - } - - let repo_info = self.repository_contact()?.repo_info(); - - let key = signer.create_key()?; - - let resources = ResourceSet::all(); - - let cert = { - let serial: Serial = signer.random_serial()?; - - let pub_key = signer.get_key_info(&key).map_err(Error::signer)?; - let name = pub_key.to_subject_name(); - - let mut cert = TbsCert::new( - serial, - name.clone(), - Validity::new(Time::five_minutes_ago(), Time::years_from_now(100)), - Some(name), - pub_key.clone(), - KeyUsage::Ca, - Overclaim::Refuse, - ); - - cert.set_basic_ca(Some(true)); - - let ns = ResourceClassName::default().to_string(); - - cert.set_ca_repository(Some(repo_info.ca_repository(&ns))); - cert.set_rpki_manifest(Some( - repo_info.resolve(&ns, ObjectName::mft_for_key(&pub_key.key_identifier()).as_ref()), - )); - cert.set_rpki_notify(repo_info.rpki_notify().cloned()); - - cert.set_as_resources(resources.to_as_resources()); - cert.set_v4_resources(resources.to_ip_resources_v4()); - cert.set_v6_resources(resources.to_ip_resources_v6()); - - signer.sign_cert(cert, &key)? - }; - - let tal = TrustAnchorLocator::new(uris, rsync_uri.clone(), cert.subject_public_key_info()); - - let rcvd_cert = - ReceivedCert::create(cert, rsync_uri, resources, RequestResourceLimit::default()).map_err(Error::custom)?; - - let ta_cert_details = TaCertDetails::new(rcvd_cert, tal); - - info!("Created Trust Anchor"); - - Ok(vec![StoredEvent::new( - &self.handle, - self.version, - CaEvtDet::TrustAnchorMade { ta_cert_details }, - )]) - } -} - /// # Being a parent /// impl CertAuth { @@ -1215,17 +1128,6 @@ impl CertAuth { None } - /// Returns true if this CertAuth is set up as a TA. - pub fn is_ta(&self) -> bool { - for info in self.parents.values() { - if let ParentCaContact::Ta(_) = info { - return true; - } - } - - false - } - /// Gets the ParentCaContact for this ParentHandle. Returns an Err when the /// parent does not exist. pub fn parent(&self, parent: &ParentHandle) -> KrillResult<&ParentCaContact> { @@ -1251,8 +1153,6 @@ impl CertAuth { Err(Error::CaParentDuplicateName(self.handle.clone(), parent)) } else if let Some(other) = self.parent_for_info(&info) { Err(Error::CaParentDuplicateInfo(self.handle.clone(), other.clone())) - } else if self.is_ta() { - Err(Error::TaNotAllowed) } else { info!("CA '{}' added parent '{}'", self.handle, parent); Ok(vec![CaEvtDet::parent_added(&self.handle, self.version, parent, info)]) @@ -1289,8 +1189,6 @@ impl CertAuth { fn update_parent(&self, parent: ParentHandle, info: ParentCaContact) -> KrillResult> { if !self.parent_known(&parent) { Err(Error::CaParentUnknown(self.handle.clone(), parent)) - } else if self.is_ta() { - Err(Error::TaNotAllowed) } else { info!("CA '{}' updated contact info for parent '{}'", self.handle, parent); Ok(vec![CaEvtDet::parent_updated(&self.handle, self.version, parent, info)]) @@ -1526,10 +1424,6 @@ impl CertAuth { /// impl CertAuth { fn keyroll_initiate(&self, duration: Duration, signer: Arc) -> KrillResult> { - if self.is_ta() { - return Ok(vec![]); - } - let mut version = self.version; let mut res = vec![]; @@ -1561,10 +1455,6 @@ impl CertAuth { config: Arc, signer: Arc, ) -> KrillResult> { - if self.is_ta() { - return Ok(vec![]); - } - let mut version = self.version; let mut res = vec![]; @@ -1594,9 +1484,6 @@ impl CertAuth { } fn keyroll_finish(&self, rcn: ResourceClassName, _response: RevocationResponse) -> KrillResult> { - if self.is_ta() { - return Ok(vec![]); - } let my_rc = self .resources .get(&rcn) @@ -1637,7 +1524,7 @@ impl CertAuth { if !rc.key_roll_possible() { // If we can't roll... well then we have to bail out. // Note: none of these events are committed in that case. - return Err(Error::KeyRollNotAllowed); + return Err(Error::KeyRollInProgress); } evt_dets.append(&mut rc.keyroll_initiate(&info, Duration::seconds(0), signer)?); diff --git a/src/daemon/ca/child.rs b/src/daemon/ca/child.rs index f0225c54..207fc558 100644 --- a/src/daemon/ca/child.rs +++ b/src/daemon/ca/child.rs @@ -8,15 +8,12 @@ use rpki::{ use crate::{ commons::{ - api::{ChildCaInfo, ChildState, IdCertInfo, IssuedCertificate, SuspendedCert, UnsuspendedCert}, + api::{ChildCaInfo, ChildState, IdCertInfo, IssuedCertificate, ReceivedCert, SuspendedCert, UnsuspendedCert}, crypto::{KrillSigner, SignSupport}, error::Error, KrillResult, }, - daemon::{ - ca::{CertifiedKey, ChildCertificateUpdates}, - config::IssuanceTimingConfig, - }, + daemon::{ca::ChildCertificateUpdates, config::IssuanceTimingConfig}, }; //------------ UsedKeyState ------------------------------------------------ @@ -193,18 +190,18 @@ impl ChildCertificates { /// Re-issue everything when activating a new key pub fn activate_key( &self, - new_key: &CertifiedKey, + signing_cert: &ReceivedCert, issuance_timing: &IssuanceTimingConfig, signer: &KrillSigner, ) -> KrillResult { let mut updates = ChildCertificateUpdates::default(); for issued in self.issued.values() { - updates.issue(self.re_issue(issued, None, new_key, issuance_timing, signer)?); + updates.issue(self.re_issue(issued, None, signing_cert, issuance_timing, signer)?); } // Also re-issue suspended certificates, they may yet become unsuspended at some point for suspended in self.suspended.values() { updates.suspend( - self.re_issue(&suspended.convert(), None, new_key, issuance_timing, signer)? + self.re_issue(&suspended.convert(), None, signing_cert, issuance_timing, signer)? .into_converted(), ); } @@ -218,13 +215,13 @@ impl ChildCertificates { /// with those resources. pub fn shrink_overclaiming( &self, - updated_key: &CertifiedKey, + received_cert: &ReceivedCert, issuance_timing: &IssuanceTimingConfig, signer: &KrillSigner, ) -> KrillResult { let mut updates = ChildCertificateUpdates::default(); - let updated_resources = updated_key.incoming_cert().resources(); + let updated_resources = received_cert.resources(); for issued in self.issued.values() { if let Some(reduced_set) = issued.reduced_applicable_resources(updated_resources) { @@ -233,7 +230,7 @@ impl ChildCertificates { updates.remove(issued.key_identifier()); } else { // re-issue - updates.issue(self.re_issue(issued, Some(reduced_set), updated_key, issuance_timing, signer)?); + updates.issue(self.re_issue(issued, Some(reduced_set), received_cert, issuance_timing, signer)?); } } } @@ -254,7 +251,7 @@ impl ChildCertificates { self.re_issue( &suspended.convert(), Some(reduced_set), - updated_key, + received_cert, issuance_timing, signer, )? @@ -273,7 +270,7 @@ impl ChildCertificates { &self, previous: &IssuedCertificate, updated_resources: Option, - signing_key: &CertifiedKey, + signing_cert: &ReceivedCert, issuance_timing: &IssuanceTimingConfig, signer: &KrillSigner, ) -> KrillResult { @@ -285,7 +282,7 @@ impl ChildCertificates { csr_info, &resource_set, limit, - signing_key, + signing_cert, issuance_timing.new_child_cert_validity(), signer, )?; diff --git a/src/daemon/ca/commands.rs b/src/daemon/ca/commands.rs index 96ae4541..d277d6b5 100644 --- a/src/daemon/ca/commands.rs +++ b/src/daemon/ca/commands.rs @@ -11,7 +11,6 @@ use rpki::{ }, }, repository::resources::ResourceSet, - uri, }; use crate::{ @@ -46,11 +45,6 @@ pub type DropReason = String; #[derive(Clone, Debug)] #[allow(clippy::large_enum_variant)] pub enum CmdDet { - // ------------------------------------------------------------ - // Being a TA - // ------------------------------------------------------------ - MakeTrustAnchor(Vec, uri::Rsync, Arc), - // ------------------------------------------------------------ // Being a parent // ------------------------------------------------------------ @@ -225,11 +219,6 @@ impl fmt::Display for CmdDet { impl From for StorableCaCommand { fn from(d: CmdDet) -> Self { match d { - // ------------------------------------------------------------ - // Being a TA - // ------------------------------------------------------------ - CmdDet::MakeTrustAnchor(_, _, _) => StorableCaCommand::MakeTrustAnchor, - // ------------------------------------------------------------ // Being a parent // ------------------------------------------------------------ @@ -344,17 +333,6 @@ impl From for StorableCaCommand { } impl CmdDet { - /// Turns this CA into a TrustAnchor - pub fn make_trust_anchor( - handle: &CaHandle, - uris: Vec, - rsync_uri: uri::Rsync, - signer: Arc, - actor: &Actor, - ) -> Cmd { - eventsourcing::SentCommand::new(handle, None, CmdDet::MakeTrustAnchor(uris, rsync_uri, signer), actor) - } - /// Adds a child to this CA. Will return an error in case you try /// to give the child resources not held by the CA. pub fn child_add( diff --git a/src/daemon/ca/events.rs b/src/daemon/ca/events.rs index 6b7385f1..9d464c11 100644 --- a/src/daemon/ca/events.rs +++ b/src/daemon/ca/events.rs @@ -13,8 +13,7 @@ use crate::{ commons::{ api::{ AspaCustomer, AspaDefinition, AspaProvidersUpdate, BgpSecAsnKey, IdCertInfo, IssuedCertificate, ObjectName, - ParentCaContact, ReceivedCert, RepositoryContact, RoaAggregateKey, RtaName, SuspendedCert, TaCertDetails, - UnsuspendedCert, + ParentCaContact, ReceivedCert, RepositoryContact, RoaAggregateKey, RtaName, SuspendedCert, UnsuspendedCert, }, crypto::KrillSigner, eventsourcing::StoredEvent, @@ -48,6 +47,12 @@ impl Rfc8183Id { } } +impl From for IdCertInfo { + fn from(id: Rfc8183Id) -> Self { + id.cert + } +} + //------------ Ini ----------------------------------------------------------- pub type Ini = StoredEvent; @@ -425,11 +430,6 @@ pub type CaEvt = StoredEvent; #[serde(rename_all = "snake_case")] #[serde(tag = "type")] pub enum CaEvtDet { - // Being a Trust Anchor - TrustAnchorMade { - ta_cert_details: TaCertDetails, - }, - // Being a parent Events /// A child was added to this (parent) CA ChildAdded { @@ -774,13 +774,6 @@ impl CaEvtDet { impl fmt::Display for CaEvtDet { fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result { match self { - // Being a Trust Anchor - CaEvtDet::TrustAnchorMade { ta_cert_details } => write!( - f, - "turn into TA with key (hash) {}", - ta_cert_details.cert().key_identifier() - ), - // Being a parent Events CaEvtDet::ChildAdded { child, @@ -874,19 +867,11 @@ impl fmt::Display for CaEvtDet { "updated RFC8183 id to key '{}'", id.cert().public_key().key_identifier() ), - CaEvtDet::ParentAdded { parent, contact } => { - let contact_str = match contact { - ParentCaContact::Ta(_) => "TA proxy", - ParentCaContact::Rfc6492(_) => "RFC6492", - }; - write!(f, "added {} parent '{}' ", contact_str, parent) + CaEvtDet::ParentAdded { parent, .. } => { + write!(f, "added parent '{}' ", parent) } - CaEvtDet::ParentUpdated { parent, contact } => { - let contact_str = match contact { - ParentCaContact::Ta(_) => "TA proxy", - ParentCaContact::Rfc6492(_) => "RFC6492", - }; - write!(f, "updated parent '{}' contact to '{}' ", parent, contact_str) + CaEvtDet::ParentUpdated { parent, .. } => { + write!(f, "updated parent '{}'", parent) } CaEvtDet::ParentRemoved { parent } => write!(f, "removed parent '{}'", parent), diff --git a/src/daemon/ca/keys.rs b/src/daemon/ca/keys.rs index 62fa8423..80f5e014 100644 --- a/src/daemon/ca/keys.rs +++ b/src/daemon/ca/keys.rs @@ -573,12 +573,16 @@ impl KeyState { signer: &KrillSigner, ) -> KrillResult { match self { - KeyState::RollNew(_new, current) => { - let revoke_req = Self::revoke_key(parent_class_name, current.key_id(), signer)?; - Ok(CaEvtDet::KeyRollActivated { - resource_class_name, - revoke_req, - }) + KeyState::RollNew(new, current) => { + if new.request().is_some() || current.request().is_some() { + Err(Error::KeyRollActivatePendingRequests) + } else { + let revoke_req = Self::revoke_key(parent_class_name, current.key_id(), signer)?; + Ok(CaEvtDet::KeyRollActivated { + resource_class_name, + revoke_req, + }) + } } _ => Err(Error::KeyUseNoNewKey), } diff --git a/src/daemon/ca/manager.rs b/src/daemon/ca/manager.rs index d0fa423a..1473b6c4 100644 --- a/src/daemon/ca/manager.rs +++ b/src/daemon/ca/manager.rs @@ -9,8 +9,8 @@ use rpki::{ idexchange::{CaHandle, ChildHandle, ParentHandle}, provisioning, provisioning::{ - IssuanceRequest, IssuanceResponse, ProvisioningCms, ResourceClassListResponse, ResourceClassName, - RevocationRequest, RevocationResponse, + IssuanceRequest, ProvisioningCms, ResourceClassListResponse, ResourceClassName, RevocationRequest, + RevocationResponse, }, publication, publication::{ListReply, Publish, PublishDelta, Update, Withdraw}, @@ -24,8 +24,8 @@ use crate::{ commons::{ actor::Actor, api::{ - rrdp::PublishElement, BgpSecCsrInfoList, BgpSecDefinitionUpdates, ParentServerInfo, PublicationServerInfo, - RoaConfigurationUpdates, Timestamp, + rrdp::PublishElement, BgpSecCsrInfoList, BgpSecDefinitionUpdates, IdCertInfo, ParentServerInfo, + PublicationServerInfo, RoaConfigurationUpdates, Timestamp, }, api::{ AddChildRequest, AspaCustomer, AspaDefinitionList, AspaDefinitionUpdates, AspaProvidersUpdate, @@ -39,27 +39,49 @@ use crate::{ util::{cmslogger::CmsLogger, httpclient}, KrillResult, }, - constants::{CASERVER_DIR, STATUS_DIR}, + constants::{CASERVER_DIR, STATUS_DIR, TA_PROXY_SERVER_DIR, TA_SIGNER_SERVER_DIR}, daemon::{ auth::common::permissions::Permission, auth::Handle, ca::{ - self, ta_handle, CaObjectsStore, CaStatus, CertAuth, Cmd, CmdDet, DeprecatedRepository, IniDet, - ResourceTaggedAttestation, RtaContentRequest, RtaPrepareRequest, StatusStore, + CaObjectsStore, CaStatus, CertAuth, Cmd, CmdDet, DeprecatedRepository, IniDet, ResourceTaggedAttestation, + RtaContentRequest, RtaPrepareRequest, StatusStore, }, config::Config, mq::{now, TaskQueue}, + ta::{ + self, ta_handle, TrustAnchorProxy, TrustAnchorProxyCommand, TrustAnchorSignedRequest, + TrustAnchorSignedResponse, TrustAnchorSigner, TrustAnchorSignerCommand, TrustAnchorSignerInfo, + TrustAnchorSignerInitCommand, TA_NAME, + }, }, pubd::RepositoryManager, }; //------------ CaManager ----------------------------------------------------- -#[derive(Clone)] pub struct CaManager { - ca_store: Arc>, + // Used to manage CAs + ca_store: AggregateStore, + + // Used to manage objects for CAs. Also shared with the ca_store as well + // as a listener so that it can create manifests and CRLs as needed. Accessed + // here for publishing. ca_objects_store: Arc, - status_store: Arc, + + // Keep track of CA parent and CA repository interaction status. + status_store: StatusStore, + + // We may have a TA Proxy that we need to manage. Many functions are + // similar to CA operations, so it makes sense to manage this as a + // special kind of CA here. + ta_proxy_store: Option>, + + // We may also have a local TA signer - in case we are running in + // testbed or benchmarking mode - so that we can do all TA signing + // without the need for user interactions through the API and + // TA signer CLI. + ta_signer_store: Option>, // shared task queue: // - listens for events in the ca_store @@ -70,7 +92,8 @@ pub struct CaManager { config: Arc, signer: Arc, - // System actor + // System actor is used for (scheduled or triggered) system actions where + // we have no operator actor context. system_actor: Actor, } @@ -124,14 +147,36 @@ impl CaManager { // the RPKI repository. ca_store.add_post_save_listener(tasks.clone()); + // Create TA proxy store if we need it. + let ta_proxy_store = if config.ta_proxy_enabled() { + let mut store = AggregateStore::::disk(&config.data_dir, TA_PROXY_SERVER_DIR)?; + + // We need to listen for proxy events so that we can schedule: + // 1. publication on updates + // 2. re-sync for local children when the proxy has new responses + // 3. signing by the Trust Anchor Signer when there are requests [in testbed mode] + store.add_post_save_listener(tasks.clone()); + Some(store) + } else { + None + }; + + let ta_signer_store = if config.ta_signer_enabled() { + Some(AggregateStore::disk(&config.data_dir, TA_SIGNER_SERVER_DIR)?) + } else { + None + }; + // Create the status store which will maintain the last known connection status between each CA // and their parent(s) and repository. let status_store = StatusStore::new(&config.data_dir, STATUS_DIR)?; Ok(CaManager { - ca_store: Arc::new(ca_store), + ca_store, ca_objects_store, - status_store: Arc::new(status_store), + status_store, + ta_proxy_store, + ta_signer_store, tasks, config, signer, @@ -143,63 +188,8 @@ impl CaManager { self.config.testbed().is_some() } - /// Gets the TrustAnchor, if present. Returns an error if the TA is uninitialized. - pub async fn get_trust_anchor(&self) -> KrillResult> { - let ta_handle = ca::ta_handle(); - self.ca_store.get_latest(&ta_handle).map_err(Error::AggregateStoreError) - } - - /// Initializes an embedded trust anchor with all resources. - pub async fn init_ta( - &self, - ta_aia: uri::Rsync, - ta_uris: Vec, - repo_manager: &Arc, - actor: &Actor, - ) -> KrillResult<()> { - let ta_handle = ca::ta_handle(); - - if self.ca_store.has(&ta_handle)? { - Err(Error::TaAlreadyInitialized) - } else { - // init normal CA - let init = IniDet::init(&ta_handle, self.signer.deref())?; - self.ca_store.add(init)?; - - // add to repo - let ta = self.get_trust_anchor().await?; - let pub_req = ta.publisher_request(); - repo_manager.create_publisher(pub_req, actor)?; - let repository_response = repo_manager.repository_response(&ta_handle.convert())?; - let contact = RepositoryContact::for_response(repository_response).map_err(Error::rfc8183)?; - - let upd_repo_cmd = CmdDet::update_repo(&ta_handle, contact, self.signer.clone(), actor); - self.ca_store.command(upd_repo_cmd)?; - - // make trust anchor - let make_ta_cmd = - CmdDet::make_trust_anchor(&ta_handle, ta_uris, ta_aia.clone(), self.signer.clone(), actor); - let ta = self.ca_store.command(make_ta_cmd)?; - - // receive the self signed cert (now as child of self) - let rcvd_cert = ta.parent(&ta_handle.convert()).unwrap().to_ta_cert().clone(); - - let rcv_cert = CmdDet::upd_received_cert( - &ta_handle, - ResourceClassName::default(), - rcvd_cert, - self.config.clone(), - self.signer.clone(), - actor, - ); - self.ca_store.command(rcv_cert)?; - - Ok(()) - } - } - /// Send a command to a CA - async fn send_command(&self, cmd: Cmd) -> KrillResult> { + async fn send_ca_command(&self, cmd: Cmd) -> KrillResult> { self.ca_store.command(cmd) } @@ -210,6 +200,218 @@ impl CaManager { } } +/// # Trust Anchor Support +/// +impl CaManager { + /// Send a command to the TA Proxy. Errors if ta support is not enabled + async fn send_ta_proxy_command(&self, cmd: TrustAnchorProxyCommand) -> KrillResult> { + self.ta_proxy_store + .as_ref() + .ok_or_else(|| Error::custom("ta_support_enabled is false"))? + .command(cmd) + } + + /// Send a command to the TA Proxy. Errors if ta support is not enabled + async fn send_ta_signer_command(&self, cmd: TrustAnchorSignerCommand) -> KrillResult> { + self.ta_signer_store + .as_ref() + .ok_or_else(|| Error::custom("ta_signer_enabled is false"))? + .command(cmd) + } + + /// Gets the Trust Anchor Proxy, if present. Returns an error if the TA is uninitialized. + pub async fn get_trust_anchor_proxy(&self) -> KrillResult> { + let ta_handle = ta::ta_handle(); + self.ta_proxy_store + .as_ref() + .ok_or_else(|| Error::custom("TA proxy not enabled"))? + .get_latest(&ta_handle) + .map_err(Error::AggregateStoreError) + } + + /// Gets the Trust Anchor Signer, if present. Returns an error if the TA is uninitialized. + pub async fn get_trust_anchor_signer(&self) -> KrillResult> { + let ta_handle = ta::ta_handle(); + self.ta_signer_store + .as_ref() + .ok_or_else(|| Error::custom("TA signer not enabled"))? + .get_latest(&ta_handle) + .map_err(Error::AggregateStoreError) + } + + /// Initialises the (one) Trust Anchor proxy. + /// + /// Returns an error if: + /// - ta_support_enabled is false + /// - the proxy was already initialised + pub async fn ta_proxy_init(&self) -> KrillResult<()> { + let ta_handle = ta::ta_handle(); + + let ta_proxy_store = self + .ta_proxy_store + .as_ref() + .ok_or_else(|| Error::custom("ta_support_enabled must be true in config"))?; + + if ta_proxy_store.has(&ta_handle)? { + Err(Error::TaAlreadyInitialized) + } else { + // Initialise proxy + let proxy_init = TrustAnchorProxy::create_init(ta_handle, &self.signer)?; + ta_proxy_store.add(proxy_init)?; + Ok(()) + } + } + + /// Initialises the embedded Trust Anchor Signer (for testbed). + /// This assumes that the one and only local Trust Anchor Proxy exists and + /// is to be associated with this signer. + pub async fn ta_signer_init(&self, tal_https: Vec, tal_rsync: uri::Rsync) -> KrillResult<()> { + let ta_signer_store = self + .ta_signer_store + .as_ref() + .ok_or_else(|| Error::custom("ta_signer_enabled must be true in config"))?; + + let handle = ta_handle(); + + if ta_signer_store.has(&handle)? { + Err(Error::TaAlreadyInitialized) + } else { + // Create Signer + let repo_contact = self.ta_proxy_repository_contact().await?; + let proxy_id = self.ta_proxy_id().await?; + + let signer_init_cmd = TrustAnchorSignerInitCommand { + handle, + proxy_id, + repo_info: repo_contact.repo_info().clone(), + tal_https, + tal_rsync, + private_key_pem: None, + signer: self.signer.clone(), + }; + + let signer_init = TrustAnchorSigner::create_init(signer_init_cmd)?; + ta_signer_store.add(signer_init)?; + + Ok(()) + } + } + + pub async fn ta_proxy_id(&self) -> KrillResult { + self.get_trust_anchor_proxy().await.map(|proxy| proxy.id().clone()) + } + + /// Gets the publisher request for the Trust Anchor proxy. + /// Returns an error if the proxy is not initialised. + pub async fn ta_proxy_publisher_request(&self) -> KrillResult { + self.get_trust_anchor_proxy() + .await + .map(|proxy| proxy.publisher_request()) + } + + /// Add the repository to Trust Anchor proxy. + /// Returns an error if the proxy is not enabled or already has a repository. + pub async fn ta_proxy_repository_update(&self, contact: RepositoryContact, actor: &Actor) -> KrillResult<()> { + let add_repo_cmd = TrustAnchorProxyCommand::add_repo(&ta::ta_handle(), contact, actor); + self.send_ta_proxy_command(add_repo_cmd).await?; + Ok(()) + } + + /// Returns the repository contact for the proxy, or an error if there is + /// no proxy, or no repository configured for it. + pub async fn ta_proxy_repository_contact(&self) -> KrillResult { + self.get_trust_anchor_proxy() + .await? + .repository() + .cloned() + .ok_or(Error::TaProxyHasNoRepository) + } + + /// Adds the associated signer to the proxy. + /// + /// Errors if: + /// - there is no proxy + /// - the proxy has a signer + pub async fn ta_proxy_signer_add(&self, info: TrustAnchorSignerInfo, actor: &Actor) -> KrillResult<()> { + let add_signer_cmd = TrustAnchorProxyCommand::add_signer(&ta_handle(), info, actor); + self.send_ta_proxy_command(add_signer_cmd).await?; + Ok(()) + } + + /// Create a new request for the signer. + /// + /// Errors if: + /// - there is no proxy + /// - the proxy already has a request + pub async fn ta_proxy_signer_make_request(&self, actor: &Actor) -> KrillResult { + let cmd = TrustAnchorProxyCommand::make_signer_request(&ta_handle(), actor); + let proxy = self.send_ta_proxy_command(cmd).await?; + + proxy.get_signer_request(&self.signer) + } + + /// Create a new request for the signer. + /// + /// Errors if: + /// - there is no proxy + /// - the proxy already has a request + pub async fn ta_proxy_signer_get_request(&self) -> KrillResult { + self.get_trust_anchor_proxy().await?.get_signer_request(&self.signer) + } + + /// Process a sign response from the signer. + /// + /// Errors if: + /// - there is no proxy + /// - there is no matching request + pub async fn ta_proxy_signer_process_response( + &self, + response: TrustAnchorSignedResponse, + actor: &Actor, + ) -> KrillResult<()> { + let cmd = TrustAnchorProxyCommand::process_signer_response(&ta_handle(), response, actor); + self.send_ta_proxy_command(cmd).await?; + Ok(()) + } + + /// Initializes an embedded trust anchor with all resources. + pub async fn ta_init_fully_embedded( + &self, + ta_aia: uri::Rsync, + ta_uris: Vec, + repo_manager: &Arc, + actor: &Actor, + ) -> KrillResult<()> { + let ta_handle = ta::ta_handle(); + + // Initialise proxy + self.ta_proxy_init().await?; + + // Add repository + let pub_req = self.ta_proxy_publisher_request().await?; + + // Create publisher + repo_manager.create_publisher(pub_req, actor)?; + let repository_response = repo_manager.repository_response(&ta_handle.convert())?; + + // Add repository to proxy + let contact = RepositoryContact::for_response(repository_response).map_err(Error::rfc8183)?; + self.ta_proxy_repository_update(contact, &self.system_actor).await?; + + // Initialise signer + self.ta_signer_init(ta_uris, ta_aia).await?; + + // Add signer to proxy + let signer_info = self.get_trust_anchor_signer().await?.get_signer_info(); + self.ta_proxy_signer_add(signer_info, &self.system_actor).await?; + + self.sync_ta_proxy_signer_if_possible().await?; + self.cas_repo_sync_single(repo_manager, &ta_handle).await?; + + Ok(()) + } +} + /// # CA instances and identity /// impl CaManager { @@ -237,7 +439,7 @@ impl CaManager { /// not support that identities are updated after initialization. pub async fn ca_update_id(&self, handle: CaHandle, actor: &Actor) -> KrillResult<()> { let cmd = CmdDet::update_id(&handle, self.signer.clone(), actor); - self.send_command(cmd).await?; + self.send_ca_command(cmd).await?; Ok(()) } @@ -321,7 +523,7 @@ impl CaManager { for repo_contact in repos { if self - .ca_repo_sync(repo_manager, ca_handle, &repo_contact, vec![]) + .ca_repo_sync(repo_manager, ca_handle, ca.id_cert(), &repo_contact, vec![]) .await .is_err() { @@ -382,12 +584,18 @@ impl CaManager { actor: &Actor, ) -> KrillResult { info!("CA '{}' process add child request: {}", &ca, &req); - let (child_handle, child_res, id_cert) = req.unpack(); + if ca.as_str() != TA_NAME { + let (child_handle, child_res, id_cert) = req.unpack(); - let add_child = CmdDet::child_add(ca, child_handle.clone(), id_cert.into(), child_res, actor); - self.send_command(add_child).await?; - - self.ca_parent_response(ca, child_handle, service_uri).await + let add_child = CmdDet::child_add(ca, child_handle.clone(), id_cert.into(), child_res, actor); + self.send_ca_command(add_child).await?; + self.ca_parent_response(ca, child_handle, service_uri).await + } else { + let child_handle = req.handle().clone(); + let add_child_cmd = TrustAnchorProxyCommand::add_child(ca, req, actor); + self.send_ta_proxy_command(add_child_cmd).await?; + self.ca_parent_response(ca, child_handle, service_uri).await + } } /// Show details for a child under the CA. @@ -419,11 +627,19 @@ impl CaManager { service_uri: &uri::Https, ) -> KrillResult { let service_uri = Self::service_uri_for_ca(service_uri, ca_handle); - let ca = self.get_ca(ca_handle).await?; + let id_cert: publication::Base64 = if ca_handle.as_str() != TA_NAME { + let ca = self.get_ca(ca_handle).await?; + ca.get_child(&child_handle)?; // ensure the child is known + ca.id_cert().base64().clone() + } else { + let proxy = self.get_trust_anchor_proxy().await?; + proxy.get_child(&child_handle)?; + proxy.id().base64().clone() + }; Ok(idexchange::ParentResponse::new( - ca.id_cert().base64().clone(), - ca.handle().convert(), + id_cert, + ca_handle.convert(), child_handle, service_uri, None, @@ -452,19 +668,19 @@ impl CaManager { let (id_opt, resources_opt, suspend_opt) = req.unpack(); if let Some(id) = id_opt { - self.send_command(CmdDet::child_update_id(ca, child.clone(), id.into(), actor)) + self.send_ca_command(CmdDet::child_update_id(ca, child.clone(), id.into(), actor)) .await?; } if let Some(resources) = resources_opt { - self.send_command(CmdDet::child_update_resources(ca, child.clone(), resources, actor)) + self.send_ca_command(CmdDet::child_update_resources(ca, child.clone(), resources, actor)) .await?; } if let Some(suspend) = suspend_opt { if suspend { - self.send_command(CmdDet::child_suspend_inactive(ca, child, actor)) + self.send_ca_command(CmdDet::child_suspend_inactive(ca, child, actor)) .await?; } else { - self.send_command(CmdDet::child_unsuspend(ca, child, actor)).await?; + self.send_ca_command(CmdDet::child_unsuspend(ca, child, actor)).await?; } } Ok(()) @@ -474,7 +690,7 @@ impl CaManager { /// are revoked and withdrawn. pub async fn ca_child_remove(&self, ca: &CaHandle, child: ChildHandle, actor: &Actor) -> KrillResult<()> { self.status_store.remove_child(ca, &child)?; - self.send_command(CmdDet::child_remove(ca, child, actor)).await?; + self.send_ca_command(CmdDet::child_remove(ca, child, actor)).await?; Ok(()) } @@ -491,6 +707,10 @@ impl CaManager { user_agent: Option, actor: &Actor, ) -> KrillResult { + if ca_handle.as_str() == TA_NAME { + return Err(Error::custom("Remote RFC 6492 to TA is not supported")); + } + let ca = self.get_ca(ca_handle).await?; let req_msg = self.rfc6492_unwrap_request(&ca, &msg_bytes)?; @@ -502,7 +722,9 @@ impl CaManager { req_msg.sender(), ); - let res_msg = self.rfc6492_process_request(&ca, req_msg, user_agent, actor).await; + let res_msg = self + .rfc6492_process_request(ca_handle, req_msg, user_agent, actor) + .await; match res_msg { Ok(msg) => { @@ -528,43 +750,40 @@ impl CaManager { /// Process an rfc6492 message and create an unsigned response pub async fn rfc6492_process_request( &self, - ca: &CertAuth, + ca_handle: &CaHandle, req_msg: provisioning::Message, user_agent: Option, actor: &Actor, ) -> KrillResult { - let (sender, recipient, payload) = req_msg.unpack(); + let (sender, _recipient, payload) = req_msg.unpack(); let child_handle = sender.convert(); // If the child was suspended, because it was inactive, then we can now conclude // that it's become active again. So unsuspend it first, before processing the request // further. - let child_ca = ca.get_child(&child_handle)?; - if child_ca.is_suspended() { - info!( - "Child '{}' under CA '{}' became active again, will unsuspend it.", - child_handle, - ca.handle() - ); - let req = UpdateChildRequest::unsuspend(); - self.ca_child_update(ca.handle(), child_handle.clone(), req, actor) - .await?; + // + // The TA will never suspend children, and does not support it. + if ca_handle.as_str() != TA_NAME { + let ca = self.get_ca(ca_handle).await?; + + let child_ca = ca.get_child(&child_handle)?; + if child_ca.is_suspended() { + info!( + "Child '{}' under CA '{}' became active again, will unsuspend it.", + child_handle, + ca.handle() + ); + let req = UpdateChildRequest::unsuspend(); + self.ca_child_update(ca.handle(), child_handle.clone(), req, actor) + .await?; + } } let res_msg = match payload { - provisioning::Payload::Revoke(req) => { - let res = self.revoke(ca.handle(), child_handle.clone(), req, actor).await?; - Ok(provisioning::Message::revoke_response(sender, recipient, res)) - } - provisioning::Payload::List => { - let entitlements = self.list(ca.handle(), &child_handle).await?; - Ok(provisioning::Message::list_response(sender, recipient, entitlements)) - } - provisioning::Payload::Issue(req) => { - let res = self.issue(ca.handle(), &child_handle, req, actor).await?; - Ok(provisioning::Message::issue_response(sender, recipient, res)) - } + provisioning::Payload::Revoke(req) => self.revoke(ca_handle, child_handle.clone(), req, actor).await, + provisioning::Payload::List => self.list(ca_handle, &child_handle).await, + provisioning::Payload::Issue(req) => self.issue(ca_handle, child_handle.clone(), req, actor).await, _ => Err(Error::custom("Unsupported RFC6492 message")), }; @@ -572,11 +791,11 @@ impl CaManager { match &res_msg { Ok(_) => { self.status_store - .set_child_success(ca.handle(), &child_handle, user_agent)?; + .set_child_success(ca_handle, &child_handle, user_agent)?; } Err(e) => { self.status_store - .set_child_failure(ca.handle(), &child_handle, user_agent, e)?; + .set_child_failure(ca_handle, &child_handle, user_agent, e)?; } } @@ -596,9 +815,21 @@ impl CaManager { } /// List the entitlements for a child: 3.3.2 of RFC 6492. - async fn list(&self, ca: &CaHandle, child: &ChildHandle) -> KrillResult { - let ca = self.get_ca(ca).await?; - ca.list(child, &self.config.issuance_timing) + async fn list(&self, ca_handle: &CaHandle, child: &ChildHandle) -> KrillResult { + let list_response = if ca_handle.as_str() != TA_NAME { + self.get_ca(ca_handle).await?.list(child, &self.config.issuance_timing) + } else { + self.get_trust_anchor_proxy() + .await? + .entitlements(child, &self.config.issuance_timing) + .map(|entitlements| ResourceClassListResponse::new(vec![entitlements])) + }?; + + Ok(provisioning::Message::list_response( + ca_handle.convert(), + child.convert(), + list_response, + )) } /// Issue a Certificate in response to an RFC 6492 Certificate Issuance request sent by a child. @@ -606,29 +837,38 @@ impl CaManager { /// See: https://tools.ietf.org/html/rfc6492#section3.4.1-2 async fn issue( &self, - ca: &CaHandle, - child: &ChildHandle, + ca_handle: &CaHandle, + child: ChildHandle, issue_req: IssuanceRequest, actor: &Actor, - ) -> KrillResult { - let class_name = issue_req.class_name(); - let pub_key = issue_req.csr().public_key(); + ) -> KrillResult { + if ca_handle.as_str() == TA_NAME { + let request = ta::ProvisioningRequest::Issuance(issue_req); + self.ta_slow_rfc6492_request(ca_handle, child, request, actor).await + } else { + let class_name = issue_req.class_name(); + let pub_key = issue_req.csr().public_key(); - let cmd = CmdDet::child_certify( - ca, - child.clone(), - issue_req.clone(), - self.config.clone(), - self.signer.clone(), - actor, - ); + let cmd = CmdDet::child_certify( + ca_handle, + child.clone(), + issue_req.clone(), + self.config.clone(), + self.signer.clone(), + actor, + ); - let ca = self.send_command(cmd).await?; + let ca = self.send_ca_command(cmd).await?; - // The updated CA will now include the newly issued certificate. - let response = ca.issuance_response(child, class_name, pub_key, &self.config.issuance_timing)?; + // The updated CA will now include the newly issued certificate. + let response = ca.issuance_response(&child, class_name, pub_key, &self.config.issuance_timing)?; - Ok(response) + Ok(provisioning::Message::issue_response( + ca_handle.convert(), + child.into_converted(), + response, + )) + } } /// Process an RFC 6492 revocation request sent by a child. @@ -639,13 +879,63 @@ impl CaManager { child: ChildHandle, revoke_request: RevocationRequest, actor: &Actor, - ) -> KrillResult { - let res = RevocationResponse::from(&revoke_request); // response provided that no errors are returned earlier + ) -> KrillResult { + if ca_handle.as_str() == TA_NAME { + let request = ta::ProvisioningRequest::Revocation(revoke_request); + self.ta_slow_rfc6492_request(ca_handle, child, request, actor).await + } else { + let res = RevocationResponse::from(&revoke_request); // response provided that no errors are returned + let msg = provisioning::Message::revoke_response(ca_handle.convert(), child.convert(), res); - let cmd = CmdDet::child_revoke_key(ca_handle, child, revoke_request, actor); - self.send_command(cmd).await?; + let cmd = CmdDet::child_revoke_key(ca_handle, child, revoke_request, actor); + self.send_ca_command(cmd).await?; - Ok(res) + Ok(msg) + } + } + + /// Processes a 'slow' RFC 6492 request to the TA: an issue or revoke request + /// which will require the Trust Anchor Signer to use the TA key. + async fn ta_slow_rfc6492_request( + &self, + ta_handle: &CaHandle, + child: ChildHandle, + request: ta::ProvisioningRequest, + actor: &Actor, + ) -> KrillResult { + let proxy = self.get_trust_anchor_proxy().await?; + if let Some(response) = proxy.response_for_child(&child, &request)? { + // Great, we have a pending response. We can give the response to the child + // and remove it from the proxy. + let response = response + .clone() + .to_provisioning_message(ta_handle.convert(), child.convert()); + + let cmd = TrustAnchorProxyCommand::give_child_response(ta_handle, child, request.key_identifier(), actor); + self.send_ta_proxy_command(cmd).await?; + + Ok(response) + } else if proxy.matching_open_request(&child, &request)? { + // already scheduled.. should not happen with krill children + // but return 1101 just in case + provisioning::Message::not_performed_response( + ta_handle.convert(), + child.convert(), + provisioning::NotPerformedResponse::err_1101(), + ) + .map_err(|_| Error::custom("creation of not performed response should never fail")) + } else { + // we will need schedule this one and return a 1104 not performed response + let cmd = TrustAnchorProxyCommand::add_child_request(ta_handle, child.clone(), request, actor); + self.send_ta_proxy_command(cmd).await?; + + provisioning::Message::not_performed_response( + ta_handle.convert(), + child.into_converted(), + provisioning::NotPerformedResponse::err_1104(), + ) + .map_err(|_| Error::custom("creation of not performed response should never fail")) + } } } @@ -673,7 +963,7 @@ impl CaManager { CmdDet::update_parent(&handle, parent, contact, actor) }; - self.send_command(cmd).await?; + self.send_ca_command(cmd).await?; Ok(()) } @@ -692,7 +982,7 @@ impl CaManager { self.status_store.remove_parent(&handle, &parent)?; let upd = CmdDet::remove_parent(&handle, parent, actor); - self.send_command(upd).await?; + self.send_ca_command(upd).await?; Ok(()) } @@ -819,6 +1109,46 @@ impl CaManager { } } + /// Synchronise the Trust Anchor Proxy with the Signer - it the Signer is local. + pub async fn sync_ta_proxy_signer_if_possible(&self) -> KrillResult<()> { + let ta_handle = ta_handle(); + + if let Ok(mut proxy) = self.get_trust_anchor_proxy().await { + if let Ok(mut signer) = self.get_trust_anchor_signer().await { + // make sign request in proxy + let sign_request_cmd = TrustAnchorProxyCommand::make_signer_request(&ta_handle, &self.system_actor); + proxy = self.send_ta_proxy_command(sign_request_cmd).await?; + + // get sign request for signer + let signed_request = proxy.get_signer_request(&self.signer)?; + let request_nonce = signed_request.content().nonce.clone(); // remember so we can retrieve it + + // let signer process request + let signer_process_request_cmd = TrustAnchorSignerCommand::make_process_request_command( + &ta_handle, + signed_request, + self.signer.clone(), + &self.system_actor, + ); + signer = self.send_ta_signer_command(signer_process_request_cmd).await?; + + // get the response from the signer and give it to the proxy + let exchange = signer.get_exchange(&request_nonce).unwrap(); + let proxy_process_response_cmd = TrustAnchorProxyCommand::process_signer_response( + &ta_handle, + exchange.clone().response, + &self.system_actor, + ); + self.send_ta_proxy_command(proxy_process_response_cmd).await?; + } else { + warn!("There is at least one pending request for the TA signer. Plan a signing session!") + } + } else { + debug!("Sync TA proxy signer was called without a TA proxy.. this is rather odd..") + } + Ok(()) + } + /// Try to get updates from a specific parent of a CA. async fn get_updates_from_parent( &self, @@ -865,7 +1195,7 @@ impl CaManager { for (rcn, revoke_responses) in revoke_responses.into_iter() { for response in revoke_responses.into_iter() { let cmd = CmdDet::key_roll_finish(handle, rcn.clone(), response, actor); - self.send_command(cmd).await?; + self.send_ca_command(cmd).await?; } } @@ -879,29 +1209,25 @@ impl CaManager { revoke_requests: HashMap>, ) -> KrillResult>> { let child = self.get_ca(handle).await?; - match child.parent(parent)? { - ParentCaContact::Ta(_) => Err(Error::TaNotAllowed), - ParentCaContact::Rfc6492(server_info) => { - let parent_uri = server_info.service_uri(); + let server_info = child.parent(parent)?.parent_server_info(); + let parent_uri = server_info.service_uri(); - match self - .send_revoke_requests_rfc6492( - revoke_requests, - &child.id_cert().public_key().key_identifier(), - server_info, - ) - .await - { - Err(e) => { - self.status_store.set_parent_failure(handle, parent, parent_uri, &e)?; - Err(e) - } - Ok(res) => { - self.status_store.set_parent_last_updated(handle, parent, parent_uri)?; - Ok(res) - } - } + match self + .send_revoke_requests_rfc6492( + revoke_requests, + &child.id_cert().public_key().key_identifier(), + server_info, + ) + .await + { + Err(e) => { + self.status_store.set_parent_failure(handle, parent, parent_uri, &e)?; + Err(e) + } + Ok(res) => { + self.status_store.set_parent_last_updated(handle, parent, parent_uri)?; + Ok(res) } } } @@ -946,18 +1272,36 @@ impl CaManager { match payload { provisioning::Payload::RevokeResponse(revoke_response) => revocations.push(revoke_response), provisioning::Payload::ErrorResponse(e) => { - // If we get one of the following responses: - // 1301 revoke - no such resource class - // 1302 revoke - no such key - // - // Then we can consider this revocation redundant from the parent side, so just add it - // as revoked to this CA and move on. While this may be unexpected this is unlikely to - // be a problem. If we would keep insisting that the parent revokes a key they already - // revoked, then we can end up in a stuck loop. - // - // More importantly we should re-sync things if we get 12** errors to certificate sign - // requests, but that is done in another function. - if e.status() == 1301 || e.status() == 1302 { + if e.status() == 1101 || e.status() == 1104 { + // If we get one of the following responses: + // 1101 already processing request + // 1104 request scheduled for processing + // + // Then we asked the parent, but don't have a revocation response yet. + // + // This is okay.. there is nothing to do but ask again later. This should really + // only happen for a CA that operates under the *local* Trust Anchor. The Krill + // TA uses a 'proxy' part for online functions, such as talking to children, + // and a 'signer' part for signing, which may happen offline - and much later. + // + // By not adding any response to the returned hash we ensure that the old key + // remains in use (for a manifest and CRL only) until we get the revocation response + // when we ask later. + // + // When the local TA 'proxy' receives new signed responses from the 'signer' then it + // will trigger all local children to sync again. That time, they should see a response. + } else if e.status() == 1301 || e.status() == 1302 { + // If we get one of the following responses: + // 1301 revoke - no such resource class + // 1302 revoke - no such key + // + // Then we can consider this revocation redundant from the parent side, so just add it + // as revoked to this CA and move on. While this may be unexpected this is unlikely to + // be a problem. If we would keep insisting that the parent revokes a key they already + // revoked, then we can end up in a stuck loop. + // + // More importantly we should re-sync things if we get 12** errors to certificate sign + // requests, but that is done in another function. let revoke_response = (&req).into(); revocations.push(revoke_response) } else { @@ -988,7 +1332,7 @@ impl CaManager { let ca = self.get_ca(ca_handle).await?; let requests = ca.cert_requests(parent); let signing_key = ca.id_cert().public_key().key_identifier(); - let server_info = ca.parent(parent)?.parent_server_info().ok_or(Error::TaNotAllowed)?; + let server_info = ca.parent(parent)?.parent_server_info(); // We may need to do work for multiple resource class and there may therefore be // multiple errors. We want to keep track of those, rather than bailing out on the @@ -1073,7 +1417,7 @@ impl CaManager { } Ok(rcvd_cert) => { if let Err(e) = self - .send_command(CmdDet::upd_received_cert( + .send_ca_command(CmdDet::upd_received_cert( ca_handle, rcn.clone(), rcvd_cert, @@ -1095,7 +1439,7 @@ impl CaManager { let reason = format!("cannot process received certificate! error: {}", e); - self.send_command(CmdDet::drop_resource_class( + self.send_ca_command(CmdDet::drop_resource_class( ca_handle, rcn.clone(), reason.clone(), @@ -1122,6 +1466,21 @@ impl CaManager { } provisioning::Payload::ErrorResponse(not_performed) => { match not_performed.status() { + 1101 | 1104 => { + // If we get one of the following responses: + // 1101 already processing request + // 1104 request scheduled for processing + // + // Then we asked the parent, but don't have a signed certificate yet. + // + // This is okay.. there is nothing to do but ask again later. This should really + // only happen for a CA that operates under the *local* Trust Anchor. The Krill + // TA uses a 'proxy' part for online functions, such as talking to children, + // and a 'signer' part for signing, which may happen offline - and much later. + // + // If the local TA 'proxy' receives new signed responses from the 'signer' then it + // will trigger all local children to sync again. That time, they should see a response. + } 1201 | 1202 => { // Okay, so it looks like the parent *just* told the CA that it was entitled // to certain resources in a resource class and now in response to certificate @@ -1131,7 +1490,7 @@ impl CaManager { let reason = "parent removed entitlement to resource class".to_string(); - self.send_command(CmdDet::drop_resource_class( + self.send_ca_command(CmdDet::drop_resource_class( ca_handle, rcn.clone(), reason.clone(), @@ -1165,7 +1524,7 @@ impl CaManager { // eligible certificates and ROAs under it. let reason = "parent claims we are re-using keys".to_string(); - self.send_command(CmdDet::drop_resource_class( + self.send_ca_command(CmdDet::drop_resource_class( ca_handle, rcn.clone(), reason.clone(), @@ -1257,7 +1616,7 @@ impl CaManager { let update_entitlements_command = CmdDet::update_entitlements(ca, parent, entitlements, self.signer.clone(), actor); - let new_version = self.send_command(update_entitlements_command).await?.version(); + let new_version = self.send_ca_command(update_entitlements_command).await?.version(); Ok(new_version > current_version) } @@ -1269,29 +1628,26 @@ impl CaManager { contact: &ParentCaContact, existing_parent: bool, ) -> KrillResult { - match contact { - ParentCaContact::Ta(_) => Err(Error::TaNotAllowed), - ParentCaContact::Rfc6492(server_info) => { - let result = self.get_entitlements_rfc6492(ca, server_info).await; - let uri = server_info.service_uri(); + let server_info = contact.parent_server_info(); + let uri = server_info.service_uri(); - match &result { - Err(error) => { - if existing_parent { - // only update the status store with errors for existing parents - // otherwise we end up with entries if a new parent is rejected because - // of the error. - self.status_store.set_parent_failure(ca, parent, uri, error)?; - } - } - Ok(entitlements) => { - self.status_store - .set_parent_entitlements(ca, parent, uri, entitlements)?; - } + let result = self.get_entitlements_rfc6492(ca, server_info).await; + + match &result { + Err(error) => { + if existing_parent { + // only update the status store with errors for existing parents + // otherwise we end up with entries if a new parent is rejected because + // of the error. + self.status_store.set_parent_failure(ca, parent, uri, error)?; } - result + } + Ok(entitlements) => { + self.status_store + .set_parent_entitlements(ca, parent, uri, entitlements)?; } } + result } async fn get_entitlements_rfc6492( @@ -1338,11 +1694,10 @@ impl CaManager { ) -> KrillResult { let service_uri = server_info.service_uri(); if let Some(parent) = Self::local_parent(service_uri, &self.config.service_uri()) { - let parent_handle = CaHandle::new(parent.into_name()); - let parent = self.get_ca(&parent_handle).await?; + let ca_handle = parent.into_converted(); let user_agent = Some("local-child".to_string()); - self.rfc6492_process_request(&parent, message, user_agent, &self.system_actor) + self.rfc6492_process_request(&ca_handle, message, user_agent, &self.system_actor) .await } else { // Set up a logger for CMS exchanges. Note that this logger is always set @@ -1460,35 +1815,45 @@ impl CaManager { ca_handle: &CaHandle, ) -> KrillResult<()> { // Note that this is a no-op for new CAs which do not yet have any repository configured. - for (repo_contact, ca_elements) in self.ca_repo_elements(ca_handle).await? { - self.ca_repo_sync(repo_manager, ca_handle, &repo_contact, ca_elements) - .await?; - } + if ca_handle.as_str() == TA_NAME { + let proxy = self.get_trust_anchor_proxy().await?; + let id = proxy.id(); + let repo = proxy.repository().ok_or(Error::TaProxyHasNoRepository)?; + let objects = proxy.get_trust_anchor_objects()?.publish_elements()?; - // Clean-up of old repos - for deprecated in self.ca_deprecated_repos(ca_handle)? { - info!( - "Will try to clean up deprecated repository '{}' for CA '{}'", - deprecated.contact(), - ca_handle - ); - - if let Err(e) = self - .ca_repo_sync(repo_manager, ca_handle, deprecated.contact(), vec![]) - .await - { - warn!("Could not clean up deprecated repository: {}", e); - - if deprecated.clean_attempts() < 5 { - self.ca_deprecated_repo_increment_clean_attempts(ca_handle, deprecated.contact())?; - return Err(e); - } + self.ca_repo_sync(repo_manager, ca_handle, id, repo, objects).await + } else { + let ca = self.get_ca(ca_handle).await?; + for (repo_contact, objects) in self.ca_repo_elements(ca_handle).await? { + self.ca_repo_sync(repo_manager, ca_handle, ca.id_cert(), &repo_contact, objects) + .await?; } - self.ca_deprecated_repo_remove(ca_handle, deprecated.contact())?; - } + // Clean-up of old repos + for deprecated in self.ca_deprecated_repos(ca_handle)? { + info!( + "Will try to clean up deprecated repository '{}' for CA '{}'", + deprecated.contact(), + ca_handle + ); - Ok(()) + if let Err(e) = self + .ca_repo_sync(repo_manager, ca_handle, ca.id_cert(), deprecated.contact(), vec![]) + .await + { + warn!("Could not clean up deprecated repository: {}", e); + + if deprecated.clean_attempts() < 5 { + self.ca_deprecated_repo_increment_clean_attempts(ca_handle, deprecated.contact())?; + return Err(e); + } + } + + self.ca_deprecated_repo_remove(ca_handle, deprecated.contact())?; + } + + Ok(()) + } } #[allow(clippy::mutable_key_type)] @@ -1496,12 +1861,13 @@ impl CaManager { &self, repo_manager: &RepositoryManager, ca_handle: &CaHandle, + id_cert: &IdCertInfo, repo_contact: &RepositoryContact, publish_elements: Vec, ) -> KrillResult<()> { - debug!("CA '{}' sends list query to repo", ca_handle); + info!("CA '{}' sends list query to repo", ca_handle); let list_reply = self - .send_rfc8181_list(repo_manager, ca_handle, repo_contact.server_info()) + .send_rfc8181_list(repo_manager, ca_handle, id_cert, repo_contact.server_info()) .await?; let elements: HashMap<_, _> = list_reply.into_elements().into_iter().map(|el| el.unpack()).collect(); @@ -1526,12 +1892,12 @@ impl CaManager { } if !delta.is_empty() { - debug!("CA '{}' sends delta", ca_handle); - self.send_rfc8181_delta(repo_manager, ca_handle, repo_contact.server_info(), delta) + info!("CA '{}' sends delta", ca_handle); + self.send_rfc8181_delta(repo_manager, ca_handle, id_cert, repo_contact.server_info(), delta) .await?; debug!("CA '{}' sent delta", ca_handle); } else { - debug!("CA '{}' empty delta - nothing to publish", ca_handle); + info!("CA '{}' has nothing to publish", ca_handle); } Ok(()) @@ -1578,19 +1944,20 @@ impl CaManager { pub async fn update_repo( &self, repo_manager: &RepositoryManager, - ca: CaHandle, + ca_handle: CaHandle, new_contact: RepositoryContact, check_repo: bool, actor: &Actor, ) -> KrillResult<()> { + let ca = self.get_ca(&ca_handle).await?; if check_repo { // First verify that this repository can be reached and responds to a list request. - self.send_rfc8181_list(repo_manager, &ca, new_contact.server_info()) + self.send_rfc8181_list(repo_manager, &ca_handle, ca.id_cert(), new_contact.server_info()) .await - .map_err(|e| Error::CaRepoIssue(ca.clone(), e.to_string()))?; + .map_err(|e| Error::CaRepoIssue(ca_handle.clone(), e.to_string()))?; } - let cmd = CmdDet::update_repo(&ca, new_contact, self.signer.clone(), actor); - self.send_command(cmd).await?; + let cmd = CmdDet::update_repo(&ca_handle, new_contact, self.signer.clone(), actor); + self.send_ca_command(cmd).await?; Ok(()) } @@ -1598,11 +1965,11 @@ impl CaManager { &self, repo_manager: &RepositoryManager, ca_handle: &CaHandle, + id_cert: &IdCertInfo, server_info: &PublicationServerInfo, ) -> KrillResult { let uri = server_info.service_uri(); - let ca = self.get_ca(ca_handle).await?; - let signing_key = ca.id_cert().public_key().key_identifier(); + let signing_key = id_cert.public_key().key_identifier(); let message = publication::Message::list_query(); @@ -1617,16 +1984,9 @@ impl CaManager { } }; - let next_update = self - .ca_objects_store - .ca_objects(ca_handle)? - .closest_next_update() - .unwrap_or_else(|| self.config.issuance_timing.republish_worst_case().into()); - match reply { publication::Reply::List(list_reply) => { - self.status_store - .set_status_repo_success(ca_handle, uri.clone(), next_update)?; + self.status_store.set_status_repo_success(ca_handle, uri.clone())?; Ok(list_reply) } publication::Reply::Success => { @@ -1648,14 +2008,14 @@ impl CaManager { &self, repo_manager: &RepositoryManager, ca_handle: &CaHandle, + id_cert: &IdCertInfo, server_info: &PublicationServerInfo, delta: PublishDelta, ) -> KrillResult<()> { let uri = server_info.service_uri(); - let ca = self.get_ca(ca_handle).await?; - let signing_key = ca.id_cert().public_key().key_identifier(); + let signing_key = id_cert.public_key().key_identifier(); - let message = publication::Message::delta(delta); + let message = publication::Message::delta(delta.clone()); let reply = match self .send_rfc8181_and_validate_response(repo_manager, message, server_info, ca_handle, &signing_key) @@ -1670,18 +2030,8 @@ impl CaManager { match reply { publication::Reply::Success => { - // Get all the currently published elements in ALL REPOS. - // TODO: reflect the status for each REPO in the API / UI? - // We probably should.. though it should be extremely rare and short-lived to - // have more than one repository. - let ca_objects = self.ca_objects_store.ca_objects(ca_handle)?; - let published = ca_objects.all_publish_elements(); - let next_update = ca_objects - .closest_next_update() - .unwrap_or_else(|| self.config.issuance_timing.republish_worst_case().into()); - self.status_store - .set_status_repo_published(ca_handle, uri.clone(), published, next_update)?; + .set_status_repo_published(ca_handle, uri.clone(), delta)?; Ok(()) } publication::Reply::ErrorReply(e) => { @@ -1763,7 +2113,7 @@ impl CaManager { updates: AspaDefinitionUpdates, actor: &Actor, ) -> KrillResult<()> { - self.send_command(CmdDet::aspas_definitions_update( + self.send_ca_command(CmdDet::aspas_definitions_update( &ca, updates, self.config.clone(), @@ -1782,7 +2132,7 @@ impl CaManager { update: AspaProvidersUpdate, actor: &Actor, ) -> KrillResult<()> { - self.send_command(CmdDet::aspas_update_aspa( + self.send_ca_command(CmdDet::aspas_update_aspa( &ca, customer, update, @@ -1809,7 +2159,7 @@ impl CaManager { updates: BgpSecDefinitionUpdates, actor: &Actor, ) -> KrillResult<()> { - self.send_command(CmdDet::bgpsec_update_definitions( + self.send_ca_command(CmdDet::bgpsec_update_definitions( &ca, updates, self.config.clone(), @@ -1838,7 +2188,7 @@ impl CaManager { updates: RoaConfigurationUpdates, actor: &Actor, ) -> KrillResult<()> { - self.send_command(CmdDet::route_authorizations_update( + self.send_ca_command(CmdDet::route_authorizations_update( &ca, updates, self.config.clone(), @@ -1866,7 +2216,7 @@ impl CaManager { actor, ); - if let Err(e) = self.send_command(cmd).await { + if let Err(e) = self.send_ca_command(cmd).await { error!("Renewing ROAs for CA '{}' failed with error: {}", ca, e); } @@ -1877,7 +2227,7 @@ impl CaManager { actor, ); - if let Err(e) = self.send_command(cmd).await { + if let Err(e) = self.send_ca_command(cmd).await { error!("Renewing ASPAs for CA '{}' failed with error: {}", ca, e); } @@ -1888,7 +2238,7 @@ impl CaManager { actor, ); - if let Err(e) = self.send_command(cmd).await { + if let Err(e) = self.send_ca_command(cmd).await { error!("Renewing BGPSec certificates for CA '{}' failed with error: {}", ca, e); } } @@ -1908,7 +2258,7 @@ impl CaManager { CmdDet::RouteAuthorizationsForceRenew(self.config.clone(), self.signer.clone()), actor, ); - if let Err(e) = self.send_command(cmd).await { + if let Err(e) = self.send_ca_command(cmd).await { error!("Renewing ROAs for CA '{}' failed with error: {}", ca, e); } } @@ -1928,7 +2278,7 @@ impl CaManager { actor: &Actor, ) -> KrillResult<()> { let cmd = CmdDet::rta_sign(&ca, name, request, self.signer.clone(), actor); - self.send_command(cmd).await?; + self.send_ca_command(cmd).await?; Ok(()) } @@ -1941,7 +2291,7 @@ impl CaManager { actor: &Actor, ) -> KrillResult<()> { let cmd = CmdDet::rta_multi_prep(ca, name, request, self.signer.clone(), actor); - self.send_command(cmd).await?; + self.send_ca_command(cmd).await?; Ok(()) } @@ -1954,7 +2304,7 @@ impl CaManager { actor: &Actor, ) -> KrillResult<()> { let cmd = CmdDet::rta_multi_sign(&ca, name, rta, self.signer.clone(), actor); - self.send_command(cmd).await?; + self.send_ca_command(cmd).await?; Ok(()) } } @@ -1965,7 +2315,7 @@ impl CaManager { /// Initiate an RFC 6489 key roll for all active keys in a CA older than the specified duration. pub async fn ca_keyroll_init(&self, handle: CaHandle, max_age: Duration, actor: &Actor) -> KrillResult<()> { let init_key_roll = CmdDet::key_roll_init(&handle, max_age, self.signer.clone(), actor); - self.send_command(init_key_roll).await?; + self.send_ca_command(init_key_roll).await?; Ok(()) } @@ -1975,7 +2325,7 @@ impl CaManager { /// manual key rolls. pub async fn ca_keyroll_activate(&self, handle: CaHandle, staging: Duration, actor: &Actor) -> KrillResult<()> { let activate_cmd = CmdDet::key_roll_activate(&handle, staging, self.config.clone(), self.signer.clone(), actor); - self.send_command(activate_cmd).await?; + self.send_ca_command(activate_cmd).await?; Ok(()) } } diff --git a/src/daemon/ca/mod.rs b/src/daemon/ca/mod.rs index f11aa2d6..1f365ab7 100644 --- a/src/daemon/ca/mod.rs +++ b/src/daemon/ca/mod.rs @@ -44,14 +44,8 @@ pub use self::rta::*; mod status; pub use self::status::*; -pub const TA_NAME: &str = "ta"; // reserved for TA pub const TESTBED_CA_NAME: &str = "testbed"; // reserved for testbed mode -pub fn ta_handle() -> CaHandle { - use std::str::FromStr; - CaHandle::from_str(TA_NAME).unwrap() -} - pub fn testbed_ca_handle() -> CaHandle { use std::str::FromStr; CaHandle::from_str(TESTBED_CA_NAME).unwrap() diff --git a/src/daemon/ca/publishing.rs b/src/daemon/ca/publishing.rs index 059c12ea..50947d20 100644 --- a/src/daemon/ca/publishing.rs +++ b/src/daemon/ca/publishing.rs @@ -27,7 +27,7 @@ use crate::{ commons::{ api::{ rrdp::PublishElement, CertInfo, IssuedCertificate, ObjectName, ReceivedCert, RepositoryContact, Revocation, - Revocations, Timestamp, + Revocations, }, crypto::KrillSigner, error::Error, @@ -344,24 +344,6 @@ impl CaObjects { all_elements } - /// Returns the closest next update time from among manifests held by this CA - pub fn closest_next_update(&self) -> Option { - let mut closest = None; - - for resource_class_objects in self.classes.values() { - let rco_time = Timestamp::from(resource_class_objects.next_update_time()); - if let Some(current_closest) = closest { - if current_closest > rco_time { - closest = Some(rco_time); - } - } else { - closest = Some(rco_time); - } - } - - closest - } - pub fn deprecated_repos(&self) -> &Vec { &self.deprecated_repos } @@ -643,14 +625,6 @@ impl ResourceClassObjects { } } - fn next_update_time(&self) -> Time { - match &self.keys { - ResourceClassKeyState::Current(state) => state.current_set.next_update(), - ResourceClassKeyState::Old(state) => state.current_set.next_update(), - ResourceClassKeyState::Staging(state) => state.current_set.next_update(), - } - } - fn reissue(&mut self, timing: &IssuanceTimingConfig, signer: &KrillSigner) -> KrillResult<()> { match self.keys.borrow_mut() { ResourceClassKeyState::Current(state) => state.current_set.reissue(timing, signer), @@ -888,7 +862,7 @@ impl KeyObjectSet { let signing_key = signing_cert.key_identifier(); let issuer = signing_cert.subject().clone(); let revocations = Revocations::default(); - let revision = ObjectSetRevision::create(timing); + let revision = ObjectSetRevision::create(timing.publish_next()); let crl = CrlBuilder::build(signing_key, issuer, &revocations, revision, signer)?; let published_objects = HashMap::new(); @@ -1031,7 +1005,7 @@ impl KeyObjectSet { } fn reissue(&mut self, timing: &IssuanceTimingConfig, signer: &KrillSigner) -> KrillResult<()> { - self.revision.next(timing); + self.revision.next(timing.publish_next()); self.revocations.remove_expired(); let signing_key = self.signing_cert.key_identifier(); @@ -1095,18 +1069,31 @@ impl ObjectSetRevision { next_update, } } - fn create(timing: &IssuanceTimingConfig) -> Self { + + pub fn number(&self) -> u64 { + self.number + } + + pub fn this_update(&self) -> Time { + self.this_update + } + + pub fn next_update(&self) -> Time { + self.next_update + } + + fn create(next_update: Time) -> Self { ObjectSetRevision { number: 1, this_update: Time::five_minutes_ago(), - next_update: timing.publish_next(), + next_update, } } - fn next(&mut self, timing: &IssuanceTimingConfig) { + pub fn next(&mut self, next_update: Time) { self.number += 1; self.this_update = Time::five_minutes_ago(); - self.next_update = timing.publish_next(); + self.next_update = next_update; } } @@ -1281,7 +1268,7 @@ impl ManifestBuilder { self } - fn build_new_mft(self, signing_cert: &ReceivedCert, signer: &KrillSigner) -> KrillResult { + pub fn build_new_mft(self, signing_cert: &ReceivedCert, signer: &KrillSigner) -> KrillResult { let mft_uri = signing_cert.mft_uri(); let crl_uri = signing_cert.crl_uri(); diff --git a/src/daemon/ca/rc.rs b/src/daemon/ca/rc.rs index 3ca6374c..b5ecbd62 100644 --- a/src/daemon/ca/rc.rs +++ b/src/daemon/ca/rc.rs @@ -26,10 +26,11 @@ use crate::{ daemon::{ ca::events::RoaUpdates, ca::{ - self, ta_handle, AspaObjects, AspaObjectsUpdates, CaEvtDet, CertifiedKey, ChildCertificates, CurrentKey, - KeyState, NewKey, OldKey, PendingKey, Roas, Routes, + self, AspaObjects, AspaObjectsUpdates, CaEvtDet, CertifiedKey, ChildCertificates, CurrentKey, KeyState, + NewKey, OldKey, PendingKey, Roas, Routes, }, config::{Config, IssuanceTimingConfig}, + ta::ta_handle, }, }; @@ -367,9 +368,9 @@ impl ResourceClass { let updated_key = CertifiedKey::create(rcvd_cert); // Shrink any overclaiming child certificates - let updates = self - .certificates - .shrink_overclaiming(&updated_key, &config.issuance_timing, signer)?; + let updates = + self.certificates + .shrink_overclaiming(updated_key.incoming_cert(), &config.issuance_timing, signer)?; if !updates.is_empty() { res.push(CaEvtDet::ChildCertificatesUpdated { resource_class_name: self.name.clone(), @@ -621,7 +622,9 @@ impl ResourceClass { events.push(aspas_updated); } - let cert_updates = self.certificates.activate_key(new_key, issuance_timing, signer)?; + let cert_updates = self + .certificates + .activate_key(new_key.incoming_cert(), issuance_timing, signer)?; if !cert_updates.is_empty() { let certs_updated = CaEvtDet::ChildCertificatesUpdated { resource_class_name: self.name.clone(), @@ -676,15 +679,15 @@ impl ResourceClass { issuance_timing: &IssuanceTimingConfig, signer: &KrillSigner, ) -> KrillResult { - let signing_key = self.get_current_key()?; - let parent_resources = signing_key.incoming_cert().resources(); + let signing_cert = self.get_current_key()?.incoming_cert(); + let parent_resources = signing_cert.resources(); let resources = parent_resources.intersection(child_resources); let issued = SignSupport::make_issued_cert( csr, &resources, limit, - signing_key, + signing_cert, issuance_timing.new_child_cert_validity(), signer, )?; diff --git a/src/daemon/ca/status.rs b/src/daemon/ca/status.rs index d6d08dd0..7dab4378 100644 --- a/src/daemon/ca/status.rs +++ b/src/daemon/ca/status.rs @@ -3,12 +3,13 @@ use std::{collections::HashMap, path::Path, str::FromStr, sync::RwLock}; use rpki::ca::{ idexchange::{CaHandle, ChildHandle, ParentHandle, ServiceUri}, provisioning::ResourceClassListResponse as Entitlements, + publication::PublishDelta, }; use crate::commons::{ api::{ - rrdp::PublishElement, ChildConnectionStats, ChildStatus, ChildrenConnectionStats, ErrorResponse, ParentStatus, - ParentStatuses, RepoStatus, Timestamp, + ChildConnectionStats, ChildStatus, ChildrenConnectionStats, ErrorResponse, ParentStatus, ParentStatuses, + RepoStatus, }, error::Error, eventsourcing::{KeyStoreKey, KeyValueStore}, @@ -285,18 +286,12 @@ impl StatusStore { self.update_repo_status(ca, |status| status.set_failure(uri, error_response)) } - pub fn set_status_repo_success(&self, ca: &CaHandle, uri: ServiceUri, next_update: Timestamp) -> KrillResult<()> { - self.update_repo_status(ca, |status| status.set_last_updated(uri, next_update)) + pub fn set_status_repo_success(&self, ca: &CaHandle, uri: ServiceUri) -> KrillResult<()> { + self.update_repo_status(ca, |status| status.set_last_updated(uri)) } - pub fn set_status_repo_published( - &self, - ca: &CaHandle, - uri: ServiceUri, - published: Vec, - next_update: Timestamp, - ) -> KrillResult<()> { - self.update_repo_status(ca, |status| status.set_published(uri, published, next_update)) + pub fn set_status_repo_published(&self, ca: &CaHandle, uri: ServiceUri, delta: PublishDelta) -> KrillResult<()> { + self.update_repo_status(ca, |status| status.update_published(uri, delta)) } fn update_repo_status(&self, ca: &CaHandle, op: F) -> KrillResult<()> diff --git a/src/daemon/config.rs b/src/daemon/config.rs index ca818b90..8041037d 100644 --- a/src/daemon/config.rs +++ b/src/daemon/config.rs @@ -61,7 +61,7 @@ impl ConfigDefaults { env::var(KRILL_ENV_FORCE_RECOVER).is_ok() } - fn log_level() -> LevelFilter { + pub fn log_level() -> LevelFilter { match env::var(KRILL_ENV_LOG_LEVEL) { Ok(level) => match LevelFilter::from_str(&level) { Ok(level) => level, @@ -74,7 +74,7 @@ impl ConfigDefaults { } } - fn log_type() -> LogType { + pub fn log_type() -> LogType { LogType::File } @@ -90,7 +90,7 @@ impl ConfigDefaults { AuthType::AdminToken } - fn admin_token() -> Token { + pub fn admin_token() -> Token { match env::var(KRILL_ENV_ADMIN_TOKEN) { Ok(token) => Token::from(token), Err(_) => match env::var(KRILL_ENV_ADMIN_TOKEN_DEPRECATED) { @@ -223,23 +223,27 @@ impl ConfigDefaults { 4 } + pub fn openssl_signer_only() -> Vec { + let signer_config = OpenSslSignerConfig { keys_path: None }; + vec![SignerConfig::new( + DEFAULT_SIGNER_NAME.to_string(), + SignerType::OpenSsl(signer_config), + )] + } + pub fn signers() -> Vec { #[cfg(not(any(feature = "hsm-tests-kmip", feature = "hsm-tests-pkcs11")))] { - let signer_config = OpenSslSignerConfig { keys_path: None }; - vec![SignerConfig::new( - DEFAULT_SIGNER_NAME.to_string(), - SignerType::OpenSsl(signer_config), - )] + Self::openssl_signer_only() } #[cfg(all(feature = "hsm-tests-kmip", feature = "hsm-tests-pkcs11"))] { - let signer_config = OpenSslSignerConfig { keys_path: None }; - vec![SignerConfig::new( - DEFAULT_SIGNER_NAME.to_string(), - SignerType::OpenSsl(signer_config), - )] + // If we have both enables then just go with openssl. + // This is because we are using rust features here to drive testing + // which is not ideal.. should be changes when we remove the feature + // flags for this. + Self::openssl_signer_only() } #[cfg(all(feature = "hsm-tests-kmip", not(feature = "hsm-tests-pkcs11")))] @@ -267,7 +271,7 @@ impl ConfigDefaults { max_response_bytes: KmipSignerConfig::default_max_response_bytes(), }; return vec![SignerConfig::new( - DEFAULT_KMIP_SIGNER_NAME.to_string(), + DEFAULT_SIGNER_NAME.to_string(), SignerType::Kmip(signer_config), )]; } @@ -285,7 +289,7 @@ impl ConfigDefaults { max_retry_seconds: Pkcs11SignerConfig::default_max_retry_seconds(), }; vec![SignerConfig::new( - DEFAULT_PKCS11_SIGNER_NAME.to_string(), + DEFAULT_SIGNER_NAME.to_string(), SignerType::Pkcs11(signer_config), )] } @@ -312,7 +316,7 @@ pub enum SignerReference { Index(usize), } -fn deserialize_signer_ref<'de, D>(deserializer: D) -> Result +pub fn deserialize_signer_ref<'de, D>(deserializer: D) -> Result where D: Deserializer<'de>, { @@ -403,6 +407,22 @@ pub struct Config { #[serde(default)] // default is false pub data_dir_use_lock: bool, + // default is false + // implicitly enabled in case of testbed + // for that reason.. not pub, but fn provided + #[serde(default)] + pub ta_support_enabled: bool, + + // default is false + // implicitly enabled in case of testbed + // MUST be enabled for ca imports to work, + // but can be disabled later and signer can + // be migrated. + // + // for that reason.. not pub, but fn provided + #[serde(default)] + pub ta_signer_enabled: bool, + #[serde(default = "ConfigDefaults::always_recover_data")] pub always_recover_data: bool, @@ -568,14 +588,6 @@ impl IssuanceTimingConfig { self.timing_publish_hours_before_next.into() } - /// Worst case guess for re-issuance - pub fn republish_worst_case(&self) -> Time { - Time::now() - + Duration::hours(self.timing_publish_next_hours.into()) - + Duration::hours(self.timing_publish_next_jitter_hours.into()) - - Duration::hours(self.publish_hours_before_next()) - } - //-- Child Cert /// Validity period for newly issued child certificates @@ -807,6 +819,17 @@ impl Config { } } + /// Returns whether TA support is explicitly enabled in the config, or + /// implicitly enabled in case testbed (or benchmark) mode is used. + pub fn ta_proxy_enabled(&self) -> bool { + self.ta_support_enabled || self.testbed.is_some() + } + + /// Returns whether TA signer is enabled. + pub fn ta_signer_enabled(&self) -> bool { + self.ta_signer_enabled || self.testbed.is_some() + } + pub fn suspend_child_after_inactive_seconds(&self) -> Option { match self.suspend_child_after_inactive_seconds { Some(seconds) => Some(seconds.into()), @@ -1008,6 +1031,8 @@ impl Config { https_mode, data_dir, data_dir_use_lock, + ta_support_enabled: false, // but, enabled by testbed where applicable + ta_signer_enabled: false, // same as above always_recover_data, pid_file, service_uri: None, diff --git a/src/daemon/http/server.rs b/src/daemon/http/server.rs index d69354e3..b208e584 100644 --- a/src/daemon/http/server.rs +++ b/src/daemon/http/server.rs @@ -53,13 +53,14 @@ use crate::{ daemon::{ auth::common::permissions::Permission, auth::{Auth, Handle}, - ca::{CaStatus, TA_NAME}, + ca::CaStatus, config::Config, http::{ auth::auth, statics::statics, testbed::testbed, tls, tls_keys, HttpResponse, Request, RequestPath, RoutingResult, }, krillserver::KrillServer, + ta::{self, TA_NAME}, }, upgrades::{finalise_data_migration, post_start_upgrade, prepare_upgrade_data_migrations, UpgradeMode}, }; @@ -604,19 +605,6 @@ pub async fn metrics(req: Request) -> RoutingResult { )); } } - - res.push('\n'); - res.push_str("# HELP krill_ca_ps_next_planned_time unix timestamp in seconds of next planned CA to Publication Server connection (unless e.g. ROAs are changed)\n"); - res.push_str("# TYPE krill_ca_ps_next_planned_time gauge\n"); - for (ca, status) in ca_status_map.iter() { - // skip the ones for which we have no status yet, i.e it was really only just added - // and no attempt to connect has yet been made. - let timestamp = status.repo().next_exchange_before(); - res.push_str(&format!( - "krill_ca_ps_next_planned_time{{ca=\"{}\"}} {}\n", - ca, timestamp - )); - } } // Do not show child metrics if none of the CAs has any children.. @@ -934,7 +922,7 @@ async fn ta(req: Request) -> RoutingResult { } pub async fn tal(req: Request) -> RoutingResult { - match req.state().ta().await { + match req.state().ta_cert_details().await { Ok(ta) => Ok(HttpResponse::text(format!("{}", ta.tal()).into_bytes())), Err(_) => render_unknown_resource(), } @@ -1117,6 +1105,7 @@ async fn api(req: Request) -> RoutingResult { Some("bulk") => api_bulk(req, &mut path).await, Some("cas") => api_cas(req, &mut path).await, Some("pubd") => aa!(req, Permission::PUB_ADMIN, api_publication_server(req, &mut path).await), + Some("ta") => aa!(req, Permission::CA_ADMIN, api_ta(req, &mut path).await), _ => render_unknown_method(), } }) @@ -2221,6 +2210,143 @@ async fn api_ca_rta_multi_sign(req: Request, ca: CaHandle, name: RtaName) -> Rou }) } +//-------------------------------- API TA -------------------------------------------------- +async fn api_ta(req: Request, path: &mut RequestPath) -> RoutingResult { + // + // krillta proxy --server .. --token .. + // + // Uses API krill API: + // + // /api/v1/ta/ + // + // - proxy and signer set up + // POST /proxy/init initialise proxy + // POST /proxy/id proxy id cert info + // GET /proxy/repo/request.xml get RFC8181 publisher request + // GET /proxy/repo/request.json get RFC8181 publisher request + // GET /proxy/repo get repository contact + // POST /proxy/repo add pub server + // POST /proxy/signer/add add initialised signer to proxy + // POST /proxy/signer/request create sign request for signer (returns request) + // GET /proxy/signer/request show open sign request if any + // POST /proxy/signer/response process sign response from signer + // + // - children + // GET /proxy/children/ future: list children + // POST /proxy/children/ add child + // GET /proxy/children/{child}/parent_response.json show parent response for child + // GET /proxy/children/{child}/parent_response.xml show parent response for child + // POST /proxy/children/{child} future: update child + // DEL /proxy/children/{child} future: remove child + // + // krillta signer --dir + // init + // process + // history (future) + // response + + match path.next() { + Some("proxy") => match path.next() { + Some("init") => render_empty_res(req.state().ta_proxy_init().await), + Some("id") => render_json_res(req.state().ta_proxy_id().await), + Some("repo") => match path.next() { + Some("request.xml") => match req.state().ta_proxy_publisher_request().await { + Ok(req) => Ok(HttpResponse::xml(req.to_xml_vec())), + Err(e) => render_error(e), + }, + Some("request.json") => render_json_res(req.state().ta_proxy_publisher_request().await), + None => match *req.method() { + Method::POST => { + let ta_handle = ta::ta_handle(); + let server = req.state().clone(); + let actor = req.actor.clone(); + + match req + .api_bytes() + .await + .map(|bytes| extract_repository_contact(&ta_handle, bytes)) + { + Ok(Ok(contact)) => { + render_empty_res(server.ta_proxy_repository_update(contact, &actor).await) + } + Ok(Err(e)) | Err(e) => render_error(e), + } + } + Method::GET => render_json_res(req.state().ta_proxy_repository_contact().await), + _ => render_unknown_method(), + }, + + _ => render_unknown_method(), + }, + Some("signer") => match path.next() { + Some("add") => { + let server = req.state().clone(); + let actor = req.actor.clone(); + match req.json().await { + Ok(ta_signer_info) => { + render_empty_res(server.ta_proxy_signer_add(ta_signer_info, &actor).await) + } + Err(e) => render_error(e), + } + } + Some("request") => match *req.method() { + Method::POST => render_json_res(req.state().ta_proxy_signer_make_request(&req.actor()).await), + Method::GET => render_json_res(req.state().ta_proxy_signer_get_request().await), + _ => render_unknown_method(), + }, + Some("response") => match *req.method() { + Method::POST => { + let server = req.state().clone(); + let actor = req.actor.clone(); + + match req.json().await { + Ok(response) => { + render_empty_res(server.ta_proxy_signer_process_response(response, &actor).await) + } + Err(e) => render_error(e), + } + } + _ => render_unknown_method(), + }, + _ => render_unknown_method(), + }, + Some("children") => match path.path_arg::() { + Some(child) => match path.next() { + Some("parent_response.json") => { + render_json_res(req.state().ca_parent_response(&ta::ta_handle(), child).await) + } + Some("parent_response.xml") => { + match req.state().ca_parent_response(&ta::ta_handle(), child).await { + Ok(parent_response) => Ok(HttpResponse::xml(parent_response.to_xml_vec())), + Err(e) => render_error(e), + } + } + None => match *req.method() { + Method::POST => render_error(Error::custom("update TA child not yet supported")), + Method::DELETE => render_error(Error::custom("remove TA child not yet supported")), + _ => render_unknown_method(), + }, + _ => render_unknown_method(), + }, + None => match *req.method() { + Method::POST => { + let actor = req.actor(); + let server = req.state().clone(); + match req.json().await { + Ok(child_req) => render_json_res(server.ta_proxy_children_add(child_req, &actor).await), + Err(e) => render_error(e), + } + } + Method::GET => render_error(Error::custom("show TA child not yet supported")), + _ => render_unknown_method(), + }, + }, + _ => render_unknown_method(), + }, + _ => render_unknown_method(), + } +} + /// A naive lock implementation used to prevent that two Krill instances /// access the same krill data directory simultaneously. struct KrillLock(PathBuf); diff --git a/src/daemon/http/testbed.rs b/src/daemon/http/testbed.rs index 797cd3eb..bc6c069f 100644 --- a/src/daemon/http/testbed.rs +++ b/src/daemon/http/testbed.rs @@ -5,7 +5,7 @@ use rpki::ca::idexchange::PublisherHandle; use crate::{ constants::ACTOR_DEF_TESTBED, daemon::{ - ca::{ta_handle, testbed_ca_handle}, + ca::testbed_ca_handle, http::{ server::{ api_add_pbl, api_ca_add_child, api_ca_child_remove, api_ca_parent_res_xml, api_remove_pbl, @@ -13,6 +13,7 @@ use crate::{ }, HttpResponse, Request, RequestPath, RoutingResult, }, + ta::ta_handle, }, }; diff --git a/src/daemon/krillserver.rs b/src/daemon/krillserver.rs index bc8a5b11..32d0d659 100644 --- a/src/daemon/krillserver.rs +++ b/src/daemon/krillserver.rs @@ -22,10 +22,10 @@ use crate::{ self, AddChildRequest, AllCertAuthIssues, AspaCustomer, AspaDefinitionList, AspaDefinitionUpdates, AspaProvidersUpdate, BgpSecCsrInfoList, BgpSecDefinitionUpdates, CaCommandDetails, CaRepoDetails, CertAuthInfo, CertAuthInit, CertAuthIssues, CertAuthList, CertAuthStats, ChildCaInfo, - ChildrenConnectionStats, CommandHistory, CommandHistoryCriteria, ConfiguredRoa, ParentCaContact, - ParentCaReq, PublicationServerUris, PublisherDetails, ReceivedCert, RepoFileDeleteCriteria, - RepositoryContact, RoaConfiguration, RoaConfigurationUpdates, RoaPayload, RtaList, RtaName, - RtaPrepResponse, ServerInfo, TaCertDetails, Timestamp, UpdateChildRequest, + ChildrenConnectionStats, CommandHistory, CommandHistoryCriteria, ConfiguredRoa, IdCertInfo, + ParentCaContact, ParentCaReq, PublicationServerUris, PublisherDetails, ReceivedCert, + RepoFileDeleteCriteria, RepositoryContact, RoaConfiguration, RoaConfigurationUpdates, RoaPayload, RtaList, + RtaName, RtaPrepResponse, ServerInfo, Timestamp, UpdateChildRequest, }, bgp::{BgpAnalyser, BgpAnalysisReport, BgpAnalysisSuggestion}, crypto::KrillSignerBuilder, @@ -36,14 +36,12 @@ use crate::{ constants::*, daemon::{ auth::{providers::AdminTokenAuthProvider, Authorizer, LoggedInUser}, - ca::{ - self, ta_handle, testbed_ca_handle, CaStatus, ResourceTaggedAttestation, RtaContentRequest, - RtaPrepareRequest, - }, + ca::{self, testbed_ca_handle, CaStatus, ResourceTaggedAttestation, RtaContentRequest, RtaPrepareRequest}, config::{AuthType, Config}, http::HttpResponse, mq::TaskQueue, scheduler::Scheduler, + ta::{ta_handle, TaCertDetails, TA_NAME}, }, pubd::{RepoStats, RepositoryManager}, }; @@ -54,7 +52,10 @@ use crate::daemon::auth::{ providers::{ConfigFileAuthProvider, OpenIDConnectAuthProvider}, }; -use super::ca::CaManager; +use super::{ + ca::CaManager, + ta::{TrustAnchorSignedRequest, TrustAnchorSignedResponse, TrustAnchorSignerInfo}, +}; //------------ KrillServer --------------------------------------------------- @@ -366,26 +367,77 @@ impl KrillServer { } } -/// # Being a parent +/// # TA Support /// impl KrillServer { - pub async fn ta(&self) -> KrillResult { - let ta_handle = ta_handle(); - let ta = self.ca_manager.get_ca(&ta_handle).await?; + pub fn ta_proxy_enabled(&self) -> bool { + self.config.ta_proxy_enabled() + } - let parent_handle = ParentHandle::new(ta_handle.into_name()); + pub async fn ta_proxy_init(&self) -> KrillResult<()> { + self.ca_manager.ta_proxy_init().await + } - if let ParentCaContact::Ta(ta) = ta.parent(&parent_handle).unwrap() { - Ok(ta.clone()) - } else { - panic!("Found TA which was not initialized as TA.") - } + pub async fn ta_proxy_id(&self) -> KrillResult { + self.ca_manager.ta_proxy_id().await + } + + pub async fn ta_proxy_publisher_request(&self) -> KrillResult { + self.ca_manager.ta_proxy_publisher_request().await + } + + pub async fn ta_proxy_repository_update(&self, contact: RepositoryContact, actor: &Actor) -> KrillResult<()> { + self.ca_manager.ta_proxy_repository_update(contact, actor).await + } + + pub async fn ta_proxy_repository_contact(&self) -> KrillResult { + self.ca_manager.ta_proxy_repository_contact().await + } + + pub async fn ta_proxy_signer_add(&self, info: TrustAnchorSignerInfo, actor: &Actor) -> KrillResult<()> { + self.ca_manager.ta_proxy_signer_add(info, actor).await + } + + pub async fn ta_proxy_signer_make_request(&self, actor: &Actor) -> KrillResult { + self.ca_manager.ta_proxy_signer_make_request(actor).await + } + + pub async fn ta_proxy_signer_get_request(&self) -> KrillResult { + self.ca_manager.ta_proxy_signer_get_request().await + } + + pub async fn ta_proxy_signer_process_response( + &self, + response: TrustAnchorSignedResponse, + actor: &Actor, + ) -> KrillResult<()> { + self.ca_manager.ta_proxy_signer_process_response(response, actor).await + } + + pub async fn ta_proxy_children_add( + &self, + child_request: AddChildRequest, + actor: &Actor, + ) -> KrillResult { + // TA as parent is handled a special case in the following + self.ca_manager + .ca_add_child(&ta_handle().convert(), child_request, &self.config.service_uri(), actor) + .await + } + + pub async fn ta_cert_details(&self) -> KrillResult { + let proxy = self.ca_manager.get_trust_anchor_proxy().await?; + Ok(proxy.get_ta_details()?.clone()) } pub async fn trust_anchor_cert(&self) -> Option { - self.ta().await.ok().map(|details| details.cert().clone()) + self.ta_cert_details().await.ok().map(|details| details.into()) } +} +/// # Being a parent +/// +impl KrillServer { /// Adds a child to a CA and returns the ParentCaInfo that the child /// will need to contact this CA for resource requests. pub async fn ca_add_child( @@ -511,29 +563,42 @@ impl KrillServer { Ok(res) } - // pub async fn cas_import(&self, structure: api::import::Structure) -> KrillResult<()> { let actor = Arc::new(self.system_actor().clone()); - if !self.ca_list(&actor)?.cas().is_empty() || self.repo_manager.initialized()? { - Err(Error::custom("Import CAs is only permitted when Krill is empty.")) - } else if let Err(e) = structure.validate_ca_hierarchy() { - Err(Error::Custom(e)) + + // We need to know which CAs already exist. They should not be imported again, + // but can serve as parents. + let mut existing_cas = HashMap::new(); + for ca in self.ca_list(&actor)?.cas() { + let parent_handle = ca.handle().convert(); + let resources = self.ca_manager.get_ca(ca.handle()).await?.all_resources(); + existing_cas.insert(parent_handle, resources); + } + structure.validate_ca_hierarchy(existing_cas)?; + + if !self.config.ta_proxy_enabled() { + Err(Error::custom( + "Import CAs is only possible when ta_support_enabled = true", + )) + } else if !self.config.ta_signer_enabled() { + Err(Error::custom( + "Import CAs is only possible when ta_signer_enabled = true", + )) } else { + if let Some(publication_server_uris) = structure.publication_server.clone() { + info!("Initialising publication server"); + self.repo_manager.init(publication_server_uris)?; + } + + if let Some(import_ta) = structure.ta.clone() { + info!("Creating embedded Trust Anchor"); + let (ta_aia, ta_uris) = import_ta.into_uris(); + self.ca_manager + .ta_init_fully_embedded(ta_aia, ta_uris, &self.repo_manager, &actor) + .await?; + } + info!("Bulk import {} CAs", structure.cas.len()); - - info!("Initialising publication server"); - self.repo_manager.init(structure.publication_server_uris.clone())?; - - info!("Creating embedded Trust Anchor"); - self.ca_manager - .init_ta( - structure.ta_aia.clone(), - vec![structure.ta_uri.clone()], - &self.repo_manager, - &actor, - ) - .await?; - // Set up each online TA child with local repo, do this in parallel. let mut import_fns = vec![]; let service_uri = Arc::new(self.config.service_uri()); @@ -607,30 +672,33 @@ impl KrillServer { let mut tried = 0; let parent_as_ca: CaHandle = parent.convert(); - loop { - tried += 1; - if let Ok(parent) = ca_manager.get_ca(&parent_as_ca).await { - if parent.all_resources().contains(&resources) { - break; + // If the parent is the TA, then there is no need to wait. + if parent.as_str() != TA_NAME { + loop { + tried += 1; + if let Ok(parent) = ca_manager.get_ca(&parent_as_ca).await { + if parent.all_resources().contains(&resources) { + break; + } else { + info!( + "Parent {} does not (yet) have resources for {}. Will wait a bit and try again", + parent.handle(), + ca_handle + ); + } } else { info!( - "Parent {} does not (yet) have resources for {}. Will wait a bit and try again", - parent.handle(), - ca_handle + "Parent {} for CA {} is not yet created. Will wait a bit and try again", + parent_as_ca, ca_handle ); } - } else { - info!( - "Parent {} for CA {} is not yet created. Will wait a bit and try again", - parent_as_ca, ca_handle - ); - } - tokio::time::sleep(std::time::Duration::from_millis(wait_ms)).await; - if tried >= max_tries { - return Err(Error::Custom(format!( - "Could not import CA {}. Parent: {} is not created", - ca_handle, parent_as_ca - ))); + tokio::time::sleep(std::time::Duration::from_millis(wait_ms)).await; + if tried >= max_tries { + return Err(Error::Custom(format!( + "Could not import CA {}. Parent: {} is not created", + ca_handle, parent_as_ca + ))); + } } } @@ -658,6 +726,14 @@ impl KrillServer { // Second sync will send that CSR to the parent ca_manager.ca_sync_parent(&ca_handle, &parent, &actor).await?; + + // If the parent is a TA, then we will need to push a bit more.. + // Normally this should be handled by triggered tasks, but the + // task scheduler is not running when we do this at startup. + if parent.as_str() == TA_NAME { + ca_manager.sync_ta_proxy_signer_if_possible().await?; + ca_manager.ca_sync_parent(&ca_handle, &parent, &actor).await?; + } } } diff --git a/src/daemon/mod.rs b/src/daemon/mod.rs index b09e7aa3..c4aa9509 100644 --- a/src/daemon/mod.rs +++ b/src/daemon/mod.rs @@ -5,3 +5,4 @@ pub mod http; pub mod krillserver; pub mod mq; pub mod scheduler; +pub mod ta; diff --git a/src/daemon/mq.rs b/src/daemon/mq.rs index ded2dbd4..cc19c2b2 100644 --- a/src/daemon/mq.rs +++ b/src/daemon/mq.rs @@ -20,9 +20,14 @@ use crate::{ api::Timestamp, eventsourcing::{self, Event}, }, - daemon::ca::{CaEvt, CaEvtDet, CertAuth}, + daemon::{ + ca::{CaEvt, CaEvtDet, CertAuth}, + ta::{ta_handle, TrustAnchorProxyEventDetails}, + }, }; +use super::ta::{TrustAnchorProxy, TrustAnchorProxyEvent}; + //------------ Task --------------------------------------------------------- /// This type contains tasks with the details needed for triggered processing. @@ -40,6 +45,8 @@ pub enum Task { parent: ParentHandle, }, + SyncTrustAnchorProxySignerIfPossible, + SuspendChildrenIfNeeded { ca: CaHandle, }, @@ -75,6 +82,7 @@ impl fmt::Display for Task { Task::QueueStartTasks => write!(f, "Server just started"), Task::SyncRepo { ca } => write!(f, "synchronize repo for '{}'", ca), Task::SyncParent { ca, parent } => write!(f, "synchronize CA '{}' with parent '{}'", ca, parent), + Task::SyncTrustAnchorProxySignerIfPossible => write!(f, "sync TA Proxy and Signer if both in this server."), Task::SuspendChildrenIfNeeded { ca } => write!(f, "verify if CA '{}' has children to suspend", ca), Task::RepublishIfNeeded => write!(f, "let CAs republish their mft/crls if needed"), Task::RenewObjectsIfNeeded => write!(f, "let CAs renew their signed objects if needed"), @@ -217,6 +225,10 @@ impl TaskQueue { self.schedule(Task::SyncParent { ca, parent }, priority); } + pub fn sync_ta_proxy_signer_if_possible(&self) { + self.schedule(Task::SyncTrustAnchorProxySignerIfPossible, now()) + } + pub fn suspend_children(&self, ca: CaHandle, priority: Priority) { self.schedule(Task::SuspendChildrenIfNeeded { ca }, priority); } @@ -253,7 +265,7 @@ impl TaskQueue { } } -/// Implement listening for CertAuth Published events. +/// Implement listening for CertAuth events. impl eventsourcing::PostSaveEventListener for TaskQueue { fn listen(&self, ca: &CertAuth, events: &[CaEvt]) { for event in events { @@ -349,6 +361,37 @@ impl eventsourcing::PostSaveEventListener for TaskQueue { } } +/// Implement listening for TrustAnchorProxy events. +impl eventsourcing::PostSaveEventListener for TaskQueue { + fn listen(&self, _proxy: &TrustAnchorProxy, events: &[TrustAnchorProxyEvent]) { + for event in events { + trace!("Seen TrustAnchorProxy event '{}'", event); + match event.details() { + TrustAnchorProxyEventDetails::ChildRequestAdded(_child, _request) => { + // schedule proxy -> signer sync + self.sync_ta_proxy_signer_if_possible(); + } + TrustAnchorProxyEventDetails::SignerResponseReceived(response) => { + // schedule publication for the TA + self.sync_repo(ta_handle(), now()); + // Schedule child->ta sync(s) now that there is a response. + for ca in response.content().child_responses.keys() { + debug!("Received signed response for TA child {}", ca); + self.sync_parent(ca.convert(), ta_handle().into_converted(), now()); + } + } + TrustAnchorProxyEventDetails::RepositoryAdded(_) + | TrustAnchorProxyEventDetails::SignerAdded(_) + | TrustAnchorProxyEventDetails::SignerRequestMade(_) + | TrustAnchorProxyEventDetails::ChildAdded(_) + | TrustAnchorProxyEventDetails::ChildResponseGiven(_, _) => { + // No triggered actions needed + } + } + } + } +} + //------------ Priority ------------------------------------------------------ /// Can be used as a priority value for [`PriorityQueue`]. Meaning that the diff --git a/src/daemon/scheduler.rs b/src/daemon/scheduler.rs index bd77b046..999ab8e3 100644 --- a/src/daemon/scheduler.rs +++ b/src/daemon/scheduler.rs @@ -75,6 +75,8 @@ impl Scheduler { Task::SyncParent { ca, parent } => self.sync_parent(ca, parent).await, + Task::SyncTrustAnchorProxySignerIfPossible => self.sync_ta_proxy_signer_if_possible().await, + Task::SuspendChildrenIfNeeded { ca } => self.suspend_children_if_needed(ca).await, Task::RepublishIfNeeded => self.republish_if_needed().await, @@ -237,6 +239,16 @@ impl Scheduler { Ok(()) } + /// Try to synchronise the Trust Anchor Proxy with the *local* Signer - if it exists + /// in this server. + async fn sync_ta_proxy_signer_if_possible(&self) -> KrillResult<()> { + debug!("Synchronise Trust Anchor Proxy with Signer - if Signer is local."); + if let Err(e) = self.ca_manager.sync_ta_proxy_signer_if_possible().await { + error!("There was an issue synchronising the TA Proxy and Signer: {}", e); + } + Ok(()) + } + /// Try to suspend children for a CA async fn suspend_children_if_needed(&self, ca_handle: CaHandle) -> KrillResult<()> { debug!("Verify if CA '{}' has children that need to be suspended", ca_handle); diff --git a/src/daemon/ta/common.rs b/src/daemon/ta/common.rs new file mode 100644 index 00000000..f4895bbc --- /dev/null +++ b/src/daemon/ta/common.rs @@ -0,0 +1,724 @@ +//! Common types used in the communication (API) between the Proxy and Signer + +use std::{ + collections::HashMap, + fmt::{self, Debug}, + sync::Arc, +}; + +use bytes::Bytes; +use rpki::{ + ca::{ + idexchange::{ChildHandle, RecipientHandle, SenderHandle}, + provisioning, + publication::Base64, + sigmsg::SignedMessage, + }, + crypto::{KeyIdentifier, PublicKey}, + repository::{resources::ResourceSet, x509::Time}, + uri, +}; +use serde::Serialize; + +use crate::{ + commons::{ + api::{IdCertInfo, IssuedCertificate, ObjectName, ReceivedCert, Revocations}, + crypto::KrillSigner, + error::Error, + KrillResult, + }, + daemon::ca::{ + CrlBuilder, ManifestBuilder, ObjectSetRevision, PublishedCrl, PublishedManifest, PublishedObject, UsedKeyState, + }, +}; + +// Some timing constants used by the Trust Anchor code. We may need to support +// configuring these things instead.. +pub const TA_CERTIFICATE_VALIDITY_YEARS: i32 = 100; +pub const TA_ISSUED_CERTIFICATE_VALIDITY_WEEKS: i64 = 52; +pub const TA_MFT_NEXT_UPDATE_WEEKS: i64 = 12; +pub const TA_SIGNED_MESSAGE_DAYS: i64 = 14; + +//------------ TrustAnchorObjects ------------------------------------------ + +/// Contains all Trust Anchor objects, including the the TA certificate +/// and TAL. +/// +/// This is kept by the Trust Anchor Proxy as read-only, so that it can +/// publish these objects. +/// +/// The Trust Anchor Signer can make changes to this set based on the +/// requests it gets from the proxy. It can then return a response to the +/// proxy that allow it to update the state with that same change. +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +pub struct TrustAnchorObjects { + // The revision of the set, meaning its number and the + // "this update" and "next update" values used on the + // manifest and CRL. + revision: ObjectSetRevision, + + // TA Key Identifier (may not change) + key_identifier: KeyIdentifier, + + // Base URI for objects published by this TA (may not change) + base_uri: uri::Rsync, + + // Track revocations and the last issued CRL. + revocations: Revocations, + crl: PublishedCrl, + + // The last issued manifest. + manifest: PublishedManifest, + + // Certificates issued to children. We use a map to avoid having + // to loop. (yes, even if typically the list would be very short) + issued: HashMap, +} + +impl TrustAnchorObjects { + /// Creates a new TrustAnchorObjects for the signing certificate. + pub fn create(signing_cert: &ReceivedCert, signer: &KrillSigner) -> KrillResult { + let revision = ObjectSetRevision::new(1, Self::this_update(), Self::next_update()); + let key_identifier = signing_cert.key_identifier(); + let base_uri = signing_cert.ca_repository().clone(); + let revocations = Revocations::default(); + + let signing_key = signing_cert.key_identifier(); + let issuer = signing_cert.subject().clone(); + + let crl = CrlBuilder::build(signing_key, issuer, &revocations, revision, signer)?; + + let manifest = ManifestBuilder::new(revision) + .with_objects(&crl, &HashMap::new()) + .build_new_mft(signing_cert, signer) + .map(|m| m.into())?; + + Ok(TrustAnchorObjects { + revision, + key_identifier, + base_uri, + revocations, + crl, + manifest, + issued: HashMap::new(), + }) + } + + /// Publish next revision of the published objects. + /// - Update CRL (times and revocations) + /// - Update Manifest (times and listed objects) + pub fn republish(&mut self, signing_cert: &ReceivedCert, signer: &KrillSigner) -> KrillResult<()> { + self.revision.next(Self::next_update()); + + let signing_key = signing_cert.key_identifier(); + + if signing_key != self.key_identifier { + // This would be a bug.. we will need to re-think this when implementing + // signed TALs and TA key rollovers. + Err(Error::custom("TA key changed when republishing")) + } else { + let issuer = signing_cert.subject().clone(); + + self.crl = CrlBuilder::build(signing_key, issuer, &self.revocations, self.revision, signer)?; + + self.manifest = ManifestBuilder::new(self.revision) + .with_objects(&self.crl, &self.issued_certs_objects()) + .build_new_mft(signing_cert, signer) + .map(|m| m.into())?; + + Ok(()) + } + } + + pub fn publish_elements(&self) -> KrillResult> { + let mut res = vec![]; + + let mft_uri = self + .base_uri + .join(ObjectName::mft_for_key(&self.key_identifier).as_ref()) + .map_err(|e| Error::Custom(format!("Cannot make uri: {}", e)))?; + res.push(self.manifest.publish_element(mft_uri)); + + let crl_uri = self + .base_uri + .join(ObjectName::crl_for_key(&self.key_identifier).as_ref()) + .map_err(|e| Error::Custom(format!("Cannot make uri: {}", e)))?; + res.push(self.crl.publish_element(crl_uri)); + + for (name, object) in self.issued_certs_objects() { + let cert_uri = self + .base_uri + .join(name.as_ref()) + .map_err(|e| Error::Custom(format!("Cannot make uri: {}", e)))?; + res.push(object.publish_element(cert_uri)); + } + Ok(res) + } + + fn issued_certs_objects(&self) -> HashMap { + self.issued + .iter() + .map(|(ki, cert)| { + let object = PublishedObject::for_cert_info(cert); + let name = ObjectName::cer_for_key(ki); + (name, object) + }) + .collect() + } + + pub fn manifest(&self) -> &PublishedManifest { + &self.manifest + } + + pub fn revision(&self) -> &ObjectSetRevision { + &self.revision + } + + pub fn this_update() -> Time { + Time::five_minutes_ago() + } + + pub fn next_update() -> Time { + Time::now() + chrono::Duration::weeks(TA_MFT_NEXT_UPDATE_WEEKS) + } + + // Adds a new issued certificate, replaces and revokes the previous if present. + pub fn add_issued(&mut self, issued: IssuedCertificate) { + if let Some(previous) = self.issued.insert(issued.key_identifier(), issued) { + self.revocations.add(previous.revocation()); + self.revocations.remove_expired(); + } + } + + // Gets an issued certificate if it is known. + pub fn get_issued(&self, ki: &KeyIdentifier) -> Option<&IssuedCertificate> { + self.issued.get(ki) + } + + // Revoke any issued certificate for the given key, and remove it. Returns false + // if there was no such certificate. + pub fn revoke_issued(&mut self, key: &KeyIdentifier) -> bool { + if let Some(issued) = self.issued.remove(key) { + self.revocations.add(issued.revocation()); + self.revocations.remove_expired(); + true + } else { + false + } + } +} + +impl fmt::Display for TrustAnchorObjects { + fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { + writeln!(f, "-------------------------------------------------------")?; + writeln!(f, " Trust Anchor Objects")?; + writeln!(f, "-------------------------------------------------------")?; + writeln!(f)?; + writeln!(f, "Revision: {}", self.revision.number())?; + writeln!(f, "Next Update: {}", self.revision.next_update().to_rfc3339())?; + writeln!(f)?; + writeln!(f, "Objects:",)?; + for publish in self.publish_elements().map_err(|_| fmt::Error)? { + writeln!(f, "{}", publish.uri())?; + writeln!(f, " ({})", publish.base64().to_hash())?; + } + writeln!(f)?; + writeln!(f, "-------------------------------------------------------") + } +} + +//------------ TaCertDetails ------------------------------------------------- + +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +pub struct TaCertDetails { + cert: ReceivedCert, + tal: TrustAnchorLocator, +} + +impl TaCertDetails { + pub fn new(cert: ReceivedCert, tal: TrustAnchorLocator) -> Self { + TaCertDetails { cert, tal } + } + + pub fn cert(&self) -> &ReceivedCert { + &self.cert + } + + pub fn resources(&self) -> &ResourceSet { + self.cert.resources() + } + + pub fn tal(&self) -> &TrustAnchorLocator { + &self.tal + } +} + +impl From for ReceivedCert { + fn from(details: TaCertDetails) -> Self { + details.cert + } +} + +impl From for TrustAnchorLocator { + fn from(details: TaCertDetails) -> Self { + details.tal + } +} + +//------------ TrustAnchorLocator -------------------------------------------- + +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +pub struct TrustAnchorLocator { + uris: Vec, + rsync_uri: uri::Rsync, + encoded_ski: Base64, +} + +impl TrustAnchorLocator { + /// Creates a new TAL, panics when the provided Cert is not a TA cert. + pub fn new(uris: Vec, rsync_uri: uri::Rsync, public_key: &PublicKey) -> Self { + let encoded_ski = Base64::from_content(&public_key.to_info_bytes()); + + TrustAnchorLocator { + uris, + rsync_uri, + encoded_ski, + } + } + + pub fn uris(&self) -> &Vec { + &self.uris + } + + pub fn rsync_uri(&self) -> &uri::Rsync { + &self.rsync_uri + } +} + +impl std::fmt::Display for TrustAnchorLocator { + fn fmt(&self, f: &mut std::fmt::Formatter) -> std::fmt::Result { + let base64_string = self.encoded_ski.to_string(); + + for uri in self.uris.iter() { + writeln!(f, "{}", uri)?; + } + writeln!(f, "{}", self.rsync_uri)?; + + writeln!(f)?; + + let len = base64_string.len(); + let wrap = 64; + + for i in 0..=(len / wrap) { + if (i * wrap + wrap) < len { + writeln!(f, "{}", &base64_string[i * wrap..i * wrap + wrap])?; + } else { + write!(f, "{}", &base64_string[i * wrap..])?; + } + } + + Ok(()) + } +} + +//------------ TrustAnchorSignerInfo --------------------------------------- + +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +pub struct TrustAnchorSignerInfo { + // The ID of the associated signer. + pub id: IdCertInfo, + // Trust Anchor objects to be published + pub objects: TrustAnchorObjects, + // The TA certificate and TAL + pub ta_cert_details: TaCertDetails, +} + +impl fmt::Display for TrustAnchorSignerInfo { + fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { + writeln!(f, "-------------------------------------------------------")?; + writeln!(f, " ID Certificate")?; + writeln!(f, "-------------------------------------------------------")?; + writeln!(f)?; + writeln!(f, "{}", self.id)?; + writeln!(f)?; + writeln!(f, "-------------------------------------------------------")?; + writeln!(f)?; + writeln!(f, "{}", self.objects)?; + writeln!(f)?; + writeln!(f, "-------------------------------------------------------")?; + writeln!(f, " TAL")?; + writeln!(f, "-------------------------------------------------------")?; + writeln!(f)?; + writeln!(f, "{}", self.ta_cert_details.tal())?; + writeln!(f)?; + writeln!(f, "-------------------------------------------------------")?; + + Ok(()) + } +} + +//------------ Nonce ------------------------------------------------------- + +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +pub struct Nonce(Arc); + +impl Nonce { + pub fn new() -> Self { + Nonce(uuid::Uuid::new_v4().to_string().into()) + } +} + +impl Default for Nonce { + fn default() -> Self { + Nonce::new() + } +} + +impl std::fmt::Display for Nonce { + fn fmt(&self, f: &mut std::fmt::Formatter) -> std::fmt::Result { + std::fmt::Display::fmt(&self.0, f) + } +} + +//------------ TrustAnchorProxySignerExchange ------------------------------ + +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +pub struct TrustAnchorProxySignerExchange { + pub time: Time, + pub request: TrustAnchorSignedRequest, + pub response: TrustAnchorSignedResponse, +} + +//------------ TrustAnchorSignedMessage ------------------------------------ + +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +pub struct TrustAnchorSignedMessage { + message: Base64, +} + +impl TrustAnchorSignedMessage { + pub fn validate(&self, issuer_key: &PublicKey) -> KrillResult { + self.validate_at(issuer_key, Time::now()) + } + + pub fn validate_at(&self, issuer_key: &PublicKey, time: Time) -> KrillResult { + let bytes = self.message.to_bytes(); + let signed_message = SignedMessage::decode(bytes, true) + .map_err(|e| Error::Custom(format!("Cannot decode signed message: {}", e)))?; + + signed_message + .validate_at(issuer_key, time) + .map_err(|e| Error::Custom(format!("Invalid signed message: {}", e)))?; + + Ok(signed_message) + } +} + +impl From for TrustAnchorSignedMessage { + fn from(signed_msg: SignedMessage) -> Self { + let message = Base64::from_content(&signed_msg.to_captured().into_bytes()); + TrustAnchorSignedMessage { message } + } +} + +//------------ TrustAnchorSignedRequest ------------------------------------ + +/// A [`TrustAnchorSignerRequest`] and its signed message as base64 for +/// (re-)validation. +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +pub struct TrustAnchorSignedRequest { + signed: TrustAnchorSignedMessage, + request: TrustAnchorSignerRequest, +} + +impl TrustAnchorSignedRequest { + pub fn validate(&self, issuer: &IdCertInfo) -> Result<(), Error> { + let signed_message = self.signed.validate(issuer.public_key())?; + + // Verify that the content of the signed message matches the + // clear text request as well. + let signed_bytes = signed_message.content().to_bytes(); + let signed_request: TrustAnchorSignerRequest = serde_json::from_slice(&signed_bytes).map_err(|e| { + Error::Custom(format!( + "Cannot deserialize content of signed Trust Anchor request: {}", + e + )) + })?; + + if self.request != signed_request { + Err(Error::custom( + "Clear text request content does not match the contained signed message in Trust Anchor request", + )) + } else { + Ok(()) + } + } + + /// Get content without validation, handle with care + pub fn content(&self) -> &TrustAnchorSignerRequest { + &self.request + } +} + +impl fmt::Display for TrustAnchorSignedRequest { + fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result { + write!(f, "{}", self.request) + } +} + +//------------ TrustAnchorSignerRequest ------------------------------------ + +/// Request for the Trust Anchor Signer to update the signed +/// objects (new mft, crl). Can contain requests for one or +/// more children to either issue a new certificate, or revoke +/// a key. If there are no requests for a child, then it is +/// assumed that the current issued certificate(s) to the child +/// should not change. +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +pub struct TrustAnchorSignerRequest { + pub nonce: Nonce, // should be matched in response (replay protection) + pub child_requests: Vec, +} + +impl TrustAnchorSignerRequest { + pub fn sign(&self, signing_key: KeyIdentifier, signer: &KrillSigner) -> Result { + let data = serde_json::to_string_pretty(&self).unwrap(); + let data = Bytes::from(data); + + signer + .create_ta_signed_message(data, &signing_key) + .map(|msg| TrustAnchorSignedRequest { + request: self.clone(), + signed: msg.into(), + }) + .map_err(Error::signer) + } +} + +impl fmt::Display for TrustAnchorSignerRequest { + fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { + writeln!(f, "-------------------------------")?; + writeln!(f, "nonce: {}", self.nonce)?; + writeln!(f, "-------------------------------")?; + writeln!(f)?; + + for request in &self.child_requests { + writeln!(f, "-------------------------------")?; + writeln!(f, " child request")?; + writeln!(f, "-------------------------------")?; + writeln!(f, "child: {}", request.child)?; + writeln!(f, "entitlements: {}", request.resources)?; + for (key, child_req) in &request.requests { + match child_req { + ProvisioningRequest::Issuance(_) => writeln!(f, "key: {} (re-)issue", key)?, + ProvisioningRequest::Revocation(_) => writeln!(f, "key: {} revoke", key)?, + } + } + writeln!(f)?; + } + writeln!(f, "NOTE: Use the JSON output for the signer.")?; + + Ok(()) + } +} + +//------------ TrustAnchorChildRequests ------------------------------------ + +/// Requests for Trust Anchor Child. +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +pub struct TrustAnchorChildRequests { + pub child: ChildHandle, + pub resources: ResourceSet, + pub requests: HashMap, +} + +//------------ TrustAnchorSignedResponse ----------------------------------- + +/// A [`TrustAnchorSignerResponse`] and its signed message as base64 for +/// (re-)validation. +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +pub struct TrustAnchorSignedResponse { + signed: TrustAnchorSignedMessage, + response: TrustAnchorSignerResponse, +} + +impl TrustAnchorSignedResponse { + pub fn validate(&self, issuer: &IdCertInfo) -> Result<(), Error> { + let signed_message = self.signed.validate(issuer.public_key())?; + + // Verify that the content of the signed message matches the + // clear text request as well. + let signed_bytes = signed_message.content().to_bytes(); + let signed_response: TrustAnchorSignerResponse = serde_json::from_slice(&signed_bytes).map_err(|e| { + Error::Custom(format!( + "Cannot deserialize content of signed Trust Anchor response: {}", + e + )) + })?; + + if self.response != signed_response { + Err(Error::custom( + "Clear text request content does not match the contained signed message in Trust Anchor response", + )) + } else { + Ok(()) + } + } + + /// Get content without validation, handle with care + pub fn content(&self) -> &TrustAnchorSignerResponse { + &self.response + } + + pub fn into_content(self) -> TrustAnchorSignerResponse { + self.response + } +} + +impl fmt::Display for TrustAnchorSignedResponse { + fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result { + write!(f, "{}", self.response) + } +} + +//------------ TrustAnchorSignerResponse ----------------------------------- + +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +pub struct TrustAnchorSignerResponse { + pub nonce: Nonce, // should match the request (replay protection) + pub objects: TrustAnchorObjects, + pub child_responses: HashMap>, +} + +impl TrustAnchorSignerResponse { + pub fn sign(&self, signing_key: KeyIdentifier, signer: &KrillSigner) -> Result { + let data = serde_json::to_string_pretty(&self).unwrap(); + let data = Bytes::from(data); + + signer + .create_ta_signed_message(data, &signing_key) + .map(|msg| TrustAnchorSignedResponse { + response: self.clone(), + signed: msg.into(), + }) + .map_err(Error::signer) + } +} + +impl fmt::Display for TrustAnchorSignerResponse { + fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { + writeln!(f, "-------------------------------")?; + writeln!(f, "nonce: {}", self.nonce)?; + writeln!(f, "-------------------------------")?; + writeln!(f)?; + writeln!(f, "{}", self.objects)?; + writeln!(f)?; + for (child, responses) in &self.child_responses { + writeln!(f, "-------------------------------")?; + writeln!(f, " child response")?; + writeln!(f, "-------------------------------")?; + writeln!(f, "child: {}", child)?; + for (key, response) in responses.iter() { + match response { + ProvisioningResponse::Error => writeln!(f, "key: {} ERROR", key)?, + ProvisioningResponse::Issuance(_) => writeln!(f, "key: {} issued", key)?, + ProvisioningResponse::Revocation(_) => writeln!(f, "key: {} revoked", key)?, + } + } + } + writeln!(f)?; + writeln!(f, "NOTE: use the json format for the proxy.")?; + + Ok(()) + } +} + +//------------ TrustAnchorChild -------------------------------------------- + +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +pub struct TrustAnchorChild { + pub handle: ChildHandle, + pub id: IdCertInfo, + pub resources: ResourceSet, + pub used_keys: HashMap, + pub open_requests: HashMap, + pub open_responses: HashMap, +} + +impl TrustAnchorChild { + pub fn new(handle: ChildHandle, id: IdCertInfo, resources: ResourceSet) -> Self { + TrustAnchorChild { + handle, + id, + resources, + used_keys: HashMap::new(), + open_requests: HashMap::new(), + open_responses: HashMap::new(), + } + } +} + +//------------ ProvisioningRequest ----------------------------------------- + +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +#[allow(clippy::large_enum_variant)] +pub enum ProvisioningRequest { + Issuance(provisioning::IssuanceRequest), + Revocation(provisioning::RevocationRequest), +} + +impl ProvisioningRequest { + pub fn key_identifier(&self) -> KeyIdentifier { + match self { + ProvisioningRequest::Issuance(req) => req.csr().public_key().key_identifier(), + ProvisioningRequest::Revocation(req) => req.key(), + } + } + + pub fn matches_response(&self, response: &ProvisioningResponse) -> bool { + match self { + ProvisioningRequest::Issuance(_) => !matches!(response, ProvisioningResponse::Revocation(_)), + ProvisioningRequest::Revocation(_) => !matches!(response, ProvisioningResponse::Issuance(_)), + } + } +} + +impl std::fmt::Display for ProvisioningRequest { + fn fmt(&self, f: &mut std::fmt::Formatter) -> std::fmt::Result { + match self { + ProvisioningRequest::Issuance(_) => write!(f, "issue certificate for key: {}", self.key_identifier()), + ProvisioningRequest::Revocation(_) => write!(f, "revoke certificates for key: {}", self.key_identifier()), + } + } +} + +//------------ ProvisioningResponse ---------------------------------------- + +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +#[allow(clippy::large_enum_variant)] +pub enum ProvisioningResponse { + Issuance(provisioning::IssuanceResponse), + Revocation(provisioning::RevocationResponse), + Error, +} + +impl ProvisioningResponse { + pub fn to_provisioning_message(self, sender: SenderHandle, recipient: RecipientHandle) -> provisioning::Message { + match self { + ProvisioningResponse::Issuance(issuance_response) => { + provisioning::Message::issue_response(sender, recipient, issuance_response) + } + ProvisioningResponse::Revocation(revocation_response) => { + provisioning::Message::revoke_response(sender, recipient, revocation_response) + } + ProvisioningResponse::Error => { + provisioning::Message::not_performed_response( + sender, + recipient, + provisioning::NotPerformedResponse::err_2001(), + ) + .unwrap() // safe unwrap, this function always returns Ok. + } + } + } +} diff --git a/src/daemon/ta/mod.rs b/src/daemon/ta/mod.rs new file mode 100644 index 00000000..4f9844aa --- /dev/null +++ b/src/daemon/ta/mod.rs @@ -0,0 +1,158 @@ +//! Trust Anchor Support +//! +use rpki::ca::idexchange::CaHandle; + +mod common; +pub use self::common::*; + +mod proxy; +pub use self::proxy::*; + +mod signer; +pub use self::signer::*; + +pub const TA_NAME: &str = "ta"; // reserved for TA + +//------------ TrustAnchor Handle Types ------------------------------------ + +pub type TrustAnchorHandle = CaHandle; + +pub fn ta_handle() -> CaHandle { + use std::str::FromStr; + CaHandle::from_str(TA_NAME).unwrap() +} + +fn ta_resource_class_name() -> rpki::ca::provisioning::ResourceClassName { + "default".into() +} + +//----------------- TESTS -------------------------------------------------------------- +#[cfg(test)] +mod tests { + use rpki::ca::idexchange::{RepoInfo, ServiceUri}; + + use super::*; + + use std::{sync::Arc, time::Duration}; + + use crate::{ + commons::{ + api::{PublicationServerInfo, RepositoryContact}, + crypto::KrillSignerBuilder, + eventsourcing::AggregateStore, + }, + daemon::config::ConfigDefaults, + test::*, + }; + + #[test] + fn init_ta() { + test_under_tmp(|d| { + init_logging(); + + let ta_signer_store: AggregateStore = AggregateStore::disk(&d, "ta_signer").unwrap(); + let ta_proxy_store: AggregateStore = AggregateStore::disk(&d, "ta_proxy").unwrap(); + + // We will import a TA key - this is only (supposed to be) supported for the openssl signer + let signers = ConfigDefaults::openssl_signer_only(); + let signer = Arc::new( + KrillSignerBuilder::new(&d, Duration::from_secs(1), &signers) + .build() + .unwrap(), + ); + + let actor = test_actor(); + + let proxy_handle = TrustAnchorHandle::new("proxy".into()); + + let init = TrustAnchorProxy::create_init(proxy_handle.clone(), &signer).unwrap(); + + ta_proxy_store.add(init).unwrap(); + + let repository = { + let repo_info = RepoInfo::new( + rsync("rsync://example.krill.cloud/repo/"), + Some(https("https://exmple.krill.cloud/repo/notification.xml")), + ); + let repo_key_id = signer.create_key().unwrap(); + let repo_key = signer.get_key_info(&repo_key_id).unwrap(); + + let service_uri = ServiceUri::Https(https("https://example.krill.cloud/rfc8181/ta")); + let server_info = PublicationServerInfo::new(repo_key, service_uri); + + RepositoryContact::new(repo_info, server_info) + }; + + let add_repo_cmd = TrustAnchorProxyCommand::add_repo(&proxy_handle, repository, &actor); + let mut proxy = ta_proxy_store.command(add_repo_cmd).unwrap(); + + let signer_handle = TrustAnchorHandle::new("signer".into()); + let tal_https = vec![https("https://example.krill.cloud/ta/ta.cer")]; + let tal_rsync = rsync("rsync://example.krill.cloud/ta/ta.cer"); + + let import_key_pem = include_str!("../../../test-resources/ta/example-pkcs1.pem"); + + let signer_init_cmd = TrustAnchorSignerInitCommand { + handle: signer_handle.clone(), + proxy_id: proxy.id().clone(), + repo_info: proxy.repository().unwrap().repo_info().clone(), + tal_https: tal_https.clone(), + tal_rsync: tal_rsync.clone(), + private_key_pem: Some(import_key_pem.to_string()), + signer: signer.clone(), + }; + + let signer_init = TrustAnchorSigner::create_init(signer_init_cmd).unwrap(); + + let mut ta_signer = ta_signer_store.add(signer_init).unwrap(); + let signer_info = ta_signer.get_signer_info(); + let add_signer_cmd = TrustAnchorProxyCommand::add_signer(&proxy_handle, signer_info, &actor); + + proxy = ta_proxy_store.command(add_signer_cmd).unwrap(); + + // The initial signer starts off with a TA certificate + // and a CRL and manifest with revision number 1. + let ta_objects = proxy.get_trust_anchor_objects().unwrap(); + assert_eq!(ta_objects.revision().number(), 1); + + let ta_cert_details = proxy.get_ta_details().unwrap(); + assert_eq!(ta_cert_details.tal().uris(), &tal_https); + assert_eq!(ta_cert_details.tal().rsync_uri(), &tal_rsync); + + // We can make a new signer request to make a new manifest and CRL + // even if we do not yet have any issued certificates to publish. + let make_publish_request_cmd = TrustAnchorProxyCommand::make_signer_request(&proxy_handle, &actor); + proxy = ta_proxy_store.command(make_publish_request_cmd).unwrap(); + + let signed_request = proxy.get_signer_request(&signer).unwrap(); + let request_nonce = signed_request.content().nonce.clone(); + + let ta_signer_process_request_command = + TrustAnchorSignerCommand::make_process_request_command(&signer_handle, signed_request, signer, &actor); + ta_signer = ta_signer_store.command(ta_signer_process_request_command).unwrap(); + + let exchange = ta_signer.get_exchange(&request_nonce).unwrap(); + let ta_proxy_process_signer_response_command = + TrustAnchorProxyCommand::process_signer_response(&proxy_handle, exchange.response.clone(), &actor); + + proxy = ta_proxy_store + .command(ta_proxy_process_signer_response_command) + .unwrap(); + + // The TA should have published again, the revision used for manifest and crl will + // have been updated. + let ta_objects = proxy.get_trust_anchor_objects().unwrap(); + assert_eq!(ta_objects.revision().number(), 2); + + // We still need to test some higher order functions: + // - add child + // - let the child request a certificate + // - let the child perform a key rollover + // - let the TA publish + // + // This is hard to test at this level. So, will test this as part of the higher + // order functional tests found under /tests. I.e. we will start a full krill + // server with testbed support, which will use the TrustAnchorProxy and Signer. + }) + } +} diff --git a/src/daemon/ta/proxy.rs b/src/daemon/ta/proxy.rs new file mode 100644 index 00000000..cca9ac93 --- /dev/null +++ b/src/daemon/ta/proxy.rs @@ -0,0 +1,797 @@ +//! Trust Anchor Proxy +//! +//! The Trust Anchor Proxy performs all Trust Anchor responsibilities +/// *except* for signing using the Trust Anchor private key. That function +/// is handled by the Trust Anchor Signer instead. +use super::*; + +use std::{collections::HashMap, convert::TryFrom, fmt}; + +use rpki::{ + ca::{ + idexchange::{self, ChildHandle}, + provisioning::{ResourceClassEntitlements, SigningCert}, + }, + crypto::KeyIdentifier, +}; + +use crate::{ + commons::{ + actor::Actor, + api::{AddChildRequest, IdCertInfo, RepositoryContact}, + crypto::{CsrInfo, KrillSigner}, + error::Error, + eventsourcing, KrillResult, + }, + daemon::{ + ca::{Rfc8183Id, UsedKeyState}, + config::IssuanceTimingConfig, + }, +}; + +//------------ TrustAnchorProxy -------------------------------------------- + +/// Krill Trust Anchors are split into the following two components: +/// - Trust Anchor Proxy +/// - Trust Anchor Signer +/// +/// The Trust Anchor Proxy performs all Trust Anchor responsibilities +/// *except* for signing using the Trust Anchor private key. That function +/// is handled by the Trust Anchor Signer instead. The reason for this +/// division is that it allows for operations where the signer is kept +/// on a separate offline system. The proxy on the other hand can maintain +/// the communication with child CAs and take care of publication. +/// +/// Note however, that the signer can also be be embedded to support test +/// systems as well as functional and regression testing of the proxy-signer +/// communication. +/// +/// Another (unrelated) thing to note is that Krill Trust Anchors are, for +/// the moment, set up to always claim all IPv4, IPv6 and ASN resources. This +/// is inline with how the current RIR Trust Anchors are being managed at the +/// moment. That said, we may add support for claiming (and changing) a +/// specific set of resources in future. +#[derive(Clone, Debug, Deserialize, Serialize)] +pub struct TrustAnchorProxy { + // event-sourcing support + handle: TrustAnchorHandle, + version: u64, + + // ID certificate used by this proxy + id: IdCertInfo, + + // The associated signer. Needs to be added after initialisation. + signer: Option, + + // The proxy is responsible for publishing all objects. + repository: Option, + + // Typically the Trust Anchor would be set up with a single child, that + // gets a certificate with all resources. This child can then be the + // de-facto *online* trust anchor in setups where the Trust Anchor Signer + // is kept offline. This is useful because signing certificates to many + // children - and especially updating their resources - directly under + // an offline signer would be cumbersome, or at the very least add significant + // delays in operation. + // + // But, there may be use cases for multiple children under the Trust Anchor. + // In particular for testing purposes where the signer is not offline. + // + // For this reason we support any number of child CAs to exist under + // the TA. + child_details: HashMap, + + // Track if there is any open signer request. Responses MUST match the + // the nonce. Furthermore, child interactions are suspended when there + // is an open request. We first need to process the response, before we + // can accept new requests from any child. + open_signer_request: Option, +} + +//------------ TrustAnchorProxy: Commands and Events ----------------------- + +pub type TrustAnchorProxyCommand = eventsourcing::SentCommand; +pub type TrustAnchorProxyInitEvent = eventsourcing::StoredEvent; +pub type TrustAnchorProxyEvent = eventsourcing::StoredEvent; + +// Initialisation +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +pub struct TrustAnchorProxyInitDetails { + id: IdCertInfo, +} + +impl fmt::Display for TrustAnchorProxyInitDetails { + fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result { + // note that this is a summary, full details are stored in the init event. + write!(f, "Trust Anchor Proxy was initialised.") + } +} + +// Events +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +#[allow(clippy::large_enum_variant)] +pub enum TrustAnchorProxyEventDetails { + // Publication Support + RepositoryAdded(RepositoryContact), + + // Proxy -> Signer interactions + SignerAdded(TrustAnchorSignerInfo), + SignerRequestMade(Nonce), + SignerResponseReceived(TrustAnchorSignedResponse), + + // Children + ChildAdded(TrustAnchorChild), + ChildRequestAdded(ChildHandle, ProvisioningRequest), + ChildResponseGiven(ChildHandle, KeyIdentifier), +} + +impl fmt::Display for TrustAnchorProxyEventDetails { + fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result { + // note that this is a summary, full details are stored in the json. + match self { + // Publication Support + TrustAnchorProxyEventDetails::RepositoryAdded(repository) => { + write!( + f, + "Added repository with service uri: {}", + repository.server_info().service_uri() + ) + } + + // Proxy -> Signer interactions + TrustAnchorProxyEventDetails::SignerAdded(signer) => { + write!(f, "Added signer with ID certificate hash: {}", signer.id.hash()) + } + TrustAnchorProxyEventDetails::SignerRequestMade(nonce) => { + write!(f, "Created signer request with nonce '{}'", nonce) + } + TrustAnchorProxyEventDetails::SignerResponseReceived(response) => { + write!(f, "Received signer response with nonce '{}'", response.content().nonce) + } + + // Children + TrustAnchorProxyEventDetails::ChildAdded(child) => { + write!(f, "Added child: {}, with resources: {}", child.handle, child.resources) + } + TrustAnchorProxyEventDetails::ChildRequestAdded(child_handle, request) => { + write!(f, "Added request for child {}: {}", child_handle, request) + } + TrustAnchorProxyEventDetails::ChildResponseGiven(child_handle, key) => { + write!(f, "Given response to child {} for key: {}", child_handle, key) + } + } + } +} + +// Commands + +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +#[allow(clippy::large_enum_variant)] +pub enum TrustAnchorProxyCommandDetails { + // Publication Support + AddRepository(RepositoryContact), + + // Proxy -> Signer interactions + AddSigner(TrustAnchorSignerInfo), + MakeSignerRequest, + ProcessSignerResponse(TrustAnchorSignedResponse), + + // Children + AddChild(AddChildRequest), + AddChildRequest(ChildHandle, ProvisioningRequest), + GiveChildResponse(ChildHandle, KeyIdentifier), +} + +impl fmt::Display for TrustAnchorProxyCommandDetails { + fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result { + // note that this is a summary, full details are stored in the json. + match self { + // Publication Support + TrustAnchorProxyCommandDetails::AddRepository(repository) => { + write!(f, "Add repository at: {}", repository.server_info().service_uri()) + } + + // Proxy -> Signer interactions + TrustAnchorProxyCommandDetails::AddSigner(signer) => { + write!(f, "Add signer with id certificate hash: {}", signer.id.hash()) + } + TrustAnchorProxyCommandDetails::MakeSignerRequest => { + write!(f, "Create new publish request for signer") + } + TrustAnchorProxyCommandDetails::ProcessSignerResponse(response) => { + write!( + f, + "Process signer response. Nonce: {}. Next Update (before): {}", + response.content().nonce, + response.content().objects.revision().next_update().to_rfc3339() + ) + } + + // Children + TrustAnchorProxyCommandDetails::AddChild(child) => { + write!(f, "Add child: {}", child) + } + TrustAnchorProxyCommandDetails::AddChildRequest(child_handle, request) => { + write!(f, "Add request for child {}: {}", child_handle, request) + } + TrustAnchorProxyCommandDetails::GiveChildResponse(child_handle, key) => { + write!( + f, + "Give (and remove) response to child {} for key {}", + child_handle, key + ) + } + } + } +} + +impl eventsourcing::WithStorableDetails for TrustAnchorProxyCommandDetails { + fn summary(&self) -> crate::commons::api::CommandSummary { + match self { + // Publication Support + TrustAnchorProxyCommandDetails::AddRepository(repository) => { + crate::commons::api::CommandSummary::new("cmd-ta-proxy-repo-add", &self) + .with_service_uri(repository.server_info().service_uri()) + } + + // Proxy -> Signer interactions + TrustAnchorProxyCommandDetails::AddSigner(signer) => { + crate::commons::api::CommandSummary::new("cmd-ta-proxy-signer-add", &self) + .with_id_cert_hash(signer.id.hash()) + } + TrustAnchorProxyCommandDetails::MakeSignerRequest => { + crate::commons::api::CommandSummary::new("cmd-ta-proxy-pub-req", &self) + } + TrustAnchorProxyCommandDetails::ProcessSignerResponse(response) => { + crate::commons::api::CommandSummary::new("cmd-ta-proxy-pub-res", &self) + .with_arg("nonce", &response.content().nonce) + .with_arg("manifest number", response.content().objects.revision().number()) + .with_arg( + "this update", + response.content().objects.revision().this_update().to_rfc3339(), + ) + .with_arg( + "next update", + response.content().objects.revision().next_update().to_rfc3339(), + ) + } + + // Children + TrustAnchorProxyCommandDetails::AddChild(child) => { + crate::commons::api::CommandSummary::new("cmd-ta-proxy-child-add", &self).with_child(child.handle()) + } + TrustAnchorProxyCommandDetails::AddChildRequest(child_handle, _request) => { + crate::commons::api::CommandSummary::new("cmd-ta-proxy-child-req", &self).with_child(child_handle) + } + TrustAnchorProxyCommandDetails::GiveChildResponse(child_handle, _response) => { + crate::commons::api::CommandSummary::new("cmd-ta-proxy-child-res", &self).with_child(child_handle) + } + } + } +} + +impl TrustAnchorProxyCommand { + pub fn add_repo(id: &TrustAnchorHandle, repository: RepositoryContact, actor: &Actor) -> Self { + TrustAnchorProxyCommand::new( + id, + None, + TrustAnchorProxyCommandDetails::AddRepository(repository), + actor, + ) + } + + pub fn add_signer(id: &TrustAnchorHandle, signer: TrustAnchorSignerInfo, actor: &Actor) -> Self { + TrustAnchorProxyCommand::new(id, None, TrustAnchorProxyCommandDetails::AddSigner(signer), actor) + } + + pub fn make_signer_request(id: &TrustAnchorHandle, actor: &Actor) -> Self { + TrustAnchorProxyCommand::new(id, None, TrustAnchorProxyCommandDetails::MakeSignerRequest, actor) + } + + pub fn process_signer_response(id: &TrustAnchorHandle, response: TrustAnchorSignedResponse, actor: &Actor) -> Self { + TrustAnchorProxyCommand::new( + id, + None, + TrustAnchorProxyCommandDetails::ProcessSignerResponse(response), + actor, + ) + } + + pub fn add_child(id: &TrustAnchorHandle, child: AddChildRequest, actor: &Actor) -> Self { + TrustAnchorProxyCommand::new(id, None, TrustAnchorProxyCommandDetails::AddChild(child), actor) + } + + pub fn add_child_request( + id: &TrustAnchorHandle, + child: ChildHandle, + request: ProvisioningRequest, + actor: &Actor, + ) -> Self { + TrustAnchorProxyCommand::new( + id, + None, + TrustAnchorProxyCommandDetails::AddChildRequest(child, request), + actor, + ) + } + + pub fn give_child_response(id: &TrustAnchorHandle, child: ChildHandle, key: KeyIdentifier, actor: &Actor) -> Self { + TrustAnchorProxyCommand::new( + id, + None, + TrustAnchorProxyCommandDetails::GiveChildResponse(child, key), + actor, + ) + } +} + +impl eventsourcing::CommandDetails for TrustAnchorProxyCommandDetails { + type Event = TrustAnchorProxyEvent; + type StorableDetails = Self; + + fn store(&self) -> Self::StorableDetails { + self.clone() + } +} + +impl eventsourcing::Aggregate for TrustAnchorProxy { + type Command = TrustAnchorProxyCommand; + type StorableCommandDetails = TrustAnchorProxyCommandDetails; + type Event = TrustAnchorProxyEvent; + type InitEvent = TrustAnchorProxyInitEvent; + type Error = Error; + + fn init(event: Self::InitEvent) -> Result { + let (handle, _version, details) = event.unpack(); + + Ok(TrustAnchorProxy { + handle, + version: 1, + id: details.id, + repository: None, + signer: None, + child_details: HashMap::new(), + open_signer_request: None, + }) + } + + fn version(&self) -> u64 { + self.version + } + + fn apply(&mut self, event: Self::Event) { + let (handle, _version, details) = event.unpack(); + + if log_enabled!(log::Level::Trace) { + trace!( + "Applying event to Trust Anchor Proxy '{}', version: {}: {}", + handle, + self.version, + details + ); + } + + self.version += 1; + match details { + // Publication Support + TrustAnchorProxyEventDetails::RepositoryAdded(repository) => self.repository = Some(repository), + + // Proxy -> Signer interactions + TrustAnchorProxyEventDetails::SignerAdded(signer) => self.signer = Some(signer), + TrustAnchorProxyEventDetails::SignerRequestMade(nonce) => self.open_signer_request = Some(nonce), + TrustAnchorProxyEventDetails::SignerResponseReceived(response) => { + let content = response.into_content(); + for (child_handle, child_responses) in content.child_responses { + if let Some(child_details) = self.child_details.get_mut(&child_handle) { + for (key_id, response) in child_responses { + match &response { + ProvisioningResponse::Issuance(_) => { + child_details + .used_keys + .insert(key_id, UsedKeyState::Current("default".into())); + } + ProvisioningResponse::Revocation(_) => { + child_details.used_keys.insert(key_id, UsedKeyState::Revoked); + } + _ => {} + } + child_details.open_requests.remove(&key_id); + child_details.open_responses.insert(key_id, response); + } + } + } + // We cannot have an accepted response if we did not have a signer + self.signer.as_mut().unwrap().objects = content.objects; + self.open_signer_request = None; + } + + // Children + TrustAnchorProxyEventDetails::ChildAdded(child) => { + self.child_details.insert(child.handle.clone(), child); + } + TrustAnchorProxyEventDetails::ChildRequestAdded(child_handle, request) => { + self.child_details + .get_mut(&child_handle) + .unwrap() // safe - we can only have an event for this child if it exists + .open_requests + .insert(request.key_identifier(), request); + } + TrustAnchorProxyEventDetails::ChildResponseGiven(child_handle, key) => { + self.child_details + .get_mut(&child_handle) + .unwrap() // safe - we can only have an event for this child if it exists + .open_responses + .remove(&key); + } + } + } + + fn process_command(&self, command: Self::Command) -> Result, Self::Error> { + if log_enabled!(log::Level::Trace) { + trace!( + "Sending command to Trust Anchor Proxy '{}', version: {}: {}", + self.handle, + self.version, + command + ); + } + match command.into_details() { + // Publication Support + TrustAnchorProxyCommandDetails::AddRepository(repository) => { + if self.repository.is_none() { + Ok(vec![TrustAnchorProxyEvent::new( + &self.handle, + self.version, + TrustAnchorProxyEventDetails::RepositoryAdded(repository), + )]) + } else { + Err(Error::TaProxyAlreadyHasRepository) + } + } + + // Proxy -> Signer interactions + TrustAnchorProxyCommandDetails::AddSigner(signer) => { + if self.signer.is_none() { + Ok(vec![TrustAnchorProxyEvent::new( + &self.handle, + self.version, + TrustAnchorProxyEventDetails::SignerAdded(signer), + )]) + } else { + Err(Error::TaProxyAlreadyHasSigner) + } + } + TrustAnchorProxyCommandDetails::MakeSignerRequest => { + if self.open_signer_request.is_some() { + Err(Error::TaProxyHasRequest) + } else { + Ok(vec![TrustAnchorProxyEvent::new( + &self.handle, + self.version, + TrustAnchorProxyEventDetails::SignerRequestMade(Nonce::new()), + )]) + } + } + + TrustAnchorProxyCommandDetails::ProcessSignerResponse(response) => { + let open_request_nonce = self.open_signer_request.as_ref().ok_or(Error::TaProxyHasNoRequest)?; + + if &response.content().nonce != open_request_nonce { + // It seems that the user uploaded the wrong the response. + Err(Error::TaProxyRequestNonceMismatch( + response.into_content().nonce, + open_request_nonce.clone(), + )) + } else if let Some(signer) = &self.signer { + // Ensure that the response was validly signed. + response.validate(&signer.id)?; + + // We accept the response as is. Since children cannot be modified, and requests + // cannot change as long as there is an open signer request we cannot have any + // mismatches between the children and child requests in the proxy vs the + // children and responses received from the signer. + // + // In other words.. we trust that the associated signer functions correctly and + // we have no further defensive coding on this side. + // + // Note that if we would reject the response, then there would be no way of + // telling the signer why. So, this is also a matter of the 'the signer is + // always right'. + Ok(vec![TrustAnchorProxyEvent::new( + &self.handle, + self.version, + TrustAnchorProxyEventDetails::SignerResponseReceived(response), + )]) + } else { + // This is rather unexpected.. it implies that we had a request, but no + // signer. Still - return a clean error for this, so unlikely as this may + // be, it can be investigated. + Err(Error::TaProxyHasNoSigner) + } + } + + // Children + TrustAnchorProxyCommandDetails::AddChild(child) => { + if self.child_details.contains_key(child.handle()) { + Err(Error::CaChildDuplicate(self.handle.clone(), child.handle().clone())) + } else { + let (handle, resources, id_cert) = child.unpack(); + Ok(vec![TrustAnchorProxyEvent::new( + &self.handle, + self.version, + TrustAnchorProxyEventDetails::ChildAdded(TrustAnchorChild::new( + handle, + id_cert.into(), + resources, + )), + )]) + } + } + TrustAnchorProxyCommandDetails::AddChildRequest(child_handle, request) => { + // We can do some basic checks on the request, like.. + // - CSR is valid + // - CSR does not exceed entitled resources + // - CSR is for correct resource class + // - Revocation is for known key + // - Revocation is for correct resource class + // + // The signer will eventually handle the actual request. So we just + // schedule it as a manner of speaking. The signer will also do these + // checks - although that means that we have some duplication this helps + // to ensure that we can "fail fast" - and on the other hand leave the + // signer to be responsible for the final say (also.. things may have + // changed by the time the signer looks at it, like resource entitlements + // perhaps in future?) + let child = self.get_child_details(&child_handle)?; + let ta_resource_class_name = ta_resource_class_name(); + + match &request { + ProvisioningRequest::Issuance(issuance) => { + if issuance.class_name() != &ta_resource_class_name { + return Err(Error::Custom(format!( + "TA child certificate sign request uses unknown resource class name '{}'", + issuance.class_name() + ))); + } + issuance.limit().apply_to(&child.resources)?; // Errors if request exceeds + CsrInfo::try_from(issuance.csr())?; // Errors if the CSR is invalid + } + ProvisioningRequest::Revocation(revocation) => { + if revocation.class_name() != &ta_resource_class_name { + return Err(Error::Custom(format!( + "TA child revocation request uses unknown resource class name '{}'", + revocation.class_name() + ))); + } + if !child.used_keys.contains_key(&revocation.key()) { + return Err(Error::Custom(format!( + "TA child revocation requested for unknown key: {}", + revocation.key() + ))); + } + } + } + + Ok(vec![TrustAnchorProxyEvent::new( + &self.handle, + self.version, + TrustAnchorProxyEventDetails::ChildRequestAdded(child_handle, request), + )]) + } + TrustAnchorProxyCommandDetails::GiveChildResponse(child_handle, key) => { + let child = self.get_child_details(&child_handle)?; + + if child.open_responses.contains_key(&key) { + Ok(vec![TrustAnchorProxyEvent::new( + &self.handle, + self.version, + TrustAnchorProxyEventDetails::ChildResponseGiven(child_handle, key), + )]) + } else { + // This should not never happen. The command would not be sent, but let's + // return some useful error anyway. + Err(Error::Custom(format!( + "No response found for child {} and key {}", + child_handle, key + ))) + } + } + } + } +} + +impl TrustAnchorProxy { + /// Creates an initialisation event that can be used to create + /// a new TrustAnchorProxy. + // + // Perhaps we should refactor the eventsourcing support to have + // a create command instead, and let the init event become a + // normal event. But, not changing that now.. + pub fn create_init(handle: TrustAnchorHandle, signer: &KrillSigner) -> KrillResult { + let id = Rfc8183Id::generate(signer)?; + Ok(TrustAnchorProxyInitEvent::new( + &handle.into_converted(), + 0, + TrustAnchorProxyInitDetails { id: id.into() }, + )) + } + + pub fn get_signer_request(&self, signer: &KrillSigner) -> KrillResult { + if let Some(nonce) = self.open_signer_request.as_ref().cloned() { + let mut child_requests = vec![]; + for (child, details) in &self.child_details { + if !details.open_requests.is_empty() { + child_requests.push(TrustAnchorChildRequests { + child: child.clone(), + resources: details.resources.clone(), + requests: details.open_requests.clone(), + }); + } + } + + TrustAnchorSignerRequest { nonce, child_requests }.sign(self.id.public_key().key_identifier(), signer) + } else { + Err(Error::TaProxyHasNoRequest) + } + } + + pub fn get_ta_details(&self) -> KrillResult<&TaCertDetails> { + self.signer + .as_ref() + .ok_or(Error::TaNotInitialized) + .map(|signer| &signer.ta_cert_details) + } + + pub fn get_trust_anchor_objects(&self) -> KrillResult<&TrustAnchorObjects> { + self.signer + .as_ref() + .ok_or(Error::TaNotInitialized) + .map(|signer| &signer.objects) + } + + pub fn id(&self) -> &IdCertInfo { + &self.id + } + + pub fn repository(&self) -> Option<&RepositoryContact> { + self.repository.as_ref() + } + + pub fn get_child(&self, child: &ChildHandle) -> KrillResult<&TrustAnchorChild> { + match self.child_details.get(child) { + None => Err(Error::CaChildUnknown(self.handle.clone(), child.clone())), + Some(child) => Ok(child), + } + } +} + +/// # Publication support +impl TrustAnchorProxy { + /// Returns an RFC 8183 Publisher Request - which can be represented as XML to a + /// repository for this `CertAuth` + pub fn publisher_request(&self) -> idexchange::PublisherRequest { + idexchange::PublisherRequest::new(self.id.base64().clone(), self.handle.convert(), None) + } +} + +/// # As a parent +impl TrustAnchorProxy { + /// Get the entitlements for a child. + /// + /// This is a simplified version of similar code in [`CertAuth`]. There is no apparent + /// easy abstraction over these two types (a normal CA and a TA proxy). Things are similar, + /// but then.. the details are quite different. So, we accept some re-implementation of + /// similar logic here. + pub fn entitlements( + &self, + child_handle: &ChildHandle, + issuance_timing: &IssuanceTimingConfig, + ) -> KrillResult { + let signer = self.signer.as_ref().ok_or(Error::TaNotInitialized)?; + let child = self.get_child_details(child_handle)?; + + let signing_cert = { + let received_cert = signer.ta_cert_details.cert(); + let my_cert = received_cert + .to_cert() + .map_err(|e| Error::Custom(format!("Issue with certificate held by TA: {} ", e)))?; + SigningCert::new(received_cert.uri().clone(), my_cert) + }; + + let mut issued_certs = vec![]; + + let mut not_after = issuance_timing.new_child_cert_not_after(); + let threshold = issuance_timing.new_child_cert_issuance_threshold(); + for ki in child.used_keys.keys() { + if let Some(issued) = signer.objects.get_issued(ki) { + issued_certs.push(issued.to_rfc6492_issued_cert().map_err(|e| { + // This should never happen, unless our current issued certificate can no longer be parsed + Error::Custom(format!("Issue with issued certificate held by TA: {} ", e)) + })?); + + let expires = issued.validity().not_after(); + + if expires > threshold { + not_after = expires; + } + } + } + + Ok(ResourceClassEntitlements::new( + ta_resource_class_name(), + child.resources.clone(), + not_after, + issued_certs, + signing_cert, + )) + } + + /// Get a response for a child request if there is one. + /// + /// Returns an error in case the request does not correspond to the open response. + /// In that case the manager should probably just clear the open response so that + /// the child can sync again. This should not happen with local Krill CA children + /// as they do not create new requests when there is an open request. We should + /// not support any non-local - i.e. possibly out-of-sync and possibly non-krill + /// child under a krill trust anchor. They can be a child of the trust anchor + /// child though. + pub fn response_for_child( + &self, + child_handle: &ChildHandle, + request: &ProvisioningRequest, + ) -> KrillResult> { + let child = self.get_child_details(child_handle)?; + + if let Some(response) = child.open_responses.get(&request.key_identifier()) { + if request.matches_response(response) { + Ok(Some(response)) + } else { + Err(Error::Custom(format!( + "Response for {} does not match request type.", + child_handle + ))) + } + } else { + Ok(None) + } + } + + /// Informs whether there is a matching open request for the child. + /// + /// If there is a matching request then we do not need to add it. If there is no matching + /// request then we may want to add a new request or replace an existing request - which + /// we just consider 'not matching and now irrelevant' - as long as there is no open request + /// to the signer. + /// + /// Returns an error if the child is not known. + pub fn matching_open_request( + &self, + child_handle: &ChildHandle, + request: &ProvisioningRequest, + ) -> KrillResult { + let child = self.get_child_details(child_handle)?; + if let Some(existing) = child.open_requests.get(&request.key_identifier()) { + match (existing, request) { + (ProvisioningRequest::Issuance(existing), ProvisioningRequest::Issuance(request)) => { + Ok( + existing.class_name() == request.class_name() // must be "default" but could differ + && existing.limit() == request.limit() + && CsrInfo::try_from(existing.csr())? == CsrInfo::try_from(request.csr())?, + ) + } + (ProvisioningRequest::Revocation(existing), ProvisioningRequest::Revocation(request)) => { + Ok(existing.class_name() == request.class_name()) // must be "default" but could differ + } + _ => Ok(false), + } + } else { + Ok(false) + } + } + + fn get_child_details(&self, child_handle: &ChildHandle) -> KrillResult<&TrustAnchorChild> { + self.child_details + .get(child_handle) + .ok_or_else(|| Error::CaChildUnknown(self.handle.clone(), child_handle.clone())) + } +} diff --git a/src/daemon/ta/signer.rs b/src/daemon/ta/signer.rs new file mode 100644 index 00000000..1acd6cdd --- /dev/null +++ b/src/daemon/ta/signer.rs @@ -0,0 +1,545 @@ +//! Trust Anchor Signer +//! +//! Handles signing operations using the (offline) Trust Anchor key. +//! Designed to work with a single associated proxy which is responsible +//! for all other functions, like publishing and talking to child CAs. +//! The proxy makes sign requests for the signer to sign. +use super::*; + +use std::{collections::HashMap, convert::TryFrom, fmt, sync::Arc}; + +use chrono::SecondsFormat; +use rpki::{ + ca::{ + idexchange::{ChildHandle, RepoInfo}, + provisioning::{self, IssuanceResponse, RequestResourceLimit, RevocationResponse}, + }, + crypto::KeyIdentifier, + repository::{ + cert::{KeyUsage, Overclaim, TbsCert}, + resources::ResourceSet, + x509::{Serial, Time}, + }, + uri, +}; + +use crate::{ + commons::{ + actor::Actor, + api::{IdCertInfo, ObjectName, ReceivedCert}, + crypto::{CsrInfo, KrillSigner, SignSupport}, + error::Error, + eventsourcing, KrillResult, + }, + daemon::ca::Rfc8183Id, +}; + +//------------ TrustAnchorSigner ------------------------------------------- + +/// The Trust Anchor Signer signs requests sent to it by its associated +/// proxy, as long as it can verify that the proxy signed that request. + +#[derive(Clone, Debug, Deserialize, Serialize)] +pub struct TrustAnchorSigner { + // event-sourcing support + handle: TrustAnchorHandle, + version: u64, + + // ID certificate used by this signer + id: IdCertInfo, + + // ID of the associated proxy + proxy_id: IdCertInfo, + + // TA certificate and TAL + ta_cert_details: TaCertDetails, + + // Objects to be published under the TA certificate + objects: TrustAnchorObjects, + + // Proxy Signer Exchanges + exchanges: TrustAnchorProxySignerExchanges, +} + +//------------ TrustAnchorSigner: Commands and Events ---------------------- +pub type TrustAnchorSignerCommand = eventsourcing::SentCommand; +pub type TrustAnchorSignerInitEvent = eventsourcing::StoredEvent; +pub type TrustAnchorSignerEvent = eventsourcing::StoredEvent; + +// Initialisation +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +pub struct TrustAnchorSignerInitDetails { + id: IdCertInfo, + proxy_id: IdCertInfo, + ta_cert_details: TaCertDetails, + objects: TrustAnchorObjects, +} + +impl fmt::Display for TrustAnchorSignerInitDetails { + fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result { + // note that this is a summary, full details are stored in the init event. + write!(f, "Trust Anchor Signer was initialised.") + } +} + +// Events +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +pub enum TrustAnchorSignerEventDetails { + ProxySignerExchangeDone(TrustAnchorProxySignerExchange), +} + +impl fmt::Display for TrustAnchorSignerEventDetails { + fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result { + match self { + TrustAnchorSignerEventDetails::ProxySignerExchangeDone(exchange) => { + write!( + f, + "Proxy signer exchange done on {} for nonce: {}", + exchange.time.to_rfc3339(), + exchange.request.content().nonce + ) + } + } + } +} + +// Commands +#[derive(Clone, Debug)] +pub enum TrustAnchorSignerCommandDetails { + TrustAnchorSignerRequest(TrustAnchorSignedRequest, Arc), +} + +impl eventsourcing::CommandDetails for TrustAnchorSignerCommandDetails { + type Event = TrustAnchorSignerEvent; + type StorableDetails = TrustAnchorSignerStorableCommand; + + fn store(&self) -> Self::StorableDetails { + self.into() + } +} + +impl fmt::Display for TrustAnchorSignerCommandDetails { + fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result { + TrustAnchorSignerStorableCommand::from(self).fmt(f) + } +} + +impl TrustAnchorSignerCommand { + pub fn make_process_request_command( + id: &TrustAnchorHandle, + request: TrustAnchorSignedRequest, + signer: Arc, + actor: &Actor, + ) -> TrustAnchorSignerCommand { + TrustAnchorSignerCommand::new( + id, + None, + TrustAnchorSignerCommandDetails::TrustAnchorSignerRequest(request, signer), + actor, + ) + } +} + +// Storable Commands (KrillSigner cannot be de-/serialized) +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +pub enum TrustAnchorSignerStorableCommand { + TrustAnchorSignerRequest(TrustAnchorSignedRequest), +} + +impl From<&TrustAnchorSignerCommandDetails> for TrustAnchorSignerStorableCommand { + fn from(details: &TrustAnchorSignerCommandDetails) -> Self { + match details { + TrustAnchorSignerCommandDetails::TrustAnchorSignerRequest(request, _) => { + TrustAnchorSignerStorableCommand::TrustAnchorSignerRequest(request.clone()) + } + } + } +} + +impl eventsourcing::WithStorableDetails for TrustAnchorSignerStorableCommand { + fn summary(&self) -> crate::commons::api::CommandSummary { + match self { + TrustAnchorSignerStorableCommand::TrustAnchorSignerRequest(request) => { + crate::commons::api::CommandSummary::new("cmd-ta-signer-process-request", &self) + .with_arg("nonce", &request.content().nonce) + } + } + } +} + +impl fmt::Display for TrustAnchorSignerStorableCommand { + fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result { + // note that this is a summary, full details are stored in the json. + match self { + TrustAnchorSignerStorableCommand::TrustAnchorSignerRequest(req) => { + write!(f, "Process signer request with nonce: {}", req.content().nonce) + } + } + } +} + +impl eventsourcing::Aggregate for TrustAnchorSigner { + type Command = TrustAnchorSignerCommand; + type StorableCommandDetails = TrustAnchorSignerStorableCommand; + type Event = TrustAnchorSignerEvent; + type InitEvent = TrustAnchorSignerInitEvent; + type Error = Error; + + fn init(event: Self::InitEvent) -> Result { + let (handle, _version, details) = event.unpack(); + + Ok(TrustAnchorSigner { + handle, + version: 1, + id: details.id, + proxy_id: details.proxy_id, + ta_cert_details: details.ta_cert_details, + objects: details.objects, + exchanges: TrustAnchorProxySignerExchanges::default(), + }) + } + + fn version(&self) -> u64 { + self.version + } + + fn apply(&mut self, event: Self::Event) { + let (handle, _version, details) = event.unpack(); + + if log_enabled!(log::Level::Trace) { + trace!( + "Applying event to Trust Anchor Signer '{}', version: {}: {}", + handle, + self.version, + details + ); + } + self.version += 1; + + match details { + TrustAnchorSignerEventDetails::ProxySignerExchangeDone(exchange) => { + self.objects = exchange.response.content().objects.clone(); + self.exchanges.0.push(exchange); + } + } + } + + fn process_command(&self, command: Self::Command) -> Result, Self::Error> { + if log_enabled!(log::Level::Trace) { + trace!( + "Sending command to Trust Anchor Signer '{}', version: {}: {}", + self.handle, + self.version, + command + ); + } + + match command.into_details() { + TrustAnchorSignerCommandDetails::TrustAnchorSignerRequest(request, signer) => { + self.process_signer_request(request, &signer) + } + } + } +} + +impl TrustAnchorSigner { + pub fn get_signer_info(&self) -> TrustAnchorSignerInfo { + TrustAnchorSignerInfo { + id: self.id.clone(), + objects: self.objects.clone(), + ta_cert_details: self.ta_cert_details.clone(), + } + } + + pub fn get_associated_proxy_id(&self) -> &IdCertInfo { + &self.proxy_id + } +} + +pub struct TrustAnchorSignerInitCommand { + pub handle: TrustAnchorHandle, + pub proxy_id: IdCertInfo, + pub repo_info: RepoInfo, + pub tal_https: Vec, + pub tal_rsync: uri::Rsync, + pub private_key_pem: Option, + pub signer: Arc, +} + +impl TrustAnchorSigner { + /// Creates an initialisation event that can be used to create a new Trust Anchor Signer. + pub fn create_init(cmd: TrustAnchorSignerInitCommand) -> KrillResult { + let signer = cmd.signer; + + let id = Rfc8183Id::generate(&signer)?.into(); + let proxy_id = cmd.proxy_id; + let ta_cert_details = Self::create_ta_cert_details( + cmd.repo_info, + cmd.tal_https, + cmd.tal_rsync, + cmd.private_key_pem, + &signer, + )?; + let objects = TrustAnchorObjects::create(ta_cert_details.cert(), &signer)?; + + Ok(TrustAnchorSignerInitEvent::new( + &cmd.handle, + 0, + TrustAnchorSignerInitDetails { + id, + proxy_id, + ta_cert_details, + objects, + }, + )) + } + + fn create_ta_cert_details( + repo_info: RepoInfo, + tal_https: Vec, + tal_rsync: uri::Rsync, + private_key_pem: Option, + signer: &KrillSigner, + ) -> KrillResult { + let key = match private_key_pem { + None => signer.create_key(), + Some(pem) => signer.import_key(&pem), + }?; + + let resources = ResourceSet::all(); + + let cert = { + let serial: Serial = signer.random_serial()?; + + let pub_key = signer.get_key_info(&key).map_err(Error::signer)?; + let name = pub_key.to_subject_name(); + + let mut cert = TbsCert::new( + serial, + name.clone(), + SignSupport::sign_validity_years(TA_CERTIFICATE_VALIDITY_YEARS), + Some(name), + pub_key.clone(), + KeyUsage::Ca, + Overclaim::Refuse, + ); + + cert.set_basic_ca(Some(true)); + + // The TA will publish directly in its root. It only has 1 resource class + // so it does not use namespaces (sub-folders). Furthermore, this should + // facilitate a structure where the TA can publish to the root of the + // rsync repository, and other CAs get their own folders under it. This + // will help recursive rsync fetches. + let ns = ""; + + cert.set_ca_repository(Some(repo_info.ca_repository(ns))); + cert.set_rpki_manifest(Some( + repo_info.resolve(ns, ObjectName::mft_for_key(&pub_key.key_identifier()).as_ref()), + )); + cert.set_rpki_notify(repo_info.rpki_notify().cloned()); + + cert.set_as_resources(resources.to_as_resources()); + cert.set_v4_resources(resources.to_ip_resources_v4()); + cert.set_v6_resources(resources.to_ip_resources_v6()); + + signer.sign_cert(cert, &key)? + }; + + let tal = TrustAnchorLocator::new(tal_https, tal_rsync.clone(), cert.subject_public_key_info()); + + let rcvd_cert = + ReceivedCert::create(cert, tal_rsync, resources, RequestResourceLimit::default()).map_err(Error::custom)?; + + Ok(TaCertDetails::new(rcvd_cert, tal)) + } + + /// Process a request. + fn process_signer_request( + &self, + request: TrustAnchorSignedRequest, + signer: &KrillSigner, + ) -> KrillResult> { + // Let's first make sure this request is valid + // and the 'content' is not tampered with. + request.validate(&self.proxy_id)?; + + let mut objects = self.objects.clone(); + + let mut child_responses: HashMap> = HashMap::new(); + + let signing_cert = self.ta_cert_details.cert(); + let ta_rcn = ta_resource_class_name(); + + for child_request in &request.content().child_requests { + let mut responses = HashMap::new(); + + for (key_id, provisioning_request) in child_request.requests.clone() { + match provisioning_request { + ProvisioningRequest::Issuance(issuance_req) => { + let (rcn, limit, csr) = issuance_req.unpack(); + + if rcn != ta_rcn { + return Err(Error::Custom(format!( + "TA child request uses unknown resource class name '{}'", + rcn + ))); + } + + let validity = SignSupport::sign_validity_weeks(TA_ISSUED_CERTIFICATE_VALIDITY_WEEKS); + let issue_resources = limit.apply_to(&child_request.resources)?; + + // Create issued certificate + let issued_cert = SignSupport::make_issued_cert( + CsrInfo::try_from(&csr)?, + &issue_resources, + limit.clone(), + signing_cert, + validity, + signer, + )?; + + // Create response for certificate + let response = IssuanceResponse::new( + ta_rcn.clone(), + issue_resources, + validity.not_after(), + provisioning::IssuedCert::new( + issued_cert.uri().clone(), + limit, + issued_cert.to_cert().unwrap(), // cannot fail + ), + provisioning::SigningCert::new(signing_cert.uri().clone(), signing_cert.to_cert().unwrap()), + ); + + // extend the objects with the issued certs + objects.add_issued(issued_cert); + + // add the response so it can be returned to the child + responses.insert(key_id, ProvisioningResponse::Issuance(response)); + } + ProvisioningRequest::Revocation(revocation_req) => { + let response = RevocationResponse::from(&revocation_req); + + let (rcn, key) = revocation_req.unpack(); + + if rcn != ta_rcn { + return Err(Error::Custom(format!( + "TA child request uses unknown resource class name '{}'", + rcn + ))); + } + + // Try to revoke for this key. Return an error in case of issues. + // Note.. we could make this idempotent instead. I.e. if there is no + // such key, then perhaps we can just consider it revoked and call + // it a day. Then again, we really do not expect that this should + // happen between a krill CA and its local TA (proxy). So.. it's + // most likely best to have an explicit error in this case so the + // issue can be investigated. + if !objects.revoke_issued(&key) { + return Err(Error::Custom(format!( + "TA child requests revocation for unknown key '{}'", + key + ))); + } + + responses.insert(key_id, ProvisioningResponse::Revocation(response)); + } + } + } + + child_responses.insert(child_request.child.clone(), responses); + } + + objects.republish(signing_cert, signer)?; + + let response = TrustAnchorSignerResponse { + nonce: request.content().nonce.clone(), + objects, + child_responses, + } + .sign(self.id.public_key().key_identifier(), signer)?; + + let exchange = TrustAnchorProxySignerExchange { + time: Time::now(), + request, + response, + }; + + Ok(vec![TrustAnchorSignerEvent::new( + &self.handle, + self.version, + TrustAnchorSignerEventDetails::ProxySignerExchangeDone(exchange), + )]) + } + + /// Get all exchanges + pub fn get_exchanges(&self) -> &TrustAnchorProxySignerExchanges { + &self.exchanges + } + + /// Get exchange for nonce + pub fn get_exchange(&self, nonce: &Nonce) -> Option<&TrustAnchorProxySignerExchange> { + self.exchanges.0.iter().find(|ex| &ex.request.content().nonce == nonce) + } + + pub fn get_latest_exchange(&self) -> Option<&TrustAnchorProxySignerExchange> { + self.exchanges.0.last() + } +} + +#[derive(Clone, Debug, Default, Deserialize, Serialize)] +pub struct TrustAnchorProxySignerExchanges(Vec); + +impl fmt::Display for TrustAnchorProxySignerExchanges { + fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { + for exchange in &self.0 { + let revision = exchange.response.content().objects.revision(); + + writeln!( + f, + "===================================================================================" + )?; + writeln!(f, " Session number: {}", revision.number() - 1)?; // We don't count init mft + writeln!( + f, + " Session date: {}", + exchange.time.to_rfc3339_opts(SecondsFormat::Secs, false) + )?; + writeln!( + f, + " Plan next before: {}", + revision.next_update().to_rfc3339_opts(SecondsFormat::Secs, false) + )?; + writeln!( + f, + "===================================================================================" + )?; + writeln!(f)?; + if !exchange.response.content().child_responses.is_empty() { + writeln!(f, " response | key identifier | child ")?; + writeln!(f, " --------------------------------------------------------------")?; + + for (child, response) in &exchange.response.content().child_responses { + for (key, res) in response.iter() { + let res_type = match res { + ProvisioningResponse::Issuance(_) => "issued ", + ProvisioningResponse::Revocation(_) => "revoked ", + ProvisioningResponse::Error => "error ", + }; + writeln!(f, " {} | {} | {}", res_type, key, child)?; + } + } + writeln!(f)?; + } + + for published in exchange.response.content().objects.publish_elements().unwrap() { + writeln!(f, " {}", published.uri())?; + } + + writeln!(f)?; + } + Ok(()) + } +} diff --git a/src/pubd/repository.rs b/src/pubd/repository.rs index 13e18cd1..46358bcc 100644 --- a/src/pubd/repository.rs +++ b/src/pubd/repository.rs @@ -42,7 +42,10 @@ use crate::{ PUBSERVER_CONTENT_DIR, PUBSERVER_DFLT, PUBSERVER_DIR, REPOSITORY_DIR, REPOSITORY_RRDP_ARCHIVE_DIR, REPOSITORY_RRDP_DIR, REPOSITORY_RSYNC_DIR, RRDP_FIRST_SERIAL, }, - daemon::config::{Config, RrdpUpdatesConfig}, + daemon::{ + config::{Config, RrdpUpdatesConfig}, + ta::TA_NAME, + }, pubd::{ publishers::Publisher, RepoAccessCmd, RepoAccessCmdDet, RepositoryAccessEvent, RepositoryAccessEventDetails, RepositoryAccessIni, RepositoryAccessInitDetails, @@ -1620,8 +1623,14 @@ impl RepositoryAccess { } fn base_uri_for(&self, name: &PublisherHandle) -> KrillResult { - uri::Rsync::from_str(&format!("{}{}/", self.rsync_base, name)) - .map_err(|_| Error::Custom(format!("Cannot derive base uri for {}", name))) + if name.as_str() == TA_NAME { + // Let the TA publish directly under the rsync base dir. This + // will be helpful for RPs that still insist on rsync. + Ok(self.rsync_base.clone()) + } else { + uri::Rsync::from_str(&format!("{}{}/", self.rsync_base, name)) + .map_err(|_| Error::Custom(format!("Cannot derive base uri for {}", name))) + } } /// Returns the repository URI information for a publisher. diff --git a/src/test.rs b/src/test.rs index 6f5e00d7..9f14711c 100644 --- a/src/test.rs +++ b/src/test.rs @@ -1108,3 +1108,8 @@ pub fn test_id_certificate() -> IdCert { let data = include_bytes!("../test-resources/oob/id_publisher_ta.cer"); IdCert::decode(Bytes::from_static(data)).unwrap() } + +#[cfg(test)] +pub fn test_actor() -> crate::commons::actor::Actor { + crate::commons::actor::Actor::test_from_def(crate::constants::ACTOR_DEF_KRILL) +} diff --git a/src/upgrades/mod.rs b/src/upgrades/mod.rs index 0faf526d..657ba7eb 100644 --- a/src/upgrades/mod.rs +++ b/src/upgrades/mod.rs @@ -102,6 +102,7 @@ pub enum PrepareUpgradeError { Unrecognised(String), CannotLoadAggregate(MyHandle), IdExchange(String), + OldTaMigration, Custom(String), } @@ -114,6 +115,7 @@ impl fmt::Display for PrepareUpgradeError { PrepareUpgradeError::Unrecognised(s) => format!("Unrecognised: {}", s), PrepareUpgradeError::CannotLoadAggregate(h) => format!("Cannot load: {}", h), PrepareUpgradeError::IdExchange(s) => format!("Could not use exchanged id info: {}", s), + PrepareUpgradeError::OldTaMigration => "Your installation cannot be upgraded to Krill 0.13.0 or later because it includes a CA called \"ta\". These CAs were used for the preliminary Trust Anchor support needed by testbed and benchmark setups. They cannot be migrated to the production grade Trust Anchor support that was introduced in Krill 0.13.0. If you want to continue to use your existing installation we recommend that you downgrade to Krill 0.12.1 or earlier. If you want to operate a testbed using Krill 0.13.0 or later, then you can create a fresh testbed instead of migrating your existing testbed. If you believe that you should not have a CA called \"ta\" - i.e. it may have been left over from an abandoned testbed set up - then you can delete the \"ta\" directory under your krill data \"cas\" directory and restart Krill.".to_string(), PrepareUpgradeError::Custom(s) => s.clone(), }; @@ -325,6 +327,18 @@ pub fn prepare_upgrade_data_migrations(mode: UpgradeMode, config: Arc) - #[cfg(feature = "hsm")] record_preexisting_openssl_keys_in_signer_mapper(config.clone())?; + // Check if there is any CA named "ta". If so, then we are trying to upgrade a Krill testbed + // or benchmark set up that uses the old deprecated trust anchor set up. These TAs cannot easily + // be migrated to the new setup in 0.13.0. Well.. it could be done, if there would be a strong use + // case to put in the effort, but there really isn't. + let ca_store_path = config.data_dir.join(CASERVER_DIR); + if ca_store_path.exists() { + let ca_kv_store = KeyValueStore::disk(&config.data_dir, CASERVER_DIR)?; + if ca_kv_store.has_scope("ta".to_string())? { + return Err(PrepareUpgradeError::OldTaMigration); + } + } + match upgrade_versions(config.as_ref()) { None => Ok(None), Some(versions) => { diff --git a/src/upgrades/pre_0_10_0/old_events.rs b/src/upgrades/pre_0_10_0/old_events.rs index 89616e86..fe08ea8f 100644 --- a/src/upgrades/pre_0_10_0/old_events.rs +++ b/src/upgrades/pre_0_10_0/old_events.rs @@ -24,7 +24,7 @@ use crate::{ api::{ AspaCustomer, AspaDefinition, AspaProvidersUpdate, CertInfo, IdCertInfo, IssuedCertificate, ObjectName, ParentCaContact, ParentServerInfo, PublicationServerInfo, ReceivedCert, RepositoryContact, Revocation, - Revocations, RoaAggregateKey, RtaName, SuspendedCert, TaCertDetails, TrustAnchorLocator, UnsuspendedCert, + Revocations, RoaAggregateKey, RtaName, SuspendedCert, UnsuspendedCert, }, eventsourcing::StoredEvent, util::ext_serde, @@ -33,6 +33,7 @@ use crate::{ self, AspaInfo, AspaObjectsUpdates, CaEvt, CaEvtDet, CaObjects, CertifiedKey, ChildCertificateUpdates, ObjectSetRevision, PreparedRta, PublishedObject, RoaInfo, RoaPayloadJsonMapKey, RoaUpdates, SignedRta, }, + daemon::ta::{TaCertDetails, TrustAnchorLocator}, pubd::{Publisher, RepositoryAccessEvent, RepositoryAccessEventDetails, RepositoryAccessInitDetails}, upgrades::PrepareUpgradeError, }; @@ -268,10 +269,10 @@ impl TryFrom for ParentCaContact { type Error = PrepareUpgradeError; fn try_from(old: OldParentCaContact) -> Result { - Ok(match old { - OldParentCaContact::Ta(old) => ParentCaContact::Ta(old.try_into()?), - OldParentCaContact::Rfc6492(old) => ParentCaContact::Rfc6492(old.into()), - }) + match old { + OldParentCaContact::Ta(_old) => Err(PrepareUpgradeError::OldTaMigration), + OldParentCaContact::Rfc6492(old) => Ok(ParentCaContact::Rfc6492(old.into())), + } } } @@ -890,9 +891,7 @@ impl TryFrom for CaEvtDet { fn try_from(old: OldCaEvtDet) -> Result { Ok(match old { - OldCaEvtDet::TrustAnchorMade { ta_cert_details } => CaEvtDet::TrustAnchorMade { - ta_cert_details: ta_cert_details.try_into()?, - }, + OldCaEvtDet::TrustAnchorMade { .. } => return Err(PrepareUpgradeError::OldTaMigration), OldCaEvtDet::ChildAdded { child, id_cert, diff --git a/src/upgrades/pre_0_9_0/ca_objects_migration.rs b/src/upgrades/pre_0_9_0/ca_objects_migration.rs index 19baf243..b9ca4fdb 100644 --- a/src/upgrades/pre_0_9_0/ca_objects_migration.rs +++ b/src/upgrades/pre_0_9_0/ca_objects_migration.rs @@ -26,7 +26,7 @@ use crate::{ commons::{ api::{ IdCertInfo, ObjectName, ReceivedCert, RepositoryContact, Revocation, Revocations, RoaAggregateKey, - StorableCaCommand, StoredEffect, TaCertDetails, TrustAnchorLocator, + StorableCaCommand, StoredEffect, }, crypto::KrillSigner, eventsourcing::{Aggregate, AggregateStore, CommandKey, KeyStoreKey, KeyValueStore, StoredValueInfo}, @@ -35,11 +35,12 @@ use crate::{ constants::{CASERVER_DIR, KRILL_VERSION}, daemon::{ ca::{ - self, ta_handle, CaEvt, CaEvtDet, CaObjects, CaObjectsStore, IniDet, KeyObjectSet, ObjectSetRevision, - PublishedCert, PublishedObject, ResourceClassKeyState, ResourceClassObjects, RoaInfo, RoaPayloadJsonMapKey, + self, CaEvt, CaEvtDet, CaObjects, CaObjectsStore, IniDet, KeyObjectSet, ObjectSetRevision, PublishedCert, + PublishedObject, ResourceClassKeyState, ResourceClassObjects, RoaInfo, RoaPayloadJsonMapKey, StoredCaCommand, }, config::Config, + ta::{ta_handle, TaCertDetails, TrustAnchorLocator}, }, pubd::RepositoryManager, upgrades::pre_0_9_0::{old_commands::*, old_events::*}, diff --git a/src/upgrades/pre_0_9_0/old_commands.rs b/src/upgrades/pre_0_9_0/old_commands.rs index 6b499689..98498083 100644 --- a/src/upgrades/pre_0_9_0/old_commands.rs +++ b/src/upgrades/pre_0_9_0/old_commands.rs @@ -189,7 +189,7 @@ impl WithStorableDetails for OldStorableCaCommand { impl From for StorableCaCommand { fn from(old: OldStorableCaCommand) -> Self { match old { - OldStorableCaCommand::MakeTrustAnchor => StorableCaCommand::MakeTrustAnchor, + OldStorableCaCommand::MakeTrustAnchor => unreachable!("TA migration is not supported and not attempted"), OldStorableCaCommand::ChildAdd(_child, _ski, _resources) => { unreachable!("migrated differently") } @@ -347,7 +347,7 @@ pub enum OldStorableParentContact { impl From for StorableParentContact { fn from(old: OldStorableParentContact) -> Self { match old { - OldStorableParentContact::Ta => StorableParentContact::Ta, + OldStorableParentContact::Ta => unreachable!("TA migration is not supported and not attempted"), _ => StorableParentContact::Rfc6492, } } diff --git a/src/upgrades/pre_0_9_0/old_events.rs b/src/upgrades/pre_0_9_0/old_events.rs index 430f1c19..fb719db1 100644 --- a/src/upgrades/pre_0_9_0/old_events.rs +++ b/src/upgrades/pre_0_9_0/old_events.rs @@ -121,7 +121,7 @@ impl OldCaEvt { OldCaEvtDet::ParentAdded(parent, old_contact) => { let contact = match old_contact { OldParentCaContact::Rfc6492(res) => ParentCaContact::for_rfc8183_parent_response(res)?, - OldParentCaContact::Ta(details) => ParentCaContact::Ta(details.try_into()?), + OldParentCaContact::Ta(_details) => return Err(PrepareUpgradeError::OldTaMigration), OldParentCaContact::Embedded => match derived_embedded_ca_info_map.get(&parent.convert()) { Some(info) => { let res = info.parent_responses.get(&id.convert()).ok_or_else(|| PrepareUpgradeError::Custom( @@ -228,9 +228,9 @@ impl TryFrom for CaEvtDet { fn try_from(old: OldCaEvtDet) -> Result { Ok(match old { - OldCaEvtDet::TrustAnchorMade(ta_cert_details) => CaEvtDet::TrustAnchorMade { - ta_cert_details: ta_cert_details.try_into()?, - }, + OldCaEvtDet::TrustAnchorMade(_) => { + return Err(PrepareUpgradeError::OldTaMigration); + } OldCaEvtDet::ChildAdded(_child, _details) => { unreachable!("Add child must be converted with embedded children in mind") } diff --git a/test-resources/bulk-ca-import/structure.json b/test-resources/bulk-ca-import/structure.json index d6e2cd5b..6bac2bd8 100644 --- a/test-resources/bulk-ca-import/structure.json +++ b/test-resources/bulk-ca-import/structure.json @@ -1,7 +1,9 @@ { - "ta_aia": "rsync://example.krill.cloud/ta/ta.cer", - "ta_uri": "https://example.krill.cloud/ta/ta.cer", - "publication_server_uris": { + "ta": { + "ta_aia": "rsync://example.krill.cloud/ta/ta.cer", + "ta_uri": "https://example.krill.cloud/ta/ta.cer" + }, + "publication_server": { "rrdp_base_uri": "https://example.krill.cloud/repo/", "rsync_jail": "rsync://example.krill.cloud/repo/" }, diff --git a/test-resources/krillta.conf b/test-resources/krillta.conf new file mode 100644 index 00000000..7c474119 --- /dev/null +++ b/test-resources/krillta.conf @@ -0,0 +1 @@ +data_dir = "./work/data_ta" \ No newline at end of file diff --git a/test-resources/migrations/v0_6_0/cas/ca/command--1616410737--2--cmd-ca-parent-add.json b/test-resources/migrations/v0_6_0/cas/ca/command--1616410737--2--cmd-ca-parent-add.json index c484e8ef..4e1089cf 100644 --- a/test-resources/migrations/v0_6_0/cas/ca/command--1616410737--2--cmd-ca-parent-add.json +++ b/test-resources/migrations/v0_6_0/cas/ca/command--1616410737--2--cmd-ca-parent-add.json @@ -7,7 +7,7 @@ "details": { "add_parent": [ "ta", - "embedded" + "rfc6492" ] }, "effect": { diff --git a/test-resources/migrations/v0_6_0/cas/ca/delta-2.json b/test-resources/migrations/v0_6_0/cas/ca/delta-2.json index 20cd8ede..83087078 100644 --- a/test-resources/migrations/v0_6_0/cas/ca/delta-2.json +++ b/test-resources/migrations/v0_6_0/cas/ca/delta-2.json @@ -4,7 +4,15 @@ "details": { "parent_added": [ "ta", - "embedded" + { + "rfc6492": { + "tag": null, + "id_cert": "MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhDOEYzODRBOTJFN0JCNTI4REUxODMxMEFFNDZFRDkxQUM1MUVDMzZEMB4XDTIxMTEyNTEwMjUxNVoXDTM2MTEyNTEwMzAxNVowMzExMC8GA1UEAxMoQzhGMzg0QTkyRTdCQjUyOERFMTgzMTBBRTQ2RUQ5MUFDNTFFQzM2RDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAPEaAhfelHOfU3fHIFpRRJFrW7mkt3SRkbscxISjiafEsGr99HVskJ737chb9DXHZVNsqNUt97V6jseZSzpeKEhsbCIVErNYkJHCCIp9YLpfIwpr+4gnUWRZXXz5zdb0hO6vgVLbIjwLkTOCaPwoGCa/4dq4oLu1+jD0de4tqygEbwWGOTaB1u1wSnVIMAxcSwU6NAOYGQlVI47fANjNWfukmIcezTXBUAqUDQnWyTlAasDdxVtOCuALQDV6FKAZrxdm2bTaJQ3pXbP85ViaBBSnt5YUtU6Wsg/bFTdBYSB86sCc8Bzl+nltcdzaQJlbzUTN5n26+G8ZovSEEUK23SECAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUyPOEqS57tSjeGDEK5G7ZGsUew20wHwYDVR0jBBgwFoAUyPOEqS57tSjeGDEK5G7ZGsUew20wDQYJKoZIhvcNAQELBQADggEBAED8jxoyOyLhwIruzOXJ+/VxAE0MjtFOeLv8fHORlX/aVsA2o2/aG/mIdb0ALHQhFtjjrESSZ6tMjWvmbdGffI65bW9VyHMsLvz7ctGKHtAgU29q84F4zxWbbHJfcl/mzHRcGqjL+ZA2K1USOoUo0E974dX21/8WwjGQpextB1dCNwFBVKOk4r976nvMqaeaQuZFiLEl9Hp4LL7NVXGjS5NCSF/E9N2TQ9ucXWEQJ6Gtc6GpBl9jOpNIir+wsXIjjDs54zR7ouCcpmVDBDDQK5/PsSWQJ/X4wxNECvFBVIu/k9WypP28bc8/HTgo+j2OeqO0oFniCq20Dq9KxJ5qJzY=", + "parent_handle": "ta", + "child_handle": "ca", + "service_uri": "https://localhost:3000/rfc6492/ta" + } + } ] } } \ No newline at end of file diff --git a/test-resources/migrations/v0_6_0/cas/ta/command--1616409877--1--cmd-ca-repo-update.json b/test-resources/migrations/v0_6_0/cas/ta/command--1616409877--1--cmd-ca-repo-update.json deleted file mode 100644 index 5a859907..00000000 --- a/test-resources/migrations/v0_6_0/cas/ta/command--1616409877--1--cmd-ca-repo-update.json +++ /dev/null @@ -1,15 +0,0 @@ -{ - "actor": "krill", - "time": "2021-03-22T10:44:37.150133637Z", - "handle": "ta", - "version": 1, - "sequence": 1, - "details": { - "repo_update": null - }, - "effect": { - "events": [ - 1 - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_6_0/cas/ta/command--1616409877--2--cmd-ca-make-ta.json b/test-resources/migrations/v0_6_0/cas/ta/command--1616409877--2--cmd-ca-make-ta.json deleted file mode 100644 index 4a3decba..00000000 --- a/test-resources/migrations/v0_6_0/cas/ta/command--1616409877--2--cmd-ca-make-ta.json +++ /dev/null @@ -1,13 +0,0 @@ -{ - "actor": "krill", - "time": "2021-03-22T10:44:37.150276043Z", - "handle": "ta", - "version": 2, - "sequence": 2, - "details": "make_trust_anchor", - "effect": { - "events": [ - 2 - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_6_0/cas/ta/command--1616409877--3--cmd-ca-rcn-receive.json b/test-resources/migrations/v0_6_0/cas/ta/command--1616409877--3--cmd-ca-rcn-receive.json deleted file mode 100644 index 72a8b079..00000000 --- a/test-resources/migrations/v0_6_0/cas/ta/command--1616409877--3--cmd-ca-rcn-receive.json +++ /dev/null @@ -1,22 +0,0 @@ -{ - "actor": "krill", - "time": "2021-03-22T10:44:37.323145796Z", - "handle": "ta", - "version": 3, - "sequence": 3, - "details": { - "update_rcvd_cert": [ - "0", - { - "asn": "AS0-AS4294967295", - "v4": "0.0.0.0/0", - "v6": "::/0" - } - ] - }, - "effect": { - "events": [ - 3 - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_6_0/cas/ta/command--1616410686--4--cmd-ca-child-add.json b/test-resources/migrations/v0_6_0/cas/ta/command--1616410686--4--cmd-ca-child-add.json deleted file mode 100644 index 0c6f94f2..00000000 --- a/test-resources/migrations/v0_6_0/cas/ta/command--1616410686--4--cmd-ca-child-add.json +++ /dev/null @@ -1,23 +0,0 @@ -{ - "actor": "krill", - "time": "2021-03-22T10:58:06.015518962Z", - "handle": "ta", - "version": 4, - "sequence": 4, - "details": { - "child_add": [ - "ca", - null, - { - "asn": "", - "v4": "192.168.0.0/16", - "v6": "" - } - ] - }, - "effect": { - "events": [ - 4 - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_6_0/cas/ta/command--1616410738--5--cmd-ca-child-certify.json b/test-resources/migrations/v0_6_0/cas/ta/command--1616410738--5--cmd-ca-child-certify.json deleted file mode 100644 index 2f4f1340..00000000 --- a/test-resources/migrations/v0_6_0/cas/ta/command--1616410738--5--cmd-ca-child-certify.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "actor": "krill", - "time": "2021-03-22T10:58:58.682526394Z", - "handle": "ta", - "version": 5, - "sequence": 5, - "details": { - "child_certify": [ - "ca", - "0", - { - "asn": "none", - "v4": "none", - "v6": "none" - }, - "B497A5F1E84F9089F5F51A899725A7C5B076E03F" - ] - }, - "effect": { - "events": [ - 5, - 6, - 7 - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_6_0/cas/ta/command--1616410864--6--cmd-ca-child-certify.json b/test-resources/migrations/v0_6_0/cas/ta/command--1616410864--6--cmd-ca-child-certify.json deleted file mode 100644 index 390a0054..00000000 --- a/test-resources/migrations/v0_6_0/cas/ta/command--1616410864--6--cmd-ca-child-certify.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "actor": "krill", - "time": "2021-03-22T11:01:04.899126536Z", - "handle": "ta", - "version": 8, - "sequence": 6, - "details": { - "child_certify": [ - "ca", - "0", - { - "asn": "none", - "v4": "none", - "v6": "none" - }, - "9F50CE97A62D7420ECB0E76400B4D00A9FF80837" - ] - }, - "effect": { - "events": [ - 8, - 9, - 10 - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_6_0/cas/ta/delta-0.json b/test-resources/migrations/v0_6_0/cas/ta/delta-0.json deleted file mode 100644 index 0de2f375..00000000 --- a/test-resources/migrations/v0_6_0/cas/ta/delta-0.json +++ /dev/null @@ -1,10 +0,0 @@ -{ - "id": "ta", - "version": 0, - "details": { - "id": { - "key": "47B37867569D650DFDB6DCC3A639FE2F75A1F8CD", - "cert": "MIIDPDCCAiSgAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyg0N0IzNzg2NzU2OUQ2NTBERkRCNkRDQzNBNjM5RkUyRjc1QTFGOENEMCAXDTIxMDMyMjEwMzkzN1oYDzIxMjEwMzIyMTA0NDM3WjAzMTEwLwYDVQQDEyg0N0IzNzg2NzU2OUQ2NTBERkRCNkRDQzNBNjM5RkUyRjc1QTFGOENEMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlak6G+3yuf8zkX9vAua+qRNYHHVjA7BaTh+nrurCznq3ogwg/Y/5RC6/19BAz0uiK5CaWUiFSi8qC2tul168yQD15l1jzix7A6n224HmgJaYtInVZ4mohQtUaUD8INvQj81t3uaD1xYOEbBqKwdwYl7JPoMCLtzta7yKOxzCTmpuVjUy0nw7vydY4WTCixmO3n/bEOIBn63WcPAkxwPrCklgwcmYHqwnJ1au3aE6OUCElasIsL/TLS/r3mRlVup8NW3CM+lkP2BVBbJWSmm6n4WJXjFSMf4FuR82n1yfmNea4Dk2R68APNviqbNv1FQEo0grrcTc3DcTHTuoWArmdwIDAQABo1kwVzAPBgNVHRMBAf8EBTADAQH/MCAGA1UdDgEBAAQWBBRHs3hnVp1lDf223MOmOf4vdaH4zTAiBgNVHSMBAQAEGDAWgBRHs3hnVp1lDf223MOmOf4vdaH4zTANBgkqhkiG9w0BAQsFAAOCAQEATT2pJ8ssOAlNFpvkxYQ867ocvpC1/e61e4e1qkesTuGSp7QpEXL3cJP5DIprdqdKhrBH9PjGcGH2OoNlSX6K7zEGy9mxnuAIqtnnf+fJCyDfk1kH9Ru8rcVyVjg//tkV5hoxYeTJSEMROMw630JK/1KWiRi3VOZ/aLHBxO/bk8OulX2X3L810JZbx5wpuO7VfTglRO2LA8FtCf12zp98qcSa6RVbDUCAnY4E/aj9ZV1aMthzkwD6BWhy5yXdwIrjDeY4oy53FHXeaF35d/mL+lpYJ1XmKM0Z3cJ52L2fyW2l/vZZYBFYFqzzYqapWjbZGpWMSNt55Lk+oMfTA39DaQ==" - } - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_6_0/cas/ta/delta-1.json b/test-resources/migrations/v0_6_0/cas/ta/delta-1.json deleted file mode 100644 index 14a648fe..00000000 --- a/test-resources/migrations/v0_6_0/cas/ta/delta-1.json +++ /dev/null @@ -1,12 +0,0 @@ -{ - "id": "ta", - "version": 1, - "details": { - "repo_updated": { - "embedded": { - "base_uri": "rsync://localhost/repo/ta/", - "rpki_notify": "https://localhost:3000/rrdp/notification.xml" - } - } - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_6_0/cas/ta/delta-10.json b/test-resources/migrations/v0_6_0/cas/ta/delta-10.json deleted file mode 100644 index a18eafdf..00000000 --- a/test-resources/migrations/v0_6_0/cas/ta/delta-10.json +++ /dev/null @@ -1,76 +0,0 @@ -{ - "id": "ta", - "version": 10, - "details": { - "object_set_updated": [ - "0", - { - "C4893EC25530F2EADFC96E89F476DA1300801AA7": { - "number": 3, - "revocations_delta": { - "added": [ - { - "serial": "650748792341242696138123586874381430911663227913", - "expires": "2021-03-23T10:58:58.687824581Z" - } - ], - "dropped": [] - }, - "manifest_info": { - "name": "C4893EC25530F2EADFC96E89F476DA1300801AA7.mft", - "current": { - "content": "MIILvQYJKoZIhvcNAQcCoIILrjCCC6oCAQMxDzANBglghkgBZQMEAgEFADCCAUUGCyqGSIb3DQEJEAEaoIIBNASCATAwggEsAgEDGA8yMDIxMDMyMjEwNTYwNFoYDzIwMjEwMzIzMTEwMTA0WgYJYIZIAWUDBAIBMIH5MFEWLEI0OTdBNUYxRTg0RjkwODlGNUY1MUE4OTk3MjVBN0M1QjA3NkUwM0YuY2VyAyEA/KwLh2STwh7ULlTQytALJBH0+asPU6AGcd024zu3YA8wURYsOUY1MENFOTdBNjJENzQyMEVDQjBFNzY0MDBCNEQwMEE5RkY4MDgzNy5jZXIDIQDuE+o5+KS8SZyHLMsS316ecsy4x8NLD9At1+PN94pJPjBRFixDNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybAMhAJ+kJjmEoMd/eccfTBRE+yWHRntWs+Vv1Ed84xw9PpakoIIImTCCCJUwggd9oAMCAQICFEboVEprFEo3FpMdjXV7STXBBFZQMA0GCSqGSIb3DQEBCwUAMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQkFBRTdCRTkyQkZGNjU2MEUyMjAxOUFEMTY1M0RFMjQ2RjI5Q0FFNDVCMURGNzMwNDU1MjY5NzhGNUUzODhFMTM0OTJGQ0VCOTg4NUI0MDBGOEY1MTE1MEE0QjlGRjkwMzdBQTU3NjkyM0FCQTA4OTA3Mzc4RTQ5QUU2NkJBMjEzRTZFNzEzMjVCMjlEMzg4OEMxOUZGNEFCRERDQkI1RUJBQ0U2NDQwRkRFOTYyOUNCODlEOTkyRjlCRDkwN0VGNEZFNkVFNjM4NzA2NTNBNEQ5NjU4NUNFNTczMzlDNzIzQkY0ODJERDZBQzIzQjhEQUM2N0M5RTBDRjlCMDUyRjlEM0RDNjc0M0YzNTk0NzU0QTA1OUQwNDc2MzM1NDM2MkIyMjU2NzYyNzMxOUIwRUYyOEQ2MEExQjA3OTM4NkI4QkMwRTcyQjhGM0U1NDU4MkMxQzhGMzNFMEU4MzM1OEE2RDAwQUQ5MTAxRDY5QTBBNDVBQjg4RjEwNEY3OTUyRUEzRkRFQTJCM0ZCMUQzNkJBMUM2NjJGMDQ0RjFEODc3NzA0ODBEMzc4M0RBMDcyOUUzQzUxNTdGMDk5RjVFQzBDRkUwMkRFODQ5NDI3RkEyMDRBRjJBMzgxMUVBMTMzNUZFQUMxM0RBRUU0M0U3Q0UzQkQzQjE0Q0RGNTdDRTMwMjAzMDEwMDAxMB4XDTIxMDMyMjEwNTYwNFoXDTIxMDMyOTExMDEwNFowggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBBREExQTVGOThERDA4MUIxQjZDRjE2RTc4NjhCNThCRUEzOTNENzY2NUJDMzJDQjU1OEU3M0UzRTAyQzUzMzQ3NTNEMzAyNzM4RjQ1RjYyQUMzNTkwNThCNDVGRkE4Njc2MUU1QUQ3MjFDODEyRDkyMEE0NTY4NEY4Mjg0MjkwNTU5Qjk1OUVCMUI1MUUwNDNBQjdGQzA1ODk2ODNCQ0VBQ0YxRTEwMDBENTY2NDg2NUY3NDNFRDY4QjJFNTZDMUVFNjhENUVCNTQwMkNEODhERUIwRTVBODlEMjFGMzYwRDg4QjA3MjJCOEJDNTRDQzIwOTExOERDNjI5OUY3NEY1OURBQjhBMUIzMkFEQUUxNTc5OEEyNUU1QTlBOTgyQzgxMTMyRjczMkQ3QTQxQkFFMEJDRTc2NzkxNzYzNjZFMThBRDMzQjU5NzY0REYzOEZGMkIzRTZCMThEN0U0NDU5RkE2RTc3RkI2N0IzOEU1NkFEQjA4RERDMDRGRjBFM0VGMzQzQUVFRkM4MTA4QTk3NzkyOENGRkU0MkQ1QzE1OEUxOEEyRkZEODY4M0YzNURBOUY3QUIzMUIyNzkyMEY5MDQ4RTExMDg2QkM3OERGNzlFRjdFMTA2RDY3N0JDNUM2NDQ2ODM3MDVBNUM4MzhCNzVGRkY0NTAyQjY4RTY5QjAyMDMwMTAwMDEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCtoaX5jdCBsbbPFueGi1i+o5PXZlvDLLVY5z4+AsUzR1PTAnOPRfYqw1kFi0X/qGdh5a1yHIEtkgpFaE+ChCkFWblZ6xtR4EOrf8BYloO86s8eEADVZkhl90PtaLLlbB7mjV61QCzYjesOWonSHzYNiLByK4vFTMIJEY3GKZ909Z2rihsyra4VeYol5ampgsgRMvcy16QbrgvOdnkXY2bhitM7WXZN84/ys+axjX5EWfpud/tns45WrbCN3AT/Dj7zQ67vyBCKl3koz/5C1cFY4Yov/YaD812p96sxsnkg+QSOEQhrx433nvfhBtZ3vFxkRoNwWlyDi3X/9FAraOabAgMBAAGjggGnMIIBozAdBgNVHQ4EFgQUdDlnon3qbCwJZxbiRwvbSWwxLZYwHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgeAMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvMC9DNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybDA8BggrBgEFBQcBAQQwMC4wLAYIKwYBBQUHMAKGIHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvdGEuY2VyMGQGCCsGAQUFBwELBFgwVjBUBggrBgEFBQcwC4ZIcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby90YS8wL0M0ODkzRUMyNTUzMEYyRUFERkM5NkU4OUY0NzZEQTEzMDA4MDFBQTcubWZ0MBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwIQYIKwYBBQUHAQcBAf8EEjAQMAYEAgABBQAwBgQCAAIFADAVBggrBgEFBQcBCAEB/wQGMASgAgUAMA0GCSqGSIb3DQEBCwUAA4IBAQAgUixAEeQXqALJSFKa7jAv6c9eIuQzDdNhebaFzWO/2cnVaxEmzn/EpnRsTabEInZAx0ZGspRepI3aK4Ep0Vo727vihPfKiQri9DyC2xRNAvox6zwtuO71q4NPJcgdlCvjOd4kdT/ZwM/rnuVXgY7BwMLGC6Hnuagrv6LIMpwFXKkctcakS0mYfxm4FyvLNB3a7Ju2foZ4YyrzY4prrUiSDwyaPJnrKwTDTROAvAZ1sbIoOuGp0W8gT1uzminc2r6XrqF8jV8J/5KMm2RaxaIEoJdMiXTXNoV+nLKZFHX+BxCLS/Hq6hw74+OIIibtYX572fSEaKXxjiX2R9k4CmQDMYIBrDCCAagCAQOAFHQ5Z6J96mwsCWcW4kcL20lsMS2WMA0GCWCGSAFlAwQCAQUAoGswGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEaMBwGCSqGSIb3DQEJBTEPFw0yMTAzMjIxMTAxMDRaMC8GCSqGSIb3DQEJBDEiBCDEEBgzS5y6sSFLuZNAkiNicoTA/wvzqUDDFT9IOCU51DANBgkqhkiG9w0BAQEFAASCAQCJNOz8cq7l1tx+mckCMOAmduwKuDWs3TVRLfLvTJlCvNkYVUdZFtYmgmJFmj00SvL08iPbcVcMGqtR8qJ5Vtx5vmtjdQMQ+Jj6U2d3cSikmdG7WXH1fg6Gi+AqXbksFg0aAg4TgcQfcxK35sE8IyMs0HS7H4SOxOskiirngrkPhf8QY5mk132Xl+YMLPGMsDsgxGVKMt1/qfxCYvtqQskRo21sHBPCJtW8eWnpaDAkD93cM2zIYNS6Cq4ijF2IsNb2+pxb94vSnz8pXt8eR59ezjVQ2Xc2atI7Coqjy1cj0jYQXl4XU0P5ngEQvq/mYhjiygq0hpUPuzHL5wJ7W/uM", - "serial": "404810469598974038024323796113457425902295340624", - "expires": "2021-03-23T11:01:04.907150446Z" - }, - "next_update": "2021-03-23T11:01:04.907150446Z", - "old": "63b69931826fc885a00c30a653a0530b3e85e8cd051b4d56891360aa9ba04a72" - }, - "crl_info": { - "name": "C4893EC25530F2EADFC96E89F476DA1300801AA7.crl", - "current": { - "content": "MIID+jCCAuICAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEXDTIxMDMyMjEwNTYwNFoXDTIxMDMyMzExMDEwNFowTjAlAhQ3wc5Hxl4b0trHFnEsFr0nPCVXQhcNMjEwMzIzMTA0NDM3WjAlAhRx/JXHAP8LOQo9uL05Yg1RLLJECRcNMjEwMzIzMTA1ODU4WqAvMC0wHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwCgYDVR0UBAMCAQMwDQYJKoZIhvcNAQELBQADggEBAHjpd5YJjNYJ/EuWwrmtltaI0U4ySKEJsf07cKCqICjiqnN2Sxvos2cTFxsDw8EdvAfqVyzpU68Zym4EjQxoUxTdsKQkuughKbaZEZi8C8E7sUmS6IoZH/KtYtxGl+dV3SCHf4gORS5ZFEtk84QVKy70MGy5WBjkZCNTWvZ2ZQ6HR8EoBKuqRH8SVXRbXWFWlPYF+X6ZewaMBMSG8XjIeUDYRXG0tJ4h8xnXemR3JGP4WX+wXCQ6Q6aJMOo2TCIU9Jo+rv47BsqSghcgVheFHrewEpeM/ecvuIp7RnJ5ILguBX7K6CD8ngtFZ/U0055qi+R51kRI2HivBAE+Rryouoc=", - "serial": "3", - "expires": "2021-03-23T11:01:04.903319261Z" - }, - "old": "f1ea1b60f804869e58c24bfd5c9aa0e147f67e0cff59ff386158e3eec07b33eb" - }, - "objects_delta": { - "ca_repo": "rsync://localhost/repo/ta/0", - "added": [ - { - "name": "9F50CE97A62D7420ECB0E76400B4D00A9FF80837.cer", - "object": { - "content": "MIIG9zCCBd+gAwIBAgIUbxupwYqnAX4cy0ub1ggDn4onxlgwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEwHhcNMjEwMzIyMTA1NjA0WhcNMjIwMzIyMTEwMTA0WjAzMTEwLwYDVQQDEyg5RjUwQ0U5N0E2MkQ3NDIwRUNCMEU3NjQwMEI0RDAwQTlGRjgwODM3MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr+c5o3kod88LphtXU6UAzmAnrCunhrJvEh2ojXC3bWCska09Nq90ntSQNTWHJZmrzAYMKHHGX4L+0VLoyKB/cFMH5uFNWPFn2gcg/a9Gp9SLCrr2BLF8cCziobX70kZAYsVc9yF+uElE6drCQrmTuXiiQiPFjG+zClC68EuomQW6NPyX6IzLnlM+X3wHKQpmUyFuJNBDonUZfjRDtv1SiHVaAg45Gx2Fent1C+/pveBnv1HiZLolpykwglw9xytCniW/h7j6HPDatn645szN4OVpYd2b4SGrOr8qEEQXo0i6HW2MtO/4C3aR3jwut/LsTTHOVaXdTiqSC+96zXggFQIDAQABo4ICBTCCAgEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUn1DOl6YtdCDssOdkALTQCp/4CDcwHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgEGMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvMC9DNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybDA8BggrBgEFBQcBAQQwMC4wLAYIKwYBBQUHMAKGIHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvdGEuY2VyMIHKBggrBgEFBQcBCwSBvTCBujAoBggrBgEFBQcwBYYccnN5bmM6Ly9sb2NhbGhvc3QvcmVwby9jYS8wLzBUBggrBgEFBQcwCoZIcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby9jYS8wLzlGNTBDRTk3QTYyRDc0MjBFQ0IwRTc2NDAwQjREMDBBOUZGODA4MzcubWZ0MDgGCCsGAQUFBzANhixodHRwczovL2xvY2FsaG9zdDozMDAwL3JyZHAvbm90aWZpY2F0aW9uLnhtbDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMB4GCCsGAQUFBwEHAQH/BA8wDTALBAIAATAFAwMAwKgwDQYJKoZIhvcNAQELBQADggEBAIlVqENjjP6omOtNzq1l2ctP1zcREBQpHgZwDOB9eZ407Re4iY4DcDwLKCFWvI7W0oqGJcIWB5r/Yqevhi4rGinwRewmggfYQYkeXg++27PYbPBN/m5GmKewCIMFnityDDVUj7t+728LUR3q177LP7jZttwHAWI09IKOT8IsP5Zi7NwIPBLK/RlS9RpX2ASkBZk9LAECljBGaYrD/PZZJ84b5nufOY5DJ/5lhJWG0E9Hm19uwS7wTnT4R4CL0hgghYUzaxtMhHW84Zmxa/N5sjY9Del7cOfnl4+/6GQ04jauo77Jr55n+AoRLh5mYUdt7VratdCsJwJjMm5hMj74xeM=", - "serial": "634314883516926404505270299091452995808036111960", - "expires": "2022-03-22T11:01:04Z" - } - } - ], - "updated": [ - { - "name": "C4893EC25530F2EADFC96E89F476DA1300801AA7.crl", - "object": { - "content": "MIID+jCCAuICAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEXDTIxMDMyMjEwNTYwNFoXDTIxMDMyMzExMDEwNFowTjAlAhQ3wc5Hxl4b0trHFnEsFr0nPCVXQhcNMjEwMzIzMTA0NDM3WjAlAhRx/JXHAP8LOQo9uL05Yg1RLLJECRcNMjEwMzIzMTA1ODU4WqAvMC0wHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwCgYDVR0UBAMCAQMwDQYJKoZIhvcNAQELBQADggEBAHjpd5YJjNYJ/EuWwrmtltaI0U4ySKEJsf07cKCqICjiqnN2Sxvos2cTFxsDw8EdvAfqVyzpU68Zym4EjQxoUxTdsKQkuughKbaZEZi8C8E7sUmS6IoZH/KtYtxGl+dV3SCHf4gORS5ZFEtk84QVKy70MGy5WBjkZCNTWvZ2ZQ6HR8EoBKuqRH8SVXRbXWFWlPYF+X6ZewaMBMSG8XjIeUDYRXG0tJ4h8xnXemR3JGP4WX+wXCQ6Q6aJMOo2TCIU9Jo+rv47BsqSghcgVheFHrewEpeM/ecvuIp7RnJ5ILguBX7K6CD8ngtFZ/U0055qi+R51kRI2HivBAE+Rryouoc=", - "serial": "3", - "expires": "2021-03-23T11:01:04.903319261Z" - }, - "old": "f1ea1b60f804869e58c24bfd5c9aa0e147f67e0cff59ff386158e3eec07b33eb" - }, - { - "name": "C4893EC25530F2EADFC96E89F476DA1300801AA7.mft", - "object": { - "content": "MIILvQYJKoZIhvcNAQcCoIILrjCCC6oCAQMxDzANBglghkgBZQMEAgEFADCCAUUGCyqGSIb3DQEJEAEaoIIBNASCATAwggEsAgEDGA8yMDIxMDMyMjEwNTYwNFoYDzIwMjEwMzIzMTEwMTA0WgYJYIZIAWUDBAIBMIH5MFEWLEI0OTdBNUYxRTg0RjkwODlGNUY1MUE4OTk3MjVBN0M1QjA3NkUwM0YuY2VyAyEA/KwLh2STwh7ULlTQytALJBH0+asPU6AGcd024zu3YA8wURYsOUY1MENFOTdBNjJENzQyMEVDQjBFNzY0MDBCNEQwMEE5RkY4MDgzNy5jZXIDIQDuE+o5+KS8SZyHLMsS316ecsy4x8NLD9At1+PN94pJPjBRFixDNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybAMhAJ+kJjmEoMd/eccfTBRE+yWHRntWs+Vv1Ed84xw9PpakoIIImTCCCJUwggd9oAMCAQICFEboVEprFEo3FpMdjXV7STXBBFZQMA0GCSqGSIb3DQEBCwUAMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQkFBRTdCRTkyQkZGNjU2MEUyMjAxOUFEMTY1M0RFMjQ2RjI5Q0FFNDVCMURGNzMwNDU1MjY5NzhGNUUzODhFMTM0OTJGQ0VCOTg4NUI0MDBGOEY1MTE1MEE0QjlGRjkwMzdBQTU3NjkyM0FCQTA4OTA3Mzc4RTQ5QUU2NkJBMjEzRTZFNzEzMjVCMjlEMzg4OEMxOUZGNEFCRERDQkI1RUJBQ0U2NDQwRkRFOTYyOUNCODlEOTkyRjlCRDkwN0VGNEZFNkVFNjM4NzA2NTNBNEQ5NjU4NUNFNTczMzlDNzIzQkY0ODJERDZBQzIzQjhEQUM2N0M5RTBDRjlCMDUyRjlEM0RDNjc0M0YzNTk0NzU0QTA1OUQwNDc2MzM1NDM2MkIyMjU2NzYyNzMxOUIwRUYyOEQ2MEExQjA3OTM4NkI4QkMwRTcyQjhGM0U1NDU4MkMxQzhGMzNFMEU4MzM1OEE2RDAwQUQ5MTAxRDY5QTBBNDVBQjg4RjEwNEY3OTUyRUEzRkRFQTJCM0ZCMUQzNkJBMUM2NjJGMDQ0RjFEODc3NzA0ODBEMzc4M0RBMDcyOUUzQzUxNTdGMDk5RjVFQzBDRkUwMkRFODQ5NDI3RkEyMDRBRjJBMzgxMUVBMTMzNUZFQUMxM0RBRUU0M0U3Q0UzQkQzQjE0Q0RGNTdDRTMwMjAzMDEwMDAxMB4XDTIxMDMyMjEwNTYwNFoXDTIxMDMyOTExMDEwNFowggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBBREExQTVGOThERDA4MUIxQjZDRjE2RTc4NjhCNThCRUEzOTNENzY2NUJDMzJDQjU1OEU3M0UzRTAyQzUzMzQ3NTNEMzAyNzM4RjQ1RjYyQUMzNTkwNThCNDVGRkE4Njc2MUU1QUQ3MjFDODEyRDkyMEE0NTY4NEY4Mjg0MjkwNTU5Qjk1OUVCMUI1MUUwNDNBQjdGQzA1ODk2ODNCQ0VBQ0YxRTEwMDBENTY2NDg2NUY3NDNFRDY4QjJFNTZDMUVFNjhENUVCNTQwMkNEODhERUIwRTVBODlEMjFGMzYwRDg4QjA3MjJCOEJDNTRDQzIwOTExOERDNjI5OUY3NEY1OURBQjhBMUIzMkFEQUUxNTc5OEEyNUU1QTlBOTgyQzgxMTMyRjczMkQ3QTQxQkFFMEJDRTc2NzkxNzYzNjZFMThBRDMzQjU5NzY0REYzOEZGMkIzRTZCMThEN0U0NDU5RkE2RTc3RkI2N0IzOEU1NkFEQjA4RERDMDRGRjBFM0VGMzQzQUVFRkM4MTA4QTk3NzkyOENGRkU0MkQ1QzE1OEUxOEEyRkZEODY4M0YzNURBOUY3QUIzMUIyNzkyMEY5MDQ4RTExMDg2QkM3OERGNzlFRjdFMTA2RDY3N0JDNUM2NDQ2ODM3MDVBNUM4MzhCNzVGRkY0NTAyQjY4RTY5QjAyMDMwMTAwMDEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCtoaX5jdCBsbbPFueGi1i+o5PXZlvDLLVY5z4+AsUzR1PTAnOPRfYqw1kFi0X/qGdh5a1yHIEtkgpFaE+ChCkFWblZ6xtR4EOrf8BYloO86s8eEADVZkhl90PtaLLlbB7mjV61QCzYjesOWonSHzYNiLByK4vFTMIJEY3GKZ909Z2rihsyra4VeYol5ampgsgRMvcy16QbrgvOdnkXY2bhitM7WXZN84/ys+axjX5EWfpud/tns45WrbCN3AT/Dj7zQ67vyBCKl3koz/5C1cFY4Yov/YaD812p96sxsnkg+QSOEQhrx433nvfhBtZ3vFxkRoNwWlyDi3X/9FAraOabAgMBAAGjggGnMIIBozAdBgNVHQ4EFgQUdDlnon3qbCwJZxbiRwvbSWwxLZYwHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgeAMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvMC9DNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybDA8BggrBgEFBQcBAQQwMC4wLAYIKwYBBQUHMAKGIHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvdGEuY2VyMGQGCCsGAQUFBwELBFgwVjBUBggrBgEFBQcwC4ZIcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby90YS8wL0M0ODkzRUMyNTUzMEYyRUFERkM5NkU4OUY0NzZEQTEzMDA4MDFBQTcubWZ0MBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwIQYIKwYBBQUHAQcBAf8EEjAQMAYEAgABBQAwBgQCAAIFADAVBggrBgEFBQcBCAEB/wQGMASgAgUAMA0GCSqGSIb3DQEBCwUAA4IBAQAgUixAEeQXqALJSFKa7jAv6c9eIuQzDdNhebaFzWO/2cnVaxEmzn/EpnRsTabEInZAx0ZGspRepI3aK4Ep0Vo727vihPfKiQri9DyC2xRNAvox6zwtuO71q4NPJcgdlCvjOd4kdT/ZwM/rnuVXgY7BwMLGC6Hnuagrv6LIMpwFXKkctcakS0mYfxm4FyvLNB3a7Ju2foZ4YyrzY4prrUiSDwyaPJnrKwTDTROAvAZ1sbIoOuGp0W8gT1uzminc2r6XrqF8jV8J/5KMm2RaxaIEoJdMiXTXNoV+nLKZFHX+BxCLS/Hq6hw74+OIIibtYX572fSEaKXxjiX2R9k4CmQDMYIBrDCCAagCAQOAFHQ5Z6J96mwsCWcW4kcL20lsMS2WMA0GCWCGSAFlAwQCAQUAoGswGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEaMBwGCSqGSIb3DQEJBTEPFw0yMTAzMjIxMTAxMDRaMC8GCSqGSIb3DQEJBDEiBCDEEBgzS5y6sSFLuZNAkiNicoTA/wvzqUDDFT9IOCU51DANBgkqhkiG9w0BAQEFAASCAQCJNOz8cq7l1tx+mckCMOAmduwKuDWs3TVRLfLvTJlCvNkYVUdZFtYmgmJFmj00SvL08iPbcVcMGqtR8qJ5Vtx5vmtjdQMQ+Jj6U2d3cSikmdG7WXH1fg6Gi+AqXbksFg0aAg4TgcQfcxK35sE8IyMs0HS7H4SOxOskiirngrkPhf8QY5mk132Xl+YMLPGMsDsgxGVKMt1/qfxCYvtqQskRo21sHBPCJtW8eWnpaDAkD93cM2zIYNS6Cq4ijF2IsNb2+pxb94vSnz8pXt8eR59ezjVQ2Xc2atI7Coqjy1cj0jYQXl4XU0P5ngEQvq/mYhjiygq0hpUPuzHL5wJ7W/uM", - "serial": "404810469598974038024323796113457425902295340624", - "expires": "2021-03-23T11:01:04.907150446Z" - }, - "old": "63b69931826fc885a00c30a653a0530b3e85e8cd051b4d56891360aa9ba04a72" - } - ], - "withdrawn": [] - } - } - } - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_6_0/cas/ta/delta-2.json b/test-resources/migrations/v0_6_0/cas/ta/delta-2.json deleted file mode 100644 index 4b3f346c..00000000 --- a/test-resources/migrations/v0_6_0/cas/ta/delta-2.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "id": "ta", - "version": 2, - "details": { - "trust_anchor_made": { - "cert": "MIIIZjCCB06gAwIBAgIUSoqhtx5bgtaf8sRtp/ZeXbmH8SwwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEwIBcNMjEwMzIyMTAzOTM3WhgPMjEyMTAzMjIxMDQ0MzdaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQkFBRTdCRTkyQkZGNjU2MEUyMjAxOUFEMTY1M0RFMjQ2RjI5Q0FFNDVCMURGNzMwNDU1MjY5NzhGNUUzODhFMTM0OTJGQ0VCOTg4NUI0MDBGOEY1MTE1MEE0QjlGRjkwMzdBQTU3NjkyM0FCQTA4OTA3Mzc4RTQ5QUU2NkJBMjEzRTZFNzEzMjVCMjlEMzg4OEMxOUZGNEFCRERDQkI1RUJBQ0U2NDQwRkRFOTYyOUNCODlEOTkyRjlCRDkwN0VGNEZFNkVFNjM4NzA2NTNBNEQ5NjU4NUNFNTczMzlDNzIzQkY0ODJERDZBQzIzQjhEQUM2N0M5RTBDRjlCMDUyRjlEM0RDNjc0M0YzNTk0NzU0QTA1OUQwNDc2MzM1NDM2MkIyMjU2NzYyNzMxOUIwRUYyOEQ2MEExQjA3OTM4NkI4QkMwRTcyQjhGM0U1NDU4MkMxQzhGMzNFMEU4MzM1OEE2RDAwQUQ5MTAxRDY5QTBBNDVBQjg4RjEwNEY3OTUyRUEzRkRFQTJCM0ZCMUQzNkJBMUM2NjJGMDQ0RjFEODc3NzA0ODBEMzc4M0RBMDcyOUUzQzUxNTdGMDk5RjVFQzBDRkUwMkRFODQ5NDI3RkEyMDRBRjJBMzgxMUVBMTMzNUZFQUMxM0RBRUU0M0U3Q0UzQkQzQjE0Q0RGNTdDRTMwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuq576Sv/ZWDiIBmtFlPeJG8pyuRbHfcwRVJpePXjiOE0kvzrmIW0APj1EVCkuf+QN6pXaSOroIkHN45Jrma6IT5ucTJbKdOIjBn/Sr3cu166zmRA/elinLidmS+b2QfvT+buY4cGU6TZZYXOVzOccjv0gt1qwjuNrGfJ4M+bBS+dPcZ0PzWUdUoFnQR2M1Q2KyJWdicxmw7yjWChsHk4a4vA5yuPPlRYLByPM+DoM1im0ArZEB1poKRauI8QT3lS6j/eorP7HTa6HGYvBE8dh3cEgNN4PaBynjxRV/CZ9ewM/gLehJQn+iBK8qOBHqEzX+rBPa7kPnzjvTsUzfV84wIDAQABo4IBdjCCAXIwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgEGMIHJBggrBgEFBQcBCwSBvDCBuTAnBggrBgEFBQcwBYYbcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby90YS8wMFQGCCsGAQUFBzAKhkhyc3luYzovL2xvY2FsaG9zdC9yZXBvL3RhLzAvQzQ4OTNFQzI1NTMwRjJFQURGQzk2RTg5RjQ3NkRBMTMwMDgwMUFBNy5tZnQwOAYIKwYBBQUHMA2GLGh0dHBzOi8vbG9jYWxob3N0OjMwMDAvcnJkcC9ub3RpZmljYXRpb24ueG1sMBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwJwYIKwYBBQUHAQcBAf8EGDAWMAkEAgABMAMDAQAwCQQCAAIwAwMBADAhBggrBgEFBQcBCAEB/wQSMBCgDjAMMAoCAQACBQD/////MA0GCSqGSIb3DQEBCwUAA4IBAQB+onQ8rAvdp73fjkOGCOP8/wvOAoFtUg1rrsc5EhgU1qh3CjjCE+ILlIv6wHLjBeBUP4UamgbafH/DXiaIqY+sID+HLQBrOZfKMQwEZxXNWXmEgqK+4e52Y+wWEEbnxg+0QfiYTrtz06apG4/BLUThshX6nIv5lnIaR3daelGunx89KlNWOOl+5tZOnkim0g4OgBv914Hg/SumT7t4Z9l2+UyMpnM9C5gmroCUMxT121YRucVqmRD4/aWqNu2ihZInKVNuXsxzWtSn33etYIjJD4KrsqEJQLydBWraxDQwo63a/b4lRaIgjIz64ihREfc5xd+av3+hfMT/u9dMrB88", - "resources": { - "asn": "AS0-AS4294967295", - "v4": "0.0.0.0/0", - "v6": "::/0" - }, - "tal": { - "uris": [ - "https://localhost:3000/ta/ta.cer" - ], - "encoded_ski": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuq576Sv/ZWDiIBmtFlPeJG8pyuRbHfcwRVJpePXjiOE0kvzrmIW0APj1EVCkuf+QN6pXaSOroIkHN45Jrma6IT5ucTJbKdOIjBn/Sr3cu166zmRA/elinLidmS+b2QfvT+buY4cGU6TZZYXOVzOccjv0gt1qwjuNrGfJ4M+bBS+dPcZ0PzWUdUoFnQR2M1Q2KyJWdicxmw7yjWChsHk4a4vA5yuPPlRYLByPM+DoM1im0ArZEB1poKRauI8QT3lS6j/eorP7HTa6HGYvBE8dh3cEgNN4PaBynjxRV/CZ9ewM/gLehJQn+iBK8qOBHqEzX+rBPa7kPnzjvTsUzfV84wIDAQAB" - } - } - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_6_0/cas/ta/delta-3.json b/test-resources/migrations/v0_6_0/cas/ta/delta-3.json deleted file mode 100644 index 43f331eb..00000000 --- a/test-resources/migrations/v0_6_0/cas/ta/delta-3.json +++ /dev/null @@ -1,68 +0,0 @@ -{ - "id": "ta", - "version": 3, - "details": { - "key_pending_to_active": [ - "0", - { - "key_id": "C4893EC25530F2EADFC96E89F476DA1300801AA7", - "incoming_cert": { - "cert": "MIIIZjCCB06gAwIBAgIUSoqhtx5bgtaf8sRtp/ZeXbmH8SwwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEwIBcNMjEwMzIyMTAzOTM3WhgPMjEyMTAzMjIxMDQ0MzdaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQkFBRTdCRTkyQkZGNjU2MEUyMjAxOUFEMTY1M0RFMjQ2RjI5Q0FFNDVCMURGNzMwNDU1MjY5NzhGNUUzODhFMTM0OTJGQ0VCOTg4NUI0MDBGOEY1MTE1MEE0QjlGRjkwMzdBQTU3NjkyM0FCQTA4OTA3Mzc4RTQ5QUU2NkJBMjEzRTZFNzEzMjVCMjlEMzg4OEMxOUZGNEFCRERDQkI1RUJBQ0U2NDQwRkRFOTYyOUNCODlEOTkyRjlCRDkwN0VGNEZFNkVFNjM4NzA2NTNBNEQ5NjU4NUNFNTczMzlDNzIzQkY0ODJERDZBQzIzQjhEQUM2N0M5RTBDRjlCMDUyRjlEM0RDNjc0M0YzNTk0NzU0QTA1OUQwNDc2MzM1NDM2MkIyMjU2NzYyNzMxOUIwRUYyOEQ2MEExQjA3OTM4NkI4QkMwRTcyQjhGM0U1NDU4MkMxQzhGMzNFMEU4MzM1OEE2RDAwQUQ5MTAxRDY5QTBBNDVBQjg4RjEwNEY3OTUyRUEzRkRFQTJCM0ZCMUQzNkJBMUM2NjJGMDQ0RjFEODc3NzA0ODBEMzc4M0RBMDcyOUUzQzUxNTdGMDk5RjVFQzBDRkUwMkRFODQ5NDI3RkEyMDRBRjJBMzgxMUVBMTMzNUZFQUMxM0RBRUU0M0U3Q0UzQkQzQjE0Q0RGNTdDRTMwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuq576Sv/ZWDiIBmtFlPeJG8pyuRbHfcwRVJpePXjiOE0kvzrmIW0APj1EVCkuf+QN6pXaSOroIkHN45Jrma6IT5ucTJbKdOIjBn/Sr3cu166zmRA/elinLidmS+b2QfvT+buY4cGU6TZZYXOVzOccjv0gt1qwjuNrGfJ4M+bBS+dPcZ0PzWUdUoFnQR2M1Q2KyJWdicxmw7yjWChsHk4a4vA5yuPPlRYLByPM+DoM1im0ArZEB1poKRauI8QT3lS6j/eorP7HTa6HGYvBE8dh3cEgNN4PaBynjxRV/CZ9ewM/gLehJQn+iBK8qOBHqEzX+rBPa7kPnzjvTsUzfV84wIDAQABo4IBdjCCAXIwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgEGMIHJBggrBgEFBQcBCwSBvDCBuTAnBggrBgEFBQcwBYYbcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby90YS8wMFQGCCsGAQUFBzAKhkhyc3luYzovL2xvY2FsaG9zdC9yZXBvL3RhLzAvQzQ4OTNFQzI1NTMwRjJFQURGQzk2RTg5RjQ3NkRBMTMwMDgwMUFBNy5tZnQwOAYIKwYBBQUHMA2GLGh0dHBzOi8vbG9jYWxob3N0OjMwMDAvcnJkcC9ub3RpZmljYXRpb24ueG1sMBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwJwYIKwYBBQUHAQcBAf8EGDAWMAkEAgABMAMDAQAwCQQCAAIwAwMBADAhBggrBgEFBQcBCAEB/wQSMBCgDjAMMAoCAQACBQD/////MA0GCSqGSIb3DQEBCwUAA4IBAQB+onQ8rAvdp73fjkOGCOP8/wvOAoFtUg1rrsc5EhgU1qh3CjjCE+ILlIv6wHLjBeBUP4UamgbafH/DXiaIqY+sID+HLQBrOZfKMQwEZxXNWXmEgqK+4e52Y+wWEEbnxg+0QfiYTrtz06apG4/BLUThshX6nIv5lnIaR3daelGunx89KlNWOOl+5tZOnkim0g4OgBv914Hg/SumT7t4Z9l2+UyMpnM9C5gmroCUMxT121YRucVqmRD4/aWqNu2ihZInKVNuXsxzWtSn33etYIjJD4KrsqEJQLydBWraxDQwo63a/b4lRaIgjIz64ihREfc5xd+av3+hfMT/u9dMrB88", - "uri": "rsync://localhost/repo/ta/ta.cer", - "resources": { - "asn": "AS0-AS4294967295", - "v4": "0.0.0.0/0", - "v6": "::/0" - } - }, - "current_set": { - "number": 1, - "revocations": [], - "manifest_info": { - "name": "C4893EC25530F2EADFC96E89F476DA1300801AA7.mft", - "current": { - "content": "MIILEgYJKoZIhvcNAQcCoIILAzCCCv8CAQMxDzANBglghkgBZQMEAgEFADCBmwYLKoZIhvcNAQkQARqggYsEgYgwgYUCAQEYDzIwMjEwMzIyMTAzOTM3WhgPMjAyMTAzMjMxMDQ0MzdaBglghkgBZQMEAgEwUzBRFixDNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybAMhAHJnKKbuB0LrBDf1T/n/bAUWodqM5jbVDG/Mx8N7/wMZoIIImTCCCJUwggd9oAMCAQICFDfBzkfGXhvS2scWcSwWvSc8JVdCMA0GCSqGSIb3DQEBCwUAMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQkFBRTdCRTkyQkZGNjU2MEUyMjAxOUFEMTY1M0RFMjQ2RjI5Q0FFNDVCMURGNzMwNDU1MjY5NzhGNUUzODhFMTM0OTJGQ0VCOTg4NUI0MDBGOEY1MTE1MEE0QjlGRjkwMzdBQTU3NjkyM0FCQTA4OTA3Mzc4RTQ5QUU2NkJBMjEzRTZFNzEzMjVCMjlEMzg4OEMxOUZGNEFCRERDQkI1RUJBQ0U2NDQwRkRFOTYyOUNCODlEOTkyRjlCRDkwN0VGNEZFNkVFNjM4NzA2NTNBNEQ5NjU4NUNFNTczMzlDNzIzQkY0ODJERDZBQzIzQjhEQUM2N0M5RTBDRjlCMDUyRjlEM0RDNjc0M0YzNTk0NzU0QTA1OUQwNDc2MzM1NDM2MkIyMjU2NzYyNzMxOUIwRUYyOEQ2MEExQjA3OTM4NkI4QkMwRTcyQjhGM0U1NDU4MkMxQzhGMzNFMEU4MzM1OEE2RDAwQUQ5MTAxRDY5QTBBNDVBQjg4RjEwNEY3OTUyRUEzRkRFQTJCM0ZCMUQzNkJBMUM2NjJGMDQ0RjFEODc3NzA0ODBEMzc4M0RBMDcyOUUzQzUxNTdGMDk5RjVFQzBDRkUwMkRFODQ5NDI3RkEyMDRBRjJBMzgxMUVBMTMzNUZFQUMxM0RBRUU0M0U3Q0UzQkQzQjE0Q0RGNTdDRTMwMjAzMDEwMDAxMB4XDTIxMDMyMjEwMzkzN1oXDTIxMDMyOTEwNDQzN1owggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDA5RTZFNUQ5MzJERTk5MjNENTY5NEVGQjM5Mjg5RTRDMjM5QTk4NkM0RUQwRjBGQ0FBRTgwQkIxODJGRTZBQkFDQTNDNDBDNzQ2NEE1MEY3RjQxQTZDMTM5MTcyMEY5MjVFMjcwNjI1QTI2REMyQjE5NTJCNjdGQUY1RTYyNkI3MENENEE1REQyMTE4MDMxRTJEQjExRjJEOUQ5QkE3NzY2NUM3RUJGNkY2Njc0MzE3RDVGQUMwNUQxNzQxQkRBN0Y3QTMzMEU0NUU2RjU4REFCQTdEMjU2MkI3OUZBNUYwRkJGNTY5OTU3OUNFNUJGNjE1NUNFMzhGRjAwRDhBMjRCRjNGNzdFQjM1NjMzMEUwQjIxNjhBQUYyMTkyQUZEREY4Q0MwQTMzMDAyNTJBMzQxRDBBQ0Y3OUEyNkM1MTk4NzQ1RkM4M0ZBMEJCRkU5NEYxRkJERDhBMzhEQUU0QjI2MDczODkxRjkyMDUxNDExQUZBRjMwREYxOTY0MTJFOEI0RjE1NjBDMjM3MzhBQjc4NDQ1OEREQzExN0I5MzFGMkFFNTQzMzZERjUyNjQ3NzUwRTVFQkE5QkU0MjdEQkI5RkVDQTFFMjAzNkFDM0MwQzkwMzcwQ0I2NTYxMEFGNTRFRDkwRjU2NkE1NTg3OUY4MzJFNTk4MTg2MjcwNEU4NTAyMDMwMTAwMDEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCebl2TLemSPVaU77OSieTCOamGxO0PD8qugLsYL+arrKPEDHRkpQ9/QabBORcg+SXicGJaJtwrGVK2f69eYmtwzUpd0hGAMeLbEfLZ2bp3Zlx+v29mdDF9X6wF0XQb2n96Mw5F5vWNq6fSVit5+l8Pv1aZV5zlv2FVzjj/ANiiS/P3frNWMw4LIWiq8hkq/d+MwKMwAlKjQdCs95omxRmHRfyD+gu/6U8fvdijja5LJgc4kfkgUUEa+vMN8ZZBLotPFWDCNzireERY3cEXuTHyrlQzbfUmR3UOXrqb5Cfbuf7KHiA2rDwMkDcMtlYQr1TtkPVmpVh5+DLlmBhicE6FAgMBAAGjggGnMIIBozAdBgNVHQ4EFgQU2op4jdYM9pDaFxLra/sHryTwgWgwHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgeAMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvMC9DNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybDA8BggrBgEFBQcBAQQwMC4wLAYIKwYBBQUHMAKGIHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvdGEuY2VyMGQGCCsGAQUFBwELBFgwVjBUBggrBgEFBQcwC4ZIcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby90YS8wL0M0ODkzRUMyNTUzMEYyRUFERkM5NkU4OUY0NzZEQTEzMDA4MDFBQTcubWZ0MBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwIQYIKwYBBQUHAQcBAf8EEjAQMAYEAgABBQAwBgQCAAIFADAVBggrBgEFBQcBCAEB/wQGMASgAgUAMA0GCSqGSIb3DQEBCwUAA4IBAQB1tDki+FVdqH93M6O4OC5AA7ZUFDD+nZ9BVTYPbEUMP9Y0mfZk8c8DER6bMNqq3ufTQtDdswfgtnCB6FmVxlmBOmzISfPKSKeBUmLnU0XAKGV7stNgKYkzxaErPnImk87IPuQsSOR4KOpK498ap8AnZWx405UmjeWSPHG9khPu80T+DLvQ9rB39J6LicFx/IqNlAlUNXfWjdzy50yIDB8/UdYVVh3scTNGmgYHbgcM1ySJqvum3ew6Gj4dXCe6OXGdNVVlTLUmJF/VQSCVqz/Z3iXVnjRvi4MgdUD1ceDPMXgGhDUT9PepPBQ9poCs5ghxsTsLoafb8IlEsrQxMYnxMYIBrDCCAagCAQOAFNqKeI3WDPaQ2hcS62v7B68k8IFoMA0GCWCGSAFlAwQCAQUAoGswGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEaMBwGCSqGSIb3DQEJBTEPFw0yMTAzMjIxMDQ0MzdaMC8GCSqGSIb3DQEJBDEiBCCiRUY5oZdYYojj/u15RnxBR9OtuHzOk0JBaF1o1RNf/jANBgkqhkiG9w0BAQEFAASCAQBR5mZ42xRhiHoCbowXfOGDhNlI0yZORoYMflXOPAB2f8o7qTWyELqBkQAHlwMrW/n58E31DDzOqEur//hpHTLnlVEI/zlMTmBFhzAitydkrNfVpBC/YBq1lpsdRVSKJCBNFZqlovJWqga5NEzKBxV8ZpvgWXj5FMSffEm/MGI8cafbUzb/CqVkqbc68pTqaYWeLAsJPkFJ4P12YGJFlOB6XbjsRLXgl96ll6v8cJMqblaovZuMrgYy4TjhLWtd+Sq9JzkokxZtk8egQTrAO6f8DvLOMFc0r5XXIY7HI2xEZaZRiHYGwDr89EYatmVtElRh8qP+s7XohKkmuQ4UmQtM", - "serial": "318316505773253361497376874909930893181779793730", - "expires": "2021-03-23T10:44:37.325554418Z" - }, - "next_update": "2021-03-23T10:44:37.325554418Z", - "old": null - }, - "crl_info": { - "name": "C4893EC25530F2EADFC96E89F476DA1300801AA7.crl", - "current": { - "content": "MIIDrDCCApQCAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEXDTIxMDMyMjEwMzkzN1oXDTIxMDMyMzEwNDQzN1owAKAvMC0wHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwCgYDVR0UBAMCAQEwDQYJKoZIhvcNAQELBQADggEBABgK5J0tzDkE5jEVM1ILweNX4M63xmsrNayCO0EcDFb9YG122JpSIgOAHClP3PBTLvruzmdkqJRDekjlOzmqc2UMLYhbiCHxgM+XkBJWB1hF/2LHNIBACDT3UpRHnXOinCqnuJipHLrhcote9woXIR26rdCdD72oTCGO60VRqtc70k3BSaVs1m+g4P5P652lEfm/QWM1XBlqUS9v9yngDLX6jA6mQbd/a4t2qSmrtK/gURygzW9i3FslFSDOMym+4m4Z0Vlogb9nnx9/cc4WJkHSK9A2Ndjng87+lJCFUfEVXkR16rwfKyE0ZOov9T6FF4M/6MrtQbggSi/oKW77GCU=", - "serial": "1", - "expires": "2021-03-23T10:44:37.323206844Z" - }, - "old": null - } - }, - "request": null - }, - { - "ca_repo": "rsync://localhost/repo/ta/0", - "added": [ - { - "name": "C4893EC25530F2EADFC96E89F476DA1300801AA7.mft", - "object": { - "content": "MIILEgYJKoZIhvcNAQcCoIILAzCCCv8CAQMxDzANBglghkgBZQMEAgEFADCBmwYLKoZIhvcNAQkQARqggYsEgYgwgYUCAQEYDzIwMjEwMzIyMTAzOTM3WhgPMjAyMTAzMjMxMDQ0MzdaBglghkgBZQMEAgEwUzBRFixDNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybAMhAHJnKKbuB0LrBDf1T/n/bAUWodqM5jbVDG/Mx8N7/wMZoIIImTCCCJUwggd9oAMCAQICFDfBzkfGXhvS2scWcSwWvSc8JVdCMA0GCSqGSIb3DQEBCwUAMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQkFBRTdCRTkyQkZGNjU2MEUyMjAxOUFEMTY1M0RFMjQ2RjI5Q0FFNDVCMURGNzMwNDU1MjY5NzhGNUUzODhFMTM0OTJGQ0VCOTg4NUI0MDBGOEY1MTE1MEE0QjlGRjkwMzdBQTU3NjkyM0FCQTA4OTA3Mzc4RTQ5QUU2NkJBMjEzRTZFNzEzMjVCMjlEMzg4OEMxOUZGNEFCRERDQkI1RUJBQ0U2NDQwRkRFOTYyOUNCODlEOTkyRjlCRDkwN0VGNEZFNkVFNjM4NzA2NTNBNEQ5NjU4NUNFNTczMzlDNzIzQkY0ODJERDZBQzIzQjhEQUM2N0M5RTBDRjlCMDUyRjlEM0RDNjc0M0YzNTk0NzU0QTA1OUQwNDc2MzM1NDM2MkIyMjU2NzYyNzMxOUIwRUYyOEQ2MEExQjA3OTM4NkI4QkMwRTcyQjhGM0U1NDU4MkMxQzhGMzNFMEU4MzM1OEE2RDAwQUQ5MTAxRDY5QTBBNDVBQjg4RjEwNEY3OTUyRUEzRkRFQTJCM0ZCMUQzNkJBMUM2NjJGMDQ0RjFEODc3NzA0ODBEMzc4M0RBMDcyOUUzQzUxNTdGMDk5RjVFQzBDRkUwMkRFODQ5NDI3RkEyMDRBRjJBMzgxMUVBMTMzNUZFQUMxM0RBRUU0M0U3Q0UzQkQzQjE0Q0RGNTdDRTMwMjAzMDEwMDAxMB4XDTIxMDMyMjEwMzkzN1oXDTIxMDMyOTEwNDQzN1owggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDA5RTZFNUQ5MzJERTk5MjNENTY5NEVGQjM5Mjg5RTRDMjM5QTk4NkM0RUQwRjBGQ0FBRTgwQkIxODJGRTZBQkFDQTNDNDBDNzQ2NEE1MEY3RjQxQTZDMTM5MTcyMEY5MjVFMjcwNjI1QTI2REMyQjE5NTJCNjdGQUY1RTYyNkI3MENENEE1REQyMTE4MDMxRTJEQjExRjJEOUQ5QkE3NzY2NUM3RUJGNkY2Njc0MzE3RDVGQUMwNUQxNzQxQkRBN0Y3QTMzMEU0NUU2RjU4REFCQTdEMjU2MkI3OUZBNUYwRkJGNTY5OTU3OUNFNUJGNjE1NUNFMzhGRjAwRDhBMjRCRjNGNzdFQjM1NjMzMEUwQjIxNjhBQUYyMTkyQUZEREY4Q0MwQTMzMDAyNTJBMzQxRDBBQ0Y3OUEyNkM1MTk4NzQ1RkM4M0ZBMEJCRkU5NEYxRkJERDhBMzhEQUU0QjI2MDczODkxRjkyMDUxNDExQUZBRjMwREYxOTY0MTJFOEI0RjE1NjBDMjM3MzhBQjc4NDQ1OEREQzExN0I5MzFGMkFFNTQzMzZERjUyNjQ3NzUwRTVFQkE5QkU0MjdEQkI5RkVDQTFFMjAzNkFDM0MwQzkwMzcwQ0I2NTYxMEFGNTRFRDkwRjU2NkE1NTg3OUY4MzJFNTk4MTg2MjcwNEU4NTAyMDMwMTAwMDEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCebl2TLemSPVaU77OSieTCOamGxO0PD8qugLsYL+arrKPEDHRkpQ9/QabBORcg+SXicGJaJtwrGVK2f69eYmtwzUpd0hGAMeLbEfLZ2bp3Zlx+v29mdDF9X6wF0XQb2n96Mw5F5vWNq6fSVit5+l8Pv1aZV5zlv2FVzjj/ANiiS/P3frNWMw4LIWiq8hkq/d+MwKMwAlKjQdCs95omxRmHRfyD+gu/6U8fvdijja5LJgc4kfkgUUEa+vMN8ZZBLotPFWDCNzireERY3cEXuTHyrlQzbfUmR3UOXrqb5Cfbuf7KHiA2rDwMkDcMtlYQr1TtkPVmpVh5+DLlmBhicE6FAgMBAAGjggGnMIIBozAdBgNVHQ4EFgQU2op4jdYM9pDaFxLra/sHryTwgWgwHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgeAMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvMC9DNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybDA8BggrBgEFBQcBAQQwMC4wLAYIKwYBBQUHMAKGIHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvdGEuY2VyMGQGCCsGAQUFBwELBFgwVjBUBggrBgEFBQcwC4ZIcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby90YS8wL0M0ODkzRUMyNTUzMEYyRUFERkM5NkU4OUY0NzZEQTEzMDA4MDFBQTcubWZ0MBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwIQYIKwYBBQUHAQcBAf8EEjAQMAYEAgABBQAwBgQCAAIFADAVBggrBgEFBQcBCAEB/wQGMASgAgUAMA0GCSqGSIb3DQEBCwUAA4IBAQB1tDki+FVdqH93M6O4OC5AA7ZUFDD+nZ9BVTYPbEUMP9Y0mfZk8c8DER6bMNqq3ufTQtDdswfgtnCB6FmVxlmBOmzISfPKSKeBUmLnU0XAKGV7stNgKYkzxaErPnImk87IPuQsSOR4KOpK498ap8AnZWx405UmjeWSPHG9khPu80T+DLvQ9rB39J6LicFx/IqNlAlUNXfWjdzy50yIDB8/UdYVVh3scTNGmgYHbgcM1ySJqvum3ew6Gj4dXCe6OXGdNVVlTLUmJF/VQSCVqz/Z3iXVnjRvi4MgdUD1ceDPMXgGhDUT9PepPBQ9poCs5ghxsTsLoafb8IlEsrQxMYnxMYIBrDCCAagCAQOAFNqKeI3WDPaQ2hcS62v7B68k8IFoMA0GCWCGSAFlAwQCAQUAoGswGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEaMBwGCSqGSIb3DQEJBTEPFw0yMTAzMjIxMDQ0MzdaMC8GCSqGSIb3DQEJBDEiBCCiRUY5oZdYYojj/u15RnxBR9OtuHzOk0JBaF1o1RNf/jANBgkqhkiG9w0BAQEFAASCAQBR5mZ42xRhiHoCbowXfOGDhNlI0yZORoYMflXOPAB2f8o7qTWyELqBkQAHlwMrW/n58E31DDzOqEur//hpHTLnlVEI/zlMTmBFhzAitydkrNfVpBC/YBq1lpsdRVSKJCBNFZqlovJWqga5NEzKBxV8ZpvgWXj5FMSffEm/MGI8cafbUzb/CqVkqbc68pTqaYWeLAsJPkFJ4P12YGJFlOB6XbjsRLXgl96ll6v8cJMqblaovZuMrgYy4TjhLWtd+Sq9JzkokxZtk8egQTrAO6f8DvLOMFc0r5XXIY7HI2xEZaZRiHYGwDr89EYatmVtElRh8qP+s7XohKkmuQ4UmQtM", - "serial": "318316505773253361497376874909930893181779793730", - "expires": "2021-03-23T10:44:37.325554418Z" - } - }, - { - "name": "C4893EC25530F2EADFC96E89F476DA1300801AA7.crl", - "object": { - "content": "MIIDrDCCApQCAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEXDTIxMDMyMjEwMzkzN1oXDTIxMDMyMzEwNDQzN1owAKAvMC0wHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwCgYDVR0UBAMCAQEwDQYJKoZIhvcNAQELBQADggEBABgK5J0tzDkE5jEVM1ILweNX4M63xmsrNayCO0EcDFb9YG122JpSIgOAHClP3PBTLvruzmdkqJRDekjlOzmqc2UMLYhbiCHxgM+XkBJWB1hF/2LHNIBACDT3UpRHnXOinCqnuJipHLrhcote9woXIR26rdCdD72oTCGO60VRqtc70k3BSaVs1m+g4P5P652lEfm/QWM1XBlqUS9v9yngDLX6jA6mQbd/a4t2qSmrtK/gURygzW9i3FslFSDOMym+4m4Z0Vlogb9nnx9/cc4WJkHSK9A2Ndjng87+lJCFUfEVXkR16rwfKyE0ZOov9T6FF4M/6MrtQbggSi/oKW77GCU=", - "serial": "1", - "expires": "2021-03-23T10:44:37.323206844Z" - } - } - ], - "updated": [], - "withdrawn": [] - } - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_6_0/cas/ta/delta-4.json b/test-resources/migrations/v0_6_0/cas/ta/delta-4.json deleted file mode 100644 index 50c9a496..00000000 --- a/test-resources/migrations/v0_6_0/cas/ta/delta-4.json +++ /dev/null @@ -1,18 +0,0 @@ -{ - "id": "ta", - "version": 4, - "details": { - "child_added": [ - "ca", - { - "id_cert": null, - "resources": { - "asn": "", - "v4": "192.168.0.0/16", - "v6": "" - }, - "used_keys": {} - } - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_6_0/cas/ta/delta-5.json b/test-resources/migrations/v0_6_0/cas/ta/delta-5.json deleted file mode 100644 index 87666fe5..00000000 --- a/test-resources/migrations/v0_6_0/cas/ta/delta-5.json +++ /dev/null @@ -1,11 +0,0 @@ -{ - "id": "ta", - "version": 5, - "details": { - "child_certificate_issued": [ - "ca", - "0", - "B497A5F1E84F9089F5F51A899725A7C5B076E03F" - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_6_0/cas/ta/delta-6.json b/test-resources/migrations/v0_6_0/cas/ta/delta-6.json deleted file mode 100644 index 67852006..00000000 --- a/test-resources/migrations/v0_6_0/cas/ta/delta-6.json +++ /dev/null @@ -1,29 +0,0 @@ -{ - "id": "ta", - "version": 6, - "details": { - "child_certificates_updated": [ - "0", - { - "issued": [ - { - "uri": "rsync://localhost/repo/ta/0/B497A5F1E84F9089F5F51A899725A7C5B076E03F.cer", - "limit": { - "asn": "none", - "v4": "none", - "v6": "none" - }, - "resource_set": { - "asn": "", - "v4": "192.168.0.0/16", - "v6": "" - }, - "cert": "MIIG9zCCBd+gAwIBAgIUW3EzhNrQB9M65JrZLCAteneQF68wDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEwHhcNMjEwMzIyMTA1MzU4WhcNMjIwMzIyMTA1ODU4WjAzMTEwLwYDVQQDEyhCNDk3QTVGMUU4NEY5MDg5RjVGNTFBODk5NzI1QTdDNUIwNzZFMDNGMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5bhcVJrttIMsGwYCELCbLtsuH93eTa6F7G2rg5GwddHhJZnWPCKcw5ja0yqpNor5SYzGeqcTsebPoZuzVRG+akS/0IitmH/Uf1YBOk7b8BiAwiotZzlTk+4ZROL56wRhnWtU6JjghBplmMA3yDPWuGabgySRBAU7KyLocILEgnQWKk49P40BUU7mqOEi9dCX9DoRSptNXeBUVG8lWrcC3HH5gGYVxKE+rhxaHz2ncyVC9lLnO6ciLHEzh3xVbQQ5btW+xWvoQHCsUHKyLBBfu0BnqnPE3XM1YKTGj9Srllz4IT4EQXCMyalgu8VsMGLzAex3Q4pksLeUBB0LjLpfWwIDAQABo4ICBTCCAgEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUtJel8ehPkIn19RqJlyWnxbB24D8wHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgEGMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvMC9DNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybDA8BggrBgEFBQcBAQQwMC4wLAYIKwYBBQUHMAKGIHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvdGEuY2VyMIHKBggrBgEFBQcBCwSBvTCBujAoBggrBgEFBQcwBYYccnN5bmM6Ly9sb2NhbGhvc3QvcmVwby9jYS8wLzBUBggrBgEFBQcwCoZIcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby9jYS8wL0I0OTdBNUYxRTg0RjkwODlGNUY1MUE4OTk3MjVBN0M1QjA3NkUwM0YubWZ0MDgGCCsGAQUFBzANhixodHRwczovL2xvY2FsaG9zdDozMDAwL3JyZHAvbm90aWZpY2F0aW9uLnhtbDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMB4GCCsGAQUFBwEHAQH/BA8wDTALBAIAATAFAwMAwKgwDQYJKoZIhvcNAQELBQADggEBAHRBAYyA6gnl0jrTbHYwo3e9Q+2HJfbu4AHrAPMA+o5clSnhSDKJCOKD6hsRZFV8YrvfmZdQmmq8nL3WMFDva3h4LcHIrd0D/gC+Nio6t3zPXInxlCIzMq10Z0Cr8uPIlMe/LFZunQ4zZDGxi0PyeEqMJhgzi/499/HDo2lf/PhvseQEohv7ZT08C1SdMrw9u+eY3TklZrfOen8OPEuWy5AY7uoq4sWDV/rjavZTRL7HcPpwr69DehsAQ34sddhB6PxUkCN01+eh8AOvU+MBKQlXPsx5vxybIHQXJ2aTSq7wVMs8L5TOLRfKIKIshVLHbYBDopRZwTyZ5fO3bGfSvdM=", - "replaces": null - } - ], - "removed": [] - } - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_6_0/cas/ta/delta-7.json b/test-resources/migrations/v0_6_0/cas/ta/delta-7.json deleted file mode 100644 index 0b05b8e0..00000000 --- a/test-resources/migrations/v0_6_0/cas/ta/delta-7.json +++ /dev/null @@ -1,76 +0,0 @@ -{ - "id": "ta", - "version": 7, - "details": { - "object_set_updated": [ - "0", - { - "C4893EC25530F2EADFC96E89F476DA1300801AA7": { - "number": 2, - "revocations_delta": { - "added": [ - { - "serial": "318316505773253361497376874909930893181779793730", - "expires": "2021-03-23T10:44:37.325554418Z" - } - ], - "dropped": [] - }, - "manifest_info": { - "name": "C4893EC25530F2EADFC96E89F476DA1300801AA7.mft", - "current": { - "content": "MIILZgYJKoZIhvcNAQcCoIILVzCCC1MCAQMxDzANBglghkgBZQMEAgEFADCB7wYLKoZIhvcNAQkQARqggd8EgdwwgdkCAQIYDzIwMjEwMzIyMTA1MzU4WhgPMjAyMTAzMjMxMDU4NThaBglghkgBZQMEAgEwgaYwURYsQjQ5N0E1RjFFODRGOTA4OUY1RjUxQTg5OTcyNUE3QzVCMDc2RTAzRi5jZXIDIQD8rAuHZJPCHtQuVNDK0AskEfT5qw9ToAZx3TbjO7dgDzBRFixDNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybAMhAPHqG2D4BIaeWMJL/VyaoOFH9n4M/1n/OGFY4+7AezProIIImTCCCJUwggd9oAMCAQICFHH8lccA/ws5Cj24vTliDVEsskQJMA0GCSqGSIb3DQEBCwUAMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQkFBRTdCRTkyQkZGNjU2MEUyMjAxOUFEMTY1M0RFMjQ2RjI5Q0FFNDVCMURGNzMwNDU1MjY5NzhGNUUzODhFMTM0OTJGQ0VCOTg4NUI0MDBGOEY1MTE1MEE0QjlGRjkwMzdBQTU3NjkyM0FCQTA4OTA3Mzc4RTQ5QUU2NkJBMjEzRTZFNzEzMjVCMjlEMzg4OEMxOUZGNEFCRERDQkI1RUJBQ0U2NDQwRkRFOTYyOUNCODlEOTkyRjlCRDkwN0VGNEZFNkVFNjM4NzA2NTNBNEQ5NjU4NUNFNTczMzlDNzIzQkY0ODJERDZBQzIzQjhEQUM2N0M5RTBDRjlCMDUyRjlEM0RDNjc0M0YzNTk0NzU0QTA1OUQwNDc2MzM1NDM2MkIyMjU2NzYyNzMxOUIwRUYyOEQ2MEExQjA3OTM4NkI4QkMwRTcyQjhGM0U1NDU4MkMxQzhGMzNFMEU4MzM1OEE2RDAwQUQ5MTAxRDY5QTBBNDVBQjg4RjEwNEY3OTUyRUEzRkRFQTJCM0ZCMUQzNkJBMUM2NjJGMDQ0RjFEODc3NzA0ODBEMzc4M0RBMDcyOUUzQzUxNTdGMDk5RjVFQzBDRkUwMkRFODQ5NDI3RkEyMDRBRjJBMzgxMUVBMTMzNUZFQUMxM0RBRUU0M0U3Q0UzQkQzQjE0Q0RGNTdDRTMwMjAzMDEwMDAxMB4XDTIxMDMyMjEwNTM1OFoXDTIxMDMyOTEwNTg1OFowggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBBNEQyNTRBQTlERDUyMUUzREE4RTZDMjU2NkJFMDU1QjM0QTIzMDk0QTMxOTc3RUZBMDkyOUFFOTY2MkY2M0IwNDdGRDJGNzA0QTRCMjdERkUyMTI5N0IyQUY0NDZEOEVDRTQxRjIwRDY3RkVCODMzQTI5NTI3OEUzQUM5QkRDQ0VGM0UwQkU2QUU3Qjk2MTIzQkI4MzYzQ0I3MkZCQ0M3MEY5NDAwOEZDOTdCQzYxQTYwRUIzRjdEMjkzOUQ5QkVGRjI2NEE4MDg4NzJFMDhFMjZBQjExOTIwQjUxM0NBNTdGQjJGMzFBODBFRTVDMjU2Q0QzRTI2OTBFNEUwNjBEOUI3NzQyOUI2RDM5NkRDMzdDNUI4MzA5RThFQjQ1OUE2QzRBMjgzQTE4ODlERTY3NDVFRTcyNTQwRTk3QkQ0NjgwQUUxNDMwNTQ5QzBCMzE0N0RGOEFDNThCMjVBN0M1MERCRDI5Q0M4RDg1NkFFMkMyMzI4MDk5MkNBMzc3QzJCRDEwQzhGMzNBOUIzMEU5QjNENDZDNkY5QjkyNEQzRjU5Njc5RTI4REI5RTQ1M0FDMTI1QUYyRTBERjRCRjdEQjJDMzMzNTEzMDdBMEZGMjZBMTJDQzc1OEI5NThFQUE2MTAzQTI2OUY1NjkwNUEyMDA5N0RGMTc2MEE0QjAzRDAyMDMwMTAwMDEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCk0lSqndUh49qObCVmvgVbNKIwlKMZd++gkprpZi9jsEf9L3BKSyff4hKXsq9EbY7OQfINZ/64M6KVJ446yb3M7z4L5q57lhI7uDY8ty+8xw+UAI/Je8YaYOs/fSk52b7/JkqAiHLgjiarEZILUTylf7LzGoDuXCVs0+JpDk4GDZt3QpttOW3DfFuDCejrRZpsSig6GIneZ0XuclQOl71GgK4UMFScCzFH34rFiyWnxQ29KcyNhWriwjKAmSyjd8K9EMjzOpsw6bPUbG+bkk0/WWeeKNueRTrBJa8uDfS/fbLDM1Eweg/yahLMdYuVjqphA6Jp9WkFogCX3xdgpLA9AgMBAAGjggGnMIIBozAdBgNVHQ4EFgQUWhArhmNo+WekTJSJoXrVRxlzqCAwHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgeAMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvMC9DNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybDA8BggrBgEFBQcBAQQwMC4wLAYIKwYBBQUHMAKGIHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvdGEuY2VyMGQGCCsGAQUFBwELBFgwVjBUBggrBgEFBQcwC4ZIcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby90YS8wL0M0ODkzRUMyNTUzMEYyRUFERkM5NkU4OUY0NzZEQTEzMDA4MDFBQTcubWZ0MBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwIQYIKwYBBQUHAQcBAf8EEjAQMAYEAgABBQAwBgQCAAIFADAVBggrBgEFBQcBCAEB/wQGMASgAgUAMA0GCSqGSIb3DQEBCwUAA4IBAQCJZVtnjUJvd4MyyLmghVDOQHkqW9ttQ4nw0biccw8S7KbGZN9188+1xTiZWGUFLuG7GnyxC9Flm+JBvQVd3B1dtUL6LRySDxLgOvQB2qdPuRXvk+srNkPHQZe9vx70JFp3XTTTvuERpr7v6PKy3CTilyjsrgrqg2+AEqckNLqOaSOQc0QgwvGaS/Edy02MtKZ18VUjKsehLNo9GYhdpM2UdkBPancS+KIMYHwAxJpfwzS6ni69JS7LnsGTpXk1GesYZkol5ia+BJGA0/s451wkINS1TkwuU0/bI0hweaI5B2sIBjFKhOCETdG5E8XYe7yHDzVd3qPhtgF+giMMXdMxMYIBrDCCAagCAQOAFFoQK4ZjaPlnpEyUiaF61UcZc6ggMA0GCWCGSAFlAwQCAQUAoGswGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEaMBwGCSqGSIb3DQEJBTEPFw0yMTAzMjIxMDU4NThaMC8GCSqGSIb3DQEJBDEiBCBPdP7+1xa9OwfmH0UpzNAQEhfoC32bFGqGHWbae1xyPjANBgkqhkiG9w0BAQEFAASCAQBNp5YjdmGTHp7gDx+OJaJXnSUvynW83eY2PnWEEaIf9VxV/3Xf5OI5H4IVtyXTeyjt77JpK1FVxLPTMmmBEWiLlyhe/9CVnSLnS1N7WkxlHQJzzmLDV1cALJZafK89BhDntde47gNg25WAybStQpsqsJV+9JcfSnffuLTFlBc33pa1eZVSfutWo2zzS2nbVtwv7sD/3J1hRRxxb8GEhSLkY37MOGFWdGCFv7QLhoO1JqVKrKo5PQbE/SZ392r2hv0DOcKLAxJXWU81u3mP8bRQdalcmCNOniwxGZN/n7PHTrt5ErpNpNBGltXgT0D+tD+sdHayqoDSHY2cIele1O17", - "serial": "650748792341242696138123586874381430911663227913", - "expires": "2021-03-23T10:58:58.687824581Z" - }, - "next_update": "2021-03-23T10:58:58.687824581Z", - "old": "23fc516d7659e4286b792f13eef161e64510af4dcdac5c63c933a84c17fa42d0" - }, - "crl_info": { - "name": "C4893EC25530F2EADFC96E89F476DA1300801AA7.crl", - "current": { - "content": "MIID0zCCArsCAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEXDTIxMDMyMjEwNTM1OFoXDTIxMDMyMzEwNTg1OFowJzAlAhQ3wc5Hxl4b0trHFnEsFr0nPCVXQhcNMjEwMzIzMTA0NDM3WqAvMC0wHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwCgYDVR0UBAMCAQIwDQYJKoZIhvcNAQELBQADggEBAHQTC61pRLu2S6YQUsikPVMeIrab74avyKeew62hXetiEnZss8YLqRXeXdujUG09UT2VgRWjvnHeSRTDbjordp9oGEIQ1BTl/lGjM+TZ0+UWlkZ2HUp2Vx5k75xz3z9v1/F3mkerXedFiq9xKOF3OYzrGGop/Xrzx7TuqLC+edCV9+3g52m6e/A+lps74e5VCqCODOu/cNpbxyVoSTm/jTKZOq4taPw8DFv64h8aLUUVLlp+IRMPJEidlgrahLKbOaO7C9ZA9CGn8Ifh4uBlcCY8+hTfDAgQbMJAUk/ggoJOgkCHqC/IDXdWEYZ2wvBuCcNFLFzySSdM5fL0KNwAlU0=", - "serial": "2", - "expires": "2021-03-23T10:58:58.685222924Z" - }, - "old": "726728a6ee0742eb0437f54ff9ff6c0516a1da8ce636d50c6fccc7c37bff0319" - }, - "objects_delta": { - "ca_repo": "rsync://localhost/repo/ta/0", - "added": [ - { - "name": "B497A5F1E84F9089F5F51A899725A7C5B076E03F.cer", - "object": { - "content": "MIIG9zCCBd+gAwIBAgIUW3EzhNrQB9M65JrZLCAteneQF68wDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEwHhcNMjEwMzIyMTA1MzU4WhcNMjIwMzIyMTA1ODU4WjAzMTEwLwYDVQQDEyhCNDk3QTVGMUU4NEY5MDg5RjVGNTFBODk5NzI1QTdDNUIwNzZFMDNGMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5bhcVJrttIMsGwYCELCbLtsuH93eTa6F7G2rg5GwddHhJZnWPCKcw5ja0yqpNor5SYzGeqcTsebPoZuzVRG+akS/0IitmH/Uf1YBOk7b8BiAwiotZzlTk+4ZROL56wRhnWtU6JjghBplmMA3yDPWuGabgySRBAU7KyLocILEgnQWKk49P40BUU7mqOEi9dCX9DoRSptNXeBUVG8lWrcC3HH5gGYVxKE+rhxaHz2ncyVC9lLnO6ciLHEzh3xVbQQ5btW+xWvoQHCsUHKyLBBfu0BnqnPE3XM1YKTGj9Srllz4IT4EQXCMyalgu8VsMGLzAex3Q4pksLeUBB0LjLpfWwIDAQABo4ICBTCCAgEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUtJel8ehPkIn19RqJlyWnxbB24D8wHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgEGMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvMC9DNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybDA8BggrBgEFBQcBAQQwMC4wLAYIKwYBBQUHMAKGIHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvdGEuY2VyMIHKBggrBgEFBQcBCwSBvTCBujAoBggrBgEFBQcwBYYccnN5bmM6Ly9sb2NhbGhvc3QvcmVwby9jYS8wLzBUBggrBgEFBQcwCoZIcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby9jYS8wL0I0OTdBNUYxRTg0RjkwODlGNUY1MUE4OTk3MjVBN0M1QjA3NkUwM0YubWZ0MDgGCCsGAQUFBzANhixodHRwczovL2xvY2FsaG9zdDozMDAwL3JyZHAvbm90aWZpY2F0aW9uLnhtbDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMB4GCCsGAQUFBwEHAQH/BA8wDTALBAIAATAFAwMAwKgwDQYJKoZIhvcNAQELBQADggEBAHRBAYyA6gnl0jrTbHYwo3e9Q+2HJfbu4AHrAPMA+o5clSnhSDKJCOKD6hsRZFV8YrvfmZdQmmq8nL3WMFDva3h4LcHIrd0D/gC+Nio6t3zPXInxlCIzMq10Z0Cr8uPIlMe/LFZunQ4zZDGxi0PyeEqMJhgzi/499/HDo2lf/PhvseQEohv7ZT08C1SdMrw9u+eY3TklZrfOen8OPEuWy5AY7uoq4sWDV/rjavZTRL7HcPpwr69DehsAQ34sddhB6PxUkCN01+eh8AOvU+MBKQlXPsx5vxybIHQXJ2aTSq7wVMs8L5TOLRfKIKIshVLHbYBDopRZwTyZ5fO3bGfSvdM=", - "serial": "522042632287110169996588701447052353597938341807", - "expires": "2022-03-22T10:58:58Z" - } - } - ], - "updated": [ - { - "name": "C4893EC25530F2EADFC96E89F476DA1300801AA7.crl", - "object": { - "content": "MIID0zCCArsCAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEXDTIxMDMyMjEwNTM1OFoXDTIxMDMyMzEwNTg1OFowJzAlAhQ3wc5Hxl4b0trHFnEsFr0nPCVXQhcNMjEwMzIzMTA0NDM3WqAvMC0wHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwCgYDVR0UBAMCAQIwDQYJKoZIhvcNAQELBQADggEBAHQTC61pRLu2S6YQUsikPVMeIrab74avyKeew62hXetiEnZss8YLqRXeXdujUG09UT2VgRWjvnHeSRTDbjordp9oGEIQ1BTl/lGjM+TZ0+UWlkZ2HUp2Vx5k75xz3z9v1/F3mkerXedFiq9xKOF3OYzrGGop/Xrzx7TuqLC+edCV9+3g52m6e/A+lps74e5VCqCODOu/cNpbxyVoSTm/jTKZOq4taPw8DFv64h8aLUUVLlp+IRMPJEidlgrahLKbOaO7C9ZA9CGn8Ifh4uBlcCY8+hTfDAgQbMJAUk/ggoJOgkCHqC/IDXdWEYZ2wvBuCcNFLFzySSdM5fL0KNwAlU0=", - "serial": "2", - "expires": "2021-03-23T10:58:58.685222924Z" - }, - "old": "726728a6ee0742eb0437f54ff9ff6c0516a1da8ce636d50c6fccc7c37bff0319" - }, - { - "name": "C4893EC25530F2EADFC96E89F476DA1300801AA7.mft", - "object": { - "content": "MIILZgYJKoZIhvcNAQcCoIILVzCCC1MCAQMxDzANBglghkgBZQMEAgEFADCB7wYLKoZIhvcNAQkQARqggd8EgdwwgdkCAQIYDzIwMjEwMzIyMTA1MzU4WhgPMjAyMTAzMjMxMDU4NThaBglghkgBZQMEAgEwgaYwURYsQjQ5N0E1RjFFODRGOTA4OUY1RjUxQTg5OTcyNUE3QzVCMDc2RTAzRi5jZXIDIQD8rAuHZJPCHtQuVNDK0AskEfT5qw9ToAZx3TbjO7dgDzBRFixDNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybAMhAPHqG2D4BIaeWMJL/VyaoOFH9n4M/1n/OGFY4+7AezProIIImTCCCJUwggd9oAMCAQICFHH8lccA/ws5Cj24vTliDVEsskQJMA0GCSqGSIb3DQEBCwUAMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQkFBRTdCRTkyQkZGNjU2MEUyMjAxOUFEMTY1M0RFMjQ2RjI5Q0FFNDVCMURGNzMwNDU1MjY5NzhGNUUzODhFMTM0OTJGQ0VCOTg4NUI0MDBGOEY1MTE1MEE0QjlGRjkwMzdBQTU3NjkyM0FCQTA4OTA3Mzc4RTQ5QUU2NkJBMjEzRTZFNzEzMjVCMjlEMzg4OEMxOUZGNEFCRERDQkI1RUJBQ0U2NDQwRkRFOTYyOUNCODlEOTkyRjlCRDkwN0VGNEZFNkVFNjM4NzA2NTNBNEQ5NjU4NUNFNTczMzlDNzIzQkY0ODJERDZBQzIzQjhEQUM2N0M5RTBDRjlCMDUyRjlEM0RDNjc0M0YzNTk0NzU0QTA1OUQwNDc2MzM1NDM2MkIyMjU2NzYyNzMxOUIwRUYyOEQ2MEExQjA3OTM4NkI4QkMwRTcyQjhGM0U1NDU4MkMxQzhGMzNFMEU4MzM1OEE2RDAwQUQ5MTAxRDY5QTBBNDVBQjg4RjEwNEY3OTUyRUEzRkRFQTJCM0ZCMUQzNkJBMUM2NjJGMDQ0RjFEODc3NzA0ODBEMzc4M0RBMDcyOUUzQzUxNTdGMDk5RjVFQzBDRkUwMkRFODQ5NDI3RkEyMDRBRjJBMzgxMUVBMTMzNUZFQUMxM0RBRUU0M0U3Q0UzQkQzQjE0Q0RGNTdDRTMwMjAzMDEwMDAxMB4XDTIxMDMyMjEwNTM1OFoXDTIxMDMyOTEwNTg1OFowggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBBNEQyNTRBQTlERDUyMUUzREE4RTZDMjU2NkJFMDU1QjM0QTIzMDk0QTMxOTc3RUZBMDkyOUFFOTY2MkY2M0IwNDdGRDJGNzA0QTRCMjdERkUyMTI5N0IyQUY0NDZEOEVDRTQxRjIwRDY3RkVCODMzQTI5NTI3OEUzQUM5QkRDQ0VGM0UwQkU2QUU3Qjk2MTIzQkI4MzYzQ0I3MkZCQ0M3MEY5NDAwOEZDOTdCQzYxQTYwRUIzRjdEMjkzOUQ5QkVGRjI2NEE4MDg4NzJFMDhFMjZBQjExOTIwQjUxM0NBNTdGQjJGMzFBODBFRTVDMjU2Q0QzRTI2OTBFNEUwNjBEOUI3NzQyOUI2RDM5NkRDMzdDNUI4MzA5RThFQjQ1OUE2QzRBMjgzQTE4ODlERTY3NDVFRTcyNTQwRTk3QkQ0NjgwQUUxNDMwNTQ5QzBCMzE0N0RGOEFDNThCMjVBN0M1MERCRDI5Q0M4RDg1NkFFMkMyMzI4MDk5MkNBMzc3QzJCRDEwQzhGMzNBOUIzMEU5QjNENDZDNkY5QjkyNEQzRjU5Njc5RTI4REI5RTQ1M0FDMTI1QUYyRTBERjRCRjdEQjJDMzMzNTEzMDdBMEZGMjZBMTJDQzc1OEI5NThFQUE2MTAzQTI2OUY1NjkwNUEyMDA5N0RGMTc2MEE0QjAzRDAyMDMwMTAwMDEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCk0lSqndUh49qObCVmvgVbNKIwlKMZd++gkprpZi9jsEf9L3BKSyff4hKXsq9EbY7OQfINZ/64M6KVJ446yb3M7z4L5q57lhI7uDY8ty+8xw+UAI/Je8YaYOs/fSk52b7/JkqAiHLgjiarEZILUTylf7LzGoDuXCVs0+JpDk4GDZt3QpttOW3DfFuDCejrRZpsSig6GIneZ0XuclQOl71GgK4UMFScCzFH34rFiyWnxQ29KcyNhWriwjKAmSyjd8K9EMjzOpsw6bPUbG+bkk0/WWeeKNueRTrBJa8uDfS/fbLDM1Eweg/yahLMdYuVjqphA6Jp9WkFogCX3xdgpLA9AgMBAAGjggGnMIIBozAdBgNVHQ4EFgQUWhArhmNo+WekTJSJoXrVRxlzqCAwHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgeAMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvMC9DNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybDA8BggrBgEFBQcBAQQwMC4wLAYIKwYBBQUHMAKGIHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvdGEuY2VyMGQGCCsGAQUFBwELBFgwVjBUBggrBgEFBQcwC4ZIcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby90YS8wL0M0ODkzRUMyNTUzMEYyRUFERkM5NkU4OUY0NzZEQTEzMDA4MDFBQTcubWZ0MBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwIQYIKwYBBQUHAQcBAf8EEjAQMAYEAgABBQAwBgQCAAIFADAVBggrBgEFBQcBCAEB/wQGMASgAgUAMA0GCSqGSIb3DQEBCwUAA4IBAQCJZVtnjUJvd4MyyLmghVDOQHkqW9ttQ4nw0biccw8S7KbGZN9188+1xTiZWGUFLuG7GnyxC9Flm+JBvQVd3B1dtUL6LRySDxLgOvQB2qdPuRXvk+srNkPHQZe9vx70JFp3XTTTvuERpr7v6PKy3CTilyjsrgrqg2+AEqckNLqOaSOQc0QgwvGaS/Edy02MtKZ18VUjKsehLNo9GYhdpM2UdkBPancS+KIMYHwAxJpfwzS6ni69JS7LnsGTpXk1GesYZkol5ia+BJGA0/s451wkINS1TkwuU0/bI0hweaI5B2sIBjFKhOCETdG5E8XYe7yHDzVd3qPhtgF+giMMXdMxMYIBrDCCAagCAQOAFFoQK4ZjaPlnpEyUiaF61UcZc6ggMA0GCWCGSAFlAwQCAQUAoGswGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEaMBwGCSqGSIb3DQEJBTEPFw0yMTAzMjIxMDU4NThaMC8GCSqGSIb3DQEJBDEiBCBPdP7+1xa9OwfmH0UpzNAQEhfoC32bFGqGHWbae1xyPjANBgkqhkiG9w0BAQEFAASCAQBNp5YjdmGTHp7gDx+OJaJXnSUvynW83eY2PnWEEaIf9VxV/3Xf5OI5H4IVtyXTeyjt77JpK1FVxLPTMmmBEWiLlyhe/9CVnSLnS1N7WkxlHQJzzmLDV1cALJZafK89BhDntde47gNg25WAybStQpsqsJV+9JcfSnffuLTFlBc33pa1eZVSfutWo2zzS2nbVtwv7sD/3J1hRRxxb8GEhSLkY37MOGFWdGCFv7QLhoO1JqVKrKo5PQbE/SZ392r2hv0DOcKLAxJXWU81u3mP8bRQdalcmCNOniwxGZN/n7PHTrt5ErpNpNBGltXgT0D+tD+sdHayqoDSHY2cIele1O17", - "serial": "650748792341242696138123586874381430911663227913", - "expires": "2021-03-23T10:58:58.687824581Z" - }, - "old": "23fc516d7659e4286b792f13eef161e64510af4dcdac5c63c933a84c17fa42d0" - } - ], - "withdrawn": [] - } - } - } - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_6_0/cas/ta/delta-8.json b/test-resources/migrations/v0_6_0/cas/ta/delta-8.json deleted file mode 100644 index cd458034..00000000 --- a/test-resources/migrations/v0_6_0/cas/ta/delta-8.json +++ /dev/null @@ -1,11 +0,0 @@ -{ - "id": "ta", - "version": 8, - "details": { - "child_certificate_issued": [ - "ca", - "0", - "9F50CE97A62D7420ECB0E76400B4D00A9FF80837" - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_6_0/cas/ta/delta-9.json b/test-resources/migrations/v0_6_0/cas/ta/delta-9.json deleted file mode 100644 index fbb4b48f..00000000 --- a/test-resources/migrations/v0_6_0/cas/ta/delta-9.json +++ /dev/null @@ -1,29 +0,0 @@ -{ - "id": "ta", - "version": 9, - "details": { - "child_certificates_updated": [ - "0", - { - "issued": [ - { - "uri": "rsync://localhost/repo/ta/0/9F50CE97A62D7420ECB0E76400B4D00A9FF80837.cer", - "limit": { - "asn": "none", - "v4": "none", - "v6": "none" - }, - "resource_set": { - "asn": "", - "v4": "192.168.0.0/16", - "v6": "" - }, - "cert": "MIIG9zCCBd+gAwIBAgIUbxupwYqnAX4cy0ub1ggDn4onxlgwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEwHhcNMjEwMzIyMTA1NjA0WhcNMjIwMzIyMTEwMTA0WjAzMTEwLwYDVQQDEyg5RjUwQ0U5N0E2MkQ3NDIwRUNCMEU3NjQwMEI0RDAwQTlGRjgwODM3MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr+c5o3kod88LphtXU6UAzmAnrCunhrJvEh2ojXC3bWCska09Nq90ntSQNTWHJZmrzAYMKHHGX4L+0VLoyKB/cFMH5uFNWPFn2gcg/a9Gp9SLCrr2BLF8cCziobX70kZAYsVc9yF+uElE6drCQrmTuXiiQiPFjG+zClC68EuomQW6NPyX6IzLnlM+X3wHKQpmUyFuJNBDonUZfjRDtv1SiHVaAg45Gx2Fent1C+/pveBnv1HiZLolpykwglw9xytCniW/h7j6HPDatn645szN4OVpYd2b4SGrOr8qEEQXo0i6HW2MtO/4C3aR3jwut/LsTTHOVaXdTiqSC+96zXggFQIDAQABo4ICBTCCAgEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUn1DOl6YtdCDssOdkALTQCp/4CDcwHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgEGMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvMC9DNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybDA8BggrBgEFBQcBAQQwMC4wLAYIKwYBBQUHMAKGIHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvdGEuY2VyMIHKBggrBgEFBQcBCwSBvTCBujAoBggrBgEFBQcwBYYccnN5bmM6Ly9sb2NhbGhvc3QvcmVwby9jYS8wLzBUBggrBgEFBQcwCoZIcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby9jYS8wLzlGNTBDRTk3QTYyRDc0MjBFQ0IwRTc2NDAwQjREMDBBOUZGODA4MzcubWZ0MDgGCCsGAQUFBzANhixodHRwczovL2xvY2FsaG9zdDozMDAwL3JyZHAvbm90aWZpY2F0aW9uLnhtbDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMB4GCCsGAQUFBwEHAQH/BA8wDTALBAIAATAFAwMAwKgwDQYJKoZIhvcNAQELBQADggEBAIlVqENjjP6omOtNzq1l2ctP1zcREBQpHgZwDOB9eZ407Re4iY4DcDwLKCFWvI7W0oqGJcIWB5r/Yqevhi4rGinwRewmggfYQYkeXg++27PYbPBN/m5GmKewCIMFnityDDVUj7t+728LUR3q177LP7jZttwHAWI09IKOT8IsP5Zi7NwIPBLK/RlS9RpX2ASkBZk9LAECljBGaYrD/PZZJ84b5nufOY5DJ/5lhJWG0E9Hm19uwS7wTnT4R4CL0hgghYUzaxtMhHW84Zmxa/N5sjY9Del7cOfnl4+/6GQ04jauo77Jr55n+AoRLh5mYUdt7VratdCsJwJjMm5hMj74xeM=", - "replaces": null - } - ], - "removed": [] - } - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_6_0/cas/ta/info.json b/test-resources/migrations/v0_6_0/cas/ta/info.json deleted file mode 100644 index 0bd63ebe..00000000 --- a/test-resources/migrations/v0_6_0/cas/ta/info.json +++ /dev/null @@ -1,6 +0,0 @@ -{ - "snapshot_version": 11, - "last_event": 11, - "last_command": 6, - "last_update": "2021-03-22T11:01:04.899126536Z" -} \ No newline at end of file diff --git a/test-resources/migrations/v0_6_0/cas/ta/snapshot.json b/test-resources/migrations/v0_6_0/cas/ta/snapshot.json deleted file mode 100644 index 63161b08..00000000 --- a/test-resources/migrations/v0_6_0/cas/ta/snapshot.json +++ /dev/null @@ -1,149 +0,0 @@ -{ - "handle": "ta", - "version": 11, - "id": { - "key": "47B37867569D650DFDB6DCC3A639FE2F75A1F8CD", - "cert": "MIIDPDCCAiSgAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyg0N0IzNzg2NzU2OUQ2NTBERkRCNkRDQzNBNjM5RkUyRjc1QTFGOENEMCAXDTIxMDMyMjEwMzkzN1oYDzIxMjEwMzIyMTA0NDM3WjAzMTEwLwYDVQQDEyg0N0IzNzg2NzU2OUQ2NTBERkRCNkRDQzNBNjM5RkUyRjc1QTFGOENEMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlak6G+3yuf8zkX9vAua+qRNYHHVjA7BaTh+nrurCznq3ogwg/Y/5RC6/19BAz0uiK5CaWUiFSi8qC2tul168yQD15l1jzix7A6n224HmgJaYtInVZ4mohQtUaUD8INvQj81t3uaD1xYOEbBqKwdwYl7JPoMCLtzta7yKOxzCTmpuVjUy0nw7vydY4WTCixmO3n/bEOIBn63WcPAkxwPrCklgwcmYHqwnJ1au3aE6OUCElasIsL/TLS/r3mRlVup8NW3CM+lkP2BVBbJWSmm6n4WJXjFSMf4FuR82n1yfmNea4Dk2R68APNviqbNv1FQEo0grrcTc3DcTHTuoWArmdwIDAQABo1kwVzAPBgNVHRMBAf8EBTADAQH/MCAGA1UdDgEBAAQWBBRHs3hnVp1lDf223MOmOf4vdaH4zTAiBgNVHSMBAQAEGDAWgBRHs3hnVp1lDf223MOmOf4vdaH4zTANBgkqhkiG9w0BAQsFAAOCAQEATT2pJ8ssOAlNFpvkxYQ867ocvpC1/e61e4e1qkesTuGSp7QpEXL3cJP5DIprdqdKhrBH9PjGcGH2OoNlSX6K7zEGy9mxnuAIqtnnf+fJCyDfk1kH9Ru8rcVyVjg//tkV5hoxYeTJSEMROMw630JK/1KWiRi3VOZ/aLHBxO/bk8OulX2X3L810JZbx5wpuO7VfTglRO2LA8FtCf12zp98qcSa6RVbDUCAnY4E/aj9ZV1aMthzkwD6BWhy5yXdwIrjDeY4oy53FHXeaF35d/mL+lpYJ1XmKM0Z3cJ52L2fyW2l/vZZYBFYFqzzYqapWjbZGpWMSNt55Lk+oMfTA39DaQ==" - }, - "repository": { - "embedded": { - "base_uri": "rsync://localhost/repo/ta/", - "rpki_notify": "https://localhost:3000/rrdp/notification.xml" - } - }, - "repository_pending_withdraw": null, - "parents": { - "ta": { - "ta": { - "cert": "MIIIZjCCB06gAwIBAgIUSoqhtx5bgtaf8sRtp/ZeXbmH8SwwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEwIBcNMjEwMzIyMTAzOTM3WhgPMjEyMTAzMjIxMDQ0MzdaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQkFBRTdCRTkyQkZGNjU2MEUyMjAxOUFEMTY1M0RFMjQ2RjI5Q0FFNDVCMURGNzMwNDU1MjY5NzhGNUUzODhFMTM0OTJGQ0VCOTg4NUI0MDBGOEY1MTE1MEE0QjlGRjkwMzdBQTU3NjkyM0FCQTA4OTA3Mzc4RTQ5QUU2NkJBMjEzRTZFNzEzMjVCMjlEMzg4OEMxOUZGNEFCRERDQkI1RUJBQ0U2NDQwRkRFOTYyOUNCODlEOTkyRjlCRDkwN0VGNEZFNkVFNjM4NzA2NTNBNEQ5NjU4NUNFNTczMzlDNzIzQkY0ODJERDZBQzIzQjhEQUM2N0M5RTBDRjlCMDUyRjlEM0RDNjc0M0YzNTk0NzU0QTA1OUQwNDc2MzM1NDM2MkIyMjU2NzYyNzMxOUIwRUYyOEQ2MEExQjA3OTM4NkI4QkMwRTcyQjhGM0U1NDU4MkMxQzhGMzNFMEU4MzM1OEE2RDAwQUQ5MTAxRDY5QTBBNDVBQjg4RjEwNEY3OTUyRUEzRkRFQTJCM0ZCMUQzNkJBMUM2NjJGMDQ0RjFEODc3NzA0ODBEMzc4M0RBMDcyOUUzQzUxNTdGMDk5RjVFQzBDRkUwMkRFODQ5NDI3RkEyMDRBRjJBMzgxMUVBMTMzNUZFQUMxM0RBRUU0M0U3Q0UzQkQzQjE0Q0RGNTdDRTMwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuq576Sv/ZWDiIBmtFlPeJG8pyuRbHfcwRVJpePXjiOE0kvzrmIW0APj1EVCkuf+QN6pXaSOroIkHN45Jrma6IT5ucTJbKdOIjBn/Sr3cu166zmRA/elinLidmS+b2QfvT+buY4cGU6TZZYXOVzOccjv0gt1qwjuNrGfJ4M+bBS+dPcZ0PzWUdUoFnQR2M1Q2KyJWdicxmw7yjWChsHk4a4vA5yuPPlRYLByPM+DoM1im0ArZEB1poKRauI8QT3lS6j/eorP7HTa6HGYvBE8dh3cEgNN4PaBynjxRV/CZ9ewM/gLehJQn+iBK8qOBHqEzX+rBPa7kPnzjvTsUzfV84wIDAQABo4IBdjCCAXIwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgEGMIHJBggrBgEFBQcBCwSBvDCBuTAnBggrBgEFBQcwBYYbcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby90YS8wMFQGCCsGAQUFBzAKhkhyc3luYzovL2xvY2FsaG9zdC9yZXBvL3RhLzAvQzQ4OTNFQzI1NTMwRjJFQURGQzk2RTg5RjQ3NkRBMTMwMDgwMUFBNy5tZnQwOAYIKwYBBQUHMA2GLGh0dHBzOi8vbG9jYWxob3N0OjMwMDAvcnJkcC9ub3RpZmljYXRpb24ueG1sMBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwJwYIKwYBBQUHAQcBAf8EGDAWMAkEAgABMAMDAQAwCQQCAAIwAwMBADAhBggrBgEFBQcBCAEB/wQSMBCgDjAMMAoCAQACBQD/////MA0GCSqGSIb3DQEBCwUAA4IBAQB+onQ8rAvdp73fjkOGCOP8/wvOAoFtUg1rrsc5EhgU1qh3CjjCE+ILlIv6wHLjBeBUP4UamgbafH/DXiaIqY+sID+HLQBrOZfKMQwEZxXNWXmEgqK+4e52Y+wWEEbnxg+0QfiYTrtz06apG4/BLUThshX6nIv5lnIaR3daelGunx89KlNWOOl+5tZOnkim0g4OgBv914Hg/SumT7t4Z9l2+UyMpnM9C5gmroCUMxT121YRucVqmRD4/aWqNu2ihZInKVNuXsxzWtSn33etYIjJD4KrsqEJQLydBWraxDQwo63a/b4lRaIgjIz64ihREfc5xd+av3+hfMT/u9dMrB88", - "resources": { - "asn": "AS0-AS4294967295", - "v4": "0.0.0.0/0", - "v6": "::/0" - }, - "tal": { - "uris": [ - "https://localhost:3000/ta/ta.cer" - ], - "encoded_ski": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuq576Sv/ZWDiIBmtFlPeJG8pyuRbHfcwRVJpePXjiOE0kvzrmIW0APj1EVCkuf+QN6pXaSOroIkHN45Jrma6IT5ucTJbKdOIjBn/Sr3cu166zmRA/elinLidmS+b2QfvT+buY4cGU6TZZYXOVzOccjv0gt1qwjuNrGfJ4M+bBS+dPcZ0PzWUdUoFnQR2M1Q2KyJWdicxmw7yjWChsHk4a4vA5yuPPlRYLByPM+DoM1im0ArZEB1poKRauI8QT3lS6j/eorP7HTa6HGYvBE8dh3cEgNN4PaBynjxRV/CZ9ewM/gLehJQn+iBK8qOBHqEzX+rBPa7kPnzjvTsUzfV84wIDAQAB" - } - } - } - }, - "next_class_name": 1, - "resources": { - "0": { - "name": "0", - "name_space": "0", - "parent_handle": "ta", - "parent_rc_name": "0", - "roas": { - "inner": {} - }, - "certificates": { - "inner": { - "9F50CE97A62D7420ECB0E76400B4D00A9FF80837": { - "uri": "rsync://localhost/repo/ta/0/9F50CE97A62D7420ECB0E76400B4D00A9FF80837.cer", - "limit": { - "asn": "none", - "v4": "none", - "v6": "none" - }, - "resource_set": { - "asn": "", - "v4": "192.168.0.0/16", - "v6": "" - }, - "cert": "MIIG9zCCBd+gAwIBAgIUbxupwYqnAX4cy0ub1ggDn4onxlgwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEwHhcNMjEwMzIyMTA1NjA0WhcNMjIwMzIyMTEwMTA0WjAzMTEwLwYDVQQDEyg5RjUwQ0U5N0E2MkQ3NDIwRUNCMEU3NjQwMEI0RDAwQTlGRjgwODM3MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr+c5o3kod88LphtXU6UAzmAnrCunhrJvEh2ojXC3bWCska09Nq90ntSQNTWHJZmrzAYMKHHGX4L+0VLoyKB/cFMH5uFNWPFn2gcg/a9Gp9SLCrr2BLF8cCziobX70kZAYsVc9yF+uElE6drCQrmTuXiiQiPFjG+zClC68EuomQW6NPyX6IzLnlM+X3wHKQpmUyFuJNBDonUZfjRDtv1SiHVaAg45Gx2Fent1C+/pveBnv1HiZLolpykwglw9xytCniW/h7j6HPDatn645szN4OVpYd2b4SGrOr8qEEQXo0i6HW2MtO/4C3aR3jwut/LsTTHOVaXdTiqSC+96zXggFQIDAQABo4ICBTCCAgEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUn1DOl6YtdCDssOdkALTQCp/4CDcwHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgEGMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvMC9DNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybDA8BggrBgEFBQcBAQQwMC4wLAYIKwYBBQUHMAKGIHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvdGEuY2VyMIHKBggrBgEFBQcBCwSBvTCBujAoBggrBgEFBQcwBYYccnN5bmM6Ly9sb2NhbGhvc3QvcmVwby9jYS8wLzBUBggrBgEFBQcwCoZIcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby9jYS8wLzlGNTBDRTk3QTYyRDc0MjBFQ0IwRTc2NDAwQjREMDBBOUZGODA4MzcubWZ0MDgGCCsGAQUFBzANhixodHRwczovL2xvY2FsaG9zdDozMDAwL3JyZHAvbm90aWZpY2F0aW9uLnhtbDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMB4GCCsGAQUFBwEHAQH/BA8wDTALBAIAATAFAwMAwKgwDQYJKoZIhvcNAQELBQADggEBAIlVqENjjP6omOtNzq1l2ctP1zcREBQpHgZwDOB9eZ407Re4iY4DcDwLKCFWvI7W0oqGJcIWB5r/Yqevhi4rGinwRewmggfYQYkeXg++27PYbPBN/m5GmKewCIMFnityDDVUj7t+728LUR3q177LP7jZttwHAWI09IKOT8IsP5Zi7NwIPBLK/RlS9RpX2ASkBZk9LAECljBGaYrD/PZZJ84b5nufOY5DJ/5lhJWG0E9Hm19uwS7wTnT4R4CL0hgghYUzaxtMhHW84Zmxa/N5sjY9Del7cOfnl4+/6GQ04jauo77Jr55n+AoRLh5mYUdt7VratdCsJwJjMm5hMj74xeM=", - "replaces": null - }, - "B497A5F1E84F9089F5F51A899725A7C5B076E03F": { - "uri": "rsync://localhost/repo/ta/0/B497A5F1E84F9089F5F51A899725A7C5B076E03F.cer", - "limit": { - "asn": "none", - "v4": "none", - "v6": "none" - }, - "resource_set": { - "asn": "", - "v4": "192.168.0.0/16", - "v6": "" - }, - "cert": "MIIG9zCCBd+gAwIBAgIUW3EzhNrQB9M65JrZLCAteneQF68wDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEwHhcNMjEwMzIyMTA1MzU4WhcNMjIwMzIyMTA1ODU4WjAzMTEwLwYDVQQDEyhCNDk3QTVGMUU4NEY5MDg5RjVGNTFBODk5NzI1QTdDNUIwNzZFMDNGMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5bhcVJrttIMsGwYCELCbLtsuH93eTa6F7G2rg5GwddHhJZnWPCKcw5ja0yqpNor5SYzGeqcTsebPoZuzVRG+akS/0IitmH/Uf1YBOk7b8BiAwiotZzlTk+4ZROL56wRhnWtU6JjghBplmMA3yDPWuGabgySRBAU7KyLocILEgnQWKk49P40BUU7mqOEi9dCX9DoRSptNXeBUVG8lWrcC3HH5gGYVxKE+rhxaHz2ncyVC9lLnO6ciLHEzh3xVbQQ5btW+xWvoQHCsUHKyLBBfu0BnqnPE3XM1YKTGj9Srllz4IT4EQXCMyalgu8VsMGLzAex3Q4pksLeUBB0LjLpfWwIDAQABo4ICBTCCAgEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUtJel8ehPkIn19RqJlyWnxbB24D8wHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgEGMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvMC9DNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybDA8BggrBgEFBQcBAQQwMC4wLAYIKwYBBQUHMAKGIHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvdGEuY2VyMIHKBggrBgEFBQcBCwSBvTCBujAoBggrBgEFBQcwBYYccnN5bmM6Ly9sb2NhbGhvc3QvcmVwby9jYS8wLzBUBggrBgEFBQcwCoZIcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby9jYS8wL0I0OTdBNUYxRTg0RjkwODlGNUY1MUE4OTk3MjVBN0M1QjA3NkUwM0YubWZ0MDgGCCsGAQUFBzANhixodHRwczovL2xvY2FsaG9zdDozMDAwL3JyZHAvbm90aWZpY2F0aW9uLnhtbDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMB4GCCsGAQUFBwEHAQH/BA8wDTALBAIAATAFAwMAwKgwDQYJKoZIhvcNAQELBQADggEBAHRBAYyA6gnl0jrTbHYwo3e9Q+2HJfbu4AHrAPMA+o5clSnhSDKJCOKD6hsRZFV8YrvfmZdQmmq8nL3WMFDva3h4LcHIrd0D/gC+Nio6t3zPXInxlCIzMq10Z0Cr8uPIlMe/LFZunQ4zZDGxi0PyeEqMJhgzi/499/HDo2lf/PhvseQEohv7ZT08C1SdMrw9u+eY3TklZrfOen8OPEuWy5AY7uoq4sWDV/rjavZTRL7HcPpwr69DehsAQ34sddhB6PxUkCN01+eh8AOvU+MBKQlXPsx5vxybIHQXJ2aTSq7wVMs8L5TOLRfKIKIshVLHbYBDopRZwTyZ5fO3bGfSvdM=", - "replaces": null - } - } - }, - "last_key_change": "2021-03-22T11:47:33.961617073Z", - "key_state": { - "active": { - "key_id": "C4893EC25530F2EADFC96E89F476DA1300801AA7", - "incoming_cert": { - "cert": "MIIIZjCCB06gAwIBAgIUSoqhtx5bgtaf8sRtp/ZeXbmH8SwwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEwIBcNMjEwMzIyMTAzOTM3WhgPMjEyMTAzMjIxMDQ0MzdaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQkFBRTdCRTkyQkZGNjU2MEUyMjAxOUFEMTY1M0RFMjQ2RjI5Q0FFNDVCMURGNzMwNDU1MjY5NzhGNUUzODhFMTM0OTJGQ0VCOTg4NUI0MDBGOEY1MTE1MEE0QjlGRjkwMzdBQTU3NjkyM0FCQTA4OTA3Mzc4RTQ5QUU2NkJBMjEzRTZFNzEzMjVCMjlEMzg4OEMxOUZGNEFCRERDQkI1RUJBQ0U2NDQwRkRFOTYyOUNCODlEOTkyRjlCRDkwN0VGNEZFNkVFNjM4NzA2NTNBNEQ5NjU4NUNFNTczMzlDNzIzQkY0ODJERDZBQzIzQjhEQUM2N0M5RTBDRjlCMDUyRjlEM0RDNjc0M0YzNTk0NzU0QTA1OUQwNDc2MzM1NDM2MkIyMjU2NzYyNzMxOUIwRUYyOEQ2MEExQjA3OTM4NkI4QkMwRTcyQjhGM0U1NDU4MkMxQzhGMzNFMEU4MzM1OEE2RDAwQUQ5MTAxRDY5QTBBNDVBQjg4RjEwNEY3OTUyRUEzRkRFQTJCM0ZCMUQzNkJBMUM2NjJGMDQ0RjFEODc3NzA0ODBEMzc4M0RBMDcyOUUzQzUxNTdGMDk5RjVFQzBDRkUwMkRFODQ5NDI3RkEyMDRBRjJBMzgxMUVBMTMzNUZFQUMxM0RBRUU0M0U3Q0UzQkQzQjE0Q0RGNTdDRTMwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuq576Sv/ZWDiIBmtFlPeJG8pyuRbHfcwRVJpePXjiOE0kvzrmIW0APj1EVCkuf+QN6pXaSOroIkHN45Jrma6IT5ucTJbKdOIjBn/Sr3cu166zmRA/elinLidmS+b2QfvT+buY4cGU6TZZYXOVzOccjv0gt1qwjuNrGfJ4M+bBS+dPcZ0PzWUdUoFnQR2M1Q2KyJWdicxmw7yjWChsHk4a4vA5yuPPlRYLByPM+DoM1im0ArZEB1poKRauI8QT3lS6j/eorP7HTa6HGYvBE8dh3cEgNN4PaBynjxRV/CZ9ewM/gLehJQn+iBK8qOBHqEzX+rBPa7kPnzjvTsUzfV84wIDAQABo4IBdjCCAXIwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgEGMIHJBggrBgEFBQcBCwSBvDCBuTAnBggrBgEFBQcwBYYbcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby90YS8wMFQGCCsGAQUFBzAKhkhyc3luYzovL2xvY2FsaG9zdC9yZXBvL3RhLzAvQzQ4OTNFQzI1NTMwRjJFQURGQzk2RTg5RjQ3NkRBMTMwMDgwMUFBNy5tZnQwOAYIKwYBBQUHMA2GLGh0dHBzOi8vbG9jYWxob3N0OjMwMDAvcnJkcC9ub3RpZmljYXRpb24ueG1sMBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwJwYIKwYBBQUHAQcBAf8EGDAWMAkEAgABMAMDAQAwCQQCAAIwAwMBADAhBggrBgEFBQcBCAEB/wQSMBCgDjAMMAoCAQACBQD/////MA0GCSqGSIb3DQEBCwUAA4IBAQB+onQ8rAvdp73fjkOGCOP8/wvOAoFtUg1rrsc5EhgU1qh3CjjCE+ILlIv6wHLjBeBUP4UamgbafH/DXiaIqY+sID+HLQBrOZfKMQwEZxXNWXmEgqK+4e52Y+wWEEbnxg+0QfiYTrtz06apG4/BLUThshX6nIv5lnIaR3daelGunx89KlNWOOl+5tZOnkim0g4OgBv914Hg/SumT7t4Z9l2+UyMpnM9C5gmroCUMxT121YRucVqmRD4/aWqNu2ihZInKVNuXsxzWtSn33etYIjJD4KrsqEJQLydBWraxDQwo63a/b4lRaIgjIz64ihREfc5xd+av3+hfMT/u9dMrB88", - "uri": "rsync://localhost/repo/ta/ta.cer", - "resources": { - "asn": "AS0-AS4294967295", - "v4": "0.0.0.0/0", - "v6": "::/0" - } - }, - "current_set": { - "number": 3, - "revocations": [ - { - "serial": "318316505773253361497376874909930893181779793730", - "expires": "2021-03-23T10:44:37.325554418Z" - }, - { - "serial": "650748792341242696138123586874381430911663227913", - "expires": "2021-03-23T10:58:58.687824581Z" - } - ], - "manifest_info": { - "name": "C4893EC25530F2EADFC96E89F476DA1300801AA7.mft", - "current": { - "content": "MIILvQYJKoZIhvcNAQcCoIILrjCCC6oCAQMxDzANBglghkgBZQMEAgEFADCCAUUGCyqGSIb3DQEJEAEaoIIBNASCATAwggEsAgEDGA8yMDIxMDMyMjEwNTYwNFoYDzIwMjEwMzIzMTEwMTA0WgYJYIZIAWUDBAIBMIH5MFEWLEI0OTdBNUYxRTg0RjkwODlGNUY1MUE4OTk3MjVBN0M1QjA3NkUwM0YuY2VyAyEA/KwLh2STwh7ULlTQytALJBH0+asPU6AGcd024zu3YA8wURYsOUY1MENFOTdBNjJENzQyMEVDQjBFNzY0MDBCNEQwMEE5RkY4MDgzNy5jZXIDIQDuE+o5+KS8SZyHLMsS316ecsy4x8NLD9At1+PN94pJPjBRFixDNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybAMhAJ+kJjmEoMd/eccfTBRE+yWHRntWs+Vv1Ed84xw9PpakoIIImTCCCJUwggd9oAMCAQICFEboVEprFEo3FpMdjXV7STXBBFZQMA0GCSqGSIb3DQEBCwUAMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQkFBRTdCRTkyQkZGNjU2MEUyMjAxOUFEMTY1M0RFMjQ2RjI5Q0FFNDVCMURGNzMwNDU1MjY5NzhGNUUzODhFMTM0OTJGQ0VCOTg4NUI0MDBGOEY1MTE1MEE0QjlGRjkwMzdBQTU3NjkyM0FCQTA4OTA3Mzc4RTQ5QUU2NkJBMjEzRTZFNzEzMjVCMjlEMzg4OEMxOUZGNEFCRERDQkI1RUJBQ0U2NDQwRkRFOTYyOUNCODlEOTkyRjlCRDkwN0VGNEZFNkVFNjM4NzA2NTNBNEQ5NjU4NUNFNTczMzlDNzIzQkY0ODJERDZBQzIzQjhEQUM2N0M5RTBDRjlCMDUyRjlEM0RDNjc0M0YzNTk0NzU0QTA1OUQwNDc2MzM1NDM2MkIyMjU2NzYyNzMxOUIwRUYyOEQ2MEExQjA3OTM4NkI4QkMwRTcyQjhGM0U1NDU4MkMxQzhGMzNFMEU4MzM1OEE2RDAwQUQ5MTAxRDY5QTBBNDVBQjg4RjEwNEY3OTUyRUEzRkRFQTJCM0ZCMUQzNkJBMUM2NjJGMDQ0RjFEODc3NzA0ODBEMzc4M0RBMDcyOUUzQzUxNTdGMDk5RjVFQzBDRkUwMkRFODQ5NDI3RkEyMDRBRjJBMzgxMUVBMTMzNUZFQUMxM0RBRUU0M0U3Q0UzQkQzQjE0Q0RGNTdDRTMwMjAzMDEwMDAxMB4XDTIxMDMyMjEwNTYwNFoXDTIxMDMyOTExMDEwNFowggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBBREExQTVGOThERDA4MUIxQjZDRjE2RTc4NjhCNThCRUEzOTNENzY2NUJDMzJDQjU1OEU3M0UzRTAyQzUzMzQ3NTNEMzAyNzM4RjQ1RjYyQUMzNTkwNThCNDVGRkE4Njc2MUU1QUQ3MjFDODEyRDkyMEE0NTY4NEY4Mjg0MjkwNTU5Qjk1OUVCMUI1MUUwNDNBQjdGQzA1ODk2ODNCQ0VBQ0YxRTEwMDBENTY2NDg2NUY3NDNFRDY4QjJFNTZDMUVFNjhENUVCNTQwMkNEODhERUIwRTVBODlEMjFGMzYwRDg4QjA3MjJCOEJDNTRDQzIwOTExOERDNjI5OUY3NEY1OURBQjhBMUIzMkFEQUUxNTc5OEEyNUU1QTlBOTgyQzgxMTMyRjczMkQ3QTQxQkFFMEJDRTc2NzkxNzYzNjZFMThBRDMzQjU5NzY0REYzOEZGMkIzRTZCMThEN0U0NDU5RkE2RTc3RkI2N0IzOEU1NkFEQjA4RERDMDRGRjBFM0VGMzQzQUVFRkM4MTA4QTk3NzkyOENGRkU0MkQ1QzE1OEUxOEEyRkZEODY4M0YzNURBOUY3QUIzMUIyNzkyMEY5MDQ4RTExMDg2QkM3OERGNzlFRjdFMTA2RDY3N0JDNUM2NDQ2ODM3MDVBNUM4MzhCNzVGRkY0NTAyQjY4RTY5QjAyMDMwMTAwMDEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCtoaX5jdCBsbbPFueGi1i+o5PXZlvDLLVY5z4+AsUzR1PTAnOPRfYqw1kFi0X/qGdh5a1yHIEtkgpFaE+ChCkFWblZ6xtR4EOrf8BYloO86s8eEADVZkhl90PtaLLlbB7mjV61QCzYjesOWonSHzYNiLByK4vFTMIJEY3GKZ909Z2rihsyra4VeYol5ampgsgRMvcy16QbrgvOdnkXY2bhitM7WXZN84/ys+axjX5EWfpud/tns45WrbCN3AT/Dj7zQ67vyBCKl3koz/5C1cFY4Yov/YaD812p96sxsnkg+QSOEQhrx433nvfhBtZ3vFxkRoNwWlyDi3X/9FAraOabAgMBAAGjggGnMIIBozAdBgNVHQ4EFgQUdDlnon3qbCwJZxbiRwvbSWwxLZYwHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwDgYDVR0PAQH/BAQDAgeAMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvMC9DNDg5M0VDMjU1MzBGMkVBREZDOTZFODlGNDc2REExMzAwODAxQUE3LmNybDA8BggrBgEFBQcBAQQwMC4wLAYIKwYBBQUHMAKGIHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGEvdGEuY2VyMGQGCCsGAQUFBwELBFgwVjBUBggrBgEFBQcwC4ZIcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby90YS8wL0M0ODkzRUMyNTUzMEYyRUFERkM5NkU4OUY0NzZEQTEzMDA4MDFBQTcubWZ0MBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwIQYIKwYBBQUHAQcBAf8EEjAQMAYEAgABBQAwBgQCAAIFADAVBggrBgEFBQcBCAEB/wQGMASgAgUAMA0GCSqGSIb3DQEBCwUAA4IBAQAgUixAEeQXqALJSFKa7jAv6c9eIuQzDdNhebaFzWO/2cnVaxEmzn/EpnRsTabEInZAx0ZGspRepI3aK4Ep0Vo727vihPfKiQri9DyC2xRNAvox6zwtuO71q4NPJcgdlCvjOd4kdT/ZwM/rnuVXgY7BwMLGC6Hnuagrv6LIMpwFXKkctcakS0mYfxm4FyvLNB3a7Ju2foZ4YyrzY4prrUiSDwyaPJnrKwTDTROAvAZ1sbIoOuGp0W8gT1uzminc2r6XrqF8jV8J/5KMm2RaxaIEoJdMiXTXNoV+nLKZFHX+BxCLS/Hq6hw74+OIIibtYX572fSEaKXxjiX2R9k4CmQDMYIBrDCCAagCAQOAFHQ5Z6J96mwsCWcW4kcL20lsMS2WMA0GCWCGSAFlAwQCAQUAoGswGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEaMBwGCSqGSIb3DQEJBTEPFw0yMTAzMjIxMTAxMDRaMC8GCSqGSIb3DQEJBDEiBCDEEBgzS5y6sSFLuZNAkiNicoTA/wvzqUDDFT9IOCU51DANBgkqhkiG9w0BAQEFAASCAQCJNOz8cq7l1tx+mckCMOAmduwKuDWs3TVRLfLvTJlCvNkYVUdZFtYmgmJFmj00SvL08iPbcVcMGqtR8qJ5Vtx5vmtjdQMQ+Jj6U2d3cSikmdG7WXH1fg6Gi+AqXbksFg0aAg4TgcQfcxK35sE8IyMs0HS7H4SOxOskiirngrkPhf8QY5mk132Xl+YMLPGMsDsgxGVKMt1/qfxCYvtqQskRo21sHBPCJtW8eWnpaDAkD93cM2zIYNS6Cq4ijF2IsNb2+pxb94vSnz8pXt8eR59ezjVQ2Xc2atI7Coqjy1cj0jYQXl4XU0P5ngEQvq/mYhjiygq0hpUPuzHL5wJ7W/uM", - "serial": "404810469598974038024323796113457425902295340624", - "expires": "2021-03-23T11:01:04.907150446Z" - }, - "next_update": "2021-03-23T11:01:04.907150446Z", - "old": "63b69931826fc885a00c30a653a0530b3e85e8cd051b4d56891360aa9ba04a72" - }, - "crl_info": { - "name": "C4893EC25530F2EADFC96E89F476DA1300801AA7.crl", - "current": { - "content": "MIID+jCCAuICAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCQUFFN0JFOTJCRkY2NTYwRTIyMDE5QUQxNjUzREUyNDZGMjlDQUU0NUIxREY3MzA0NTUyNjk3OEY1RTM4OEUxMzQ5MkZDRUI5ODg1QjQwMEY4RjUxMTUwQTRCOUZGOTAzN0FBNTc2OTIzQUJBMDg5MDczNzhFNDlBRTY2QkEyMTNFNkU3MTMyNUIyOUQzODg4QzE5RkY0QUJERENCQjVFQkFDRTY0NDBGREU5NjI5Q0I4OUQ5OTJGOUJEOTA3RUY0RkU2RUU2Mzg3MDY1M0E0RDk2NTg1Q0U1NzMzOUM3MjNCRjQ4MkRENkFDMjNCOERBQzY3QzlFMENGOUIwNTJGOUQzREM2NzQzRjM1OTQ3NTRBMDU5RDA0NzYzMzU0MzYyQjIyNTY3NjI3MzE5QjBFRjI4RDYwQTFCMDc5Mzg2QjhCQzBFNzJCOEYzRTU0NTgyQzFDOEYzM0UwRTgzMzU4QTZEMDBBRDkxMDFENjlBMEE0NUFCODhGMTA0Rjc5NTJFQTNGREVBMkIzRkIxRDM2QkExQzY2MkYwNDRGMUQ4Nzc3MDQ4MEQzNzgzREEwNzI5RTNDNTE1N0YwOTlGNUVDMENGRTAyREU4NDk0MjdGQTIwNEFGMkEzODExRUExMzM1RkVBQzEzREFFRTQzRTdDRTNCRDNCMTRDREY1N0NFMzAyMDMwMTAwMDEXDTIxMDMyMjEwNTYwNFoXDTIxMDMyMzExMDEwNFowTjAlAhQ3wc5Hxl4b0trHFnEsFr0nPCVXQhcNMjEwMzIzMTA0NDM3WjAlAhRx/JXHAP8LOQo9uL05Yg1RLLJECRcNMjEwMzIzMTA1ODU4WqAvMC0wHwYDVR0jBBgwFoAUxIk+wlUw8urfyW6J9HbaEwCAGqcwCgYDVR0UBAMCAQMwDQYJKoZIhvcNAQELBQADggEBAHjpd5YJjNYJ/EuWwrmtltaI0U4ySKEJsf07cKCqICjiqnN2Sxvos2cTFxsDw8EdvAfqVyzpU68Zym4EjQxoUxTdsKQkuughKbaZEZi8C8E7sUmS6IoZH/KtYtxGl+dV3SCHf4gORS5ZFEtk84QVKy70MGy5WBjkZCNTWvZ2ZQ6HR8EoBKuqRH8SVXRbXWFWlPYF+X6ZewaMBMSG8XjIeUDYRXG0tJ4h8xnXemR3JGP4WX+wXCQ6Q6aJMOo2TCIU9Jo+rv47BsqSghcgVheFHrewEpeM/ecvuIp7RnJ5ILguBX7K6CD8ngtFZ/U0055qi+R51kRI2HivBAE+Rryouoc=", - "serial": "3", - "expires": "2021-03-23T11:01:04.903319261Z" - }, - "old": "f1ea1b60f804869e58c24bfd5c9aa0e147f67e0cff59ff386158e3eec07b33eb" - } - }, - "request": null - } - } - } - }, - "children": { - "ca": { - "id_cert": null, - "resources": { - "asn": "", - "v4": "192.168.0.0/16", - "v6": "" - }, - "used_keys": { - "B497A5F1E84F9089F5F51A899725A7C5B076E03F": { - "current": "0" - }, - "9F50CE97A62D7420ECB0E76400B4D00A9FF80837": { - "current": "0" - } - } - } - }, - "routes": { - "map": {} - }, - "phantom_signer": null -} \ No newline at end of file diff --git a/test-resources/migrations/v0_8_1/cas/ta/command--1610030922--1--cmd-ca-repo-update.json b/test-resources/migrations/v0_8_1/cas/ta/command--1610030922--1--cmd-ca-repo-update.json deleted file mode 100644 index b561fd0e..00000000 --- a/test-resources/migrations/v0_8_1/cas/ta/command--1610030922--1--cmd-ca-repo-update.json +++ /dev/null @@ -1,15 +0,0 @@ -{ - "actor": "krill", - "time": "2021-01-07T14:48:42.036604Z", - "handle": "ta", - "version": 1, - "sequence": 1, - "details": { - "repo_update": null - }, - "effect": { - "events": [ - 1 - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_8_1/cas/ta/command--1610030922--2--cmd-ca-make-ta.json b/test-resources/migrations/v0_8_1/cas/ta/command--1610030922--2--cmd-ca-make-ta.json deleted file mode 100644 index da582ef4..00000000 --- a/test-resources/migrations/v0_8_1/cas/ta/command--1610030922--2--cmd-ca-make-ta.json +++ /dev/null @@ -1,13 +0,0 @@ -{ - "actor": "krill", - "time": "2021-01-07T14:48:42.038141Z", - "handle": "ta", - "version": 2, - "sequence": 2, - "details": "make_trust_anchor", - "effect": { - "events": [ - 2 - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_8_1/cas/ta/command--1610030922--3--cmd-ca-rcn-receive.json b/test-resources/migrations/v0_8_1/cas/ta/command--1610030922--3--cmd-ca-rcn-receive.json deleted file mode 100644 index 80e14002..00000000 --- a/test-resources/migrations/v0_8_1/cas/ta/command--1610030922--3--cmd-ca-rcn-receive.json +++ /dev/null @@ -1,22 +0,0 @@ -{ - "actor": "krill", - "time": "2021-01-07T14:48:42.206675Z", - "handle": "ta", - "version": 3, - "sequence": 3, - "details": { - "update_rcvd_cert": [ - "0", - { - "asn": "AS0-AS4294967295", - "v4": "0.0.0.0/0", - "v6": "::/0" - } - ] - }, - "effect": { - "events": [ - 3 - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_8_1/cas/ta/command--1610030922--4--cmd-ca-child-add.json b/test-resources/migrations/v0_8_1/cas/ta/command--1610030922--4--cmd-ca-child-add.json deleted file mode 100644 index 7b2469a2..00000000 --- a/test-resources/migrations/v0_8_1/cas/ta/command--1610030922--4--cmd-ca-child-add.json +++ /dev/null @@ -1,23 +0,0 @@ -{ - "actor": "krill", - "time": "2021-01-07T14:48:42.421518Z", - "handle": "ta", - "version": 4, - "sequence": 4, - "details": { - "child_add": [ - "testbed", - "C27EAEB707CEA225FC5B54EF0AE5B88FA47D2D3A", - { - "asn": "AS0-AS4294967295", - "v4": "0.0.0.0/0", - "v6": "::/0" - } - ] - }, - "effect": { - "events": [ - 4 - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_8_1/cas/ta/command--1610030924--5--cmd-ca-child-certify.json b/test-resources/migrations/v0_8_1/cas/ta/command--1610030924--5--cmd-ca-child-certify.json deleted file mode 100644 index ec7e5463..00000000 --- a/test-resources/migrations/v0_8_1/cas/ta/command--1610030924--5--cmd-ca-child-certify.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "actor": "anonymous", - "time": "2021-01-07T14:48:44.276202Z", - "handle": "ta", - "version": 5, - "sequence": 5, - "details": { - "child_certify": [ - "testbed", - "0", - { - "asn": "none", - "v4": "none", - "v6": "none" - }, - "578C2EF4CFC1810860F52DC0D86530B1176FAE2B" - ] - }, - "effect": { - "events": [ - 5, - 6, - 7 - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_8_1/cas/ta/command--1610100840--6--cmd-ca-publish.json b/test-resources/migrations/v0_8_1/cas/ta/command--1610100840--6--cmd-ca-publish.json deleted file mode 100644 index 0e3dbd16..00000000 --- a/test-resources/migrations/v0_8_1/cas/ta/command--1610100840--6--cmd-ca-publish.json +++ /dev/null @@ -1,13 +0,0 @@ -{ - "actor": "krill", - "time": "2021-01-08T10:14:00.682228Z", - "handle": "ta", - "version": 8, - "sequence": 6, - "details": "republish", - "effect": { - "events": [ - 8 - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_8_1/cas/ta/command--1610537281--7--cmd-ca-publish.json b/test-resources/migrations/v0_8_1/cas/ta/command--1610537281--7--cmd-ca-publish.json deleted file mode 100644 index 83740fe0..00000000 --- a/test-resources/migrations/v0_8_1/cas/ta/command--1610537281--7--cmd-ca-publish.json +++ /dev/null @@ -1,13 +0,0 @@ -{ - "actor": "krill", - "time": "2021-01-13T11:28:01.075106Z", - "handle": "ta", - "version": 9, - "sequence": 7, - "details": "republish", - "effect": { - "events": [ - 9 - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_8_1/cas/ta/delta-0.json b/test-resources/migrations/v0_8_1/cas/ta/delta-0.json deleted file mode 100644 index 3b63ccbb..00000000 --- a/test-resources/migrations/v0_8_1/cas/ta/delta-0.json +++ /dev/null @@ -1,10 +0,0 @@ -{ - "id": "ta", - "version": 0, - "details": { - "id": { - "key": "D272D0F1E7F20EBE4F3038F29ACFA9774590E835", - "cert": "MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhEMjcyRDBGMUU3RjIwRUJFNEYzMDM4RjI5QUNGQTk3NzQ1OTBFODM1MB4XDTIxMDEwNzE0NDM0MloXDTM2MDEwNzE0NDg0MlowMzExMC8GA1UEAxMoRDI3MkQwRjFFN0YyMEVCRTRGMzAzOEYyOUFDRkE5Nzc0NTkwRTgzNTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN3jacZMe8xlT+AcOVWbj49zwPCzQpzNSwUTPqsYYhAU9mwQXA0tFx0e5VC+qGYCMLJkY1goywEi+qiLJVdlLSmB8LokYcgJKG9EIw3q3JxrfseLVWJjbQAd0VdkG4FvU3LtB+f3Yr1whM6T4AOt070de/9Ox20RioCiSBCEsgfLTmFZsGCzUomtp9krfO7HpBMar08YJ46Bm1h450K79+AbvvhaRctSnrmaxjd/TBi4Q6FtskkcRonBCF1Lcu8eqn1nnfjglflOu/5yOqk+4OXel9b4zx+iooybmjhIhi6istKpYQgzVaAVnpGP3//wF6/zgQsxfHtC74DDA6jvJq8CAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU0nLQ8efyDr5PMDjyms+pd0WQ6DUwHwYDVR0jBBgwFoAU0nLQ8efyDr5PMDjyms+pd0WQ6DUwDQYJKoZIhvcNAQELBQADggEBAMWMRfUSu2C3VznHT+gH7Hg1UobuxZSAlN44kgcWryZa849oPml4OPy3iGKCeEKDxuEAdM/FGXgOUkMSR/psP3ym5FG+RVollSyj25GVgmgmxkV9VaoT4xiJxg3qfHNIeDgReLWYumfHanrpuVw56fhQb+5IEkq4Cw1mrSeoJxtC5Hdij/taylXJ0kP9rEnC5Kh7xGQlvMQXZc+Zn3i+myyHBK8EgUH7un++6b6uxNY+8/2MWN5kO/0sY2QQCgXAfFToiY95emR//c5rud3Wx4oboiS/u4iAObDyV5dCPpHKEP9lG6JWEOkRZYBA5KHydHhYHnKFJ+awvevrr+qn918=" - } - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_8_1/cas/ta/delta-1.json b/test-resources/migrations/v0_8_1/cas/ta/delta-1.json deleted file mode 100644 index cf480e43..00000000 --- a/test-resources/migrations/v0_8_1/cas/ta/delta-1.json +++ /dev/null @@ -1,12 +0,0 @@ -{ - "id": "ta", - "version": 1, - "details": { - "repo_updated": { - "embedded": { - "base_uri": "rsync://lostlhost/repo/ta/", - "rpki_notify": "https://localhost:3000/rrdp/notification.xml" - } - } - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_8_1/cas/ta/delta-2.json b/test-resources/migrations/v0_8_1/cas/ta/delta-2.json deleted file mode 100644 index 77f736e3..00000000 --- a/test-resources/migrations/v0_8_1/cas/ta/delta-2.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "id": "ta", - "version": 2, - "details": { - "trust_anchor_made": { - "cert": "MIIIZjCCB06gAwIBAgIUL1jmoavzDeBUl69dks9XgsYxicwwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEwIBcNMjEwMTA3MTQ0MzQyWhgPMjEyMTAxMDcxNDQ4NDJaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQ0QyODM2REI3MjQ0NDMyNzU3OTNGODk5MkYzREMwMzUzRjA2NkRFNzk1QzMzMUMwMjRENUYxOUZGNEQ0OUZCQjdGQzc2MkRENkJENUUxNDIyM0U3MDQyMjYxMzY3MkFEQzVENkRDQkQxRTU5NTJCQTU1OTcwNzM4QzhERDBEMEQ3MjkyREM2NzkzMzYwOEU5RUI1ODJFRjk2NTcxNkIwM0YzMDM1MzY1OURGQTU0MjA1RDczRkI0RENBNzQzOTRDQUYyM0YyNzQyQjJBODExQ0Y5MkI0MjZGNTk0NzZGQkQzMDNBREY3MjI4MjY1MDMzMDBGRENGMjlBNTMxRjY0NDc3N0U1NTE3MDdGQzhDODUyN0QzNzRBMUEyNDEyNkZGMjJGOEY0QkVEOTRDQkRBRTQ2Njc1MzI2RDBEMDI2NDU5ODUyODk4OTk3QzNFNjc3NUFDMTk5RUQxRTc5MEUzMkIwN0FGQjI4N0YyQTdGQzlERjc0RkZGNDg1NzlBMDcyNEYyRDJDNTdDMjdFOEQwREUxMkNENkQ2RTJBRTJFMkMxMjkxNTE4MzdEMTVDRThBREI1NzA1NEJCODU2NUY4RDU4NEU4MzkxODE1RjA0MzZGOUMzOEZERUUxMDVCQjk4RjZDQUQ1MjE5RkUyNkNCQkY2MDNCM0M4N0MxN0FBQ0YwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzSg223JEQydXk/iZLz3ANT8GbeeVwzHAJNXxn/TUn7t/x2Lda9XhQiPnBCJhNnKtxdbcvR5ZUrpVlwc4yN0NDXKS3GeTNgjp61gu+WVxawPzA1NlnfpUIF1z+03KdDlMryPydCsqgRz5K0JvWUdvvTA633IoJlAzAP3PKaUx9kR3flUXB/yMhSfTdKGiQSb/Ivj0vtlMva5GZ1Mm0NAmRZhSiYmXw+Z3WsGZ7R55DjKwevsofyp/yd90//SFeaByTy0sV8J+jQ3hLNbW4q4uLBKRUYN9Fc6K21cFS7hWX41YToORgV8ENvnDj97hBbuY9srVIZ/ibLv2A7PIfBeqzwIDAQABo4IBdjCCAXIwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUhQtAABMRo95Q7W09+snI0Ic/PgMwDgYDVR0PAQH/BAQDAgEGMIHJBggrBgEFBQcBCwSBvDCBuTAnBggrBgEFBQcwBYYbcnN5bmM6Ly9sb3N0bGhvc3QvcmVwby90YS8wMFQGCCsGAQUFBzAKhkhyc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhLzAvODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5tZnQwOAYIKwYBBQUHMA2GLGh0dHBzOi8vbG9jYWxob3N0OjMwMDAvcnJkcC9ub3RpZmljYXRpb24ueG1sMBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwJwYIKwYBBQUHAQcBAf8EGDAWMAkEAgABMAMDAQAwCQQCAAIwAwMBADAhBggrBgEFBQcBCAEB/wQSMBCgDjAMMAoCAQACBQD/////MA0GCSqGSIb3DQEBCwUAA4IBAQCkZ0kAVe2d8sIp9+DUtf4nvXItI2H1ouWZIJnOgBvrWlwTMbfijQxRD04WSLwzOVC39+2bqP9GGDqr9nBOPbpbtQPhYhV4wbvaVLc7wFgIrVrJ/D7fV9HasH6xQpeH1c/plHKPHFQdHGQZU/s3DKwl1cJ4iMxqRbuC3d3LwnMOuviej58EzDW351ZCu8xNxah93VS5Rspw0x2OHhml5xGIg735QKlXKT0gVfFN8CG+AOjzD0l5wKv7Nt7HQ07ikAYj6NZ7/7eiupg9hIyspWif+po7MKzhbR3PrYcLOFp9jAOCdMOY7E3blgZVsQsIZGQO4tTtgdnYURw0I4kx2YQW", - "resources": { - "asn": "AS0-AS4294967295", - "v4": "0.0.0.0/0", - "v6": "::/0" - }, - "tal": { - "uris": [ - "https://localhost:3000/rrdp/ta/ta.cer" - ], - "encoded_ski": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzSg223JEQydXk/iZLz3ANT8GbeeVwzHAJNXxn/TUn7t/x2Lda9XhQiPnBCJhNnKtxdbcvR5ZUrpVlwc4yN0NDXKS3GeTNgjp61gu+WVxawPzA1NlnfpUIF1z+03KdDlMryPydCsqgRz5K0JvWUdvvTA633IoJlAzAP3PKaUx9kR3flUXB/yMhSfTdKGiQSb/Ivj0vtlMva5GZ1Mm0NAmRZhSiYmXw+Z3WsGZ7R55DjKwevsofyp/yd90//SFeaByTy0sV8J+jQ3hLNbW4q4uLBKRUYN9Fc6K21cFS7hWX41YToORgV8ENvnDj97hBbuY9srVIZ/ibLv2A7PIfBeqzwIDAQAB" - } - } - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_8_1/cas/ta/delta-3.json b/test-resources/migrations/v0_8_1/cas/ta/delta-3.json deleted file mode 100644 index 51015bc4..00000000 --- a/test-resources/migrations/v0_8_1/cas/ta/delta-3.json +++ /dev/null @@ -1,68 +0,0 @@ -{ - "id": "ta", - "version": 3, - "details": { - "key_pending_to_active": [ - "0", - { - "key_id": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03", - "incoming_cert": { - "cert": "MIIIZjCCB06gAwIBAgIUL1jmoavzDeBUl69dks9XgsYxicwwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEwIBcNMjEwMTA3MTQ0MzQyWhgPMjEyMTAxMDcxNDQ4NDJaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQ0QyODM2REI3MjQ0NDMyNzU3OTNGODk5MkYzREMwMzUzRjA2NkRFNzk1QzMzMUMwMjRENUYxOUZGNEQ0OUZCQjdGQzc2MkRENkJENUUxNDIyM0U3MDQyMjYxMzY3MkFEQzVENkRDQkQxRTU5NTJCQTU1OTcwNzM4QzhERDBEMEQ3MjkyREM2NzkzMzYwOEU5RUI1ODJFRjk2NTcxNkIwM0YzMDM1MzY1OURGQTU0MjA1RDczRkI0RENBNzQzOTRDQUYyM0YyNzQyQjJBODExQ0Y5MkI0MjZGNTk0NzZGQkQzMDNBREY3MjI4MjY1MDMzMDBGRENGMjlBNTMxRjY0NDc3N0U1NTE3MDdGQzhDODUyN0QzNzRBMUEyNDEyNkZGMjJGOEY0QkVEOTRDQkRBRTQ2Njc1MzI2RDBEMDI2NDU5ODUyODk4OTk3QzNFNjc3NUFDMTk5RUQxRTc5MEUzMkIwN0FGQjI4N0YyQTdGQzlERjc0RkZGNDg1NzlBMDcyNEYyRDJDNTdDMjdFOEQwREUxMkNENkQ2RTJBRTJFMkMxMjkxNTE4MzdEMTVDRThBREI1NzA1NEJCODU2NUY4RDU4NEU4MzkxODE1RjA0MzZGOUMzOEZERUUxMDVCQjk4RjZDQUQ1MjE5RkUyNkNCQkY2MDNCM0M4N0MxN0FBQ0YwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzSg223JEQydXk/iZLz3ANT8GbeeVwzHAJNXxn/TUn7t/x2Lda9XhQiPnBCJhNnKtxdbcvR5ZUrpVlwc4yN0NDXKS3GeTNgjp61gu+WVxawPzA1NlnfpUIF1z+03KdDlMryPydCsqgRz5K0JvWUdvvTA633IoJlAzAP3PKaUx9kR3flUXB/yMhSfTdKGiQSb/Ivj0vtlMva5GZ1Mm0NAmRZhSiYmXw+Z3WsGZ7R55DjKwevsofyp/yd90//SFeaByTy0sV8J+jQ3hLNbW4q4uLBKRUYN9Fc6K21cFS7hWX41YToORgV8ENvnDj97hBbuY9srVIZ/ibLv2A7PIfBeqzwIDAQABo4IBdjCCAXIwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUhQtAABMRo95Q7W09+snI0Ic/PgMwDgYDVR0PAQH/BAQDAgEGMIHJBggrBgEFBQcBCwSBvDCBuTAnBggrBgEFBQcwBYYbcnN5bmM6Ly9sb3N0bGhvc3QvcmVwby90YS8wMFQGCCsGAQUFBzAKhkhyc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhLzAvODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5tZnQwOAYIKwYBBQUHMA2GLGh0dHBzOi8vbG9jYWxob3N0OjMwMDAvcnJkcC9ub3RpZmljYXRpb24ueG1sMBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwJwYIKwYBBQUHAQcBAf8EGDAWMAkEAgABMAMDAQAwCQQCAAIwAwMBADAhBggrBgEFBQcBCAEB/wQSMBCgDjAMMAoCAQACBQD/////MA0GCSqGSIb3DQEBCwUAA4IBAQCkZ0kAVe2d8sIp9+DUtf4nvXItI2H1ouWZIJnOgBvrWlwTMbfijQxRD04WSLwzOVC39+2bqP9GGDqr9nBOPbpbtQPhYhV4wbvaVLc7wFgIrVrJ/D7fV9HasH6xQpeH1c/plHKPHFQdHGQZU/s3DKwl1cJ4iMxqRbuC3d3LwnMOuviej58EzDW351ZCu8xNxah93VS5Rspw0x2OHhml5xGIg735QKlXKT0gVfFN8CG+AOjzD0l5wKv7Nt7HQ07ikAYj6NZ7/7eiupg9hIyspWif+po7MKzhbR3PrYcLOFp9jAOCdMOY7E3blgZVsQsIZGQO4tTtgdnYURw0I4kx2YQW", - "uri": "rsync://lostlhost/repo/ta/ta.cer", - "resources": { - "asn": "AS0-AS4294967295", - "v4": "0.0.0.0/0", - "v6": "::/0" - } - }, - "current_set": { - "number": 1, - "revocations": [], - "manifest_info": { - "name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.mft", - "current": { - "content": "MIILDgYJKoZIhvcNAQcCoIIK/zCCCvsCAQMxDTALBglghkgBZQMEAgEwgZsGCyqGSIb3DQEJEAEaoIGLBIGIMIGFAgEBGA8yMDIxMDEwNzE0NDM0MloYDzIwMjEwMTA4MTQ0ODQyWgYJYIZIAWUDBAIBMFMwURYsODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwDIQBXMtxEZAK2j3yWhvJ8kdnJVY3JzDGX8tOPAwdVQIiubaCCCJkwggiVMIIHfaADAgECAhR7d20umSmlUcdHOHFN7onxJPoZ/TANBgkqhkiG9w0BAQsFADCCAi0xggIpMIICJQYDVQQDE4ICHDMwODIwMTBBMDI4MjAxMDEwMENEMjgzNkRCNzI0NDQzMjc1NzkzRjg5OTJGM0RDMDM1M0YwNjZERTc5NUMzMzFDMDI0RDVGMTlGRjRENDlGQkI3RkM3NjJERDZCRDVFMTQyMjNFNzA0MjI2MTM2NzJBREM1RDZEQ0JEMUU1OTUyQkE1NTk3MDczOEM4REQwRDBENzI5MkRDNjc5MzM2MDhFOUVCNTgyRUY5NjU3MTZCMDNGMzAzNTM2NTlERkE1NDIwNUQ3M0ZCNERDQTc0Mzk0Q0FGMjNGMjc0MkIyQTgxMUNGOTJCNDI2RjU5NDc2RkJEMzAzQURGNzIyODI2NTAzMzAwRkRDRjI5QTUzMUY2NDQ3NzdFNTUxNzA3RkM4Qzg1MjdEMzc0QTFBMjQxMjZGRjIyRjhGNEJFRDk0Q0JEQUU0NjY3NTMyNkQwRDAyNjQ1OTg1Mjg5ODk5N0MzRTY3NzVBQzE5OUVEMUU3OTBFMzJCMDdBRkIyODdGMkE3RkM5REY3NEZGRjQ4NTc5QTA3MjRGMkQyQzU3QzI3RThEMERFMTJDRDZENkUyQUUyRTJDMTI5MTUxODM3RDE1Q0U4QURCNTcwNTRCQjg1NjVGOEQ1ODRFODM5MTgxNUYwNDM2RjlDMzhGREVFMTA1QkI5OEY2Q0FENTIxOUZFMjZDQkJGNjAzQjNDODdDMTdBQUNGMDIwMzAxMDAwMTAeFw0yMTAxMDcxNDQzNDJaFw0yMTAxMTQxNDQ4NDJaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQjVBRjI5QUY3ODIxM0YyNTZERTg2OUI4ODhEQzRENEY0OUI2NkE4QzM1RjkwMkY5QjFDNTY2RUI5QUNFODU5MDMyRTM4MkI0NkIzNzRBRDg2MjczMDNENEZBRDg5MEI2RDQ3NTBFOTFBNUIyMDU3OTBEMjU0Q0VDRkYzRjlCRTU3RUY3Qzc4RDZBMEUxMTQ4RUNCMkQzMjY0OEE4NDUwQ0E4Nzc4N0Y5MTkwQkFDMUFFQjA2RDcyODZBNDlBN0Q2QjYyMUVBQUExMDc2NUJFQzUwMUM0NTcxMzA4QTZDNUZBNTM5MjdGNzYzN0U5RkQxMDAyMzE4QTBGNjRGMkU3MzgyMUE3RTRGNzBERTQ3MjA5NjA3MzRCOTlCOTRENUI2QkQzQjE4M0NFQUY1MjQxNUVEN0Y1NTJBMDIxQTM1NjJEOTVGREYxNjJDNkU5MTNCNzlFMzcxMUJENDkyQzZERjFBNzk5QTUxRDA1RDQwRTU0RkZDQTU3Q0I0OUNCNEM5QkI2MDBFMkVEMDQxNkZGMTRBNTlGNDRFNTMzQzU1ODI2RTkyMDM3M0I4MzFDMzA5MEYzMDUwNjA0Qzg4QURFNUNDODVFNUMyQ0NFM0M2NTE2MkFBQ0VDMjk1QjI2Q0U2MDFBNTM1MjAxMjI1MTlDN0Y2ODQ3NzI1MDI2RTlFMTEwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAta8pr3ghPyVt6Gm4iNxNT0m2aow1+QL5scVm65rOhZAy44K0azdK2GJzA9T62JC21HUOkaWyBXkNJUzs/z+b5X73x41qDhFI7LLTJkioRQyod4f5GQusGusG1yhqSafWtiHqqhB2W+xQHEVxMIpsX6U5J/djfp/RACMYoPZPLnOCGn5PcN5HIJYHNLmblNW2vTsYPOr1JBXtf1UqAho1Ytlf3xYsbpE7eeNxG9SSxt8aeZpR0F1A5U/8pXy0nLTJu2AOLtBBb/FKWfROUzxVgm6SA3O4McMJDzBQYEyIreXMheXCzOPGUWKqzsKVsmzmAaU1IBIlGcf2hHclAm6eEQIDAQABo4IBpzCCAaMwHQYDVR0OBBYEFDHUwV2kk93zGIbpVc6wgx5WA7yHMB8GA1UdIwQYMBaAFIULQAATEaPeUO1tPfrJyNCHPz4DMA4GA1UdDwEB/wQEAwIHgDBZBgNVHR8EUjBQME6gTKBKhkhyc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhLzAvODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwwPAYIKwYBBQUHAQEEMDAuMCwGCCsGAQUFBzAChiByc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhL3RhLmNlcjBkBggrBgEFBQcBCwRYMFYwVAYIKwYBBQUHMAuGSHJzeW5jOi8vbG9zdGxob3N0L3JlcG8vdGEvMC84NTBCNDAwMDEzMTFBM0RFNTBFRDZEM0RGQUM5QzhEMDg3M0YzRTAzLm1mdDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCEGCCsGAQUFBwEHAQH/BBIwEDAGBAIAAQUAMAYEAgACBQAwFQYIKwYBBQUHAQgBAf8EBjAEoAIFADANBgkqhkiG9w0BAQsFAAOCAQEAloqK+RhQFAtfSVI+nWBr1fyHFKVEhSMEdpGYSwzG5xBOh6iMnXM9ti4I2Olrh3rmLCx8tb76SNmm/8UsaRv0tierluN+ZxR62v271eFunAcUmGPkGY2E/u79tNGQZ1jRJCFeiN7K6fQmOzUyUilr7qifHQGLCDGiu9S21M2SJFu+RAXEUGWnDJ6CbQ/sbH6Psi0Twuo18ADBX9tPTfQEAPP/QK+wwueIdVT8Ve9l9/YpvWzSdopgCW00W4i3p14IQ90I41A+9LPmthLqX4iFYiLfaH4bY6qwfpGBlBA+iyJzSHpoKFsm75uvnUhYkUYZ7F53o6krQWg0umbV/t4LFzGCAaowggGmAgEDgBQx1MFdpJPd8xiG6VXOsIMeVgO8hzALBglghkgBZQMEAgGgazAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQARowHAYJKoZIhvcNAQkFMQ8XDTIxMDEwNzE0NDg0MlowLwYJKoZIhvcNAQkEMSIEIMLV0vz/dR2wTz93ouxGAhfLQSyOkjhlxzZfklGCB7lBMA0GCSqGSIb3DQEBAQUABIIBAGFI8XpsEwcuFdmWRjex0snxtn1ViZRe1lowZmgF32G43vCbmUq3TW7lMoHfQKnY69AvCTFVIMdR34AyLs6tZOZcvp81/He+XmYEuP7w19BRjYjeP356XRuLLUb8poGjR6vwQAQ1vgP+mvRq2twGJuwkvng3CQHxcI5Wt5WG/TJTfgdc368uMJO1861Hz24p3hCt4iqto1lXHKI4mUbLbGXbWCaxw2F3mtD/Vr5th6HO1MKrGrufwaXRSZsKCyIrYYtiQD/EMNag0m9tAToez3geIyASQsOS86rQ+BlgUrOiiyoVsgByDZh75aK2vQZmsodNnWqGuiGlYIPq0QgB6FQ=", - "serial": "704869164585700966467604688662219012818071067133", - "expires": "2021-01-08T14:48:42.210471Z" - }, - "next_update": "2021-01-08T14:48:42.210471Z", - "old": null - }, - "crl_info": { - "name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.crl", - "current": { - "content": "MIIDrDCCApQCAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEXDTIxMDEwNzE0NDM0MloXDTIxMDEwODE0NDg0MlowAKAvMC0wHwYDVR0jBBgwFoAUhQtAABMRo95Q7W09+snI0Ic/PgMwCgYDVR0UBAMCAQEwDQYJKoZIhvcNAQELBQADggEBABlhhKHSGBgrdHU5qG/QQQB9W6tPvcWFj8Ln5Rd7kQB5kUCt870KAs2sgVscnVXimHJPpDDi09oKaisYLNlDZb//vgOhJiU4etBqhpBHtpjAWGNqejvS/BVv0n5mlKmrsefq946RoPxMHejL28QwKpyWaRdaCsT1xSDp0+9uu/1DobucgO5vfNtYYoSVazqtx3F0M6GUh5diWtCBIHEmghHGmn16+LPdvs/AAR8z2d31q9RpaT7UI0FITme1j9rIoBHKL0OxXoPb8L/baRS5FG9NnYPgvRJ7d4AJc7T14WxdeEs+y1Kwq/V4cNX1259BFfNLXJrBX0BtAm0erKmMBEo=", - "serial": "1", - "expires": "2021-01-08T14:48:42.206964Z" - }, - "old": null - } - }, - "request": null - }, - { - "ca_repo": "rsync://lostlhost/repo/ta/0", - "added": [ - { - "name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.mft", - "object": { - "content": "MIILDgYJKoZIhvcNAQcCoIIK/zCCCvsCAQMxDTALBglghkgBZQMEAgEwgZsGCyqGSIb3DQEJEAEaoIGLBIGIMIGFAgEBGA8yMDIxMDEwNzE0NDM0MloYDzIwMjEwMTA4MTQ0ODQyWgYJYIZIAWUDBAIBMFMwURYsODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwDIQBXMtxEZAK2j3yWhvJ8kdnJVY3JzDGX8tOPAwdVQIiubaCCCJkwggiVMIIHfaADAgECAhR7d20umSmlUcdHOHFN7onxJPoZ/TANBgkqhkiG9w0BAQsFADCCAi0xggIpMIICJQYDVQQDE4ICHDMwODIwMTBBMDI4MjAxMDEwMENEMjgzNkRCNzI0NDQzMjc1NzkzRjg5OTJGM0RDMDM1M0YwNjZERTc5NUMzMzFDMDI0RDVGMTlGRjRENDlGQkI3RkM3NjJERDZCRDVFMTQyMjNFNzA0MjI2MTM2NzJBREM1RDZEQ0JEMUU1OTUyQkE1NTk3MDczOEM4REQwRDBENzI5MkRDNjc5MzM2MDhFOUVCNTgyRUY5NjU3MTZCMDNGMzAzNTM2NTlERkE1NDIwNUQ3M0ZCNERDQTc0Mzk0Q0FGMjNGMjc0MkIyQTgxMUNGOTJCNDI2RjU5NDc2RkJEMzAzQURGNzIyODI2NTAzMzAwRkRDRjI5QTUzMUY2NDQ3NzdFNTUxNzA3RkM4Qzg1MjdEMzc0QTFBMjQxMjZGRjIyRjhGNEJFRDk0Q0JEQUU0NjY3NTMyNkQwRDAyNjQ1OTg1Mjg5ODk5N0MzRTY3NzVBQzE5OUVEMUU3OTBFMzJCMDdBRkIyODdGMkE3RkM5REY3NEZGRjQ4NTc5QTA3MjRGMkQyQzU3QzI3RThEMERFMTJDRDZENkUyQUUyRTJDMTI5MTUxODM3RDE1Q0U4QURCNTcwNTRCQjg1NjVGOEQ1ODRFODM5MTgxNUYwNDM2RjlDMzhGREVFMTA1QkI5OEY2Q0FENTIxOUZFMjZDQkJGNjAzQjNDODdDMTdBQUNGMDIwMzAxMDAwMTAeFw0yMTAxMDcxNDQzNDJaFw0yMTAxMTQxNDQ4NDJaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQjVBRjI5QUY3ODIxM0YyNTZERTg2OUI4ODhEQzRENEY0OUI2NkE4QzM1RjkwMkY5QjFDNTY2RUI5QUNFODU5MDMyRTM4MkI0NkIzNzRBRDg2MjczMDNENEZBRDg5MEI2RDQ3NTBFOTFBNUIyMDU3OTBEMjU0Q0VDRkYzRjlCRTU3RUY3Qzc4RDZBMEUxMTQ4RUNCMkQzMjY0OEE4NDUwQ0E4Nzc4N0Y5MTkwQkFDMUFFQjA2RDcyODZBNDlBN0Q2QjYyMUVBQUExMDc2NUJFQzUwMUM0NTcxMzA4QTZDNUZBNTM5MjdGNzYzN0U5RkQxMDAyMzE4QTBGNjRGMkU3MzgyMUE3RTRGNzBERTQ3MjA5NjA3MzRCOTlCOTRENUI2QkQzQjE4M0NFQUY1MjQxNUVEN0Y1NTJBMDIxQTM1NjJEOTVGREYxNjJDNkU5MTNCNzlFMzcxMUJENDkyQzZERjFBNzk5QTUxRDA1RDQwRTU0RkZDQTU3Q0I0OUNCNEM5QkI2MDBFMkVEMDQxNkZGMTRBNTlGNDRFNTMzQzU1ODI2RTkyMDM3M0I4MzFDMzA5MEYzMDUwNjA0Qzg4QURFNUNDODVFNUMyQ0NFM0M2NTE2MkFBQ0VDMjk1QjI2Q0U2MDFBNTM1MjAxMjI1MTlDN0Y2ODQ3NzI1MDI2RTlFMTEwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAta8pr3ghPyVt6Gm4iNxNT0m2aow1+QL5scVm65rOhZAy44K0azdK2GJzA9T62JC21HUOkaWyBXkNJUzs/z+b5X73x41qDhFI7LLTJkioRQyod4f5GQusGusG1yhqSafWtiHqqhB2W+xQHEVxMIpsX6U5J/djfp/RACMYoPZPLnOCGn5PcN5HIJYHNLmblNW2vTsYPOr1JBXtf1UqAho1Ytlf3xYsbpE7eeNxG9SSxt8aeZpR0F1A5U/8pXy0nLTJu2AOLtBBb/FKWfROUzxVgm6SA3O4McMJDzBQYEyIreXMheXCzOPGUWKqzsKVsmzmAaU1IBIlGcf2hHclAm6eEQIDAQABo4IBpzCCAaMwHQYDVR0OBBYEFDHUwV2kk93zGIbpVc6wgx5WA7yHMB8GA1UdIwQYMBaAFIULQAATEaPeUO1tPfrJyNCHPz4DMA4GA1UdDwEB/wQEAwIHgDBZBgNVHR8EUjBQME6gTKBKhkhyc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhLzAvODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwwPAYIKwYBBQUHAQEEMDAuMCwGCCsGAQUFBzAChiByc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhL3RhLmNlcjBkBggrBgEFBQcBCwRYMFYwVAYIKwYBBQUHMAuGSHJzeW5jOi8vbG9zdGxob3N0L3JlcG8vdGEvMC84NTBCNDAwMDEzMTFBM0RFNTBFRDZEM0RGQUM5QzhEMDg3M0YzRTAzLm1mdDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCEGCCsGAQUFBwEHAQH/BBIwEDAGBAIAAQUAMAYEAgACBQAwFQYIKwYBBQUHAQgBAf8EBjAEoAIFADANBgkqhkiG9w0BAQsFAAOCAQEAloqK+RhQFAtfSVI+nWBr1fyHFKVEhSMEdpGYSwzG5xBOh6iMnXM9ti4I2Olrh3rmLCx8tb76SNmm/8UsaRv0tierluN+ZxR62v271eFunAcUmGPkGY2E/u79tNGQZ1jRJCFeiN7K6fQmOzUyUilr7qifHQGLCDGiu9S21M2SJFu+RAXEUGWnDJ6CbQ/sbH6Psi0Twuo18ADBX9tPTfQEAPP/QK+wwueIdVT8Ve9l9/YpvWzSdopgCW00W4i3p14IQ90I41A+9LPmthLqX4iFYiLfaH4bY6qwfpGBlBA+iyJzSHpoKFsm75uvnUhYkUYZ7F53o6krQWg0umbV/t4LFzGCAaowggGmAgEDgBQx1MFdpJPd8xiG6VXOsIMeVgO8hzALBglghkgBZQMEAgGgazAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQARowHAYJKoZIhvcNAQkFMQ8XDTIxMDEwNzE0NDg0MlowLwYJKoZIhvcNAQkEMSIEIMLV0vz/dR2wTz93ouxGAhfLQSyOkjhlxzZfklGCB7lBMA0GCSqGSIb3DQEBAQUABIIBAGFI8XpsEwcuFdmWRjex0snxtn1ViZRe1lowZmgF32G43vCbmUq3TW7lMoHfQKnY69AvCTFVIMdR34AyLs6tZOZcvp81/He+XmYEuP7w19BRjYjeP356XRuLLUb8poGjR6vwQAQ1vgP+mvRq2twGJuwkvng3CQHxcI5Wt5WG/TJTfgdc368uMJO1861Hz24p3hCt4iqto1lXHKI4mUbLbGXbWCaxw2F3mtD/Vr5th6HO1MKrGrufwaXRSZsKCyIrYYtiQD/EMNag0m9tAToez3geIyASQsOS86rQ+BlgUrOiiyoVsgByDZh75aK2vQZmsodNnWqGuiGlYIPq0QgB6FQ=", - "serial": "704869164585700966467604688662219012818071067133", - "expires": "2021-01-08T14:48:42.210471Z" - } - }, - { - "name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.crl", - "object": { - "content": "MIIDrDCCApQCAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEXDTIxMDEwNzE0NDM0MloXDTIxMDEwODE0NDg0MlowAKAvMC0wHwYDVR0jBBgwFoAUhQtAABMRo95Q7W09+snI0Ic/PgMwCgYDVR0UBAMCAQEwDQYJKoZIhvcNAQELBQADggEBABlhhKHSGBgrdHU5qG/QQQB9W6tPvcWFj8Ln5Rd7kQB5kUCt870KAs2sgVscnVXimHJPpDDi09oKaisYLNlDZb//vgOhJiU4etBqhpBHtpjAWGNqejvS/BVv0n5mlKmrsefq946RoPxMHejL28QwKpyWaRdaCsT1xSDp0+9uu/1DobucgO5vfNtYYoSVazqtx3F0M6GUh5diWtCBIHEmghHGmn16+LPdvs/AAR8z2d31q9RpaT7UI0FITme1j9rIoBHKL0OxXoPb8L/baRS5FG9NnYPgvRJ7d4AJc7T14WxdeEs+y1Kwq/V4cNX1259BFfNLXJrBX0BtAm0erKmMBEo=", - "serial": "1", - "expires": "2021-01-08T14:48:42.206964Z" - } - } - ], - "updated": [], - "withdrawn": [] - } - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_8_1/cas/ta/delta-4.json b/test-resources/migrations/v0_8_1/cas/ta/delta-4.json deleted file mode 100644 index b22fa413..00000000 --- a/test-resources/migrations/v0_8_1/cas/ta/delta-4.json +++ /dev/null @@ -1,18 +0,0 @@ -{ - "id": "ta", - "version": 4, - "details": { - "child_added": [ - "testbed", - { - "id_cert": "MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhDMjdFQUVCNzA3Q0VBMjI1RkM1QjU0RUYwQUU1Qjg4RkE0N0QyRDNBMB4XDTIxMDEwNzE0NDM0MloXDTM2MDEwNzE0NDg0MlowMzExMC8GA1UEAxMoQzI3RUFFQjcwN0NFQTIyNUZDNUI1NEVGMEFFNUI4OEZBNDdEMkQzQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMyjKrgOjfJzCe/jzSqBKBHLNOfGlLPcGxcXjNO0KZYKYahtolEmF1tY36xxEiVZbV/p568RFV5fB7rzBc6kPnCABZzDW5RMF5g4JrNc09ZkmUYxfDj5F6OiE0iTsOhHfNm+K3l3NKWjtFuFf2+8HGoyd3toKw4KjBOPsYYOmGiECW2mAU/69VfxndJru34b3p145MzkHBCmvU0UoByItKa3IvCgEMDtT/M7nNG9IJYry8t9RycA1mlRQE7GiqAZGdXaJr+rextdGGKAiZNPmcdDi8vAInxdMW5njVyxx1aMIXHKNUAJ7XykEE3AjOsR/yixEEgalramiFaJnnHkBUECAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUwn6utwfOoiX8W1TvCuW4j6R9LTowHwYDVR0jBBgwFoAUwn6utwfOoiX8W1TvCuW4j6R9LTowDQYJKoZIhvcNAQELBQADggEBABeYST0jZYqp26k933IiKXBFyECObIMbS/Fto5oqIvS+UZYbOF8an/ivTGmOlkyNRXbVYhIW9HTXN4Zb25kBnu1y/u5gy05CkA+9lzrsdIdGvlwJHSLQDQVh7tZE45pNPBIiTbhBmM8/9Jw+GzZn75+PqUvnNh1uZT2Bi4bPMyNt0Jk4+2xci4DF9gZlLsNVy5kEDGyMr5n6ECALhAUjAcE+jeB16QChrdV32HEzHVk4nejb/w2IcrKDhT72738R33wzJWBH2VYo4dPZFFecbDEO/D7wfkC+A/15mKKPQS1rdcAXqeeuI9XKc1EmBaQ4DJNFtclWLtHdl4q6XozbRVQ=", - "resources": { - "asn": "AS0-AS4294967295", - "v4": "0.0.0.0/0", - "v6": "::/0" - }, - "used_keys": {} - } - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_8_1/cas/ta/delta-5.json b/test-resources/migrations/v0_8_1/cas/ta/delta-5.json deleted file mode 100644 index d6d7130b..00000000 --- a/test-resources/migrations/v0_8_1/cas/ta/delta-5.json +++ /dev/null @@ -1,11 +0,0 @@ -{ - "id": "ta", - "version": 5, - "details": { - "child_certificate_issued": [ - "testbed", - "0", - "578C2EF4CFC1810860F52DC0D86530B1176FAE2B" - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_8_1/cas/ta/delta-6.json b/test-resources/migrations/v0_8_1/cas/ta/delta-6.json deleted file mode 100644 index d534d6ff..00000000 --- a/test-resources/migrations/v0_8_1/cas/ta/delta-6.json +++ /dev/null @@ -1,29 +0,0 @@ -{ - "id": "ta", - "version": 6, - "details": { - "child_certificates_updated": [ - "0", - { - "issued": [ - { - "uri": "rsync://lostlhost/repo/ta/0/578C2EF4CFC1810860F52DC0D86530B1176FAE2B.cer", - "limit": { - "asn": "none", - "v4": "none", - "v6": "none" - }, - "resource_set": { - "asn": "AS0-AS4294967295", - "v4": "0.0.0.0/0", - "v6": "::/0" - }, - "cert": "MIIHLTCCBhWgAwIBAgIUI/SFnDjXvYPFZXmeG9gQPoh0CFYwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEwHhcNMjEwMTA3MTQ0MzQ0WhcNMjIwMTA2MTQ0ODQ0WjAzMTEwLwYDVQQDEyg1NzhDMkVGNENGQzE4MTA4NjBGNTJEQzBEODY1MzBCMTE3NkZBRTJCMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtmHy7qwTc91JeWA4ClyPrnIsGegWpdCJwfJvmXgsTxIjld+m42CzrwjdaIfTiBy3lH4tLUDlGi71TFdJBQnHdX0od3c2i1QBKqYaLFomOFEDxaafA3khAAyQqsxIHA1XAoz4E8sw3E6VbwxRL0k7/6dlfBZgSvSgsL7SLTsgZ7RibcxCm5yB5i+XzMa51cHVIKW6LNMlbl/89RT2RO4cSVFm5aHixpE9WlII8OAwy5cXC9jZQaQey7Xz4WPmYB682CZv5az0tg+mucpJvQ1zViTYee4fv2vLE9Xo+jF0aGNwMxDGRJoIEUmGjiYwnbq3ICjHV6knV7GTvzN+H2zxrQIDAQABo4ICOzCCAjcwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUV4wu9M/BgQhg9S3A2GUwsRdvriswHwYDVR0jBBgwFoAUhQtAABMRo95Q7W09+snI0Ic/PgMwDgYDVR0PAQH/BAQDAgEGMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9zdGxob3N0L3JlcG8vdGEvMC84NTBCNDAwMDEzMTFBM0RFNTBFRDZEM0RGQUM5QzhEMDg3M0YzRTAzLmNybDA8BggrBgEFBQcBAQQwMC4wLAYIKwYBBQUHMAKGIHJzeW5jOi8vbG9zdGxob3N0L3JlcG8vdGEvdGEuY2VyMIHUBggrBgEFBQcBCwSBxzCBxDAtBggrBgEFBQcwBYYhcnN5bmM6Ly9sb3N0bGhvc3QvcmVwby90ZXN0YmVkLzAvMFkGCCsGAQUFBzAKhk1yc3luYzovL2xvc3RsaG9zdC9yZXBvL3Rlc3RiZWQvMC81NzhDMkVGNENGQzE4MTA4NjBGNTJEQzBEODY1MzBCMTE3NkZBRTJCLm1mdDA4BggrBgEFBQcwDYYsaHR0cHM6Ly9sb2NhbGhvc3Q6MzAwMC9ycmRwL25vdGlmaWNhdGlvbi54bWwwGAYDVR0gAQH/BA4wDDAKBggrBgEFBQcOAjAnBggrBgEFBQcBBwEB/wQYMBYwCQQCAAEwAwMBADAJBAIAAjADAwEAMCEGCCsGAQUFBwEIAQH/BBIwEKAOMAwwCgIBAAIFAP////8wDQYJKoZIhvcNAQELBQADggEBALDZ4wTeOjHCs6FTTEJzZrJWUAU4kev2AwSN/FyEIxxfG507FPhd0W3jVL2ya/Rg5QwyCebjCPAk8Jz55pn7Nh87/USImmc4U+myRn+QiFUmz4Iv0kC0chpOGyPhbmvAw4Lv1Yy4RAZG3oagB2YtxAH8P5vPVuRcbgsVPsi/kgr3kkwXkaI+g2RQnuC3B2JDtpNLvyXcJNvylgsHsG8IbTioKJGe+h4cgotx+/lU1wr3PmSL+QxzGSbCBQyrYnbsaPGEPXpxPE4I1oV8VBUaSzpkNTt7o0qjgpyC+AryUqUJQDWL79dYCL2Yh+5mqWeAi+nPP94jzON7dHWIF5Vat/Q=", - "replaces": null - } - ], - "removed": [] - } - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_8_1/cas/ta/delta-7.json b/test-resources/migrations/v0_8_1/cas/ta/delta-7.json deleted file mode 100644 index d78f2a96..00000000 --- a/test-resources/migrations/v0_8_1/cas/ta/delta-7.json +++ /dev/null @@ -1,76 +0,0 @@ -{ - "id": "ta", - "version": 7, - "details": { - "object_set_updated": [ - "0", - { - "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03": { - "number": 2, - "revocations_delta": { - "added": [ - { - "serial": "704869164585700966467604688662219012818071067133", - "expires": "2021-01-08T14:48:42.210471Z" - } - ], - "dropped": [] - }, - "manifest_info": { - "name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.mft", - "current": { - "content": "MIILYgYJKoZIhvcNAQcCoIILUzCCC08CAQMxDTALBglghkgBZQMEAgEwge8GCyqGSIb3DQEJEAEaoIHfBIHcMIHZAgECGA8yMDIxMDEwNzE0NDM0NFoYDzIwMjEwMTA4MTQ0ODQ0WgYJYIZIAWUDBAIBMIGmMFEWLDU3OEMyRUY0Q0ZDMTgxMDg2MEY1MkRDMEQ4NjUzMEIxMTc2RkFFMkIuY2VyAyEAxEtBwJWKNOD10U9HPPQoCbxBV85EZ7gIwUeHRvLkSiwwURYsODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwDIQB08CqSE/ymIcOrYNvnQ7V8pAclEo+HMQufY+46SgrllqCCCJkwggiVMIIHfaADAgECAhQnawikV2iOnwjjP45V32cn7+cSRTANBgkqhkiG9w0BAQsFADCCAi0xggIpMIICJQYDVQQDE4ICHDMwODIwMTBBMDI4MjAxMDEwMENEMjgzNkRCNzI0NDQzMjc1NzkzRjg5OTJGM0RDMDM1M0YwNjZERTc5NUMzMzFDMDI0RDVGMTlGRjRENDlGQkI3RkM3NjJERDZCRDVFMTQyMjNFNzA0MjI2MTM2NzJBREM1RDZEQ0JEMUU1OTUyQkE1NTk3MDczOEM4REQwRDBENzI5MkRDNjc5MzM2MDhFOUVCNTgyRUY5NjU3MTZCMDNGMzAzNTM2NTlERkE1NDIwNUQ3M0ZCNERDQTc0Mzk0Q0FGMjNGMjc0MkIyQTgxMUNGOTJCNDI2RjU5NDc2RkJEMzAzQURGNzIyODI2NTAzMzAwRkRDRjI5QTUzMUY2NDQ3NzdFNTUxNzA3RkM4Qzg1MjdEMzc0QTFBMjQxMjZGRjIyRjhGNEJFRDk0Q0JEQUU0NjY3NTMyNkQwRDAyNjQ1OTg1Mjg5ODk5N0MzRTY3NzVBQzE5OUVEMUU3OTBFMzJCMDdBRkIyODdGMkE3RkM5REY3NEZGRjQ4NTc5QTA3MjRGMkQyQzU3QzI3RThEMERFMTJDRDZENkUyQUUyRTJDMTI5MTUxODM3RDE1Q0U4QURCNTcwNTRCQjg1NjVGOEQ1ODRFODM5MTgxNUYwNDM2RjlDMzhGREVFMTA1QkI5OEY2Q0FENTIxOUZFMjZDQkJGNjAzQjNDODdDMTdBQUNGMDIwMzAxMDAwMTAeFw0yMTAxMDcxNDQzNDRaFw0yMTAxMTQxNDQ4NDRaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwRjEyOTNDRjU2NzIyMEI3NjFFMDMxREYzMjYxNUMzODg5RDRDM0Y0REQ4MjlDODQ5QkY0NkM5MkU2OEU3RTNGQUEzNUQwRjRCMjNEOTdFMDI0RjFBMTdGQzdGRjJDQjc4Mjc1QzlBQTkxRjkwNzdDQkExMTgzODg2NUIzQkMyQzc5NjFFNzFEMzI5MTU0NDg4MEU4M0FEQUM0QTlEQTcyNjBCRENFQTJEMThDNkE0NTg1ODFEQkM3QkJDOEE2MDM1OENFNkNCMDAxNDAxMjQ1NjdGNTNFNUZBNzIxQUIxMjRDRDM5RTU3OEZDQzVBQUQ1ODM4ODBBM0Y2OEZFNjBEOTlCNDk0NkE5RUZDRjlGQkE3QjlCODA2OEJGQTA3MzYzMUYxQkQ0MENEODk4MDFFMzMzQjQwRERDNzA4OEQxQkREQzdGODVEQ0NDOTJEMzU4MjA1RUEwRUQ4REI1MzhGOTBENDQ1NkE2MzQ3MEE4OEFGQzgxMEE4ODIwM0JCQkVDQzAxOTMzNTI3OTVENzlBNTk3NTgwRTNEOThGQThENDU0N0NBNzA3MzIxQkY3NkFFNUJBMkJEMkNGMkRFNzg5QTc0QjE0QUI4NEFDOTJGRTU0OTZGMkNCMEEzOTQ4RDhBNkMxMTZGNDdDODhFNzBFOEVCQUQ0OTc1NTBCMjBFNjEwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA8Sk89WciC3YeAx3zJhXDiJ1MP03YKchJv0bJLmjn4/qjXQ9LI9l+Ak8aF/x/8st4J1yaqR+Qd8uhGDiGWzvCx5YecdMpFUSIDoOtrEqdpyYL3OotGMakWFgdvHu8imA1jObLABQBJFZ/U+X6chqxJM055Xj8xarVg4gKP2j+YNmbSUap78+funubgGi/oHNjHxvUDNiYAeMztA3ccIjRvdx/hdzMktNYIF6g7Y21OPkNRFamNHCoivyBCoggO7vswBkzUnldeaWXWA49mPqNRUfKcHMhv3auW6K9LPLeeJp0sUq4Sskv5UlvLLCjlI2KbBFvR8iOcOjrrUl1ULIOYQIDAQABo4IBpzCCAaMwHQYDVR0OBBYEFJ1dHFTs7iozEMCP8QqFGf07zNFPMB8GA1UdIwQYMBaAFIULQAATEaPeUO1tPfrJyNCHPz4DMA4GA1UdDwEB/wQEAwIHgDBZBgNVHR8EUjBQME6gTKBKhkhyc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhLzAvODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwwPAYIKwYBBQUHAQEEMDAuMCwGCCsGAQUFBzAChiByc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhL3RhLmNlcjBkBggrBgEFBQcBCwRYMFYwVAYIKwYBBQUHMAuGSHJzeW5jOi8vbG9zdGxob3N0L3JlcG8vdGEvMC84NTBCNDAwMDEzMTFBM0RFNTBFRDZEM0RGQUM5QzhEMDg3M0YzRTAzLm1mdDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCEGCCsGAQUFBwEHAQH/BBIwEDAGBAIAAQUAMAYEAgACBQAwFQYIKwYBBQUHAQgBAf8EBjAEoAIFADANBgkqhkiG9w0BAQsFAAOCAQEAM1N8ovx0VcmGS1Vu3+Idj9P4jFHDmgO4f7snYAuX4LaKzGMaUgNnIQzbdQqy1eh9NlTdS+7h/2f3IZJ6ldTzx37q/MeaJjwunCc5jy5ZdaaNlfERE4dEG2LC+T17TEuyY9EiMne8W6eMGArYjIrEhGoWxCASraVeMSEUkd7NdpuWBZxDoqxlEqUa0cUfSRnK5gfD92X6Ipq6KNY0oWlZgI75O1ZHkv3PyXTtQV0Fcx+tc5C0ECKTPPPjAiSpEF8F3i1PMxC8Pl7kuUAd8XqLfxqTNjyg7Ij5f7kpFnjZdv3iYvlmtqoe0c4i2fEY9Udl6V+23n74rCVx/UOPYWsLKjGCAaowggGmAgEDgBSdXRxU7O4qMxDAj/EKhRn9O8zRTzALBglghkgBZQMEAgGgazAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQARowHAYJKoZIhvcNAQkFMQ8XDTIxMDEwNzE0NDg0NFowLwYJKoZIhvcNAQkEMSIEIEB6MQIpv0PdmLUu+3Ovg/GxVUpeK0iNjc0J6zzfPh2CMA0GCSqGSIb3DQEBAQUABIIBAL9z4mT5dbLw0AFloafj/zd3RAeiWYM94qVzjcDtyNy+ENzb6IsU/rS7sWAeYINnJUtHURE5VwKGcOnAoHy8HhJSoQaxPRhauJ4laH50bAC340AqlskP8G1tR/Vcss0UubpCqAHd0xcHxfy6Qx/vsxDfu6aYm0/QWDvocwQti/zyTipYbT3S9D6PIpxzWGGgNpUXO9Pvl8m+hyas53IRS1aOUMHyROrnsNkEJWGc33Gt63oWOLmzYorjkaKh3fr1iUweU+7XvoF6HsLsRU42a/mC0c2hOFXapNAPRR0NKQVQ/xGX/elUh7/AhXciNWx2iGrNDzgyDZK5kDSgJAZcqh4=", - "serial": "225037572619153874445885581769491657235049681477", - "expires": "2021-01-08T14:48:44.284625Z" - }, - "next_update": "2021-01-08T14:48:44.284625Z", - "old": "e5de6e92cba5edbf709e22622f784ab0929ef81adc26da7d949350c1219141fd" - }, - "crl_info": { - "name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.crl", - "current": { - "content": "MIID0zCCArsCAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEXDTIxMDEwNzE0NDM0NFoXDTIxMDEwODE0NDg0NFowJzAlAhR7d20umSmlUcdHOHFN7onxJPoZ/RcNMjEwMTA4MTQ0ODQyWqAvMC0wHwYDVR0jBBgwFoAUhQtAABMRo95Q7W09+snI0Ic/PgMwCgYDVR0UBAMCAQIwDQYJKoZIhvcNAQELBQADggEBALjhm0ocAsj7rl6ERaaeSfhrPcN9oBMMZMzuPwnoOblfNfI1Xuk0H7vSjTQRrnFVbPmfL/OdFNQep/mu68Kv6n1wX0f47ALuRQZkpZQU4bBoOHdf1gBPmpLZEwFA8+VO4KVN7m8P8qqQgBYNw3XVqurY2QvHb7fco8EjirOsvd3IUTmtK/NlTq8mz5IhUyVFT0xFSR3h4rrqC0KIGO5KLh2IoC+pAv4AAAqTJxRL3Mk2jgNeRvIjUbdIx1r9RuoxXQcRpsJ0DUNNZmaPFDLI6bBxAcXY3JJyZRZ+04Bvoxej5bVAbG697li+kyw1uH1T10t9gC3l4xZ1aAnlneTsAuQ=", - "serial": "2", - "expires": "2021-01-08T14:48:44.280906Z" - }, - "old": "5732dc446402b68f7c9686f27c91d9c9558dc9cc3197f2d38f0307554088ae6d" - }, - "objects_delta": { - "ca_repo": "rsync://lostlhost/repo/ta/0", - "added": [ - { - "name": "578C2EF4CFC1810860F52DC0D86530B1176FAE2B.cer", - "object": { - "content": "MIIHLTCCBhWgAwIBAgIUI/SFnDjXvYPFZXmeG9gQPoh0CFYwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEwHhcNMjEwMTA3MTQ0MzQ0WhcNMjIwMTA2MTQ0ODQ0WjAzMTEwLwYDVQQDEyg1NzhDMkVGNENGQzE4MTA4NjBGNTJEQzBEODY1MzBCMTE3NkZBRTJCMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtmHy7qwTc91JeWA4ClyPrnIsGegWpdCJwfJvmXgsTxIjld+m42CzrwjdaIfTiBy3lH4tLUDlGi71TFdJBQnHdX0od3c2i1QBKqYaLFomOFEDxaafA3khAAyQqsxIHA1XAoz4E8sw3E6VbwxRL0k7/6dlfBZgSvSgsL7SLTsgZ7RibcxCm5yB5i+XzMa51cHVIKW6LNMlbl/89RT2RO4cSVFm5aHixpE9WlII8OAwy5cXC9jZQaQey7Xz4WPmYB682CZv5az0tg+mucpJvQ1zViTYee4fv2vLE9Xo+jF0aGNwMxDGRJoIEUmGjiYwnbq3ICjHV6knV7GTvzN+H2zxrQIDAQABo4ICOzCCAjcwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUV4wu9M/BgQhg9S3A2GUwsRdvriswHwYDVR0jBBgwFoAUhQtAABMRo95Q7W09+snI0Ic/PgMwDgYDVR0PAQH/BAQDAgEGMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9zdGxob3N0L3JlcG8vdGEvMC84NTBCNDAwMDEzMTFBM0RFNTBFRDZEM0RGQUM5QzhEMDg3M0YzRTAzLmNybDA8BggrBgEFBQcBAQQwMC4wLAYIKwYBBQUHMAKGIHJzeW5jOi8vbG9zdGxob3N0L3JlcG8vdGEvdGEuY2VyMIHUBggrBgEFBQcBCwSBxzCBxDAtBggrBgEFBQcwBYYhcnN5bmM6Ly9sb3N0bGhvc3QvcmVwby90ZXN0YmVkLzAvMFkGCCsGAQUFBzAKhk1yc3luYzovL2xvc3RsaG9zdC9yZXBvL3Rlc3RiZWQvMC81NzhDMkVGNENGQzE4MTA4NjBGNTJEQzBEODY1MzBCMTE3NkZBRTJCLm1mdDA4BggrBgEFBQcwDYYsaHR0cHM6Ly9sb2NhbGhvc3Q6MzAwMC9ycmRwL25vdGlmaWNhdGlvbi54bWwwGAYDVR0gAQH/BA4wDDAKBggrBgEFBQcOAjAnBggrBgEFBQcBBwEB/wQYMBYwCQQCAAEwAwMBADAJBAIAAjADAwEAMCEGCCsGAQUFBwEIAQH/BBIwEKAOMAwwCgIBAAIFAP////8wDQYJKoZIhvcNAQELBQADggEBALDZ4wTeOjHCs6FTTEJzZrJWUAU4kev2AwSN/FyEIxxfG507FPhd0W3jVL2ya/Rg5QwyCebjCPAk8Jz55pn7Nh87/USImmc4U+myRn+QiFUmz4Iv0kC0chpOGyPhbmvAw4Lv1Yy4RAZG3oagB2YtxAH8P5vPVuRcbgsVPsi/kgr3kkwXkaI+g2RQnuC3B2JDtpNLvyXcJNvylgsHsG8IbTioKJGe+h4cgotx+/lU1wr3PmSL+QxzGSbCBQyrYnbsaPGEPXpxPE4I1oV8VBUaSzpkNTt7o0qjgpyC+AryUqUJQDWL79dYCL2Yh+5mqWeAi+nPP94jzON7dHWIF5Vat/Q=", - "serial": "205267697900910974577834931369136136825544640598", - "expires": "2022-01-06T14:48:44.276694Z" - } - } - ], - "updated": [ - { - "name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.crl", - "object": { - "content": "MIID0zCCArsCAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEXDTIxMDEwNzE0NDM0NFoXDTIxMDEwODE0NDg0NFowJzAlAhR7d20umSmlUcdHOHFN7onxJPoZ/RcNMjEwMTA4MTQ0ODQyWqAvMC0wHwYDVR0jBBgwFoAUhQtAABMRo95Q7W09+snI0Ic/PgMwCgYDVR0UBAMCAQIwDQYJKoZIhvcNAQELBQADggEBALjhm0ocAsj7rl6ERaaeSfhrPcN9oBMMZMzuPwnoOblfNfI1Xuk0H7vSjTQRrnFVbPmfL/OdFNQep/mu68Kv6n1wX0f47ALuRQZkpZQU4bBoOHdf1gBPmpLZEwFA8+VO4KVN7m8P8qqQgBYNw3XVqurY2QvHb7fco8EjirOsvd3IUTmtK/NlTq8mz5IhUyVFT0xFSR3h4rrqC0KIGO5KLh2IoC+pAv4AAAqTJxRL3Mk2jgNeRvIjUbdIx1r9RuoxXQcRpsJ0DUNNZmaPFDLI6bBxAcXY3JJyZRZ+04Bvoxej5bVAbG697li+kyw1uH1T10t9gC3l4xZ1aAnlneTsAuQ=", - "serial": "2", - "expires": "2021-01-08T14:48:44.280906Z" - }, - "old": "5732dc446402b68f7c9686f27c91d9c9558dc9cc3197f2d38f0307554088ae6d" - }, - { - "name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.mft", - "object": { - "content": "MIILYgYJKoZIhvcNAQcCoIILUzCCC08CAQMxDTALBglghkgBZQMEAgEwge8GCyqGSIb3DQEJEAEaoIHfBIHcMIHZAgECGA8yMDIxMDEwNzE0NDM0NFoYDzIwMjEwMTA4MTQ0ODQ0WgYJYIZIAWUDBAIBMIGmMFEWLDU3OEMyRUY0Q0ZDMTgxMDg2MEY1MkRDMEQ4NjUzMEIxMTc2RkFFMkIuY2VyAyEAxEtBwJWKNOD10U9HPPQoCbxBV85EZ7gIwUeHRvLkSiwwURYsODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwDIQB08CqSE/ymIcOrYNvnQ7V8pAclEo+HMQufY+46SgrllqCCCJkwggiVMIIHfaADAgECAhQnawikV2iOnwjjP45V32cn7+cSRTANBgkqhkiG9w0BAQsFADCCAi0xggIpMIICJQYDVQQDE4ICHDMwODIwMTBBMDI4MjAxMDEwMENEMjgzNkRCNzI0NDQzMjc1NzkzRjg5OTJGM0RDMDM1M0YwNjZERTc5NUMzMzFDMDI0RDVGMTlGRjRENDlGQkI3RkM3NjJERDZCRDVFMTQyMjNFNzA0MjI2MTM2NzJBREM1RDZEQ0JEMUU1OTUyQkE1NTk3MDczOEM4REQwRDBENzI5MkRDNjc5MzM2MDhFOUVCNTgyRUY5NjU3MTZCMDNGMzAzNTM2NTlERkE1NDIwNUQ3M0ZCNERDQTc0Mzk0Q0FGMjNGMjc0MkIyQTgxMUNGOTJCNDI2RjU5NDc2RkJEMzAzQURGNzIyODI2NTAzMzAwRkRDRjI5QTUzMUY2NDQ3NzdFNTUxNzA3RkM4Qzg1MjdEMzc0QTFBMjQxMjZGRjIyRjhGNEJFRDk0Q0JEQUU0NjY3NTMyNkQwRDAyNjQ1OTg1Mjg5ODk5N0MzRTY3NzVBQzE5OUVEMUU3OTBFMzJCMDdBRkIyODdGMkE3RkM5REY3NEZGRjQ4NTc5QTA3MjRGMkQyQzU3QzI3RThEMERFMTJDRDZENkUyQUUyRTJDMTI5MTUxODM3RDE1Q0U4QURCNTcwNTRCQjg1NjVGOEQ1ODRFODM5MTgxNUYwNDM2RjlDMzhGREVFMTA1QkI5OEY2Q0FENTIxOUZFMjZDQkJGNjAzQjNDODdDMTdBQUNGMDIwMzAxMDAwMTAeFw0yMTAxMDcxNDQzNDRaFw0yMTAxMTQxNDQ4NDRaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwRjEyOTNDRjU2NzIyMEI3NjFFMDMxREYzMjYxNUMzODg5RDRDM0Y0REQ4MjlDODQ5QkY0NkM5MkU2OEU3RTNGQUEzNUQwRjRCMjNEOTdFMDI0RjFBMTdGQzdGRjJDQjc4Mjc1QzlBQTkxRjkwNzdDQkExMTgzODg2NUIzQkMyQzc5NjFFNzFEMzI5MTU0NDg4MEU4M0FEQUM0QTlEQTcyNjBCRENFQTJEMThDNkE0NTg1ODFEQkM3QkJDOEE2MDM1OENFNkNCMDAxNDAxMjQ1NjdGNTNFNUZBNzIxQUIxMjRDRDM5RTU3OEZDQzVBQUQ1ODM4ODBBM0Y2OEZFNjBEOTlCNDk0NkE5RUZDRjlGQkE3QjlCODA2OEJGQTA3MzYzMUYxQkQ0MENEODk4MDFFMzMzQjQwRERDNzA4OEQxQkREQzdGODVEQ0NDOTJEMzU4MjA1RUEwRUQ4REI1MzhGOTBENDQ1NkE2MzQ3MEE4OEFGQzgxMEE4ODIwM0JCQkVDQzAxOTMzNTI3OTVENzlBNTk3NTgwRTNEOThGQThENDU0N0NBNzA3MzIxQkY3NkFFNUJBMkJEMkNGMkRFNzg5QTc0QjE0QUI4NEFDOTJGRTU0OTZGMkNCMEEzOTQ4RDhBNkMxMTZGNDdDODhFNzBFOEVCQUQ0OTc1NTBCMjBFNjEwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA8Sk89WciC3YeAx3zJhXDiJ1MP03YKchJv0bJLmjn4/qjXQ9LI9l+Ak8aF/x/8st4J1yaqR+Qd8uhGDiGWzvCx5YecdMpFUSIDoOtrEqdpyYL3OotGMakWFgdvHu8imA1jObLABQBJFZ/U+X6chqxJM055Xj8xarVg4gKP2j+YNmbSUap78+funubgGi/oHNjHxvUDNiYAeMztA3ccIjRvdx/hdzMktNYIF6g7Y21OPkNRFamNHCoivyBCoggO7vswBkzUnldeaWXWA49mPqNRUfKcHMhv3auW6K9LPLeeJp0sUq4Sskv5UlvLLCjlI2KbBFvR8iOcOjrrUl1ULIOYQIDAQABo4IBpzCCAaMwHQYDVR0OBBYEFJ1dHFTs7iozEMCP8QqFGf07zNFPMB8GA1UdIwQYMBaAFIULQAATEaPeUO1tPfrJyNCHPz4DMA4GA1UdDwEB/wQEAwIHgDBZBgNVHR8EUjBQME6gTKBKhkhyc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhLzAvODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwwPAYIKwYBBQUHAQEEMDAuMCwGCCsGAQUFBzAChiByc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhL3RhLmNlcjBkBggrBgEFBQcBCwRYMFYwVAYIKwYBBQUHMAuGSHJzeW5jOi8vbG9zdGxob3N0L3JlcG8vdGEvMC84NTBCNDAwMDEzMTFBM0RFNTBFRDZEM0RGQUM5QzhEMDg3M0YzRTAzLm1mdDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCEGCCsGAQUFBwEHAQH/BBIwEDAGBAIAAQUAMAYEAgACBQAwFQYIKwYBBQUHAQgBAf8EBjAEoAIFADANBgkqhkiG9w0BAQsFAAOCAQEAM1N8ovx0VcmGS1Vu3+Idj9P4jFHDmgO4f7snYAuX4LaKzGMaUgNnIQzbdQqy1eh9NlTdS+7h/2f3IZJ6ldTzx37q/MeaJjwunCc5jy5ZdaaNlfERE4dEG2LC+T17TEuyY9EiMne8W6eMGArYjIrEhGoWxCASraVeMSEUkd7NdpuWBZxDoqxlEqUa0cUfSRnK5gfD92X6Ipq6KNY0oWlZgI75O1ZHkv3PyXTtQV0Fcx+tc5C0ECKTPPPjAiSpEF8F3i1PMxC8Pl7kuUAd8XqLfxqTNjyg7Ij5f7kpFnjZdv3iYvlmtqoe0c4i2fEY9Udl6V+23n74rCVx/UOPYWsLKjGCAaowggGmAgEDgBSdXRxU7O4qMxDAj/EKhRn9O8zRTzALBglghkgBZQMEAgGgazAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQARowHAYJKoZIhvcNAQkFMQ8XDTIxMDEwNzE0NDg0NFowLwYJKoZIhvcNAQkEMSIEIEB6MQIpv0PdmLUu+3Ovg/GxVUpeK0iNjc0J6zzfPh2CMA0GCSqGSIb3DQEBAQUABIIBAL9z4mT5dbLw0AFloafj/zd3RAeiWYM94qVzjcDtyNy+ENzb6IsU/rS7sWAeYINnJUtHURE5VwKGcOnAoHy8HhJSoQaxPRhauJ4laH50bAC340AqlskP8G1tR/Vcss0UubpCqAHd0xcHxfy6Qx/vsxDfu6aYm0/QWDvocwQti/zyTipYbT3S9D6PIpxzWGGgNpUXO9Pvl8m+hyas53IRS1aOUMHyROrnsNkEJWGc33Gt63oWOLmzYorjkaKh3fr1iUweU+7XvoF6HsLsRU42a/mC0c2hOFXapNAPRR0NKQVQ/xGX/elUh7/AhXciNWx2iGrNDzgyDZK5kDSgJAZcqh4=", - "serial": "225037572619153874445885581769491657235049681477", - "expires": "2021-01-08T14:48:44.284625Z" - }, - "old": "e5de6e92cba5edbf709e22622f784ab0929ef81adc26da7d949350c1219141fd" - } - ], - "withdrawn": [] - } - } - } - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_8_1/cas/ta/delta-8.json b/test-resources/migrations/v0_8_1/cas/ta/delta-8.json deleted file mode 100644 index bec21bae..00000000 --- a/test-resources/migrations/v0_8_1/cas/ta/delta-8.json +++ /dev/null @@ -1,67 +0,0 @@ -{ - "id": "ta", - "version": 8, - "details": { - "object_set_updated": [ - "0", - { - "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03": { - "number": 3, - "revocations_delta": { - "added": [ - { - "serial": "225037572619153874445885581769491657235049681477", - "expires": "2021-01-08T14:48:44.284625Z" - } - ], - "dropped": [] - }, - "manifest_info": { - "name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.mft", - "current": { - "content": "MIILYgYJKoZIhvcNAQcCoIILUzCCC08CAQMxDTALBglghkgBZQMEAgEwge8GCyqGSIb3DQEJEAEaoIHfBIHcMIHZAgEDGA8yMDIxMDEwODEwMDkwMFoYDzIwMjEwMTA5MTAxNDAwWgYJYIZIAWUDBAIBMIGmMFEWLDU3OEMyRUY0Q0ZDMTgxMDg2MEY1MkRDMEQ4NjUzMEIxMTc2RkFFMkIuY2VyAyEAxEtBwJWKNOD10U9HPPQoCbxBV85EZ7gIwUeHRvLkSiwwURYsODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwDIQC37X6mEM/vwf5RoCc16p8tA+RQ73e8jY1EfS5RwKFjaaCCCJkwggiVMIIHfaADAgECAhQjWm2ZXzc6wPlYcnawHzfXxPaFdDANBgkqhkiG9w0BAQsFADCCAi0xggIpMIICJQYDVQQDE4ICHDMwODIwMTBBMDI4MjAxMDEwMENEMjgzNkRCNzI0NDQzMjc1NzkzRjg5OTJGM0RDMDM1M0YwNjZERTc5NUMzMzFDMDI0RDVGMTlGRjRENDlGQkI3RkM3NjJERDZCRDVFMTQyMjNFNzA0MjI2MTM2NzJBREM1RDZEQ0JEMUU1OTUyQkE1NTk3MDczOEM4REQwRDBENzI5MkRDNjc5MzM2MDhFOUVCNTgyRUY5NjU3MTZCMDNGMzAzNTM2NTlERkE1NDIwNUQ3M0ZCNERDQTc0Mzk0Q0FGMjNGMjc0MkIyQTgxMUNGOTJCNDI2RjU5NDc2RkJEMzAzQURGNzIyODI2NTAzMzAwRkRDRjI5QTUzMUY2NDQ3NzdFNTUxNzA3RkM4Qzg1MjdEMzc0QTFBMjQxMjZGRjIyRjhGNEJFRDk0Q0JEQUU0NjY3NTMyNkQwRDAyNjQ1OTg1Mjg5ODk5N0MzRTY3NzVBQzE5OUVEMUU3OTBFMzJCMDdBRkIyODdGMkE3RkM5REY3NEZGRjQ4NTc5QTA3MjRGMkQyQzU3QzI3RThEMERFMTJDRDZENkUyQUUyRTJDMTI5MTUxODM3RDE1Q0U4QURCNTcwNTRCQjg1NjVGOEQ1ODRFODM5MTgxNUYwNDM2RjlDMzhGREVFMTA1QkI5OEY2Q0FENTIxOUZFMjZDQkJGNjAzQjNDODdDMTdBQUNGMDIwMzAxMDAwMTAeFw0yMTAxMDgxMDA5MDBaFw0yMTAxMTUxMDE0MDBaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwRTY5MEM3N0ZGQjdDRUM4MTJDNEU0MERENjZCQzFGRjFDRUYxNTEyNDJGQkZDQjdDRTlCMEVCRDI2RjFFODVDODczNjUxMjRBQzgxNDc1NjQwNTkwOTM5MjQyMEEwQjNGQTAwQkFFREZGRjYxRjI2OTVGRUVFMURFQ0FGOTRBNDlENjk0MEE4RkRDNjZENTBDNDk4RUNBRThGNTc0RDE3MkIyRjM2QTQyM0MzRUMzQUE5REU4MUQwODQ1MENGNUM3MTgyNTQ4RDlENjc2MjBEMkE1NUEzRUFDMzIwOEIxOEYzMTRGQkQ0RjlBRDYwOEUzNDFDNkM1MTBBNEUwQzI2OEIxN0JCMEYxNkJEM0ZDMkE3MUQ1NDk2QkRDMDkwMzU4MUM0OUU2NzREN0ZBNjEyNkE0Q0E2OUQyOEUyMzE2MUNDQjQ4NzI3OTIzRjdBRTk2OUExOTQ4QzcxQTlEN0M3RDNGQTJCNDk4QUI1Q0VBNDY2RTFGREQ5RTc5MTM2NDdEMjdERUE1RjJCNjNFODQwMkUxODFDREFBQkIwNjI5RkRBQjczRDYxNDE2RkI5ODc1NUE3NUUxMDM5NTkyQTFBQjI1RDNFOEVDQTk3OEY2QzlBOTEyNURCREQyNkVGRjkxQzg4QzVFRkRDODFBM0NGQTE4OEI3QzJFNEUwOEVFRTMwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5pDHf/t87IEsTkDdZrwf8c7xUSQvv8t86bDr0m8ehchzZRJKyBR1ZAWQk5JCCgs/oAuu3/9h8mlf7uHeyvlKSdaUCo/cZtUMSY7K6PV00XKy82pCPD7Dqp3oHQhFDPXHGCVI2dZ2INKlWj6sMgixjzFPvU+a1gjjQcbFEKTgwmixe7Dxa9P8KnHVSWvcCQNYHEnmdNf6YSakymnSjiMWHMtIcnkj966WmhlIxxqdfH0/orSYq1zqRm4f3Z55E2R9J96l8rY+hALhgc2quwYp/atz1hQW+5h1WnXhA5WSoasl0+jsqXj2yakSXb3Sbv+RyIxe/cgaPPoYi3wuTgju4wIDAQABo4IBpzCCAaMwHQYDVR0OBBYEFMphmbm7uju6IFEDJ/Za+oR3U0LfMB8GA1UdIwQYMBaAFIULQAATEaPeUO1tPfrJyNCHPz4DMA4GA1UdDwEB/wQEAwIHgDBZBgNVHR8EUjBQME6gTKBKhkhyc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhLzAvODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwwPAYIKwYBBQUHAQEEMDAuMCwGCCsGAQUFBzAChiByc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhL3RhLmNlcjBkBggrBgEFBQcBCwRYMFYwVAYIKwYBBQUHMAuGSHJzeW5jOi8vbG9zdGxob3N0L3JlcG8vdGEvMC84NTBCNDAwMDEzMTFBM0RFNTBFRDZEM0RGQUM5QzhEMDg3M0YzRTAzLm1mdDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCEGCCsGAQUFBwEHAQH/BBIwEDAGBAIAAQUAMAYEAgACBQAwFQYIKwYBBQUHAQgBAf8EBjAEoAIFADANBgkqhkiG9w0BAQsFAAOCAQEAT0bPz1vBIglKCwuK1sZZMSGvy9HoybARxrHljqT5nhZdbsRNLbfTI4i6UFNVJrpuoI/XHE+spLCs3LAMoZiiNT5/iCnQVOvoDhIJfFPbvBdPMJk10IQqZNQMRK4u+GEBxMBsZgVEdzOxVOd/DHhO9u3vTh9/2mV3KKG0yGoQ7a6v7SbP8zENMFFW1ddSIhz0wamTR83pkSYV5JT4TzNzMcFX5euUkrzUbefhdiYLWHm0tcVzWG8jsdOKgP84/akH55AqHuEXW+UKALRtwOHWrrHOBJYlk4SSOrFFS/0mObJJh2nDsgn2ITL4KeEOvtb33TkOPXjJ4nkgr/OMrHQpvTGCAaowggGmAgEDgBTKYZm5u7o7uiBRAyf2WvqEd1NC3zALBglghkgBZQMEAgGgazAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQARowHAYJKoZIhvcNAQkFMQ8XDTIxMDEwODEwMTQwMFowLwYJKoZIhvcNAQkEMSIEINMjfuzhmAzjvl2phUcJHM2/FURvm2mj74+x1XoDd4BlMA0GCSqGSIb3DQEBAQUABIIBAJHEyo1jqzQyf00Ie8HxXq8/vEg6T27zB+rpNLLXJt8lwU4DrLMgqGIE6JKGKzrZJ6On5NGMBBKUsuTgzBQamvnRs1fIS2codTOCFkSjPVtdIdmPMn6h7eQkyszEDgNlqUwOyKOC8++6aUfn4KOSUpLLnW/MhoCQZcAvAAXNiFwhYXWb8m8tgktOEj1OG4RzXqW8HuOmN+4x0Dblle5nOjG/StQRT866eBInZ33pX8p/9T7ht7NvT0dHWGuP1EZMLkIK+VY3EKM3/gS/sbTwaFYEej5Xqy2v13omvVqgbaUfcWgebFC+1BCajE/pr7cDp35rmKBCfI23HfPqbpFeUnE=", - "serial": "201831291475634267796886973706723420667525891444", - "expires": "2021-01-09T10:14:00.687129Z" - }, - "next_update": "2021-01-09T10:14:00.687129Z", - "old": "074af04412634623062b29e67235eda88241377bd35100449f786d74e1f6101c" - }, - "crl_info": { - "name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.crl", - "current": { - "content": "MIID+jCCAuICAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEXDTIxMDEwODEwMDkwMFoXDTIxMDEwOTEwMTQwMFowTjAlAhR7d20umSmlUcdHOHFN7onxJPoZ/RcNMjEwMTA4MTQ0ODQyWjAlAhQnawikV2iOnwjjP45V32cn7+cSRRcNMjEwMTA4MTQ0ODQ0WqAvMC0wHwYDVR0jBBgwFoAUhQtAABMRo95Q7W09+snI0Ic/PgMwCgYDVR0UBAMCAQMwDQYJKoZIhvcNAQELBQADggEBAIagHE9PVrWASG9vGjw4n1SBOrC4f5wj8GZSUFYabHn5gJ/PFIWsS88QwIa5U+cgWfnVsD9xxALaopGCDtU7XLbW/4E16AB9erRKJrH0wMcFDHPRlxG8qaDNg3LVyOkQtari45t/uqJ3INR1xZEYSDXg8XlscaVdEZFTC1gy3qqGG/ZmtdJfVWtapSjIFBbpyZqMMdMC8C4R7Yqyxl79/WWIhgy3GHeAwgr8+I+RNSyGeaOc8lwbukk1CqzIU2YJaOhxQrJ2hBEOco8D2UVY9GTHbCXcHX2rhFs6WJs3BamPm/r8S0ORGndoIKcLy6fZUbmQ+K5tjF4H44RO7a+1cD0=", - "serial": "3", - "expires": "2021-01-09T10:14:00.682699Z" - }, - "old": "74f02a9213fca621c3ab60dbe743b57ca40725128f87310b9f63ee3a4a0ae596" - }, - "objects_delta": { - "ca_repo": "rsync://lostlhost/repo/ta/0", - "added": [], - "updated": [ - { - "name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.crl", - "object": { - "content": "MIID+jCCAuICAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEXDTIxMDEwODEwMDkwMFoXDTIxMDEwOTEwMTQwMFowTjAlAhR7d20umSmlUcdHOHFN7onxJPoZ/RcNMjEwMTA4MTQ0ODQyWjAlAhQnawikV2iOnwjjP45V32cn7+cSRRcNMjEwMTA4MTQ0ODQ0WqAvMC0wHwYDVR0jBBgwFoAUhQtAABMRo95Q7W09+snI0Ic/PgMwCgYDVR0UBAMCAQMwDQYJKoZIhvcNAQELBQADggEBAIagHE9PVrWASG9vGjw4n1SBOrC4f5wj8GZSUFYabHn5gJ/PFIWsS88QwIa5U+cgWfnVsD9xxALaopGCDtU7XLbW/4E16AB9erRKJrH0wMcFDHPRlxG8qaDNg3LVyOkQtari45t/uqJ3INR1xZEYSDXg8XlscaVdEZFTC1gy3qqGG/ZmtdJfVWtapSjIFBbpyZqMMdMC8C4R7Yqyxl79/WWIhgy3GHeAwgr8+I+RNSyGeaOc8lwbukk1CqzIU2YJaOhxQrJ2hBEOco8D2UVY9GTHbCXcHX2rhFs6WJs3BamPm/r8S0ORGndoIKcLy6fZUbmQ+K5tjF4H44RO7a+1cD0=", - "serial": "3", - "expires": "2021-01-09T10:14:00.682699Z" - }, - "old": "74f02a9213fca621c3ab60dbe743b57ca40725128f87310b9f63ee3a4a0ae596" - }, - { - "name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.mft", - "object": { - "content": "MIILYgYJKoZIhvcNAQcCoIILUzCCC08CAQMxDTALBglghkgBZQMEAgEwge8GCyqGSIb3DQEJEAEaoIHfBIHcMIHZAgEDGA8yMDIxMDEwODEwMDkwMFoYDzIwMjEwMTA5MTAxNDAwWgYJYIZIAWUDBAIBMIGmMFEWLDU3OEMyRUY0Q0ZDMTgxMDg2MEY1MkRDMEQ4NjUzMEIxMTc2RkFFMkIuY2VyAyEAxEtBwJWKNOD10U9HPPQoCbxBV85EZ7gIwUeHRvLkSiwwURYsODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwDIQC37X6mEM/vwf5RoCc16p8tA+RQ73e8jY1EfS5RwKFjaaCCCJkwggiVMIIHfaADAgECAhQjWm2ZXzc6wPlYcnawHzfXxPaFdDANBgkqhkiG9w0BAQsFADCCAi0xggIpMIICJQYDVQQDE4ICHDMwODIwMTBBMDI4MjAxMDEwMENEMjgzNkRCNzI0NDQzMjc1NzkzRjg5OTJGM0RDMDM1M0YwNjZERTc5NUMzMzFDMDI0RDVGMTlGRjRENDlGQkI3RkM3NjJERDZCRDVFMTQyMjNFNzA0MjI2MTM2NzJBREM1RDZEQ0JEMUU1OTUyQkE1NTk3MDczOEM4REQwRDBENzI5MkRDNjc5MzM2MDhFOUVCNTgyRUY5NjU3MTZCMDNGMzAzNTM2NTlERkE1NDIwNUQ3M0ZCNERDQTc0Mzk0Q0FGMjNGMjc0MkIyQTgxMUNGOTJCNDI2RjU5NDc2RkJEMzAzQURGNzIyODI2NTAzMzAwRkRDRjI5QTUzMUY2NDQ3NzdFNTUxNzA3RkM4Qzg1MjdEMzc0QTFBMjQxMjZGRjIyRjhGNEJFRDk0Q0JEQUU0NjY3NTMyNkQwRDAyNjQ1OTg1Mjg5ODk5N0MzRTY3NzVBQzE5OUVEMUU3OTBFMzJCMDdBRkIyODdGMkE3RkM5REY3NEZGRjQ4NTc5QTA3MjRGMkQyQzU3QzI3RThEMERFMTJDRDZENkUyQUUyRTJDMTI5MTUxODM3RDE1Q0U4QURCNTcwNTRCQjg1NjVGOEQ1ODRFODM5MTgxNUYwNDM2RjlDMzhGREVFMTA1QkI5OEY2Q0FENTIxOUZFMjZDQkJGNjAzQjNDODdDMTdBQUNGMDIwMzAxMDAwMTAeFw0yMTAxMDgxMDA5MDBaFw0yMTAxMTUxMDE0MDBaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwRTY5MEM3N0ZGQjdDRUM4MTJDNEU0MERENjZCQzFGRjFDRUYxNTEyNDJGQkZDQjdDRTlCMEVCRDI2RjFFODVDODczNjUxMjRBQzgxNDc1NjQwNTkwOTM5MjQyMEEwQjNGQTAwQkFFREZGRjYxRjI2OTVGRUVFMURFQ0FGOTRBNDlENjk0MEE4RkRDNjZENTBDNDk4RUNBRThGNTc0RDE3MkIyRjM2QTQyM0MzRUMzQUE5REU4MUQwODQ1MENGNUM3MTgyNTQ4RDlENjc2MjBEMkE1NUEzRUFDMzIwOEIxOEYzMTRGQkQ0RjlBRDYwOEUzNDFDNkM1MTBBNEUwQzI2OEIxN0JCMEYxNkJEM0ZDMkE3MUQ1NDk2QkRDMDkwMzU4MUM0OUU2NzREN0ZBNjEyNkE0Q0E2OUQyOEUyMzE2MUNDQjQ4NzI3OTIzRjdBRTk2OUExOTQ4QzcxQTlEN0M3RDNGQTJCNDk4QUI1Q0VBNDY2RTFGREQ5RTc5MTM2NDdEMjdERUE1RjJCNjNFODQwMkUxODFDREFBQkIwNjI5RkRBQjczRDYxNDE2RkI5ODc1NUE3NUUxMDM5NTkyQTFBQjI1RDNFOEVDQTk3OEY2QzlBOTEyNURCREQyNkVGRjkxQzg4QzVFRkRDODFBM0NGQTE4OEI3QzJFNEUwOEVFRTMwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5pDHf/t87IEsTkDdZrwf8c7xUSQvv8t86bDr0m8ehchzZRJKyBR1ZAWQk5JCCgs/oAuu3/9h8mlf7uHeyvlKSdaUCo/cZtUMSY7K6PV00XKy82pCPD7Dqp3oHQhFDPXHGCVI2dZ2INKlWj6sMgixjzFPvU+a1gjjQcbFEKTgwmixe7Dxa9P8KnHVSWvcCQNYHEnmdNf6YSakymnSjiMWHMtIcnkj966WmhlIxxqdfH0/orSYq1zqRm4f3Z55E2R9J96l8rY+hALhgc2quwYp/atz1hQW+5h1WnXhA5WSoasl0+jsqXj2yakSXb3Sbv+RyIxe/cgaPPoYi3wuTgju4wIDAQABo4IBpzCCAaMwHQYDVR0OBBYEFMphmbm7uju6IFEDJ/Za+oR3U0LfMB8GA1UdIwQYMBaAFIULQAATEaPeUO1tPfrJyNCHPz4DMA4GA1UdDwEB/wQEAwIHgDBZBgNVHR8EUjBQME6gTKBKhkhyc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhLzAvODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwwPAYIKwYBBQUHAQEEMDAuMCwGCCsGAQUFBzAChiByc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhL3RhLmNlcjBkBggrBgEFBQcBCwRYMFYwVAYIKwYBBQUHMAuGSHJzeW5jOi8vbG9zdGxob3N0L3JlcG8vdGEvMC84NTBCNDAwMDEzMTFBM0RFNTBFRDZEM0RGQUM5QzhEMDg3M0YzRTAzLm1mdDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCEGCCsGAQUFBwEHAQH/BBIwEDAGBAIAAQUAMAYEAgACBQAwFQYIKwYBBQUHAQgBAf8EBjAEoAIFADANBgkqhkiG9w0BAQsFAAOCAQEAT0bPz1vBIglKCwuK1sZZMSGvy9HoybARxrHljqT5nhZdbsRNLbfTI4i6UFNVJrpuoI/XHE+spLCs3LAMoZiiNT5/iCnQVOvoDhIJfFPbvBdPMJk10IQqZNQMRK4u+GEBxMBsZgVEdzOxVOd/DHhO9u3vTh9/2mV3KKG0yGoQ7a6v7SbP8zENMFFW1ddSIhz0wamTR83pkSYV5JT4TzNzMcFX5euUkrzUbefhdiYLWHm0tcVzWG8jsdOKgP84/akH55AqHuEXW+UKALRtwOHWrrHOBJYlk4SSOrFFS/0mObJJh2nDsgn2ITL4KeEOvtb33TkOPXjJ4nkgr/OMrHQpvTGCAaowggGmAgEDgBTKYZm5u7o7uiBRAyf2WvqEd1NC3zALBglghkgBZQMEAgGgazAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQARowHAYJKoZIhvcNAQkFMQ8XDTIxMDEwODEwMTQwMFowLwYJKoZIhvcNAQkEMSIEINMjfuzhmAzjvl2phUcJHM2/FURvm2mj74+x1XoDd4BlMA0GCSqGSIb3DQEBAQUABIIBAJHEyo1jqzQyf00Ie8HxXq8/vEg6T27zB+rpNLLXJt8lwU4DrLMgqGIE6JKGKzrZJ6On5NGMBBKUsuTgzBQamvnRs1fIS2codTOCFkSjPVtdIdmPMn6h7eQkyszEDgNlqUwOyKOC8++6aUfn4KOSUpLLnW/MhoCQZcAvAAXNiFwhYXWb8m8tgktOEj1OG4RzXqW8HuOmN+4x0Dblle5nOjG/StQRT866eBInZ33pX8p/9T7ht7NvT0dHWGuP1EZMLkIK+VY3EKM3/gS/sbTwaFYEej5Xqy2v13omvVqgbaUfcWgebFC+1BCajE/pr7cDp35rmKBCfI23HfPqbpFeUnE=", - "serial": "201831291475634267796886973706723420667525891444", - "expires": "2021-01-09T10:14:00.687129Z" - }, - "old": "074af04412634623062b29e67235eda88241377bd35100449f786d74e1f6101c" - } - ], - "withdrawn": [] - } - } - } - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_8_1/cas/ta/delta-9.json b/test-resources/migrations/v0_8_1/cas/ta/delta-9.json deleted file mode 100644 index c60505d8..00000000 --- a/test-resources/migrations/v0_8_1/cas/ta/delta-9.json +++ /dev/null @@ -1,80 +0,0 @@ -{ - "id": "ta", - "version": 9, - "details": { - "object_set_updated": [ - "0", - { - "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03": { - "number": 4, - "revocations_delta": { - "added": [ - { - "serial": "201831291475634267796886973706723420667525891444", - "expires": "2021-01-09T10:14:00.687129Z" - } - ], - "dropped": [ - { - "serial": "704869164585700966467604688662219012818071067133", - "expires": "2021-01-08T14:48:42.210471Z" - }, - { - "serial": "225037572619153874445885581769491657235049681477", - "expires": "2021-01-08T14:48:44.284625Z" - }, - { - "serial": "201831291475634267796886973706723420667525891444", - "expires": "2021-01-09T10:14:00.687129Z" - } - ] - }, - "manifest_info": { - "name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.mft", - "current": { - "content": "MIILYgYJKoZIhvcNAQcCoIILUzCCC08CAQMxDTALBglghkgBZQMEAgEwge8GCyqGSIb3DQEJEAEaoIHfBIHcMIHZAgEEGA8yMDIxMDExMzExMjMwMVoYDzIwMjEwMTE0MTEyODAxWgYJYIZIAWUDBAIBMIGmMFEWLDg1MEI0MDAwMTMxMUEzREU1MEVENkQzREZBQzlDOEQwODczRjNFMDMuY3JsAyEA6mNo+nxZrIChzTmZT8JK3Aj1o0JHc8tyRh0B9/kPiMswURYsNTc4QzJFRjRDRkMxODEwODYwRjUyREMwRDg2NTMwQjExNzZGQUUyQi5jZXIDIQDES0HAlYo04PXRT0c89CgJvEFXzkRnuAjBR4dG8uRKLKCCCJkwggiVMIIHfaADAgECAhRFqiSIGoF+Nq3QuPFW3aEexfnerTANBgkqhkiG9w0BAQsFADCCAi0xggIpMIICJQYDVQQDE4ICHDMwODIwMTBBMDI4MjAxMDEwMENEMjgzNkRCNzI0NDQzMjc1NzkzRjg5OTJGM0RDMDM1M0YwNjZERTc5NUMzMzFDMDI0RDVGMTlGRjRENDlGQkI3RkM3NjJERDZCRDVFMTQyMjNFNzA0MjI2MTM2NzJBREM1RDZEQ0JEMUU1OTUyQkE1NTk3MDczOEM4REQwRDBENzI5MkRDNjc5MzM2MDhFOUVCNTgyRUY5NjU3MTZCMDNGMzAzNTM2NTlERkE1NDIwNUQ3M0ZCNERDQTc0Mzk0Q0FGMjNGMjc0MkIyQTgxMUNGOTJCNDI2RjU5NDc2RkJEMzAzQURGNzIyODI2NTAzMzAwRkRDRjI5QTUzMUY2NDQ3NzdFNTUxNzA3RkM4Qzg1MjdEMzc0QTFBMjQxMjZGRjIyRjhGNEJFRDk0Q0JEQUU0NjY3NTMyNkQwRDAyNjQ1OTg1Mjg5ODk5N0MzRTY3NzVBQzE5OUVEMUU3OTBFMzJCMDdBRkIyODdGMkE3RkM5REY3NEZGRjQ4NTc5QTA3MjRGMkQyQzU3QzI3RThEMERFMTJDRDZENkUyQUUyRTJDMTI5MTUxODM3RDE1Q0U4QURCNTcwNTRCQjg1NjVGOEQ1ODRFODM5MTgxNUYwNDM2RjlDMzhGREVFMTA1QkI5OEY2Q0FENTIxOUZFMjZDQkJGNjAzQjNDODdDMTdBQUNGMDIwMzAxMDAwMTAeFw0yMTAxMTMxMTIzMDFaFw0yMTAxMjAxMTI4MDFaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwOUNGOTAzRERFMzI4M0JBN0I1RDcyQUY5RUNFRjk4N0Q4NTU3MTFGOUQ5MDhCMzY3NjczOTkyNTA5OTgxRDE4NjNCQzcxMUU3Njg1QzE4ODk2Rjc1OTI2NjU0ODczRjZENUM3NjcyNUQzQTY5RTEyRjk1MEE2ODE0OUY4Q0UyMzQwNDUyRjIzMUE5RkM4NjFCRjAzMUVCM0IzMEQ0OUYzRkFGRkQ4RkJEOUYwQ0EzQkUwNzk0MEJCRUI3ODg5NTFFMTk3OUZDQjdGOTkwQUMzMUQ2MkU4MTBBRkY0MUQyMTNFRDJEOTNFOUQ0QTAzREU0RUE0N0Y3RDcwOUQ3OEI5RDFFODExRDU3NDhGRThCRDM0ODZEQ0JFNDQyRUIyMjE4OEI4OEUyMjQzMDBGODBFQzQwMEMyRkYxNzFCMTAzOEEzQTZFOTc0QUY4N0M4QzFBQjQ2RDQxOTIxMkI3MkMzODQzMjRFMEJFNTJFNTBDNzk3OUM1MkRCMzk4NUU0OTI2OENGNDE0RTQzODdGNzFCNjRFNTUxRjc2NzVFNTZDMjIxRTk2RERFRjZFNjI1QkFDMkJENzFDQUY2RTZEMTFEMEYwRDFGQkJDOUYyNTZENENBQTkxRDg0QTkwOTcyRTFFOERBNzQyOTFEMjNCMDUyMjRBOEFEREE3MkNDREI3MTEwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnPkD3eMoO6e11yr57O+YfYVXEfnZCLNnZzmSUJmB0YY7xxHnaFwYiW91kmZUhz9tXHZyXTpp4S+VCmgUn4ziNARS8jGp/IYb8DHrOzDUnz+v/Y+9nwyjvgeUC763iJUeGXn8t/mQrDHWLoEK/0HSE+0tk+nUoD3k6kf31wnXi50egR1XSP6L00hty+RC6yIYi4jiJDAPgOxADC/xcbEDijpul0r4fIwatG1BkhK3LDhDJOC+UuUMeXnFLbOYXkkmjPQU5Dh/cbZOVR92deVsIh6W3e9uYlusK9ccr25tEdDw0fu8nyVtTKqR2EqQly4ejadCkdI7BSJKit2nLM23EQIDAQABo4IBpzCCAaMwHQYDVR0OBBYEFFV4uJxrfdfmI9KQmdKtbB7YqNLZMB8GA1UdIwQYMBaAFIULQAATEaPeUO1tPfrJyNCHPz4DMA4GA1UdDwEB/wQEAwIHgDBZBgNVHR8EUjBQME6gTKBKhkhyc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhLzAvODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwwPAYIKwYBBQUHAQEEMDAuMCwGCCsGAQUFBzAChiByc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhL3RhLmNlcjBkBggrBgEFBQcBCwRYMFYwVAYIKwYBBQUHMAuGSHJzeW5jOi8vbG9zdGxob3N0L3JlcG8vdGEvMC84NTBCNDAwMDEzMTFBM0RFNTBFRDZEM0RGQUM5QzhEMDg3M0YzRTAzLm1mdDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCEGCCsGAQUFBwEHAQH/BBIwEDAGBAIAAQUAMAYEAgACBQAwFQYIKwYBBQUHAQgBAf8EBjAEoAIFADANBgkqhkiG9w0BAQsFAAOCAQEABP8eMGdPiQFqKVl61O0k3Tno4oQnjPob76oLwJguZLYD6ALVRJEjK9N/0UW89oy+c9ITfaECa18cufklZm50VnEqDvItS4KmEEKgjM0rLZDMWoRvOhXTR3Uhv8hVrwMJZqnqji7UfrdBuh/Eig/zuQrHotQQhznr6D011jGZ2LwPRn+sORB8k126fiCeykaCrqEmaxlJej67dei1SmhnILTYI46miTYlprQre1bFixXFv6Ev5+1r+sT8sY8duHb6mcpUiCNaiQKMeqsbN9vg45b+oxWe5Xj3ibitB3Kbf7oYNlHTsPlHi2jtXo0in1ODdsDYpHVqNfyNW96IaLDbiDGCAaowggGmAgEDgBRVeLica33X5iPSkJnSrWwe2KjS2TALBglghkgBZQMEAgGgazAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQARowHAYJKoZIhvcNAQkFMQ8XDTIxMDExMzExMjgwMVowLwYJKoZIhvcNAQkEMSIEIJ8/HRUwo5c7LyfB4n6fXORpin5RdHwPnSlOtgAMAPm4MA0GCSqGSIb3DQEBAQUABIIBAEIlbSqYXbPacK6z/BHe6nwpO8WwktajgVLXz+POTY8h8BQW5bUSk7ITYJZiDRNACjTwdAlp+GlAcY5PftWyhy+OnGObGOg9nqCBtEWP3OykWpZgm+MdmGPpDLRKRFivAiq5W/UUXzJqUCg1aMQBWrhWqrubviIFKSttqneWSCG+wRJqc1wirbz9ry7+flA3TF/s5X1CxvzoxdxPJsFrKH7ufmKxAIBzAdYXwYKv+mVnfXpApKkh9QxEHl96FGhqPHW386k0AdG1VPgDThNV6VEEDoaTXAUm/5QALCo4+eNcdP7HLdLXsfkSbP1S70A+clUG56q6hAxRwMHJyVSjJAs=", - "serial": "397714672226522871823541187130996691739866685101", - "expires": "2021-01-14T11:28:01.080728Z" - }, - "next_update": "2021-01-14T11:28:01.080728Z", - "old": "f9c4504820ea0c83b264a25302c76d5c3b6961bc788bbd3cf4b08f69c670bbe1" - }, - "crl_info": { - "name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.crl", - "current": { - "content": "MIIDrDCCApQCAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEXDTIxMDExMzExMjMwMVoXDTIxMDExNDExMjgwMVowAKAvMC0wHwYDVR0jBBgwFoAUhQtAABMRo95Q7W09+snI0Ic/PgMwCgYDVR0UBAMCAQQwDQYJKoZIhvcNAQELBQADggEBAD26Wa9JDK8ej4ADSPsZkwcFWgT7C+1t3oFA9EAxXQBNu7myhNBcNpaHO9sdKpOaouXmbE7vAWV9PfLpDtjtmxLhUYeBmjUB8RdXqxGr5aT+78a0tQjsIt/LFeolNf/J5qQZBUnwldWrO2C8qW7iFyiWEvLlfgnKD5yqhZvFhYD+UoN4pyyLGgqZJzAbXtcMab0AkGDQqLNvsyNF3CNHz136Fic3fIMum4Tp8HlyB2CYiMesBFcwgWtuCp5GzDmXr6PSC2lWxkefnsxbG6mb4cVctPNTEHTjUoC6sNKlHaaRsq/gyCBIs8ylt7RJl5cwzwL1UQZnT6RDwKGDDA/d41k=", - "serial": "4", - "expires": "2021-01-14T11:28:01.075690Z" - }, - "old": "b7ed7ea610cfefc1fe51a02735ea9f2d03e450ef77bc8d8d447d2e51c0a16369" - }, - "objects_delta": { - "ca_repo": "rsync://lostlhost/repo/ta/0", - "added": [], - "updated": [ - { - "name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.crl", - "object": { - "content": "MIIDrDCCApQCAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEXDTIxMDExMzExMjMwMVoXDTIxMDExNDExMjgwMVowAKAvMC0wHwYDVR0jBBgwFoAUhQtAABMRo95Q7W09+snI0Ic/PgMwCgYDVR0UBAMCAQQwDQYJKoZIhvcNAQELBQADggEBAD26Wa9JDK8ej4ADSPsZkwcFWgT7C+1t3oFA9EAxXQBNu7myhNBcNpaHO9sdKpOaouXmbE7vAWV9PfLpDtjtmxLhUYeBmjUB8RdXqxGr5aT+78a0tQjsIt/LFeolNf/J5qQZBUnwldWrO2C8qW7iFyiWEvLlfgnKD5yqhZvFhYD+UoN4pyyLGgqZJzAbXtcMab0AkGDQqLNvsyNF3CNHz136Fic3fIMum4Tp8HlyB2CYiMesBFcwgWtuCp5GzDmXr6PSC2lWxkefnsxbG6mb4cVctPNTEHTjUoC6sNKlHaaRsq/gyCBIs8ylt7RJl5cwzwL1UQZnT6RDwKGDDA/d41k=", - "serial": "4", - "expires": "2021-01-14T11:28:01.075690Z" - }, - "old": "b7ed7ea610cfefc1fe51a02735ea9f2d03e450ef77bc8d8d447d2e51c0a16369" - }, - { - "name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.mft", - "object": { - "content": "MIILYgYJKoZIhvcNAQcCoIILUzCCC08CAQMxDTALBglghkgBZQMEAgEwge8GCyqGSIb3DQEJEAEaoIHfBIHcMIHZAgEEGA8yMDIxMDExMzExMjMwMVoYDzIwMjEwMTE0MTEyODAxWgYJYIZIAWUDBAIBMIGmMFEWLDg1MEI0MDAwMTMxMUEzREU1MEVENkQzREZBQzlDOEQwODczRjNFMDMuY3JsAyEA6mNo+nxZrIChzTmZT8JK3Aj1o0JHc8tyRh0B9/kPiMswURYsNTc4QzJFRjRDRkMxODEwODYwRjUyREMwRDg2NTMwQjExNzZGQUUyQi5jZXIDIQDES0HAlYo04PXRT0c89CgJvEFXzkRnuAjBR4dG8uRKLKCCCJkwggiVMIIHfaADAgECAhRFqiSIGoF+Nq3QuPFW3aEexfnerTANBgkqhkiG9w0BAQsFADCCAi0xggIpMIICJQYDVQQDE4ICHDMwODIwMTBBMDI4MjAxMDEwMENEMjgzNkRCNzI0NDQzMjc1NzkzRjg5OTJGM0RDMDM1M0YwNjZERTc5NUMzMzFDMDI0RDVGMTlGRjRENDlGQkI3RkM3NjJERDZCRDVFMTQyMjNFNzA0MjI2MTM2NzJBREM1RDZEQ0JEMUU1OTUyQkE1NTk3MDczOEM4REQwRDBENzI5MkRDNjc5MzM2MDhFOUVCNTgyRUY5NjU3MTZCMDNGMzAzNTM2NTlERkE1NDIwNUQ3M0ZCNERDQTc0Mzk0Q0FGMjNGMjc0MkIyQTgxMUNGOTJCNDI2RjU5NDc2RkJEMzAzQURGNzIyODI2NTAzMzAwRkRDRjI5QTUzMUY2NDQ3NzdFNTUxNzA3RkM4Qzg1MjdEMzc0QTFBMjQxMjZGRjIyRjhGNEJFRDk0Q0JEQUU0NjY3NTMyNkQwRDAyNjQ1OTg1Mjg5ODk5N0MzRTY3NzVBQzE5OUVEMUU3OTBFMzJCMDdBRkIyODdGMkE3RkM5REY3NEZGRjQ4NTc5QTA3MjRGMkQyQzU3QzI3RThEMERFMTJDRDZENkUyQUUyRTJDMTI5MTUxODM3RDE1Q0U4QURCNTcwNTRCQjg1NjVGOEQ1ODRFODM5MTgxNUYwNDM2RjlDMzhGREVFMTA1QkI5OEY2Q0FENTIxOUZFMjZDQkJGNjAzQjNDODdDMTdBQUNGMDIwMzAxMDAwMTAeFw0yMTAxMTMxMTIzMDFaFw0yMTAxMjAxMTI4MDFaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwOUNGOTAzRERFMzI4M0JBN0I1RDcyQUY5RUNFRjk4N0Q4NTU3MTFGOUQ5MDhCMzY3NjczOTkyNTA5OTgxRDE4NjNCQzcxMUU3Njg1QzE4ODk2Rjc1OTI2NjU0ODczRjZENUM3NjcyNUQzQTY5RTEyRjk1MEE2ODE0OUY4Q0UyMzQwNDUyRjIzMUE5RkM4NjFCRjAzMUVCM0IzMEQ0OUYzRkFGRkQ4RkJEOUYwQ0EzQkUwNzk0MEJCRUI3ODg5NTFFMTk3OUZDQjdGOTkwQUMzMUQ2MkU4MTBBRkY0MUQyMTNFRDJEOTNFOUQ0QTAzREU0RUE0N0Y3RDcwOUQ3OEI5RDFFODExRDU3NDhGRThCRDM0ODZEQ0JFNDQyRUIyMjE4OEI4OEUyMjQzMDBGODBFQzQwMEMyRkYxNzFCMTAzOEEzQTZFOTc0QUY4N0M4QzFBQjQ2RDQxOTIxMkI3MkMzODQzMjRFMEJFNTJFNTBDNzk3OUM1MkRCMzk4NUU0OTI2OENGNDE0RTQzODdGNzFCNjRFNTUxRjc2NzVFNTZDMjIxRTk2RERFRjZFNjI1QkFDMkJENzFDQUY2RTZEMTFEMEYwRDFGQkJDOUYyNTZENENBQTkxRDg0QTkwOTcyRTFFOERBNzQyOTFEMjNCMDUyMjRBOEFEREE3MkNDREI3MTEwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnPkD3eMoO6e11yr57O+YfYVXEfnZCLNnZzmSUJmB0YY7xxHnaFwYiW91kmZUhz9tXHZyXTpp4S+VCmgUn4ziNARS8jGp/IYb8DHrOzDUnz+v/Y+9nwyjvgeUC763iJUeGXn8t/mQrDHWLoEK/0HSE+0tk+nUoD3k6kf31wnXi50egR1XSP6L00hty+RC6yIYi4jiJDAPgOxADC/xcbEDijpul0r4fIwatG1BkhK3LDhDJOC+UuUMeXnFLbOYXkkmjPQU5Dh/cbZOVR92deVsIh6W3e9uYlusK9ccr25tEdDw0fu8nyVtTKqR2EqQly4ejadCkdI7BSJKit2nLM23EQIDAQABo4IBpzCCAaMwHQYDVR0OBBYEFFV4uJxrfdfmI9KQmdKtbB7YqNLZMB8GA1UdIwQYMBaAFIULQAATEaPeUO1tPfrJyNCHPz4DMA4GA1UdDwEB/wQEAwIHgDBZBgNVHR8EUjBQME6gTKBKhkhyc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhLzAvODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwwPAYIKwYBBQUHAQEEMDAuMCwGCCsGAQUFBzAChiByc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhL3RhLmNlcjBkBggrBgEFBQcBCwRYMFYwVAYIKwYBBQUHMAuGSHJzeW5jOi8vbG9zdGxob3N0L3JlcG8vdGEvMC84NTBCNDAwMDEzMTFBM0RFNTBFRDZEM0RGQUM5QzhEMDg3M0YzRTAzLm1mdDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCEGCCsGAQUFBwEHAQH/BBIwEDAGBAIAAQUAMAYEAgACBQAwFQYIKwYBBQUHAQgBAf8EBjAEoAIFADANBgkqhkiG9w0BAQsFAAOCAQEABP8eMGdPiQFqKVl61O0k3Tno4oQnjPob76oLwJguZLYD6ALVRJEjK9N/0UW89oy+c9ITfaECa18cufklZm50VnEqDvItS4KmEEKgjM0rLZDMWoRvOhXTR3Uhv8hVrwMJZqnqji7UfrdBuh/Eig/zuQrHotQQhznr6D011jGZ2LwPRn+sORB8k126fiCeykaCrqEmaxlJej67dei1SmhnILTYI46miTYlprQre1bFixXFv6Ev5+1r+sT8sY8duHb6mcpUiCNaiQKMeqsbN9vg45b+oxWe5Xj3ibitB3Kbf7oYNlHTsPlHi2jtXo0in1ODdsDYpHVqNfyNW96IaLDbiDGCAaowggGmAgEDgBRVeLica33X5iPSkJnSrWwe2KjS2TALBglghkgBZQMEAgGgazAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQARowHAYJKoZIhvcNAQkFMQ8XDTIxMDExMzExMjgwMVowLwYJKoZIhvcNAQkEMSIEIJ8/HRUwo5c7LyfB4n6fXORpin5RdHwPnSlOtgAMAPm4MA0GCSqGSIb3DQEBAQUABIIBAEIlbSqYXbPacK6z/BHe6nwpO8WwktajgVLXz+POTY8h8BQW5bUSk7ITYJZiDRNACjTwdAlp+GlAcY5PftWyhy+OnGObGOg9nqCBtEWP3OykWpZgm+MdmGPpDLRKRFivAiq5W/UUXzJqUCg1aMQBWrhWqrubviIFKSttqneWSCG+wRJqc1wirbz9ry7+flA3TF/s5X1CxvzoxdxPJsFrKH7ufmKxAIBzAdYXwYKv+mVnfXpApKkh9QxEHl96FGhqPHW386k0AdG1VPgDThNV6VEEDoaTXAUm/5QALCo4+eNcdP7HLdLXsfkSbP1S70A+clUG56q6hAxRwMHJyVSjJAs=", - "serial": "397714672226522871823541187130996691739866685101", - "expires": "2021-01-14T11:28:01.080728Z" - }, - "old": "f9c4504820ea0c83b264a25302c76d5c3b6961bc788bbd3cf4b08f69c670bbe1" - } - ], - "withdrawn": [] - } - } - } - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_8_1/cas/ta/info.json b/test-resources/migrations/v0_8_1/cas/ta/info.json deleted file mode 100644 index 4e8e4149..00000000 --- a/test-resources/migrations/v0_8_1/cas/ta/info.json +++ /dev/null @@ -1,6 +0,0 @@ -{ - "snapshot_version": 10, - "last_event": 9, - "last_command": 7, - "last_update": "2021-01-13T11:28:01.074918Z" -} \ No newline at end of file diff --git a/test-resources/migrations/v0_8_1/cas/ta/snapshot-bk.json b/test-resources/migrations/v0_8_1/cas/ta/snapshot-bk.json deleted file mode 100644 index e175d735..00000000 --- a/test-resources/migrations/v0_8_1/cas/ta/snapshot-bk.json +++ /dev/null @@ -1,99 +0,0 @@ -{ - "handle": "ta", - "version": 5, - "id": { - "key": "D272D0F1E7F20EBE4F3038F29ACFA9774590E835", - "cert": "MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhEMjcyRDBGMUU3RjIwRUJFNEYzMDM4RjI5QUNGQTk3NzQ1OTBFODM1MB4XDTIxMDEwNzE0NDM0MloXDTM2MDEwNzE0NDg0MlowMzExMC8GA1UEAxMoRDI3MkQwRjFFN0YyMEVCRTRGMzAzOEYyOUFDRkE5Nzc0NTkwRTgzNTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN3jacZMe8xlT+AcOVWbj49zwPCzQpzNSwUTPqsYYhAU9mwQXA0tFx0e5VC+qGYCMLJkY1goywEi+qiLJVdlLSmB8LokYcgJKG9EIw3q3JxrfseLVWJjbQAd0VdkG4FvU3LtB+f3Yr1whM6T4AOt070de/9Ox20RioCiSBCEsgfLTmFZsGCzUomtp9krfO7HpBMar08YJ46Bm1h450K79+AbvvhaRctSnrmaxjd/TBi4Q6FtskkcRonBCF1Lcu8eqn1nnfjglflOu/5yOqk+4OXel9b4zx+iooybmjhIhi6istKpYQgzVaAVnpGP3//wF6/zgQsxfHtC74DDA6jvJq8CAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU0nLQ8efyDr5PMDjyms+pd0WQ6DUwHwYDVR0jBBgwFoAU0nLQ8efyDr5PMDjyms+pd0WQ6DUwDQYJKoZIhvcNAQELBQADggEBAMWMRfUSu2C3VznHT+gH7Hg1UobuxZSAlN44kgcWryZa849oPml4OPy3iGKCeEKDxuEAdM/FGXgOUkMSR/psP3ym5FG+RVollSyj25GVgmgmxkV9VaoT4xiJxg3qfHNIeDgReLWYumfHanrpuVw56fhQb+5IEkq4Cw1mrSeoJxtC5Hdij/taylXJ0kP9rEnC5Kh7xGQlvMQXZc+Zn3i+myyHBK8EgUH7un++6b6uxNY+8/2MWN5kO/0sY2QQCgXAfFToiY95emR//c5rud3Wx4oboiS/u4iAObDyV5dCPpHKEP9lG6JWEOkRZYBA5KHydHhYHnKFJ+awvevrr+qn918=" - }, - "repository": { - "embedded": { - "base_uri": "rsync://lostlhost/repo/ta/", - "rpki_notify": "https://localhost:3000/rrdp/notification.xml" - } - }, - "repository_pending_withdraw": null, - "parents": { - "ta": { - "ta": { - "cert": "MIIIZjCCB06gAwIBAgIUL1jmoavzDeBUl69dks9XgsYxicwwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEwIBcNMjEwMTA3MTQ0MzQyWhgPMjEyMTAxMDcxNDQ4NDJaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQ0QyODM2REI3MjQ0NDMyNzU3OTNGODk5MkYzREMwMzUzRjA2NkRFNzk1QzMzMUMwMjRENUYxOUZGNEQ0OUZCQjdGQzc2MkRENkJENUUxNDIyM0U3MDQyMjYxMzY3MkFEQzVENkRDQkQxRTU5NTJCQTU1OTcwNzM4QzhERDBEMEQ3MjkyREM2NzkzMzYwOEU5RUI1ODJFRjk2NTcxNkIwM0YzMDM1MzY1OURGQTU0MjA1RDczRkI0RENBNzQzOTRDQUYyM0YyNzQyQjJBODExQ0Y5MkI0MjZGNTk0NzZGQkQzMDNBREY3MjI4MjY1MDMzMDBGRENGMjlBNTMxRjY0NDc3N0U1NTE3MDdGQzhDODUyN0QzNzRBMUEyNDEyNkZGMjJGOEY0QkVEOTRDQkRBRTQ2Njc1MzI2RDBEMDI2NDU5ODUyODk4OTk3QzNFNjc3NUFDMTk5RUQxRTc5MEUzMkIwN0FGQjI4N0YyQTdGQzlERjc0RkZGNDg1NzlBMDcyNEYyRDJDNTdDMjdFOEQwREUxMkNENkQ2RTJBRTJFMkMxMjkxNTE4MzdEMTVDRThBREI1NzA1NEJCODU2NUY4RDU4NEU4MzkxODE1RjA0MzZGOUMzOEZERUUxMDVCQjk4RjZDQUQ1MjE5RkUyNkNCQkY2MDNCM0M4N0MxN0FBQ0YwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzSg223JEQydXk/iZLz3ANT8GbeeVwzHAJNXxn/TUn7t/x2Lda9XhQiPnBCJhNnKtxdbcvR5ZUrpVlwc4yN0NDXKS3GeTNgjp61gu+WVxawPzA1NlnfpUIF1z+03KdDlMryPydCsqgRz5K0JvWUdvvTA633IoJlAzAP3PKaUx9kR3flUXB/yMhSfTdKGiQSb/Ivj0vtlMva5GZ1Mm0NAmRZhSiYmXw+Z3WsGZ7R55DjKwevsofyp/yd90//SFeaByTy0sV8J+jQ3hLNbW4q4uLBKRUYN9Fc6K21cFS7hWX41YToORgV8ENvnDj97hBbuY9srVIZ/ibLv2A7PIfBeqzwIDAQABo4IBdjCCAXIwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUhQtAABMRo95Q7W09+snI0Ic/PgMwDgYDVR0PAQH/BAQDAgEGMIHJBggrBgEFBQcBCwSBvDCBuTAnBggrBgEFBQcwBYYbcnN5bmM6Ly9sb3N0bGhvc3QvcmVwby90YS8wMFQGCCsGAQUFBzAKhkhyc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhLzAvODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5tZnQwOAYIKwYBBQUHMA2GLGh0dHBzOi8vbG9jYWxob3N0OjMwMDAvcnJkcC9ub3RpZmljYXRpb24ueG1sMBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwJwYIKwYBBQUHAQcBAf8EGDAWMAkEAgABMAMDAQAwCQQCAAIwAwMBADAhBggrBgEFBQcBCAEB/wQSMBCgDjAMMAoCAQACBQD/////MA0GCSqGSIb3DQEBCwUAA4IBAQCkZ0kAVe2d8sIp9+DUtf4nvXItI2H1ouWZIJnOgBvrWlwTMbfijQxRD04WSLwzOVC39+2bqP9GGDqr9nBOPbpbtQPhYhV4wbvaVLc7wFgIrVrJ/D7fV9HasH6xQpeH1c/plHKPHFQdHGQZU/s3DKwl1cJ4iMxqRbuC3d3LwnMOuviej58EzDW351ZCu8xNxah93VS5Rspw0x2OHhml5xGIg735QKlXKT0gVfFN8CG+AOjzD0l5wKv7Nt7HQ07ikAYj6NZ7/7eiupg9hIyspWif+po7MKzhbR3PrYcLOFp9jAOCdMOY7E3blgZVsQsIZGQO4tTtgdnYURw0I4kx2YQW", - "resources": { - "asn": "AS0-AS4294967295", - "v4": "0.0.0.0/0", - "v6": "::/0" - }, - "tal": { - "uris": [ - "https://localhost:3000/rrdp/ta/ta.cer" - ], - "encoded_ski": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzSg223JEQydXk/iZLz3ANT8GbeeVwzHAJNXxn/TUn7t/x2Lda9XhQiPnBCJhNnKtxdbcvR5ZUrpVlwc4yN0NDXKS3GeTNgjp61gu+WVxawPzA1NlnfpUIF1z+03KdDlMryPydCsqgRz5K0JvWUdvvTA633IoJlAzAP3PKaUx9kR3flUXB/yMhSfTdKGiQSb/Ivj0vtlMva5GZ1Mm0NAmRZhSiYmXw+Z3WsGZ7R55DjKwevsofyp/yd90//SFeaByTy0sV8J+jQ3hLNbW4q4uLBKRUYN9Fc6K21cFS7hWX41YToORgV8ENvnDj97hBbuY9srVIZ/ibLv2A7PIfBeqzwIDAQAB" - } - } - } - }, - "next_class_name": 1, - "resources": { - "0": { - "name": "0", - "name_space": "0", - "parent_handle": "ta", - "parent_rc_name": "0", - "roas": {}, - "certificates": { - "inner": {} - }, - "last_key_change": "2021-01-07T14:48:42.205924Z", - "key_state": { - "active": { - "key_id": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03", - "incoming_cert": { - "cert": "MIIIZjCCB06gAwIBAgIUL1jmoavzDeBUl69dks9XgsYxicwwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEwIBcNMjEwMTA3MTQ0MzQyWhgPMjEyMTAxMDcxNDQ4NDJaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQ0QyODM2REI3MjQ0NDMyNzU3OTNGODk5MkYzREMwMzUzRjA2NkRFNzk1QzMzMUMwMjRENUYxOUZGNEQ0OUZCQjdGQzc2MkRENkJENUUxNDIyM0U3MDQyMjYxMzY3MkFEQzVENkRDQkQxRTU5NTJCQTU1OTcwNzM4QzhERDBEMEQ3MjkyREM2NzkzMzYwOEU5RUI1ODJFRjk2NTcxNkIwM0YzMDM1MzY1OURGQTU0MjA1RDczRkI0RENBNzQzOTRDQUYyM0YyNzQyQjJBODExQ0Y5MkI0MjZGNTk0NzZGQkQzMDNBREY3MjI4MjY1MDMzMDBGRENGMjlBNTMxRjY0NDc3N0U1NTE3MDdGQzhDODUyN0QzNzRBMUEyNDEyNkZGMjJGOEY0QkVEOTRDQkRBRTQ2Njc1MzI2RDBEMDI2NDU5ODUyODk4OTk3QzNFNjc3NUFDMTk5RUQxRTc5MEUzMkIwN0FGQjI4N0YyQTdGQzlERjc0RkZGNDg1NzlBMDcyNEYyRDJDNTdDMjdFOEQwREUxMkNENkQ2RTJBRTJFMkMxMjkxNTE4MzdEMTVDRThBREI1NzA1NEJCODU2NUY4RDU4NEU4MzkxODE1RjA0MzZGOUMzOEZERUUxMDVCQjk4RjZDQUQ1MjE5RkUyNkNCQkY2MDNCM0M4N0MxN0FBQ0YwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzSg223JEQydXk/iZLz3ANT8GbeeVwzHAJNXxn/TUn7t/x2Lda9XhQiPnBCJhNnKtxdbcvR5ZUrpVlwc4yN0NDXKS3GeTNgjp61gu+WVxawPzA1NlnfpUIF1z+03KdDlMryPydCsqgRz5K0JvWUdvvTA633IoJlAzAP3PKaUx9kR3flUXB/yMhSfTdKGiQSb/Ivj0vtlMva5GZ1Mm0NAmRZhSiYmXw+Z3WsGZ7R55DjKwevsofyp/yd90//SFeaByTy0sV8J+jQ3hLNbW4q4uLBKRUYN9Fc6K21cFS7hWX41YToORgV8ENvnDj97hBbuY9srVIZ/ibLv2A7PIfBeqzwIDAQABo4IBdjCCAXIwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUhQtAABMRo95Q7W09+snI0Ic/PgMwDgYDVR0PAQH/BAQDAgEGMIHJBggrBgEFBQcBCwSBvDCBuTAnBggrBgEFBQcwBYYbcnN5bmM6Ly9sb3N0bGhvc3QvcmVwby90YS8wMFQGCCsGAQUFBzAKhkhyc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhLzAvODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5tZnQwOAYIKwYBBQUHMA2GLGh0dHBzOi8vbG9jYWxob3N0OjMwMDAvcnJkcC9ub3RpZmljYXRpb24ueG1sMBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwJwYIKwYBBQUHAQcBAf8EGDAWMAkEAgABMAMDAQAwCQQCAAIwAwMBADAhBggrBgEFBQcBCAEB/wQSMBCgDjAMMAoCAQACBQD/////MA0GCSqGSIb3DQEBCwUAA4IBAQCkZ0kAVe2d8sIp9+DUtf4nvXItI2H1ouWZIJnOgBvrWlwTMbfijQxRD04WSLwzOVC39+2bqP9GGDqr9nBOPbpbtQPhYhV4wbvaVLc7wFgIrVrJ/D7fV9HasH6xQpeH1c/plHKPHFQdHGQZU/s3DKwl1cJ4iMxqRbuC3d3LwnMOuviej58EzDW351ZCu8xNxah93VS5Rspw0x2OHhml5xGIg735QKlXKT0gVfFN8CG+AOjzD0l5wKv7Nt7HQ07ikAYj6NZ7/7eiupg9hIyspWif+po7MKzhbR3PrYcLOFp9jAOCdMOY7E3blgZVsQsIZGQO4tTtgdnYURw0I4kx2YQW", - "uri": "rsync://lostlhost/repo/ta/ta.cer", - "resources": { - "asn": "AS0-AS4294967295", - "v4": "0.0.0.0/0", - "v6": "::/0" - } - }, - "current_set": { - "number": 1, - "revocations": [], - "manifest_info": { - "name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.mft", - "current": { - "content": "MIILDgYJKoZIhvcNAQcCoIIK/zCCCvsCAQMxDTALBglghkgBZQMEAgEwgZsGCyqGSIb3DQEJEAEaoIGLBIGIMIGFAgEBGA8yMDIxMDEwNzE0NDM0MloYDzIwMjEwMTA4MTQ0ODQyWgYJYIZIAWUDBAIBMFMwURYsODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwDIQBXMtxEZAK2j3yWhvJ8kdnJVY3JzDGX8tOPAwdVQIiubaCCCJkwggiVMIIHfaADAgECAhR7d20umSmlUcdHOHFN7onxJPoZ/TANBgkqhkiG9w0BAQsFADCCAi0xggIpMIICJQYDVQQDE4ICHDMwODIwMTBBMDI4MjAxMDEwMENEMjgzNkRCNzI0NDQzMjc1NzkzRjg5OTJGM0RDMDM1M0YwNjZERTc5NUMzMzFDMDI0RDVGMTlGRjRENDlGQkI3RkM3NjJERDZCRDVFMTQyMjNFNzA0MjI2MTM2NzJBREM1RDZEQ0JEMUU1OTUyQkE1NTk3MDczOEM4REQwRDBENzI5MkRDNjc5MzM2MDhFOUVCNTgyRUY5NjU3MTZCMDNGMzAzNTM2NTlERkE1NDIwNUQ3M0ZCNERDQTc0Mzk0Q0FGMjNGMjc0MkIyQTgxMUNGOTJCNDI2RjU5NDc2RkJEMzAzQURGNzIyODI2NTAzMzAwRkRDRjI5QTUzMUY2NDQ3NzdFNTUxNzA3RkM4Qzg1MjdEMzc0QTFBMjQxMjZGRjIyRjhGNEJFRDk0Q0JEQUU0NjY3NTMyNkQwRDAyNjQ1OTg1Mjg5ODk5N0MzRTY3NzVBQzE5OUVEMUU3OTBFMzJCMDdBRkIyODdGMkE3RkM5REY3NEZGRjQ4NTc5QTA3MjRGMkQyQzU3QzI3RThEMERFMTJDRDZENkUyQUUyRTJDMTI5MTUxODM3RDE1Q0U4QURCNTcwNTRCQjg1NjVGOEQ1ODRFODM5MTgxNUYwNDM2RjlDMzhGREVFMTA1QkI5OEY2Q0FENTIxOUZFMjZDQkJGNjAzQjNDODdDMTdBQUNGMDIwMzAxMDAwMTAeFw0yMTAxMDcxNDQzNDJaFw0yMTAxMTQxNDQ4NDJaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQjVBRjI5QUY3ODIxM0YyNTZERTg2OUI4ODhEQzRENEY0OUI2NkE4QzM1RjkwMkY5QjFDNTY2RUI5QUNFODU5MDMyRTM4MkI0NkIzNzRBRDg2MjczMDNENEZBRDg5MEI2RDQ3NTBFOTFBNUIyMDU3OTBEMjU0Q0VDRkYzRjlCRTU3RUY3Qzc4RDZBMEUxMTQ4RUNCMkQzMjY0OEE4NDUwQ0E4Nzc4N0Y5MTkwQkFDMUFFQjA2RDcyODZBNDlBN0Q2QjYyMUVBQUExMDc2NUJFQzUwMUM0NTcxMzA4QTZDNUZBNTM5MjdGNzYzN0U5RkQxMDAyMzE4QTBGNjRGMkU3MzgyMUE3RTRGNzBERTQ3MjA5NjA3MzRCOTlCOTRENUI2QkQzQjE4M0NFQUY1MjQxNUVEN0Y1NTJBMDIxQTM1NjJEOTVGREYxNjJDNkU5MTNCNzlFMzcxMUJENDkyQzZERjFBNzk5QTUxRDA1RDQwRTU0RkZDQTU3Q0I0OUNCNEM5QkI2MDBFMkVEMDQxNkZGMTRBNTlGNDRFNTMzQzU1ODI2RTkyMDM3M0I4MzFDMzA5MEYzMDUwNjA0Qzg4QURFNUNDODVFNUMyQ0NFM0M2NTE2MkFBQ0VDMjk1QjI2Q0U2MDFBNTM1MjAxMjI1MTlDN0Y2ODQ3NzI1MDI2RTlFMTEwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAta8pr3ghPyVt6Gm4iNxNT0m2aow1+QL5scVm65rOhZAy44K0azdK2GJzA9T62JC21HUOkaWyBXkNJUzs/z+b5X73x41qDhFI7LLTJkioRQyod4f5GQusGusG1yhqSafWtiHqqhB2W+xQHEVxMIpsX6U5J/djfp/RACMYoPZPLnOCGn5PcN5HIJYHNLmblNW2vTsYPOr1JBXtf1UqAho1Ytlf3xYsbpE7eeNxG9SSxt8aeZpR0F1A5U/8pXy0nLTJu2AOLtBBb/FKWfROUzxVgm6SA3O4McMJDzBQYEyIreXMheXCzOPGUWKqzsKVsmzmAaU1IBIlGcf2hHclAm6eEQIDAQABo4IBpzCCAaMwHQYDVR0OBBYEFDHUwV2kk93zGIbpVc6wgx5WA7yHMB8GA1UdIwQYMBaAFIULQAATEaPeUO1tPfrJyNCHPz4DMA4GA1UdDwEB/wQEAwIHgDBZBgNVHR8EUjBQME6gTKBKhkhyc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhLzAvODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwwPAYIKwYBBQUHAQEEMDAuMCwGCCsGAQUFBzAChiByc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhL3RhLmNlcjBkBggrBgEFBQcBCwRYMFYwVAYIKwYBBQUHMAuGSHJzeW5jOi8vbG9zdGxob3N0L3JlcG8vdGEvMC84NTBCNDAwMDEzMTFBM0RFNTBFRDZEM0RGQUM5QzhEMDg3M0YzRTAzLm1mdDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCEGCCsGAQUFBwEHAQH/BBIwEDAGBAIAAQUAMAYEAgACBQAwFQYIKwYBBQUHAQgBAf8EBjAEoAIFADANBgkqhkiG9w0BAQsFAAOCAQEAloqK+RhQFAtfSVI+nWBr1fyHFKVEhSMEdpGYSwzG5xBOh6iMnXM9ti4I2Olrh3rmLCx8tb76SNmm/8UsaRv0tierluN+ZxR62v271eFunAcUmGPkGY2E/u79tNGQZ1jRJCFeiN7K6fQmOzUyUilr7qifHQGLCDGiu9S21M2SJFu+RAXEUGWnDJ6CbQ/sbH6Psi0Twuo18ADBX9tPTfQEAPP/QK+wwueIdVT8Ve9l9/YpvWzSdopgCW00W4i3p14IQ90I41A+9LPmthLqX4iFYiLfaH4bY6qwfpGBlBA+iyJzSHpoKFsm75uvnUhYkUYZ7F53o6krQWg0umbV/t4LFzGCAaowggGmAgEDgBQx1MFdpJPd8xiG6VXOsIMeVgO8hzALBglghkgBZQMEAgGgazAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQARowHAYJKoZIhvcNAQkFMQ8XDTIxMDEwNzE0NDg0MlowLwYJKoZIhvcNAQkEMSIEIMLV0vz/dR2wTz93ouxGAhfLQSyOkjhlxzZfklGCB7lBMA0GCSqGSIb3DQEBAQUABIIBAGFI8XpsEwcuFdmWRjex0snxtn1ViZRe1lowZmgF32G43vCbmUq3TW7lMoHfQKnY69AvCTFVIMdR34AyLs6tZOZcvp81/He+XmYEuP7w19BRjYjeP356XRuLLUb8poGjR6vwQAQ1vgP+mvRq2twGJuwkvng3CQHxcI5Wt5WG/TJTfgdc368uMJO1861Hz24p3hCt4iqto1lXHKI4mUbLbGXbWCaxw2F3mtD/Vr5th6HO1MKrGrufwaXRSZsKCyIrYYtiQD/EMNag0m9tAToez3geIyASQsOS86rQ+BlgUrOiiyoVsgByDZh75aK2vQZmsodNnWqGuiGlYIPq0QgB6FQ=", - "serial": "704869164585700966467604688662219012818071067133", - "expires": "2021-01-08T14:48:42.210471Z" - }, - "next_update": "2021-01-08T14:48:42.210471Z", - "old": null - }, - "crl_info": { - "name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.crl", - "current": { - "content": "MIIDrDCCApQCAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEXDTIxMDEwNzE0NDM0MloXDTIxMDEwODE0NDg0MlowAKAvMC0wHwYDVR0jBBgwFoAUhQtAABMRo95Q7W09+snI0Ic/PgMwCgYDVR0UBAMCAQEwDQYJKoZIhvcNAQELBQADggEBABlhhKHSGBgrdHU5qG/QQQB9W6tPvcWFj8Ln5Rd7kQB5kUCt870KAs2sgVscnVXimHJPpDDi09oKaisYLNlDZb//vgOhJiU4etBqhpBHtpjAWGNqejvS/BVv0n5mlKmrsefq946RoPxMHejL28QwKpyWaRdaCsT1xSDp0+9uu/1DobucgO5vfNtYYoSVazqtx3F0M6GUh5diWtCBIHEmghHGmn16+LPdvs/AAR8z2d31q9RpaT7UI0FITme1j9rIoBHKL0OxXoPb8L/baRS5FG9NnYPgvRJ7d4AJc7T14WxdeEs+y1Kwq/V4cNX1259BFfNLXJrBX0BtAm0erKmMBEo=", - "serial": "1", - "expires": "2021-01-08T14:48:42.206964Z" - }, - "old": null - } - }, - "request": null - } - } - } - }, - "children": { - "testbed": { - "id_cert": "MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhDMjdFQUVCNzA3Q0VBMjI1RkM1QjU0RUYwQUU1Qjg4RkE0N0QyRDNBMB4XDTIxMDEwNzE0NDM0MloXDTM2MDEwNzE0NDg0MlowMzExMC8GA1UEAxMoQzI3RUFFQjcwN0NFQTIyNUZDNUI1NEVGMEFFNUI4OEZBNDdEMkQzQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMyjKrgOjfJzCe/jzSqBKBHLNOfGlLPcGxcXjNO0KZYKYahtolEmF1tY36xxEiVZbV/p568RFV5fB7rzBc6kPnCABZzDW5RMF5g4JrNc09ZkmUYxfDj5F6OiE0iTsOhHfNm+K3l3NKWjtFuFf2+8HGoyd3toKw4KjBOPsYYOmGiECW2mAU/69VfxndJru34b3p145MzkHBCmvU0UoByItKa3IvCgEMDtT/M7nNG9IJYry8t9RycA1mlRQE7GiqAZGdXaJr+rextdGGKAiZNPmcdDi8vAInxdMW5njVyxx1aMIXHKNUAJ7XykEE3AjOsR/yixEEgalramiFaJnnHkBUECAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUwn6utwfOoiX8W1TvCuW4j6R9LTowHwYDVR0jBBgwFoAUwn6utwfOoiX8W1TvCuW4j6R9LTowDQYJKoZIhvcNAQELBQADggEBABeYST0jZYqp26k933IiKXBFyECObIMbS/Fto5oqIvS+UZYbOF8an/ivTGmOlkyNRXbVYhIW9HTXN4Zb25kBnu1y/u5gy05CkA+9lzrsdIdGvlwJHSLQDQVh7tZE45pNPBIiTbhBmM8/9Jw+GzZn75+PqUvnNh1uZT2Bi4bPMyNt0Jk4+2xci4DF9gZlLsNVy5kEDGyMr5n6ECALhAUjAcE+jeB16QChrdV32HEzHVk4nejb/w2IcrKDhT72738R33wzJWBH2VYo4dPZFFecbDEO/D7wfkC+A/15mKKPQS1rdcAXqeeuI9XKc1EmBaQ4DJNFtclWLtHdl4q6XozbRVQ=", - "resources": { - "asn": "AS0-AS4294967295", - "v4": "0.0.0.0/0", - "v6": "::/0" - }, - "used_keys": {} - } - }, - "routes": { - "map": {} - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_8_1/cas/ta/snapshot.json b/test-resources/migrations/v0_8_1/cas/ta/snapshot.json deleted file mode 100644 index e9a4f203..00000000 --- a/test-resources/migrations/v0_8_1/cas/ta/snapshot.json +++ /dev/null @@ -1,124 +0,0 @@ -{ - "handle": "ta", - "version": 10, - "id": { - "key": "D272D0F1E7F20EBE4F3038F29ACFA9774590E835", - "cert": "MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhEMjcyRDBGMUU3RjIwRUJFNEYzMDM4RjI5QUNGQTk3NzQ1OTBFODM1MB4XDTIxMDEwNzE0NDM0MloXDTM2MDEwNzE0NDg0MlowMzExMC8GA1UEAxMoRDI3MkQwRjFFN0YyMEVCRTRGMzAzOEYyOUFDRkE5Nzc0NTkwRTgzNTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN3jacZMe8xlT+AcOVWbj49zwPCzQpzNSwUTPqsYYhAU9mwQXA0tFx0e5VC+qGYCMLJkY1goywEi+qiLJVdlLSmB8LokYcgJKG9EIw3q3JxrfseLVWJjbQAd0VdkG4FvU3LtB+f3Yr1whM6T4AOt070de/9Ox20RioCiSBCEsgfLTmFZsGCzUomtp9krfO7HpBMar08YJ46Bm1h450K79+AbvvhaRctSnrmaxjd/TBi4Q6FtskkcRonBCF1Lcu8eqn1nnfjglflOu/5yOqk+4OXel9b4zx+iooybmjhIhi6istKpYQgzVaAVnpGP3//wF6/zgQsxfHtC74DDA6jvJq8CAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU0nLQ8efyDr5PMDjyms+pd0WQ6DUwHwYDVR0jBBgwFoAU0nLQ8efyDr5PMDjyms+pd0WQ6DUwDQYJKoZIhvcNAQELBQADggEBAMWMRfUSu2C3VznHT+gH7Hg1UobuxZSAlN44kgcWryZa849oPml4OPy3iGKCeEKDxuEAdM/FGXgOUkMSR/psP3ym5FG+RVollSyj25GVgmgmxkV9VaoT4xiJxg3qfHNIeDgReLWYumfHanrpuVw56fhQb+5IEkq4Cw1mrSeoJxtC5Hdij/taylXJ0kP9rEnC5Kh7xGQlvMQXZc+Zn3i+myyHBK8EgUH7un++6b6uxNY+8/2MWN5kO/0sY2QQCgXAfFToiY95emR//c5rud3Wx4oboiS/u4iAObDyV5dCPpHKEP9lG6JWEOkRZYBA5KHydHhYHnKFJ+awvevrr+qn918=" - }, - "repository": { - "embedded": { - "base_uri": "rsync://lostlhost/repo/ta/", - "rpki_notify": "https://localhost:3000/rrdp/notification.xml" - } - }, - "repository_pending_withdraw": null, - "parents": { - "ta": { - "ta": { - "cert": "MIIIZjCCB06gAwIBAgIUL1jmoavzDeBUl69dks9XgsYxicwwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEwIBcNMjEwMTA3MTQ0MzQyWhgPMjEyMTAxMDcxNDQ4NDJaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQ0QyODM2REI3MjQ0NDMyNzU3OTNGODk5MkYzREMwMzUzRjA2NkRFNzk1QzMzMUMwMjRENUYxOUZGNEQ0OUZCQjdGQzc2MkRENkJENUUxNDIyM0U3MDQyMjYxMzY3MkFEQzVENkRDQkQxRTU5NTJCQTU1OTcwNzM4QzhERDBEMEQ3MjkyREM2NzkzMzYwOEU5RUI1ODJFRjk2NTcxNkIwM0YzMDM1MzY1OURGQTU0MjA1RDczRkI0RENBNzQzOTRDQUYyM0YyNzQyQjJBODExQ0Y5MkI0MjZGNTk0NzZGQkQzMDNBREY3MjI4MjY1MDMzMDBGRENGMjlBNTMxRjY0NDc3N0U1NTE3MDdGQzhDODUyN0QzNzRBMUEyNDEyNkZGMjJGOEY0QkVEOTRDQkRBRTQ2Njc1MzI2RDBEMDI2NDU5ODUyODk4OTk3QzNFNjc3NUFDMTk5RUQxRTc5MEUzMkIwN0FGQjI4N0YyQTdGQzlERjc0RkZGNDg1NzlBMDcyNEYyRDJDNTdDMjdFOEQwREUxMkNENkQ2RTJBRTJFMkMxMjkxNTE4MzdEMTVDRThBREI1NzA1NEJCODU2NUY4RDU4NEU4MzkxODE1RjA0MzZGOUMzOEZERUUxMDVCQjk4RjZDQUQ1MjE5RkUyNkNCQkY2MDNCM0M4N0MxN0FBQ0YwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzSg223JEQydXk/iZLz3ANT8GbeeVwzHAJNXxn/TUn7t/x2Lda9XhQiPnBCJhNnKtxdbcvR5ZUrpVlwc4yN0NDXKS3GeTNgjp61gu+WVxawPzA1NlnfpUIF1z+03KdDlMryPydCsqgRz5K0JvWUdvvTA633IoJlAzAP3PKaUx9kR3flUXB/yMhSfTdKGiQSb/Ivj0vtlMva5GZ1Mm0NAmRZhSiYmXw+Z3WsGZ7R55DjKwevsofyp/yd90//SFeaByTy0sV8J+jQ3hLNbW4q4uLBKRUYN9Fc6K21cFS7hWX41YToORgV8ENvnDj97hBbuY9srVIZ/ibLv2A7PIfBeqzwIDAQABo4IBdjCCAXIwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUhQtAABMRo95Q7W09+snI0Ic/PgMwDgYDVR0PAQH/BAQDAgEGMIHJBggrBgEFBQcBCwSBvDCBuTAnBggrBgEFBQcwBYYbcnN5bmM6Ly9sb3N0bGhvc3QvcmVwby90YS8wMFQGCCsGAQUFBzAKhkhyc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhLzAvODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5tZnQwOAYIKwYBBQUHMA2GLGh0dHBzOi8vbG9jYWxob3N0OjMwMDAvcnJkcC9ub3RpZmljYXRpb24ueG1sMBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwJwYIKwYBBQUHAQcBAf8EGDAWMAkEAgABMAMDAQAwCQQCAAIwAwMBADAhBggrBgEFBQcBCAEB/wQSMBCgDjAMMAoCAQACBQD/////MA0GCSqGSIb3DQEBCwUAA4IBAQCkZ0kAVe2d8sIp9+DUtf4nvXItI2H1ouWZIJnOgBvrWlwTMbfijQxRD04WSLwzOVC39+2bqP9GGDqr9nBOPbpbtQPhYhV4wbvaVLc7wFgIrVrJ/D7fV9HasH6xQpeH1c/plHKPHFQdHGQZU/s3DKwl1cJ4iMxqRbuC3d3LwnMOuviej58EzDW351ZCu8xNxah93VS5Rspw0x2OHhml5xGIg735QKlXKT0gVfFN8CG+AOjzD0l5wKv7Nt7HQ07ikAYj6NZ7/7eiupg9hIyspWif+po7MKzhbR3PrYcLOFp9jAOCdMOY7E3blgZVsQsIZGQO4tTtgdnYURw0I4kx2YQW", - "resources": { - "asn": "AS0-AS4294967295", - "v4": "0.0.0.0/0", - "v6": "::/0" - }, - "tal": { - "uris": [ - "https://localhost:3000/rrdp/ta/ta.cer" - ], - "encoded_ski": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzSg223JEQydXk/iZLz3ANT8GbeeVwzHAJNXxn/TUn7t/x2Lda9XhQiPnBCJhNnKtxdbcvR5ZUrpVlwc4yN0NDXKS3GeTNgjp61gu+WVxawPzA1NlnfpUIF1z+03KdDlMryPydCsqgRz5K0JvWUdvvTA633IoJlAzAP3PKaUx9kR3flUXB/yMhSfTdKGiQSb/Ivj0vtlMva5GZ1Mm0NAmRZhSiYmXw+Z3WsGZ7R55DjKwevsofyp/yd90//SFeaByTy0sV8J+jQ3hLNbW4q4uLBKRUYN9Fc6K21cFS7hWX41YToORgV8ENvnDj97hBbuY9srVIZ/ibLv2A7PIfBeqzwIDAQAB" - } - } - } - }, - "next_class_name": 1, - "resources": { - "0": { - "name": "0", - "name_space": "0", - "parent_handle": "ta", - "parent_rc_name": "0", - "roas": {}, - "certificates": { - "inner": { - "578C2EF4CFC1810860F52DC0D86530B1176FAE2B": { - "uri": "rsync://lostlhost/repo/ta/0/578C2EF4CFC1810860F52DC0D86530B1176FAE2B.cer", - "limit": { - "asn": "none", - "v4": "none", - "v6": "none" - }, - "resource_set": { - "asn": "AS0-AS4294967295", - "v4": "0.0.0.0/0", - "v6": "::/0" - }, - "cert": "MIIHLTCCBhWgAwIBAgIUI/SFnDjXvYPFZXmeG9gQPoh0CFYwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEwHhcNMjEwMTA3MTQ0MzQ0WhcNMjIwMTA2MTQ0ODQ0WjAzMTEwLwYDVQQDEyg1NzhDMkVGNENGQzE4MTA4NjBGNTJEQzBEODY1MzBCMTE3NkZBRTJCMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtmHy7qwTc91JeWA4ClyPrnIsGegWpdCJwfJvmXgsTxIjld+m42CzrwjdaIfTiBy3lH4tLUDlGi71TFdJBQnHdX0od3c2i1QBKqYaLFomOFEDxaafA3khAAyQqsxIHA1XAoz4E8sw3E6VbwxRL0k7/6dlfBZgSvSgsL7SLTsgZ7RibcxCm5yB5i+XzMa51cHVIKW6LNMlbl/89RT2RO4cSVFm5aHixpE9WlII8OAwy5cXC9jZQaQey7Xz4WPmYB682CZv5az0tg+mucpJvQ1zViTYee4fv2vLE9Xo+jF0aGNwMxDGRJoIEUmGjiYwnbq3ICjHV6knV7GTvzN+H2zxrQIDAQABo4ICOzCCAjcwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUV4wu9M/BgQhg9S3A2GUwsRdvriswHwYDVR0jBBgwFoAUhQtAABMRo95Q7W09+snI0Ic/PgMwDgYDVR0PAQH/BAQDAgEGMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9zdGxob3N0L3JlcG8vdGEvMC84NTBCNDAwMDEzMTFBM0RFNTBFRDZEM0RGQUM5QzhEMDg3M0YzRTAzLmNybDA8BggrBgEFBQcBAQQwMC4wLAYIKwYBBQUHMAKGIHJzeW5jOi8vbG9zdGxob3N0L3JlcG8vdGEvdGEuY2VyMIHUBggrBgEFBQcBCwSBxzCBxDAtBggrBgEFBQcwBYYhcnN5bmM6Ly9sb3N0bGhvc3QvcmVwby90ZXN0YmVkLzAvMFkGCCsGAQUFBzAKhk1yc3luYzovL2xvc3RsaG9zdC9yZXBvL3Rlc3RiZWQvMC81NzhDMkVGNENGQzE4MTA4NjBGNTJEQzBEODY1MzBCMTE3NkZBRTJCLm1mdDA4BggrBgEFBQcwDYYsaHR0cHM6Ly9sb2NhbGhvc3Q6MzAwMC9ycmRwL25vdGlmaWNhdGlvbi54bWwwGAYDVR0gAQH/BA4wDDAKBggrBgEFBQcOAjAnBggrBgEFBQcBBwEB/wQYMBYwCQQCAAEwAwMBADAJBAIAAjADAwEAMCEGCCsGAQUFBwEIAQH/BBIwEKAOMAwwCgIBAAIFAP////8wDQYJKoZIhvcNAQELBQADggEBALDZ4wTeOjHCs6FTTEJzZrJWUAU4kev2AwSN/FyEIxxfG507FPhd0W3jVL2ya/Rg5QwyCebjCPAk8Jz55pn7Nh87/USImmc4U+myRn+QiFUmz4Iv0kC0chpOGyPhbmvAw4Lv1Yy4RAZG3oagB2YtxAH8P5vPVuRcbgsVPsi/kgr3kkwXkaI+g2RQnuC3B2JDtpNLvyXcJNvylgsHsG8IbTioKJGe+h4cgotx+/lU1wr3PmSL+QxzGSbCBQyrYnbsaPGEPXpxPE4I1oV8VBUaSzpkNTt7o0qjgpyC+AryUqUJQDWL79dYCL2Yh+5mqWeAi+nPP94jzON7dHWIF5Vat/Q=", - "replaces": null - } - } - }, - "last_key_change": "2021-01-07T14:48:42.205924Z", - "key_state": { - "active": { - "key_id": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03", - "incoming_cert": { - "cert": "MIIIZjCCB06gAwIBAgIUL1jmoavzDeBUl69dks9XgsYxicwwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEwIBcNMjEwMTA3MTQ0MzQyWhgPMjEyMTAxMDcxNDQ4NDJaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQ0QyODM2REI3MjQ0NDMyNzU3OTNGODk5MkYzREMwMzUzRjA2NkRFNzk1QzMzMUMwMjRENUYxOUZGNEQ0OUZCQjdGQzc2MkRENkJENUUxNDIyM0U3MDQyMjYxMzY3MkFEQzVENkRDQkQxRTU5NTJCQTU1OTcwNzM4QzhERDBEMEQ3MjkyREM2NzkzMzYwOEU5RUI1ODJFRjk2NTcxNkIwM0YzMDM1MzY1OURGQTU0MjA1RDczRkI0RENBNzQzOTRDQUYyM0YyNzQyQjJBODExQ0Y5MkI0MjZGNTk0NzZGQkQzMDNBREY3MjI4MjY1MDMzMDBGRENGMjlBNTMxRjY0NDc3N0U1NTE3MDdGQzhDODUyN0QzNzRBMUEyNDEyNkZGMjJGOEY0QkVEOTRDQkRBRTQ2Njc1MzI2RDBEMDI2NDU5ODUyODk4OTk3QzNFNjc3NUFDMTk5RUQxRTc5MEUzMkIwN0FGQjI4N0YyQTdGQzlERjc0RkZGNDg1NzlBMDcyNEYyRDJDNTdDMjdFOEQwREUxMkNENkQ2RTJBRTJFMkMxMjkxNTE4MzdEMTVDRThBREI1NzA1NEJCODU2NUY4RDU4NEU4MzkxODE1RjA0MzZGOUMzOEZERUUxMDVCQjk4RjZDQUQ1MjE5RkUyNkNCQkY2MDNCM0M4N0MxN0FBQ0YwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzSg223JEQydXk/iZLz3ANT8GbeeVwzHAJNXxn/TUn7t/x2Lda9XhQiPnBCJhNnKtxdbcvR5ZUrpVlwc4yN0NDXKS3GeTNgjp61gu+WVxawPzA1NlnfpUIF1z+03KdDlMryPydCsqgRz5K0JvWUdvvTA633IoJlAzAP3PKaUx9kR3flUXB/yMhSfTdKGiQSb/Ivj0vtlMva5GZ1Mm0NAmRZhSiYmXw+Z3WsGZ7R55DjKwevsofyp/yd90//SFeaByTy0sV8J+jQ3hLNbW4q4uLBKRUYN9Fc6K21cFS7hWX41YToORgV8ENvnDj97hBbuY9srVIZ/ibLv2A7PIfBeqzwIDAQABo4IBdjCCAXIwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUhQtAABMRo95Q7W09+snI0Ic/PgMwDgYDVR0PAQH/BAQDAgEGMIHJBggrBgEFBQcBCwSBvDCBuTAnBggrBgEFBQcwBYYbcnN5bmM6Ly9sb3N0bGhvc3QvcmVwby90YS8wMFQGCCsGAQUFBzAKhkhyc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhLzAvODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5tZnQwOAYIKwYBBQUHMA2GLGh0dHBzOi8vbG9jYWxob3N0OjMwMDAvcnJkcC9ub3RpZmljYXRpb24ueG1sMBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwJwYIKwYBBQUHAQcBAf8EGDAWMAkEAgABMAMDAQAwCQQCAAIwAwMBADAhBggrBgEFBQcBCAEB/wQSMBCgDjAMMAoCAQACBQD/////MA0GCSqGSIb3DQEBCwUAA4IBAQCkZ0kAVe2d8sIp9+DUtf4nvXItI2H1ouWZIJnOgBvrWlwTMbfijQxRD04WSLwzOVC39+2bqP9GGDqr9nBOPbpbtQPhYhV4wbvaVLc7wFgIrVrJ/D7fV9HasH6xQpeH1c/plHKPHFQdHGQZU/s3DKwl1cJ4iMxqRbuC3d3LwnMOuviej58EzDW351ZCu8xNxah93VS5Rspw0x2OHhml5xGIg735QKlXKT0gVfFN8CG+AOjzD0l5wKv7Nt7HQ07ikAYj6NZ7/7eiupg9hIyspWif+po7MKzhbR3PrYcLOFp9jAOCdMOY7E3blgZVsQsIZGQO4tTtgdnYURw0I4kx2YQW", - "uri": "rsync://lostlhost/repo/ta/ta.cer", - "resources": { - "asn": "AS0-AS4294967295", - "v4": "0.0.0.0/0", - "v6": "::/0" - } - }, - "current_set": { - "number": 4, - "revocations": [ - { - "serial": "201831291475634267796886973706723420667525891444", - "expires": "2021-01-09T10:14:00.687129Z" - } - ], - "manifest_info": { - "name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.mft", - "current": { - "content": "MIILYgYJKoZIhvcNAQcCoIILUzCCC08CAQMxDTALBglghkgBZQMEAgEwge8GCyqGSIb3DQEJEAEaoIHfBIHcMIHZAgEEGA8yMDIxMDExMzExMjMwMVoYDzIwMjEwMTE0MTEyODAxWgYJYIZIAWUDBAIBMIGmMFEWLDg1MEI0MDAwMTMxMUEzREU1MEVENkQzREZBQzlDOEQwODczRjNFMDMuY3JsAyEA6mNo+nxZrIChzTmZT8JK3Aj1o0JHc8tyRh0B9/kPiMswURYsNTc4QzJFRjRDRkMxODEwODYwRjUyREMwRDg2NTMwQjExNzZGQUUyQi5jZXIDIQDES0HAlYo04PXRT0c89CgJvEFXzkRnuAjBR4dG8uRKLKCCCJkwggiVMIIHfaADAgECAhRFqiSIGoF+Nq3QuPFW3aEexfnerTANBgkqhkiG9w0BAQsFADCCAi0xggIpMIICJQYDVQQDE4ICHDMwODIwMTBBMDI4MjAxMDEwMENEMjgzNkRCNzI0NDQzMjc1NzkzRjg5OTJGM0RDMDM1M0YwNjZERTc5NUMzMzFDMDI0RDVGMTlGRjRENDlGQkI3RkM3NjJERDZCRDVFMTQyMjNFNzA0MjI2MTM2NzJBREM1RDZEQ0JEMUU1OTUyQkE1NTk3MDczOEM4REQwRDBENzI5MkRDNjc5MzM2MDhFOUVCNTgyRUY5NjU3MTZCMDNGMzAzNTM2NTlERkE1NDIwNUQ3M0ZCNERDQTc0Mzk0Q0FGMjNGMjc0MkIyQTgxMUNGOTJCNDI2RjU5NDc2RkJEMzAzQURGNzIyODI2NTAzMzAwRkRDRjI5QTUzMUY2NDQ3NzdFNTUxNzA3RkM4Qzg1MjdEMzc0QTFBMjQxMjZGRjIyRjhGNEJFRDk0Q0JEQUU0NjY3NTMyNkQwRDAyNjQ1OTg1Mjg5ODk5N0MzRTY3NzVBQzE5OUVEMUU3OTBFMzJCMDdBRkIyODdGMkE3RkM5REY3NEZGRjQ4NTc5QTA3MjRGMkQyQzU3QzI3RThEMERFMTJDRDZENkUyQUUyRTJDMTI5MTUxODM3RDE1Q0U4QURCNTcwNTRCQjg1NjVGOEQ1ODRFODM5MTgxNUYwNDM2RjlDMzhGREVFMTA1QkI5OEY2Q0FENTIxOUZFMjZDQkJGNjAzQjNDODdDMTdBQUNGMDIwMzAxMDAwMTAeFw0yMTAxMTMxMTIzMDFaFw0yMTAxMjAxMTI4MDFaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwOUNGOTAzRERFMzI4M0JBN0I1RDcyQUY5RUNFRjk4N0Q4NTU3MTFGOUQ5MDhCMzY3NjczOTkyNTA5OTgxRDE4NjNCQzcxMUU3Njg1QzE4ODk2Rjc1OTI2NjU0ODczRjZENUM3NjcyNUQzQTY5RTEyRjk1MEE2ODE0OUY4Q0UyMzQwNDUyRjIzMUE5RkM4NjFCRjAzMUVCM0IzMEQ0OUYzRkFGRkQ4RkJEOUYwQ0EzQkUwNzk0MEJCRUI3ODg5NTFFMTk3OUZDQjdGOTkwQUMzMUQ2MkU4MTBBRkY0MUQyMTNFRDJEOTNFOUQ0QTAzREU0RUE0N0Y3RDcwOUQ3OEI5RDFFODExRDU3NDhGRThCRDM0ODZEQ0JFNDQyRUIyMjE4OEI4OEUyMjQzMDBGODBFQzQwMEMyRkYxNzFCMTAzOEEzQTZFOTc0QUY4N0M4QzFBQjQ2RDQxOTIxMkI3MkMzODQzMjRFMEJFNTJFNTBDNzk3OUM1MkRCMzk4NUU0OTI2OENGNDE0RTQzODdGNzFCNjRFNTUxRjc2NzVFNTZDMjIxRTk2RERFRjZFNjI1QkFDMkJENzFDQUY2RTZEMTFEMEYwRDFGQkJDOUYyNTZENENBQTkxRDg0QTkwOTcyRTFFOERBNzQyOTFEMjNCMDUyMjRBOEFEREE3MkNDREI3MTEwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnPkD3eMoO6e11yr57O+YfYVXEfnZCLNnZzmSUJmB0YY7xxHnaFwYiW91kmZUhz9tXHZyXTpp4S+VCmgUn4ziNARS8jGp/IYb8DHrOzDUnz+v/Y+9nwyjvgeUC763iJUeGXn8t/mQrDHWLoEK/0HSE+0tk+nUoD3k6kf31wnXi50egR1XSP6L00hty+RC6yIYi4jiJDAPgOxADC/xcbEDijpul0r4fIwatG1BkhK3LDhDJOC+UuUMeXnFLbOYXkkmjPQU5Dh/cbZOVR92deVsIh6W3e9uYlusK9ccr25tEdDw0fu8nyVtTKqR2EqQly4ejadCkdI7BSJKit2nLM23EQIDAQABo4IBpzCCAaMwHQYDVR0OBBYEFFV4uJxrfdfmI9KQmdKtbB7YqNLZMB8GA1UdIwQYMBaAFIULQAATEaPeUO1tPfrJyNCHPz4DMA4GA1UdDwEB/wQEAwIHgDBZBgNVHR8EUjBQME6gTKBKhkhyc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhLzAvODUwQjQwMDAxMzExQTNERTUwRUQ2RDNERkFDOUM4RDA4NzNGM0UwMy5jcmwwPAYIKwYBBQUHAQEEMDAuMCwGCCsGAQUFBzAChiByc3luYzovL2xvc3RsaG9zdC9yZXBvL3RhL3RhLmNlcjBkBggrBgEFBQcBCwRYMFYwVAYIKwYBBQUHMAuGSHJzeW5jOi8vbG9zdGxob3N0L3JlcG8vdGEvMC84NTBCNDAwMDEzMTFBM0RFNTBFRDZEM0RGQUM5QzhEMDg3M0YzRTAzLm1mdDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCEGCCsGAQUFBwEHAQH/BBIwEDAGBAIAAQUAMAYEAgACBQAwFQYIKwYBBQUHAQgBAf8EBjAEoAIFADANBgkqhkiG9w0BAQsFAAOCAQEABP8eMGdPiQFqKVl61O0k3Tno4oQnjPob76oLwJguZLYD6ALVRJEjK9N/0UW89oy+c9ITfaECa18cufklZm50VnEqDvItS4KmEEKgjM0rLZDMWoRvOhXTR3Uhv8hVrwMJZqnqji7UfrdBuh/Eig/zuQrHotQQhznr6D011jGZ2LwPRn+sORB8k126fiCeykaCrqEmaxlJej67dei1SmhnILTYI46miTYlprQre1bFixXFv6Ev5+1r+sT8sY8duHb6mcpUiCNaiQKMeqsbN9vg45b+oxWe5Xj3ibitB3Kbf7oYNlHTsPlHi2jtXo0in1ODdsDYpHVqNfyNW96IaLDbiDGCAaowggGmAgEDgBRVeLica33X5iPSkJnSrWwe2KjS2TALBglghkgBZQMEAgGgazAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQARowHAYJKoZIhvcNAQkFMQ8XDTIxMDExMzExMjgwMVowLwYJKoZIhvcNAQkEMSIEIJ8/HRUwo5c7LyfB4n6fXORpin5RdHwPnSlOtgAMAPm4MA0GCSqGSIb3DQEBAQUABIIBAEIlbSqYXbPacK6z/BHe6nwpO8WwktajgVLXz+POTY8h8BQW5bUSk7ITYJZiDRNACjTwdAlp+GlAcY5PftWyhy+OnGObGOg9nqCBtEWP3OykWpZgm+MdmGPpDLRKRFivAiq5W/UUXzJqUCg1aMQBWrhWqrubviIFKSttqneWSCG+wRJqc1wirbz9ry7+flA3TF/s5X1CxvzoxdxPJsFrKH7ufmKxAIBzAdYXwYKv+mVnfXpApKkh9QxEHl96FGhqPHW386k0AdG1VPgDThNV6VEEDoaTXAUm/5QALCo4+eNcdP7HLdLXsfkSbP1S70A+clUG56q6hAxRwMHJyVSjJAs=", - "serial": "397714672226522871823541187130996691739866685101", - "expires": "2021-01-14T11:28:01.080728Z" - }, - "next_update": "2021-01-14T11:28:01.080728Z", - "old": "f9c4504820ea0c83b264a25302c76d5c3b6961bc788bbd3cf4b08f69c670bbe1" - }, - "crl_info": { - "name": "850B40001311A3DE50ED6D3DFAC9C8D0873F3E03.crl", - "current": { - "content": "MIIDrDCCApQCAQEwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBDRDI4MzZEQjcyNDQ0MzI3NTc5M0Y4OTkyRjNEQzAzNTNGMDY2REU3OTVDMzMxQzAyNEQ1RjE5RkY0RDQ5RkJCN0ZDNzYyREQ2QkQ1RTE0MjIzRTcwNDIyNjEzNjcyQURDNUQ2RENCRDFFNTk1MkJBNTU5NzA3MzhDOEREMEQwRDcyOTJEQzY3OTMzNjA4RTlFQjU4MkVGOTY1NzE2QjAzRjMwMzUzNjU5REZBNTQyMDVENzNGQjREQ0E3NDM5NENBRjIzRjI3NDJCMkE4MTFDRjkyQjQyNkY1OTQ3NkZCRDMwM0FERjcyMjgyNjUwMzMwMEZEQ0YyOUE1MzFGNjQ0Nzc3RTU1MTcwN0ZDOEM4NTI3RDM3NEExQTI0MTI2RkYyMkY4RjRCRUQ5NENCREFFNDY2NzUzMjZEMEQwMjY0NTk4NTI4OTg5OTdDM0U2Nzc1QUMxOTlFRDFFNzkwRTMyQjA3QUZCMjg3RjJBN0ZDOURGNzRGRkY0ODU3OUEwNzI0RjJEMkM1N0MyN0U4RDBERTEyQ0Q2RDZFMkFFMkUyQzEyOTE1MTgzN0QxNUNFOEFEQjU3MDU0QkI4NTY1RjhENTg0RTgzOTE4MTVGMDQzNkY5QzM4RkRFRTEwNUJCOThGNkNBRDUyMTlGRTI2Q0JCRjYwM0IzQzg3QzE3QUFDRjAyMDMwMTAwMDEXDTIxMDExMzExMjMwMVoXDTIxMDExNDExMjgwMVowAKAvMC0wHwYDVR0jBBgwFoAUhQtAABMRo95Q7W09+snI0Ic/PgMwCgYDVR0UBAMCAQQwDQYJKoZIhvcNAQELBQADggEBAD26Wa9JDK8ej4ADSPsZkwcFWgT7C+1t3oFA9EAxXQBNu7myhNBcNpaHO9sdKpOaouXmbE7vAWV9PfLpDtjtmxLhUYeBmjUB8RdXqxGr5aT+78a0tQjsIt/LFeolNf/J5qQZBUnwldWrO2C8qW7iFyiWEvLlfgnKD5yqhZvFhYD+UoN4pyyLGgqZJzAbXtcMab0AkGDQqLNvsyNF3CNHz136Fic3fIMum4Tp8HlyB2CYiMesBFcwgWtuCp5GzDmXr6PSC2lWxkefnsxbG6mb4cVctPNTEHTjUoC6sNKlHaaRsq/gyCBIs8ylt7RJl5cwzwL1UQZnT6RDwKGDDA/d41k=", - "serial": "4", - "expires": "2021-01-14T11:28:01.075690Z" - }, - "old": "b7ed7ea610cfefc1fe51a02735ea9f2d03e450ef77bc8d8d447d2e51c0a16369" - } - }, - "request": null - } - } - } - }, - "children": { - "testbed": { - "id_cert": "MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhDMjdFQUVCNzA3Q0VBMjI1RkM1QjU0RUYwQUU1Qjg4RkE0N0QyRDNBMB4XDTIxMDEwNzE0NDM0MloXDTM2MDEwNzE0NDg0MlowMzExMC8GA1UEAxMoQzI3RUFFQjcwN0NFQTIyNUZDNUI1NEVGMEFFNUI4OEZBNDdEMkQzQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMyjKrgOjfJzCe/jzSqBKBHLNOfGlLPcGxcXjNO0KZYKYahtolEmF1tY36xxEiVZbV/p568RFV5fB7rzBc6kPnCABZzDW5RMF5g4JrNc09ZkmUYxfDj5F6OiE0iTsOhHfNm+K3l3NKWjtFuFf2+8HGoyd3toKw4KjBOPsYYOmGiECW2mAU/69VfxndJru34b3p145MzkHBCmvU0UoByItKa3IvCgEMDtT/M7nNG9IJYry8t9RycA1mlRQE7GiqAZGdXaJr+rextdGGKAiZNPmcdDi8vAInxdMW5njVyxx1aMIXHKNUAJ7XykEE3AjOsR/yixEEgalramiFaJnnHkBUECAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUwn6utwfOoiX8W1TvCuW4j6R9LTowHwYDVR0jBBgwFoAUwn6utwfOoiX8W1TvCuW4j6R9LTowDQYJKoZIhvcNAQELBQADggEBABeYST0jZYqp26k933IiKXBFyECObIMbS/Fto5oqIvS+UZYbOF8an/ivTGmOlkyNRXbVYhIW9HTXN4Zb25kBnu1y/u5gy05CkA+9lzrsdIdGvlwJHSLQDQVh7tZE45pNPBIiTbhBmM8/9Jw+GzZn75+PqUvnNh1uZT2Bi4bPMyNt0Jk4+2xci4DF9gZlLsNVy5kEDGyMr5n6ECALhAUjAcE+jeB16QChrdV32HEzHVk4nejb/w2IcrKDhT72738R33wzJWBH2VYo4dPZFFecbDEO/D7wfkC+A/15mKKPQS1rdcAXqeeuI9XKc1EmBaQ4DJNFtclWLtHdl4q6XozbRVQ=", - "resources": { - "asn": "AS0-AS4294967295", - "v4": "0.0.0.0/0", - "v6": "::/0" - }, - "used_keys": { - "578C2EF4CFC1810860F52DC0D86530B1176FAE2B": { - "current": "0" - } - } - } - }, - "routes": { - "map": {} - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_9_5/cas/ta/command--1645792256--1--cmd-ca-repo-update.json b/test-resources/migrations/v0_9_5/cas/ta/command--1645792256--1--cmd-ca-repo-update.json deleted file mode 100644 index 529d5ee9..00000000 --- a/test-resources/migrations/v0_9_5/cas/ta/command--1645792256--1--cmd-ca-repo-update.json +++ /dev/null @@ -1,17 +0,0 @@ -{ - "actor": "krill", - "time": "2022-02-25T12:30:56.405477897Z", - "handle": "ta", - "version": 1, - "sequence": 1, - "details": { - "type": "repo_update", - "service_uri": "https://testbed.krill.cloud/rfc8181/ta/" - }, - "effect": { - "result": "success", - "events": [ - 1 - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_9_5/cas/ta/command--1645792256--2--cmd-ca-make-ta.json b/test-resources/migrations/v0_9_5/cas/ta/command--1645792256--2--cmd-ca-make-ta.json deleted file mode 100644 index 031da7d8..00000000 --- a/test-resources/migrations/v0_9_5/cas/ta/command--1645792256--2--cmd-ca-make-ta.json +++ /dev/null @@ -1,16 +0,0 @@ -{ - "actor": "krill", - "time": "2022-02-25T12:30:56.410915529Z", - "handle": "ta", - "version": 2, - "sequence": 2, - "details": { - "type": "make_trust_anchor" - }, - "effect": { - "result": "success", - "events": [ - 2 - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_9_5/cas/ta/command--1645792256--3--cmd-ca-rcn-receive.json b/test-resources/migrations/v0_9_5/cas/ta/command--1645792256--3--cmd-ca-rcn-receive.json deleted file mode 100644 index e2a99194..00000000 --- a/test-resources/migrations/v0_9_5/cas/ta/command--1645792256--3--cmd-ca-rcn-receive.json +++ /dev/null @@ -1,22 +0,0 @@ -{ - "actor": "krill", - "time": "2022-02-25T12:30:56.784994924Z", - "handle": "ta", - "version": 3, - "sequence": 3, - "details": { - "type": "update_rcvd_cert", - "resource_class_name": "0", - "resources": { - "asn": "AS0-AS4294967295", - "v4": "0.0.0.0/0", - "v6": "::/0" - } - }, - "effect": { - "result": "success", - "events": [ - 3 - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_9_5/cas/ta/command--1645792257--4--cmd-ca-child-add.json b/test-resources/migrations/v0_9_5/cas/ta/command--1645792257--4--cmd-ca-child-add.json deleted file mode 100644 index 4d5209a7..00000000 --- a/test-resources/migrations/v0_9_5/cas/ta/command--1645792257--4--cmd-ca-child-add.json +++ /dev/null @@ -1,23 +0,0 @@ -{ - "actor": "krill", - "time": "2022-02-25T12:30:57.075046022Z", - "handle": "ta", - "version": 4, - "sequence": 4, - "details": { - "type": "child_add", - "child": "testbed", - "ski": "DFFC9F34DD8239B816B4352C04586CE53CD7383D", - "resources": { - "asn": "AS0-AS4294967295", - "v4": "0.0.0.0/0", - "v6": "::/0" - } - }, - "effect": { - "result": "success", - "events": [ - 4 - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_9_5/cas/ta/command--1645792261--5--cmd-ca-child-certify.json b/test-resources/migrations/v0_9_5/cas/ta/command--1645792261--5--cmd-ca-child-certify.json deleted file mode 100644 index 08850778..00000000 --- a/test-resources/migrations/v0_9_5/cas/ta/command--1645792261--5--cmd-ca-child-certify.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "actor": "anonymous", - "time": "2022-02-25T12:31:01.544268360Z", - "handle": "ta", - "version": 5, - "sequence": 5, - "details": { - "type": "child_certify", - "child": "testbed", - "resource_class_name": "0", - "limit": { - "asn": "none", - "v4": "none", - "v6": "none" - }, - "ki": "62BC88453E78424F7F886712A4B904A07B98BEE7" - }, - "effect": { - "result": "success", - "events": [ - 5, - 6 - ] - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_9_5/cas/ta/delta-0.json b/test-resources/migrations/v0_9_5/cas/ta/delta-0.json deleted file mode 100644 index 27af56eb..00000000 --- a/test-resources/migrations/v0_9_5/cas/ta/delta-0.json +++ /dev/null @@ -1,9 +0,0 @@ -{ - "id": "ta", - "version": 0, - "details": { - "id": { - "cert": "MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEygxOTU0MzVCMEIwQ0VDOTA0NDJBNjc3RkJFM0NGRUQwRDIwOEU3MThCMB4XDTIyMDIyNTEyMjU1NloXDTM3MDIyNTEyMzA1NlowMzExMC8GA1UEAxMoMTk1NDM1QjBCMENFQzkwNDQyQTY3N0ZCRTNDRkVEMEQyMDhFNzE4QjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL+gRHahtBp+xnhOCX6U839Ela8t9plrcv/673NV9qWd4RjZrqGa06gMjhw/2kt0lK9EEt2UqTamSJdbWYMtqi6fyxRRaSRJ4uuOUGGIIO85gJ5EbQCctZwvvUdNcMRPqBR1Ked6CYNaMibDWUUhIy4qbDhG3OgsOHg6IG1rGhJriTgUaT5NKzDX8tge/iSOIFK/ltXzeHhbzo9BzDRJnoFNZgs7rTZ14t8xScUPZsJWsLP4o62hLmYgLMMQY4Vb96KpR3z4edKYn4svd3UGIt0hPiVHnig7ZZn7d/wSbvugNMxGiHCPNJgJnwRv5tzRuBaj094bwIUdNsRCKr0olo8CAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUGVQ1sLDOyQRCpnf748/tDSCOcYswHwYDVR0jBBgwFoAUGVQ1sLDOyQRCpnf748/tDSCOcYswDQYJKoZIhvcNAQELBQADggEBAJuslEa2y/uLG2O5N/luTxFbd0HhJtbaGucP7WS7VtO8Zv/Egidd12uLyep1z4FszbSm5J0lYXeJd+Kqql3/IZfpGo4vvO5AOUFnskssFzCMoTMenI/08SdyWzDv+VvUAQee9l4IP3kOgGzJlO9U+6MEPqvsd/0irRnthq+KC5jAPT6RWLTUxMQb8bFFH92/IYe9KEYWwzhFhMXPMQmmrQc0uUXvoNjaniqEf9dH1PqYdoLvIXggkjMEw8aaj8GJEdYPuUqEDliX0QutvxXUV20EgnTqPUUzsMS2vM++eB9sf9OgBlGxrLqiuN1rY/cL/4i17r4wn3CdMUWXhMwzdSc=" - } - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_9_5/cas/ta/delta-1.json b/test-resources/migrations/v0_9_5/cas/ta/delta-1.json deleted file mode 100644 index c43d439e..00000000 --- a/test-resources/migrations/v0_9_5/cas/ta/delta-1.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "id": "ta", - "version": 1, - "details": { - "type": "repo_updated", - "contact": { - "repository_response": { - "tag": null, - "publisher_handle": "ta", - "id_cert": "MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyg2QThBOUFEMTA5MjdGOUUzRTMyRDg3MjczQTg1NUIzRDBDMzRDNjFGMB4XDTIyMDIyNTEyMjU1NloXDTM3MDIyNTEyMzA1NlowMzExMC8GA1UEAxMoNkE4QTlBRDEwOTI3RjlFM0UzMkQ4NzI3M0E4NTVCM0QwQzM0QzYxRjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMt42y6PtPChcJqopCCQZkl/amGqyPwhF1QbISlnyehKVjnPfp4ITO1831bA4B7vgtKYqaFMxbrEocBw4BHv7b0hzmIVffrZ0vFYd5kODKQ/5lK9CwnBYRvBCPBu2KwIWWC1soHHdiPpM/dOVoXxmKk46aSclvFaPAn2CGrXU3Sx04yplWcMOB+9PX4ELmrgttKxJYHXMNVz89XNADWC/vgivZTic5h46PPMZIn0cKILkKdwUx05BcNzVgx2GAzvwspyhyYiT9EXBsgYaNDl0ENWZu7NLbhxLj3WXRNxd/AIWmpsDDqBiIq7n6DOqiebHu/3kapgrb7cv1L1MywhRHUCAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUaoqa0Qkn+ePjLYcnOoVbPQw0xh8wHwYDVR0jBBgwFoAUaoqa0Qkn+ePjLYcnOoVbPQw0xh8wDQYJKoZIhvcNAQELBQADggEBAIH8R3/14PK1qy1D7HOqN5FbYEO2brwSPKb0UdqNC1o8zLLJ5qGNCWoAvck+pkAJsxOPxgvzvYlwlUzuCToiXFUnDBYPXzI6u8kziJFchRIOFmaQxL+1LKhV66hgXi7r85+3nB0UMrfARzgUjXcZ9WIIQOwtSYq7yTcMHf8na7GJRelvH4B1lNht5AW6fQeRPBHleZZ3DQQc18mX2cPdm/uoegnTlTpM9dRhFTcZeezwkZvEkYG/i9rSMxVmFd1E4gN2e0CPsxdJxZ9oMNubyNToW146Y7v+M5OTibfrIqQKvsBC3BuTZRbXB9093HVmJTff33/zFYexfM3X740MhOo=", - "service_uri": "https://testbed.krill.cloud/rfc8181/ta/", - "repo_info": { - "base_uri": "rsync://testbed.krill.cloud/repo/ta/", - "rpki_notify": "https://testbed.krill.cloud/rrdp/notification.xml" - } - } - } - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_9_5/cas/ta/delta-2.json b/test-resources/migrations/v0_9_5/cas/ta/delta-2.json deleted file mode 100644 index 70e38c88..00000000 --- a/test-resources/migrations/v0_9_5/cas/ta/delta-2.json +++ /dev/null @@ -1,21 +0,0 @@ -{ - "id": "ta", - "version": 2, - "details": { - "type": "trust_anchor_made", - "ta_cert_details": { - "cert": "MIIIfzCCB2egAwIBAgIUEBe+IpSz9etWpgVDQxkZJG/a48QwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCMjY5RjRENjA3RkUzRDJCMzMxQkNERDMwNDZFNTEzM0RCODJGNkM3NEJGQzRFMkE3MzBBNDYyMTg5NUUwMDk1MTk3M0I0NzY2ODIxMDJGQjNERDQyOTJFMEE4QTZCNDI4QkEyQ0I3QTRFNDJFMzFEQTFBM0U5RjFEQjgxQ0FGMDk0MDg3ODVFNDgwNkQ1OTkyN0M1MjQ1QzBDRkI5ODQyMDFCNkMxNjhBNzEzN0VBMTczOTgzRTczMDUyNERDODFCMjMzOUJDMzY1RENDMTE4REQ2QTk0NzI2RURGNzQyM0VFM0M2RTQ5RUQzRDc2QjcyMTY2NDVGMUQ5MUNCOEQ4ODZBMjQ3MTc0NENGNUVEMzIzODBEREJBRTA0QkIzQkFENTY3OTNGRDgzMTk2OTBEQzFENTZBNUZENDNBRjdFNEJCQUZGNEM4RjVFOEIwMzQ1QkYyOUU0NzA2RjAzRDg5Q0NGNTZBRjZEQkIwMkQwRThBMDZFMjJFQkFBNEJENjQ2N0JBQjVCQjI5NDlGNjRDRTZGQTM2QTJBNjlDQTQ1QkJFQjRCNzJFMjUwM0I5QTAyNDJGQjY1MEMyNUU2QjVDMDUyMkZGNTAxRjA3QTM1MTU0MkREQzdGNUUyQjVDMDlFMkEzNjk2NjZCRTVBMzc3OEMwRkUxN0UzMkNGNjVBMTAyMDMwMTAwMDEwIBcNMjIwMjI1MTIyNTU2WhgPMjEyMjAyMjUxMjMwNTZaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQjI2OUY0RDYwN0ZFM0QyQjMzMUJDREQzMDQ2RTUxMzNEQjgyRjZDNzRCRkM0RTJBNzMwQTQ2MjE4OTVFMDA5NTE5NzNCNDc2NjgyMTAyRkIzREQ0MjkyRTBBOEE2QjQyOEJBMkNCN0E0RTQyRTMxREExQTNFOUYxREI4MUNBRjA5NDA4Nzg1RTQ4MDZENTk5MjdDNTI0NUMwQ0ZCOTg0MjAxQjZDMTY4QTcxMzdFQTE3Mzk4M0U3MzA1MjREQzgxQjIzMzlCQzM2NURDQzExOERENkE5NDcyNkVERjc0MjNFRTNDNkU0OUVEM0Q3NkI3MjE2NjQ1RjFEOTFDQjhEODg2QTI0NzE3NDRDRjVFRDMyMzgwRERCQUUwNEJCM0JBRDU2NzkzRkQ4MzE5NjkwREMxRDU2QTVGRDQzQUY3RTRCQkFGRjRDOEY1RThCMDM0NUJGMjlFNDcwNkYwM0Q4OUNDRjU2QUY2REJCMDJEMEU4QTA2RTIyRUJBQTRCRDY0NjdCQUI1QkIyOTQ5RjY0Q0U2RkEzNkEyQTY5Q0E0NUJCRUI0QjcyRTI1MDNCOUEwMjQyRkI2NTBDMjVFNkI1QzA1MjJGRjUwMUYwN0EzNTE1NDJEREM3RjVFMkI1QzA5RTJBMzY5NjY2QkU1QTM3NzhDMEZFMTdFMzJDRjY1QTEwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsmn01gf+PSszG83TBG5RM9uC9sdL/E4qcwpGIYleAJUZc7R2aCEC+z3UKS4KimtCi6LLek5C4x2ho+nx24HK8JQIeF5IBtWZJ8UkXAz7mEIBtsFopxN+oXOYPnMFJNyBsjObw2XcwRjdapRybt90I+48bkntPXa3IWZF8dkcuNiGokcXRM9e0yOA3brgS7O61WeT/YMZaQ3B1Wpf1Dr35Luv9Mj16LA0W/KeRwbwPYnM9Wr227AtDooG4i66pL1kZ7q1uylJ9kzm+jaippykW760ty4lA7mgJC+2UMJea1wFIv9QHwejUVQt3H9eK1wJ4qNpZmvlo3eMD+F+Ms9loQIDAQABo4IBjzCCAYswDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUqXWSXyH8qWbZMdVswhLerEMTwPwwDgYDVR0PAQH/BAQDAgEGMIHiBggrBgEFBQcBCwSB1TCB0jAxBggrBgEFBQcwBYYlcnN5bmM6Ly90ZXN0YmVkLmtyaWxsLmNsb3VkL3JlcG8vdGEvMDBeBggrBgEFBQcwCoZScnN5bmM6Ly90ZXN0YmVkLmtyaWxsLmNsb3VkL3JlcG8vdGEvMC9BOTc1OTI1RjIxRkNBOTY2RDkzMUQ1NkNDMjEyREVBQzQzMTNDMEZDLm1mdDA9BggrBgEFBQcwDYYxaHR0cHM6Ly90ZXN0YmVkLmtyaWxsLmNsb3VkL3JyZHAvbm90aWZpY2F0aW9uLnhtbDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCcGCCsGAQUFBwEHAQH/BBgwFjAJBAIAATADAwEAMAkEAgACMAMDAQAwIQYIKwYBBQUHAQgBAf8EEjAQoA4wDDAKAgEAAgUA/////zANBgkqhkiG9w0BAQsFAAOCAQEAOcRy21AK7ctJFkgTGnzwSaSCNLKwZ6JWkfJym9DqTYe/lKgyLKHidTeAvU8AmCsHqB3y1KKbHzoRjXHVhFWZZNZVglz9vDxW81081S2RQvfkwI1vHNHaEF64K5FSRv8SpOt/h5ZtaqpD+/p7BevLS7KPu3/PvBSphK1UV2eZomeYGjUstKTT2nj96x3JZO844pM7XCWYqLPIeWj7SmqXWUoiszuL+XjtObfKvutnaMuBX/LdOgASZqFurl3F/DPiTQS4kaIFnwoAzxsvCVata17+KWRNfOzp+jLLTK/anQjRNujuvgee9wmB4UnKkqdsq7KtOBiKkitDtthPqZePGA==", - "resources": { - "asn": "AS0-AS4294967295", - "v4": "0.0.0.0/0", - "v6": "::/0" - }, - "tal": { - "uris": [ - "https://testbed.krill.cloud/ta/ta.cer" - ], - "encoded_ski": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsmn01gf+PSszG83TBG5RM9uC9sdL/E4qcwpGIYleAJUZc7R2aCEC+z3UKS4KimtCi6LLek5C4x2ho+nx24HK8JQIeF5IBtWZJ8UkXAz7mEIBtsFopxN+oXOYPnMFJNyBsjObw2XcwRjdapRybt90I+48bkntPXa3IWZF8dkcuNiGokcXRM9e0yOA3brgS7O61WeT/YMZaQ3B1Wpf1Dr35Luv9Mj16LA0W/KeRwbwPYnM9Wr227AtDooG4i66pL1kZ7q1uylJ9kzm+jaippykW760ty4lA7mgJC+2UMJea1wFIv9QHwejUVQt3H9eK1wJ4qNpZmvlo3eMD+F+Ms9loQIDAQAB" - } - } - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_9_5/cas/ta/delta-3.json b/test-resources/migrations/v0_9_5/cas/ta/delta-3.json deleted file mode 100644 index 1f4ebf90..00000000 --- a/test-resources/migrations/v0_9_5/cas/ta/delta-3.json +++ /dev/null @@ -1,21 +0,0 @@ -{ - "id": "ta", - "version": 3, - "details": { - "type": "key_pending_to_active", - "resource_class_name": "0", - "current_key": { - "key_id": "A975925F21FCA966D931D56CC212DEAC4313C0FC", - "incoming_cert": { - "cert": "MIIIfzCCB2egAwIBAgIUEBe+IpSz9etWpgVDQxkZJG/a48QwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCMjY5RjRENjA3RkUzRDJCMzMxQkNERDMwNDZFNTEzM0RCODJGNkM3NEJGQzRFMkE3MzBBNDYyMTg5NUUwMDk1MTk3M0I0NzY2ODIxMDJGQjNERDQyOTJFMEE4QTZCNDI4QkEyQ0I3QTRFNDJFMzFEQTFBM0U5RjFEQjgxQ0FGMDk0MDg3ODVFNDgwNkQ1OTkyN0M1MjQ1QzBDRkI5ODQyMDFCNkMxNjhBNzEzN0VBMTczOTgzRTczMDUyNERDODFCMjMzOUJDMzY1RENDMTE4REQ2QTk0NzI2RURGNzQyM0VFM0M2RTQ5RUQzRDc2QjcyMTY2NDVGMUQ5MUNCOEQ4ODZBMjQ3MTc0NENGNUVEMzIzODBEREJBRTA0QkIzQkFENTY3OTNGRDgzMTk2OTBEQzFENTZBNUZENDNBRjdFNEJCQUZGNEM4RjVFOEIwMzQ1QkYyOUU0NzA2RjAzRDg5Q0NGNTZBRjZEQkIwMkQwRThBMDZFMjJFQkFBNEJENjQ2N0JBQjVCQjI5NDlGNjRDRTZGQTM2QTJBNjlDQTQ1QkJFQjRCNzJFMjUwM0I5QTAyNDJGQjY1MEMyNUU2QjVDMDUyMkZGNTAxRjA3QTM1MTU0MkREQzdGNUUyQjVDMDlFMkEzNjk2NjZCRTVBMzc3OEMwRkUxN0UzMkNGNjVBMTAyMDMwMTAwMDEwIBcNMjIwMjI1MTIyNTU2WhgPMjEyMjAyMjUxMjMwNTZaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQjI2OUY0RDYwN0ZFM0QyQjMzMUJDREQzMDQ2RTUxMzNEQjgyRjZDNzRCRkM0RTJBNzMwQTQ2MjE4OTVFMDA5NTE5NzNCNDc2NjgyMTAyRkIzREQ0MjkyRTBBOEE2QjQyOEJBMkNCN0E0RTQyRTMxREExQTNFOUYxREI4MUNBRjA5NDA4Nzg1RTQ4MDZENTk5MjdDNTI0NUMwQ0ZCOTg0MjAxQjZDMTY4QTcxMzdFQTE3Mzk4M0U3MzA1MjREQzgxQjIzMzlCQzM2NURDQzExOERENkE5NDcyNkVERjc0MjNFRTNDNkU0OUVEM0Q3NkI3MjE2NjQ1RjFEOTFDQjhEODg2QTI0NzE3NDRDRjVFRDMyMzgwRERCQUUwNEJCM0JBRDU2NzkzRkQ4MzE5NjkwREMxRDU2QTVGRDQzQUY3RTRCQkFGRjRDOEY1RThCMDM0NUJGMjlFNDcwNkYwM0Q4OUNDRjU2QUY2REJCMDJEMEU4QTA2RTIyRUJBQTRCRDY0NjdCQUI1QkIyOTQ5RjY0Q0U2RkEzNkEyQTY5Q0E0NUJCRUI0QjcyRTI1MDNCOUEwMjQyRkI2NTBDMjVFNkI1QzA1MjJGRjUwMUYwN0EzNTE1NDJEREM3RjVFMkI1QzA5RTJBMzY5NjY2QkU1QTM3NzhDMEZFMTdFMzJDRjY1QTEwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsmn01gf+PSszG83TBG5RM9uC9sdL/E4qcwpGIYleAJUZc7R2aCEC+z3UKS4KimtCi6LLek5C4x2ho+nx24HK8JQIeF5IBtWZJ8UkXAz7mEIBtsFopxN+oXOYPnMFJNyBsjObw2XcwRjdapRybt90I+48bkntPXa3IWZF8dkcuNiGokcXRM9e0yOA3brgS7O61WeT/YMZaQ3B1Wpf1Dr35Luv9Mj16LA0W/KeRwbwPYnM9Wr227AtDooG4i66pL1kZ7q1uylJ9kzm+jaippykW760ty4lA7mgJC+2UMJea1wFIv9QHwejUVQt3H9eK1wJ4qNpZmvlo3eMD+F+Ms9loQIDAQABo4IBjzCCAYswDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUqXWSXyH8qWbZMdVswhLerEMTwPwwDgYDVR0PAQH/BAQDAgEGMIHiBggrBgEFBQcBCwSB1TCB0jAxBggrBgEFBQcwBYYlcnN5bmM6Ly90ZXN0YmVkLmtyaWxsLmNsb3VkL3JlcG8vdGEvMDBeBggrBgEFBQcwCoZScnN5bmM6Ly90ZXN0YmVkLmtyaWxsLmNsb3VkL3JlcG8vdGEvMC9BOTc1OTI1RjIxRkNBOTY2RDkzMUQ1NkNDMjEyREVBQzQzMTNDMEZDLm1mdDA9BggrBgEFBQcwDYYxaHR0cHM6Ly90ZXN0YmVkLmtyaWxsLmNsb3VkL3JyZHAvbm90aWZpY2F0aW9uLnhtbDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCcGCCsGAQUFBwEHAQH/BBgwFjAJBAIAATADAwEAMAkEAgACMAMDAQAwIQYIKwYBBQUHAQgBAf8EEjAQoA4wDDAKAgEAAgUA/////zANBgkqhkiG9w0BAQsFAAOCAQEAOcRy21AK7ctJFkgTGnzwSaSCNLKwZ6JWkfJym9DqTYe/lKgyLKHidTeAvU8AmCsHqB3y1KKbHzoRjXHVhFWZZNZVglz9vDxW81081S2RQvfkwI1vHNHaEF64K5FSRv8SpOt/h5ZtaqpD+/p7BevLS7KPu3/PvBSphK1UV2eZomeYGjUstKTT2nj96x3JZO844pM7XCWYqLPIeWj7SmqXWUoiszuL+XjtObfKvutnaMuBX/LdOgASZqFurl3F/DPiTQS4kaIFnwoAzxsvCVata17+KWRNfOzp+jLLTK/anQjRNujuvgee9wmB4UnKkqdsq7KtOBiKkitDtthPqZePGA==", - "uri": "rsync://testbed.krill.cloud/ta/ta.cer", - "resources": { - "asn": "AS0-AS4294967295", - "v4": "0.0.0.0/0", - "v6": "::/0" - } - }, - "request": null - } - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_9_5/cas/ta/delta-4.json b/test-resources/migrations/v0_9_5/cas/ta/delta-4.json deleted file mode 100644 index a8736c30..00000000 --- a/test-resources/migrations/v0_9_5/cas/ta/delta-4.json +++ /dev/null @@ -1,14 +0,0 @@ -{ - "id": "ta", - "version": 4, - "details": { - "type": "child_added", - "child": "testbed", - "id_cert": "MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhERkZDOUYzNEREODIzOUI4MTZCNDM1MkMwNDU4NkNFNTNDRDczODNEMB4XDTIyMDIyNTEyMjU1N1oXDTM3MDIyNTEyMzA1N1owMzExMC8GA1UEAxMoREZGQzlGMzRERDgyMzlCODE2QjQzNTJDMDQ1ODZDRTUzQ0Q3MzgzRDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALtf+ZXpEzJa5E+Kix0HqRsnmiX14S1HI67byO6MgWE/pyWo5TwKD2J5Etquyl95e8DtPyzKMLerHKnX8ky865Awz0hNA2tpFI9XTzrf0DyBazLk0mrgjqmDcu+suusqbgt6BtV8BM3BfOWIFeUh3zjeayALbqo7V9a2yF1I0ro4CATQqf5ZAbsUCVYZ58wSoIvNlLsgosZnM2vL3ls8R6sT5ajxQMQoAfmsEWLQzHukQyi0l4MLBVO7SG5trCPB7pU8MJkJLPLfJs6MhEuaFgDaazwrcSnYHGmp43pPY4pRkDgAIdcNrzD+w3W171sb+Wdor7WW3NMgEWjSCdplkf8CAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU3/yfNN2CObgWtDUsBFhs5TzXOD0wHwYDVR0jBBgwFoAU3/yfNN2CObgWtDUsBFhs5TzXOD0wDQYJKoZIhvcNAQELBQADggEBAHXvUCM/wakhszwlVa+WpLQfpjzxXyLeTDprqJumtRWb/S0LnD/HduzPawO4H7JuO2vNc2DUvBQPP3fGfN2F3Hwuz0TbseP5T4YKynxtgZh420rM/aF8D5/LzjeNmeAxGLj0YC8RFH9AbHaVkD7d/59UBNJLYY+MjQ02aoHoy+gFMgDI70ivckfgJiAT6i9OOMTdeL+ZOI6BhEyirqQZMoMGruvJZ7RDJKZCcpyO9crFO/5A+VFLDAB5/vfDCeS7HoA5Pf1Z/oVImAf8Yr9+Hcq3CXDuTGfx/o0wKjQDTVr6doXwWGvVkbWFejRvZaWxgg+r+9QepPjPDTGOWT/4M78=", - "resources": { - "asn": "AS0-AS4294967295", - "v4": "0.0.0.0/0", - "v6": "::/0" - } - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_9_5/cas/ta/delta-5.json b/test-resources/migrations/v0_9_5/cas/ta/delta-5.json deleted file mode 100644 index 29e5262e..00000000 --- a/test-resources/migrations/v0_9_5/cas/ta/delta-5.json +++ /dev/null @@ -1,10 +0,0 @@ -{ - "id": "ta", - "version": 5, - "details": { - "type": "child_certificate_issued", - "child": "testbed", - "resource_class_name": "0", - "ki": "62BC88453E78424F7F886712A4B904A07B98BEE7" - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_9_5/cas/ta/delta-6.json b/test-resources/migrations/v0_9_5/cas/ta/delta-6.json deleted file mode 100644 index 08586b4f..00000000 --- a/test-resources/migrations/v0_9_5/cas/ta/delta-6.json +++ /dev/null @@ -1,27 +0,0 @@ -{ - "id": "ta", - "version": 6, - "details": { - "type": "child_certificates_updated", - "resource_class_name": "0", - "updates": { - "issued": [ - { - "uri": "rsync://testbed.krill.cloud/repo/ta/0/62BC88453E78424F7F886712A4B904A07B98BEE7.cer", - "limit": { - "asn": "none", - "v4": "none", - "v6": "none" - }, - "resource_set": { - "asn": "AS0-AS4294967295", - "v4": "0.0.0.0/0", - "v6": "::/0" - }, - "cert": "MIIHVTCCBj2gAwIBAgIUQ7GgOP7b1fhnzKqDm7Y3vDb+u6MwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCMjY5RjRENjA3RkUzRDJCMzMxQkNERDMwNDZFNTEzM0RCODJGNkM3NEJGQzRFMkE3MzBBNDYyMTg5NUUwMDk1MTk3M0I0NzY2ODIxMDJGQjNERDQyOTJFMEE4QTZCNDI4QkEyQ0I3QTRFNDJFMzFEQTFBM0U5RjFEQjgxQ0FGMDk0MDg3ODVFNDgwNkQ1OTkyN0M1MjQ1QzBDRkI5ODQyMDFCNkMxNjhBNzEzN0VBMTczOTgzRTczMDUyNERDODFCMjMzOUJDMzY1RENDMTE4REQ2QTk0NzI2RURGNzQyM0VFM0M2RTQ5RUQzRDc2QjcyMTY2NDVGMUQ5MUNCOEQ4ODZBMjQ3MTc0NENGNUVEMzIzODBEREJBRTA0QkIzQkFENTY3OTNGRDgzMTk2OTBEQzFENTZBNUZENDNBRjdFNEJCQUZGNEM4RjVFOEIwMzQ1QkYyOUU0NzA2RjAzRDg5Q0NGNTZBRjZEQkIwMkQwRThBMDZFMjJFQkFBNEJENjQ2N0JBQjVCQjI5NDlGNjRDRTZGQTM2QTJBNjlDQTQ1QkJFQjRCNzJFMjUwM0I5QTAyNDJGQjY1MEMyNUU2QjVDMDUyMkZGNTAxRjA3QTM1MTU0MkREQzdGNUUyQjVDMDlFMkEzNjk2NjZCRTVBMzc3OEMwRkUxN0UzMkNGNjVBMTAyMDMwMTAwMDEwHhcNMjIwMjI1MTIyNjAxWhcNMjMwMjI0MTIzMTAxWjAzMTEwLwYDVQQDEyg2MkJDODg0NTNFNzg0MjRGN0Y4ODY3MTJBNEI5MDRBMDdCOThCRUU3MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0Jr8jBCAHqEWo7KWrdLFQTyXUk+Ifg7xWoKfXVjuTaVqOQ00V1qTWvUggMNmNd9EJsTzbO3ewauMPwYRsdVIzucewbEsJApKzFddAXTX0Q9B3qd+th5e2MyQBLtOF6ibC/4Qeg4i+q3aG67YEPU0cvyXbmNWBNa8d5wMazSEY8k7ZveK+gNZnIP0wpolNRGWrMvV4nkH9i1wKmo+wPyOdy73+s+ZhlygKUixfp/Dn4h/NKXiYVOrL3VHf7a+ucb90+P99Dz98he5ftzYDONCZF5rzgSxUJIO3bhJLZuRxC3z6/Cnf71FTFUG1uGDesaBQ8R0TKclYZIeIcKSdPzicQIDAQABo4ICYzCCAl8wDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUYryIRT54Qk9/iGcSpLkEoHuYvucwHwYDVR0jBBgwFoAUqXWSXyH8qWbZMdVswhLerEMTwPwwDgYDVR0PAQH/BAQDAgEGMGMGA1UdHwRcMFowWKBWoFSGUnJzeW5jOi8vdGVzdGJlZC5rcmlsbC5jbG91ZC9yZXBvL3RhLzAvQTk3NTkyNUYyMUZDQTk2NkQ5MzFENTZDQzIxMkRFQUM0MzEzQzBGQy5jcmwwQQYIKwYBBQUHAQEENTAzMDEGCCsGAQUFBzAChiVyc3luYzovL3Rlc3RiZWQua3JpbGwuY2xvdWQvdGEvdGEuY2VyMIHtBggrBgEFBQcBCwSB4DCB3TA3BggrBgEFBQcwBYYrcnN5bmM6Ly90ZXN0YmVkLmtyaWxsLmNsb3VkL3JlcG8vdGVzdGJlZC8wLzBjBggrBgEFBQcwCoZXcnN5bmM6Ly90ZXN0YmVkLmtyaWxsLmNsb3VkL3JlcG8vdGVzdGJlZC8wLzYyQkM4ODQ1M0U3ODQyNEY3Rjg4NjcxMkE0QjkwNEEwN0I5OEJFRTcubWZ0MD0GCCsGAQUFBzANhjFodHRwczovL3Rlc3RiZWQua3JpbGwuY2xvdWQvcnJkcC9ub3RpZmljYXRpb24ueG1sMBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwJwYIKwYBBQUHAQcBAf8EGDAWMAkEAgABMAMDAQAwCQQCAAIwAwMBADAhBggrBgEFBQcBCAEB/wQSMBCgDjAMMAoCAQACBQD/////MA0GCSqGSIb3DQEBCwUAA4IBAQAzefekijlB3SITIhWdjRK7mxBfDmv7yyF5st78AcsoU2l95D6ryECMZwXL0UIsuO4jY+C15VlXCld7nwGaAZB+QhPohQdqHOrbV8GLdrnIKp7WCGSI46mOlvSgzf8ceP2juTP/Vwk09t1WVJtxocglI7G0Gx6JHQQyNAPv4ZSgkCrMkOVZC3tZ8kGj76CCI1Mpjg0ZbWrhGO33NM9c//7PtU1l6IHmKs+w6Lg8pbg2q8QlMOOKtdgoBmC7iIMowCtQIdLnko7MFC3Osvt1S2CAxfnGqTw9n2JwBvKzoVIY4vViNxm/SkxxIyHtWEDkuXjw5QPekcoHDfh/kuDHel2R" - } - ], - "removed": [] - } - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_9_5/cas/ta/info.json b/test-resources/migrations/v0_9_5/cas/ta/info.json deleted file mode 100644 index 5f25bbf4..00000000 --- a/test-resources/migrations/v0_9_5/cas/ta/info.json +++ /dev/null @@ -1,6 +0,0 @@ -{ - "snapshot_version": 7, - "last_event": 6, - "last_command": 5, - "last_update": "2022-02-25T12:31:01.544088774Z" -} \ No newline at end of file diff --git a/test-resources/migrations/v0_9_5/cas/ta/snapshot-bk.json b/test-resources/migrations/v0_9_5/cas/ta/snapshot-bk.json deleted file mode 100644 index 2d11c6e8..00000000 --- a/test-resources/migrations/v0_9_5/cas/ta/snapshot-bk.json +++ /dev/null @@ -1,79 +0,0 @@ -{ - "handle": "ta", - "version": 5, - "id": { - "cert": "MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEygxOTU0MzVCMEIwQ0VDOTA0NDJBNjc3RkJFM0NGRUQwRDIwOEU3MThCMB4XDTIyMDIyNTEyMjU1NloXDTM3MDIyNTEyMzA1NlowMzExMC8GA1UEAxMoMTk1NDM1QjBCMENFQzkwNDQyQTY3N0ZCRTNDRkVEMEQyMDhFNzE4QjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL+gRHahtBp+xnhOCX6U839Ela8t9plrcv/673NV9qWd4RjZrqGa06gMjhw/2kt0lK9EEt2UqTamSJdbWYMtqi6fyxRRaSRJ4uuOUGGIIO85gJ5EbQCctZwvvUdNcMRPqBR1Ked6CYNaMibDWUUhIy4qbDhG3OgsOHg6IG1rGhJriTgUaT5NKzDX8tge/iSOIFK/ltXzeHhbzo9BzDRJnoFNZgs7rTZ14t8xScUPZsJWsLP4o62hLmYgLMMQY4Vb96KpR3z4edKYn4svd3UGIt0hPiVHnig7ZZn7d/wSbvugNMxGiHCPNJgJnwRv5tzRuBaj094bwIUdNsRCKr0olo8CAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUGVQ1sLDOyQRCpnf748/tDSCOcYswHwYDVR0jBBgwFoAUGVQ1sLDOyQRCpnf748/tDSCOcYswDQYJKoZIhvcNAQELBQADggEBAJuslEa2y/uLG2O5N/luTxFbd0HhJtbaGucP7WS7VtO8Zv/Egidd12uLyep1z4FszbSm5J0lYXeJd+Kqql3/IZfpGo4vvO5AOUFnskssFzCMoTMenI/08SdyWzDv+VvUAQee9l4IP3kOgGzJlO9U+6MEPqvsd/0irRnthq+KC5jAPT6RWLTUxMQb8bFFH92/IYe9KEYWwzhFhMXPMQmmrQc0uUXvoNjaniqEf9dH1PqYdoLvIXggkjMEw8aaj8GJEdYPuUqEDliX0QutvxXUV20EgnTqPUUzsMS2vM++eB9sf9OgBlGxrLqiuN1rY/cL/4i17r4wn3CdMUWXhMwzdSc=" - }, - "repository": { - "repository_response": { - "tag": null, - "publisher_handle": "ta", - "id_cert": "MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyg2QThBOUFEMTA5MjdGOUUzRTMyRDg3MjczQTg1NUIzRDBDMzRDNjFGMB4XDTIyMDIyNTEyMjU1NloXDTM3MDIyNTEyMzA1NlowMzExMC8GA1UEAxMoNkE4QTlBRDEwOTI3RjlFM0UzMkQ4NzI3M0E4NTVCM0QwQzM0QzYxRjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMt42y6PtPChcJqopCCQZkl/amGqyPwhF1QbISlnyehKVjnPfp4ITO1831bA4B7vgtKYqaFMxbrEocBw4BHv7b0hzmIVffrZ0vFYd5kODKQ/5lK9CwnBYRvBCPBu2KwIWWC1soHHdiPpM/dOVoXxmKk46aSclvFaPAn2CGrXU3Sx04yplWcMOB+9PX4ELmrgttKxJYHXMNVz89XNADWC/vgivZTic5h46PPMZIn0cKILkKdwUx05BcNzVgx2GAzvwspyhyYiT9EXBsgYaNDl0ENWZu7NLbhxLj3WXRNxd/AIWmpsDDqBiIq7n6DOqiebHu/3kapgrb7cv1L1MywhRHUCAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUaoqa0Qkn+ePjLYcnOoVbPQw0xh8wHwYDVR0jBBgwFoAUaoqa0Qkn+ePjLYcnOoVbPQw0xh8wDQYJKoZIhvcNAQELBQADggEBAIH8R3/14PK1qy1D7HOqN5FbYEO2brwSPKb0UdqNC1o8zLLJ5qGNCWoAvck+pkAJsxOPxgvzvYlwlUzuCToiXFUnDBYPXzI6u8kziJFchRIOFmaQxL+1LKhV66hgXi7r85+3nB0UMrfARzgUjXcZ9WIIQOwtSYq7yTcMHf8na7GJRelvH4B1lNht5AW6fQeRPBHleZZ3DQQc18mX2cPdm/uoegnTlTpM9dRhFTcZeezwkZvEkYG/i9rSMxVmFd1E4gN2e0CPsxdJxZ9oMNubyNToW146Y7v+M5OTibfrIqQKvsBC3BuTZRbXB9093HVmJTff33/zFYexfM3X740MhOo=", - "service_uri": "https://testbed.krill.cloud/rfc8181/ta/", - "repo_info": { - "base_uri": "rsync://testbed.krill.cloud/repo/ta/", - "rpki_notify": "https://testbed.krill.cloud/rrdp/notification.xml" - } - } - }, - "parents": { - "ta": { - "type": "ta", - "cert": "MIIIfzCCB2egAwIBAgIUEBe+IpSz9etWpgVDQxkZJG/a48QwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCMjY5RjRENjA3RkUzRDJCMzMxQkNERDMwNDZFNTEzM0RCODJGNkM3NEJGQzRFMkE3MzBBNDYyMTg5NUUwMDk1MTk3M0I0NzY2ODIxMDJGQjNERDQyOTJFMEE4QTZCNDI4QkEyQ0I3QTRFNDJFMzFEQTFBM0U5RjFEQjgxQ0FGMDk0MDg3ODVFNDgwNkQ1OTkyN0M1MjQ1QzBDRkI5ODQyMDFCNkMxNjhBNzEzN0VBMTczOTgzRTczMDUyNERDODFCMjMzOUJDMzY1RENDMTE4REQ2QTk0NzI2RURGNzQyM0VFM0M2RTQ5RUQzRDc2QjcyMTY2NDVGMUQ5MUNCOEQ4ODZBMjQ3MTc0NENGNUVEMzIzODBEREJBRTA0QkIzQkFENTY3OTNGRDgzMTk2OTBEQzFENTZBNUZENDNBRjdFNEJCQUZGNEM4RjVFOEIwMzQ1QkYyOUU0NzA2RjAzRDg5Q0NGNTZBRjZEQkIwMkQwRThBMDZFMjJFQkFBNEJENjQ2N0JBQjVCQjI5NDlGNjRDRTZGQTM2QTJBNjlDQTQ1QkJFQjRCNzJFMjUwM0I5QTAyNDJGQjY1MEMyNUU2QjVDMDUyMkZGNTAxRjA3QTM1MTU0MkREQzdGNUUyQjVDMDlFMkEzNjk2NjZCRTVBMzc3OEMwRkUxN0UzMkNGNjVBMTAyMDMwMTAwMDEwIBcNMjIwMjI1MTIyNTU2WhgPMjEyMjAyMjUxMjMwNTZaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQjI2OUY0RDYwN0ZFM0QyQjMzMUJDREQzMDQ2RTUxMzNEQjgyRjZDNzRCRkM0RTJBNzMwQTQ2MjE4OTVFMDA5NTE5NzNCNDc2NjgyMTAyRkIzREQ0MjkyRTBBOEE2QjQyOEJBMkNCN0E0RTQyRTMxREExQTNFOUYxREI4MUNBRjA5NDA4Nzg1RTQ4MDZENTk5MjdDNTI0NUMwQ0ZCOTg0MjAxQjZDMTY4QTcxMzdFQTE3Mzk4M0U3MzA1MjREQzgxQjIzMzlCQzM2NURDQzExOERENkE5NDcyNkVERjc0MjNFRTNDNkU0OUVEM0Q3NkI3MjE2NjQ1RjFEOTFDQjhEODg2QTI0NzE3NDRDRjVFRDMyMzgwRERCQUUwNEJCM0JBRDU2NzkzRkQ4MzE5NjkwREMxRDU2QTVGRDQzQUY3RTRCQkFGRjRDOEY1RThCMDM0NUJGMjlFNDcwNkYwM0Q4OUNDRjU2QUY2REJCMDJEMEU4QTA2RTIyRUJBQTRCRDY0NjdCQUI1QkIyOTQ5RjY0Q0U2RkEzNkEyQTY5Q0E0NUJCRUI0QjcyRTI1MDNCOUEwMjQyRkI2NTBDMjVFNkI1QzA1MjJGRjUwMUYwN0EzNTE1NDJEREM3RjVFMkI1QzA5RTJBMzY5NjY2QkU1QTM3NzhDMEZFMTdFMzJDRjY1QTEwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsmn01gf+PSszG83TBG5RM9uC9sdL/E4qcwpGIYleAJUZc7R2aCEC+z3UKS4KimtCi6LLek5C4x2ho+nx24HK8JQIeF5IBtWZJ8UkXAz7mEIBtsFopxN+oXOYPnMFJNyBsjObw2XcwRjdapRybt90I+48bkntPXa3IWZF8dkcuNiGokcXRM9e0yOA3brgS7O61WeT/YMZaQ3B1Wpf1Dr35Luv9Mj16LA0W/KeRwbwPYnM9Wr227AtDooG4i66pL1kZ7q1uylJ9kzm+jaippykW760ty4lA7mgJC+2UMJea1wFIv9QHwejUVQt3H9eK1wJ4qNpZmvlo3eMD+F+Ms9loQIDAQABo4IBjzCCAYswDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUqXWSXyH8qWbZMdVswhLerEMTwPwwDgYDVR0PAQH/BAQDAgEGMIHiBggrBgEFBQcBCwSB1TCB0jAxBggrBgEFBQcwBYYlcnN5bmM6Ly90ZXN0YmVkLmtyaWxsLmNsb3VkL3JlcG8vdGEvMDBeBggrBgEFBQcwCoZScnN5bmM6Ly90ZXN0YmVkLmtyaWxsLmNsb3VkL3JlcG8vdGEvMC9BOTc1OTI1RjIxRkNBOTY2RDkzMUQ1NkNDMjEyREVBQzQzMTNDMEZDLm1mdDA9BggrBgEFBQcwDYYxaHR0cHM6Ly90ZXN0YmVkLmtyaWxsLmNsb3VkL3JyZHAvbm90aWZpY2F0aW9uLnhtbDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCcGCCsGAQUFBwEHAQH/BBgwFjAJBAIAATADAwEAMAkEAgACMAMDAQAwIQYIKwYBBQUHAQgBAf8EEjAQoA4wDDAKAgEAAgUA/////zANBgkqhkiG9w0BAQsFAAOCAQEAOcRy21AK7ctJFkgTGnzwSaSCNLKwZ6JWkfJym9DqTYe/lKgyLKHidTeAvU8AmCsHqB3y1KKbHzoRjXHVhFWZZNZVglz9vDxW81081S2RQvfkwI1vHNHaEF64K5FSRv8SpOt/h5ZtaqpD+/p7BevLS7KPu3/PvBSphK1UV2eZomeYGjUstKTT2nj96x3JZO844pM7XCWYqLPIeWj7SmqXWUoiszuL+XjtObfKvutnaMuBX/LdOgASZqFurl3F/DPiTQS4kaIFnwoAzxsvCVata17+KWRNfOzp+jLLTK/anQjRNujuvgee9wmB4UnKkqdsq7KtOBiKkitDtthPqZePGA==", - "resources": { - "asn": "AS0-AS4294967295", - "v4": "0.0.0.0/0", - "v6": "::/0" - }, - "tal": { - "uris": [ - "https://testbed.krill.cloud/ta/ta.cer" - ], - "encoded_ski": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsmn01gf+PSszG83TBG5RM9uC9sdL/E4qcwpGIYleAJUZc7R2aCEC+z3UKS4KimtCi6LLek5C4x2ho+nx24HK8JQIeF5IBtWZJ8UkXAz7mEIBtsFopxN+oXOYPnMFJNyBsjObw2XcwRjdapRybt90I+48bkntPXa3IWZF8dkcuNiGokcXRM9e0yOA3brgS7O61WeT/YMZaQ3B1Wpf1Dr35Luv9Mj16LA0W/KeRwbwPYnM9Wr227AtDooG4i66pL1kZ7q1uylJ9kzm+jaippykW760ty4lA7mgJC+2UMJea1wFIv9QHwejUVQt3H9eK1wJ4qNpZmvlo3eMD+F+Ms9loQIDAQAB" - } - } - }, - "next_class_name": 1, - "resources": { - "0": { - "name": "0", - "name_space": "0", - "parent_handle": "ta", - "parent_rc_name": "0", - "roas": {}, - "certificates": { - "inner": {} - }, - "last_key_change": "2022-02-25T12:30:56.776208499Z", - "key_state": { - "active": { - "key_id": "A975925F21FCA966D931D56CC212DEAC4313C0FC", - "incoming_cert": { - "cert": "MIIIfzCCB2egAwIBAgIUEBe+IpSz9etWpgVDQxkZJG/a48QwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCMjY5RjRENjA3RkUzRDJCMzMxQkNERDMwNDZFNTEzM0RCODJGNkM3NEJGQzRFMkE3MzBBNDYyMTg5NUUwMDk1MTk3M0I0NzY2ODIxMDJGQjNERDQyOTJFMEE4QTZCNDI4QkEyQ0I3QTRFNDJFMzFEQTFBM0U5RjFEQjgxQ0FGMDk0MDg3ODVFNDgwNkQ1OTkyN0M1MjQ1QzBDRkI5ODQyMDFCNkMxNjhBNzEzN0VBMTczOTgzRTczMDUyNERDODFCMjMzOUJDMzY1RENDMTE4REQ2QTk0NzI2RURGNzQyM0VFM0M2RTQ5RUQzRDc2QjcyMTY2NDVGMUQ5MUNCOEQ4ODZBMjQ3MTc0NENGNUVEMzIzODBEREJBRTA0QkIzQkFENTY3OTNGRDgzMTk2OTBEQzFENTZBNUZENDNBRjdFNEJCQUZGNEM4RjVFOEIwMzQ1QkYyOUU0NzA2RjAzRDg5Q0NGNTZBRjZEQkIwMkQwRThBMDZFMjJFQkFBNEJENjQ2N0JBQjVCQjI5NDlGNjRDRTZGQTM2QTJBNjlDQTQ1QkJFQjRCNzJFMjUwM0I5QTAyNDJGQjY1MEMyNUU2QjVDMDUyMkZGNTAxRjA3QTM1MTU0MkREQzdGNUUyQjVDMDlFMkEzNjk2NjZCRTVBMzc3OEMwRkUxN0UzMkNGNjVBMTAyMDMwMTAwMDEwIBcNMjIwMjI1MTIyNTU2WhgPMjEyMjAyMjUxMjMwNTZaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQjI2OUY0RDYwN0ZFM0QyQjMzMUJDREQzMDQ2RTUxMzNEQjgyRjZDNzRCRkM0RTJBNzMwQTQ2MjE4OTVFMDA5NTE5NzNCNDc2NjgyMTAyRkIzREQ0MjkyRTBBOEE2QjQyOEJBMkNCN0E0RTQyRTMxREExQTNFOUYxREI4MUNBRjA5NDA4Nzg1RTQ4MDZENTk5MjdDNTI0NUMwQ0ZCOTg0MjAxQjZDMTY4QTcxMzdFQTE3Mzk4M0U3MzA1MjREQzgxQjIzMzlCQzM2NURDQzExOERENkE5NDcyNkVERjc0MjNFRTNDNkU0OUVEM0Q3NkI3MjE2NjQ1RjFEOTFDQjhEODg2QTI0NzE3NDRDRjVFRDMyMzgwRERCQUUwNEJCM0JBRDU2NzkzRkQ4MzE5NjkwREMxRDU2QTVGRDQzQUY3RTRCQkFGRjRDOEY1RThCMDM0NUJGMjlFNDcwNkYwM0Q4OUNDRjU2QUY2REJCMDJEMEU4QTA2RTIyRUJBQTRCRDY0NjdCQUI1QkIyOTQ5RjY0Q0U2RkEzNkEyQTY5Q0E0NUJCRUI0QjcyRTI1MDNCOUEwMjQyRkI2NTBDMjVFNkI1QzA1MjJGRjUwMUYwN0EzNTE1NDJEREM3RjVFMkI1QzA5RTJBMzY5NjY2QkU1QTM3NzhDMEZFMTdFMzJDRjY1QTEwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsmn01gf+PSszG83TBG5RM9uC9sdL/E4qcwpGIYleAJUZc7R2aCEC+z3UKS4KimtCi6LLek5C4x2ho+nx24HK8JQIeF5IBtWZJ8UkXAz7mEIBtsFopxN+oXOYPnMFJNyBsjObw2XcwRjdapRybt90I+48bkntPXa3IWZF8dkcuNiGokcXRM9e0yOA3brgS7O61WeT/YMZaQ3B1Wpf1Dr35Luv9Mj16LA0W/KeRwbwPYnM9Wr227AtDooG4i66pL1kZ7q1uylJ9kzm+jaippykW760ty4lA7mgJC+2UMJea1wFIv9QHwejUVQt3H9eK1wJ4qNpZmvlo3eMD+F+Ms9loQIDAQABo4IBjzCCAYswDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUqXWSXyH8qWbZMdVswhLerEMTwPwwDgYDVR0PAQH/BAQDAgEGMIHiBggrBgEFBQcBCwSB1TCB0jAxBggrBgEFBQcwBYYlcnN5bmM6Ly90ZXN0YmVkLmtyaWxsLmNsb3VkL3JlcG8vdGEvMDBeBggrBgEFBQcwCoZScnN5bmM6Ly90ZXN0YmVkLmtyaWxsLmNsb3VkL3JlcG8vdGEvMC9BOTc1OTI1RjIxRkNBOTY2RDkzMUQ1NkNDMjEyREVBQzQzMTNDMEZDLm1mdDA9BggrBgEFBQcwDYYxaHR0cHM6Ly90ZXN0YmVkLmtyaWxsLmNsb3VkL3JyZHAvbm90aWZpY2F0aW9uLnhtbDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCcGCCsGAQUFBwEHAQH/BBgwFjAJBAIAATADAwEAMAkEAgACMAMDAQAwIQYIKwYBBQUHAQgBAf8EEjAQoA4wDDAKAgEAAgUA/////zANBgkqhkiG9w0BAQsFAAOCAQEAOcRy21AK7ctJFkgTGnzwSaSCNLKwZ6JWkfJym9DqTYe/lKgyLKHidTeAvU8AmCsHqB3y1KKbHzoRjXHVhFWZZNZVglz9vDxW81081S2RQvfkwI1vHNHaEF64K5FSRv8SpOt/h5ZtaqpD+/p7BevLS7KPu3/PvBSphK1UV2eZomeYGjUstKTT2nj96x3JZO844pM7XCWYqLPIeWj7SmqXWUoiszuL+XjtObfKvutnaMuBX/LdOgASZqFurl3F/DPiTQS4kaIFnwoAzxsvCVata17+KWRNfOzp+jLLTK/anQjRNujuvgee9wmB4UnKkqdsq7KtOBiKkitDtthPqZePGA==", - "uri": "rsync://testbed.krill.cloud/ta/ta.cer", - "resources": { - "asn": "AS0-AS4294967295", - "v4": "0.0.0.0/0", - "v6": "::/0" - } - }, - "request": null - } - } - } - }, - "children": { - "testbed": { - "id_cert": "MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhERkZDOUYzNEREODIzOUI4MTZCNDM1MkMwNDU4NkNFNTNDRDczODNEMB4XDTIyMDIyNTEyMjU1N1oXDTM3MDIyNTEyMzA1N1owMzExMC8GA1UEAxMoREZGQzlGMzRERDgyMzlCODE2QjQzNTJDMDQ1ODZDRTUzQ0Q3MzgzRDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALtf+ZXpEzJa5E+Kix0HqRsnmiX14S1HI67byO6MgWE/pyWo5TwKD2J5Etquyl95e8DtPyzKMLerHKnX8ky865Awz0hNA2tpFI9XTzrf0DyBazLk0mrgjqmDcu+suusqbgt6BtV8BM3BfOWIFeUh3zjeayALbqo7V9a2yF1I0ro4CATQqf5ZAbsUCVYZ58wSoIvNlLsgosZnM2vL3ls8R6sT5ajxQMQoAfmsEWLQzHukQyi0l4MLBVO7SG5trCPB7pU8MJkJLPLfJs6MhEuaFgDaazwrcSnYHGmp43pPY4pRkDgAIdcNrzD+w3W171sb+Wdor7WW3NMgEWjSCdplkf8CAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU3/yfNN2CObgWtDUsBFhs5TzXOD0wHwYDVR0jBBgwFoAU3/yfNN2CObgWtDUsBFhs5TzXOD0wDQYJKoZIhvcNAQELBQADggEBAHXvUCM/wakhszwlVa+WpLQfpjzxXyLeTDprqJumtRWb/S0LnD/HduzPawO4H7JuO2vNc2DUvBQPP3fGfN2F3Hwuz0TbseP5T4YKynxtgZh420rM/aF8D5/LzjeNmeAxGLj0YC8RFH9AbHaVkD7d/59UBNJLYY+MjQ02aoHoy+gFMgDI70ivckfgJiAT6i9OOMTdeL+ZOI6BhEyirqQZMoMGruvJZ7RDJKZCcpyO9crFO/5A+VFLDAB5/vfDCeS7HoA5Pf1Z/oVImAf8Yr9+Hcq3CXDuTGfx/o0wKjQDTVr6doXwWGvVkbWFejRvZaWxgg+r+9QepPjPDTGOWT/4M78=", - "resources": { - "asn": "AS0-AS4294967295", - "v4": "0.0.0.0/0", - "v6": "::/0" - }, - "used_keys": {} - } - }, - "routes": { - "map": {} - } -} \ No newline at end of file diff --git a/test-resources/migrations/v0_9_5/cas/ta/snapshot.json b/test-resources/migrations/v0_9_5/cas/ta/snapshot.json deleted file mode 100644 index cb140444..00000000 --- a/test-resources/migrations/v0_9_5/cas/ta/snapshot.json +++ /dev/null @@ -1,98 +0,0 @@ -{ - "handle": "ta", - "version": 7, - "id": { - "cert": "MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEygxOTU0MzVCMEIwQ0VDOTA0NDJBNjc3RkJFM0NGRUQwRDIwOEU3MThCMB4XDTIyMDIyNTEyMjU1NloXDTM3MDIyNTEyMzA1NlowMzExMC8GA1UEAxMoMTk1NDM1QjBCMENFQzkwNDQyQTY3N0ZCRTNDRkVEMEQyMDhFNzE4QjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL+gRHahtBp+xnhOCX6U839Ela8t9plrcv/673NV9qWd4RjZrqGa06gMjhw/2kt0lK9EEt2UqTamSJdbWYMtqi6fyxRRaSRJ4uuOUGGIIO85gJ5EbQCctZwvvUdNcMRPqBR1Ked6CYNaMibDWUUhIy4qbDhG3OgsOHg6IG1rGhJriTgUaT5NKzDX8tge/iSOIFK/ltXzeHhbzo9BzDRJnoFNZgs7rTZ14t8xScUPZsJWsLP4o62hLmYgLMMQY4Vb96KpR3z4edKYn4svd3UGIt0hPiVHnig7ZZn7d/wSbvugNMxGiHCPNJgJnwRv5tzRuBaj094bwIUdNsRCKr0olo8CAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUGVQ1sLDOyQRCpnf748/tDSCOcYswHwYDVR0jBBgwFoAUGVQ1sLDOyQRCpnf748/tDSCOcYswDQYJKoZIhvcNAQELBQADggEBAJuslEa2y/uLG2O5N/luTxFbd0HhJtbaGucP7WS7VtO8Zv/Egidd12uLyep1z4FszbSm5J0lYXeJd+Kqql3/IZfpGo4vvO5AOUFnskssFzCMoTMenI/08SdyWzDv+VvUAQee9l4IP3kOgGzJlO9U+6MEPqvsd/0irRnthq+KC5jAPT6RWLTUxMQb8bFFH92/IYe9KEYWwzhFhMXPMQmmrQc0uUXvoNjaniqEf9dH1PqYdoLvIXggkjMEw8aaj8GJEdYPuUqEDliX0QutvxXUV20EgnTqPUUzsMS2vM++eB9sf9OgBlGxrLqiuN1rY/cL/4i17r4wn3CdMUWXhMwzdSc=" - }, - "repository": { - "repository_response": { - "tag": null, - "publisher_handle": "ta", - "id_cert": "MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyg2QThBOUFEMTA5MjdGOUUzRTMyRDg3MjczQTg1NUIzRDBDMzRDNjFGMB4XDTIyMDIyNTEyMjU1NloXDTM3MDIyNTEyMzA1NlowMzExMC8GA1UEAxMoNkE4QTlBRDEwOTI3RjlFM0UzMkQ4NzI3M0E4NTVCM0QwQzM0QzYxRjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMt42y6PtPChcJqopCCQZkl/amGqyPwhF1QbISlnyehKVjnPfp4ITO1831bA4B7vgtKYqaFMxbrEocBw4BHv7b0hzmIVffrZ0vFYd5kODKQ/5lK9CwnBYRvBCPBu2KwIWWC1soHHdiPpM/dOVoXxmKk46aSclvFaPAn2CGrXU3Sx04yplWcMOB+9PX4ELmrgttKxJYHXMNVz89XNADWC/vgivZTic5h46PPMZIn0cKILkKdwUx05BcNzVgx2GAzvwspyhyYiT9EXBsgYaNDl0ENWZu7NLbhxLj3WXRNxd/AIWmpsDDqBiIq7n6DOqiebHu/3kapgrb7cv1L1MywhRHUCAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUaoqa0Qkn+ePjLYcnOoVbPQw0xh8wHwYDVR0jBBgwFoAUaoqa0Qkn+ePjLYcnOoVbPQw0xh8wDQYJKoZIhvcNAQELBQADggEBAIH8R3/14PK1qy1D7HOqN5FbYEO2brwSPKb0UdqNC1o8zLLJ5qGNCWoAvck+pkAJsxOPxgvzvYlwlUzuCToiXFUnDBYPXzI6u8kziJFchRIOFmaQxL+1LKhV66hgXi7r85+3nB0UMrfARzgUjXcZ9WIIQOwtSYq7yTcMHf8na7GJRelvH4B1lNht5AW6fQeRPBHleZZ3DQQc18mX2cPdm/uoegnTlTpM9dRhFTcZeezwkZvEkYG/i9rSMxVmFd1E4gN2e0CPsxdJxZ9oMNubyNToW146Y7v+M5OTibfrIqQKvsBC3BuTZRbXB9093HVmJTff33/zFYexfM3X740MhOo=", - "service_uri": "https://testbed.krill.cloud/rfc8181/ta/", - "repo_info": { - "base_uri": "rsync://testbed.krill.cloud/repo/ta/", - "rpki_notify": "https://testbed.krill.cloud/rrdp/notification.xml" - } - } - }, - "parents": { - "ta": { - "type": "ta", - "cert": "MIIIfzCCB2egAwIBAgIUEBe+IpSz9etWpgVDQxkZJG/a48QwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCMjY5RjRENjA3RkUzRDJCMzMxQkNERDMwNDZFNTEzM0RCODJGNkM3NEJGQzRFMkE3MzBBNDYyMTg5NUUwMDk1MTk3M0I0NzY2ODIxMDJGQjNERDQyOTJFMEE4QTZCNDI4QkEyQ0I3QTRFNDJFMzFEQTFBM0U5RjFEQjgxQ0FGMDk0MDg3ODVFNDgwNkQ1OTkyN0M1MjQ1QzBDRkI5ODQyMDFCNkMxNjhBNzEzN0VBMTczOTgzRTczMDUyNERDODFCMjMzOUJDMzY1RENDMTE4REQ2QTk0NzI2RURGNzQyM0VFM0M2RTQ5RUQzRDc2QjcyMTY2NDVGMUQ5MUNCOEQ4ODZBMjQ3MTc0NENGNUVEMzIzODBEREJBRTA0QkIzQkFENTY3OTNGRDgzMTk2OTBEQzFENTZBNUZENDNBRjdFNEJCQUZGNEM4RjVFOEIwMzQ1QkYyOUU0NzA2RjAzRDg5Q0NGNTZBRjZEQkIwMkQwRThBMDZFMjJFQkFBNEJENjQ2N0JBQjVCQjI5NDlGNjRDRTZGQTM2QTJBNjlDQTQ1QkJFQjRCNzJFMjUwM0I5QTAyNDJGQjY1MEMyNUU2QjVDMDUyMkZGNTAxRjA3QTM1MTU0MkREQzdGNUUyQjVDMDlFMkEzNjk2NjZCRTVBMzc3OEMwRkUxN0UzMkNGNjVBMTAyMDMwMTAwMDEwIBcNMjIwMjI1MTIyNTU2WhgPMjEyMjAyMjUxMjMwNTZaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQjI2OUY0RDYwN0ZFM0QyQjMzMUJDREQzMDQ2RTUxMzNEQjgyRjZDNzRCRkM0RTJBNzMwQTQ2MjE4OTVFMDA5NTE5NzNCNDc2NjgyMTAyRkIzREQ0MjkyRTBBOEE2QjQyOEJBMkNCN0E0RTQyRTMxREExQTNFOUYxREI4MUNBRjA5NDA4Nzg1RTQ4MDZENTk5MjdDNTI0NUMwQ0ZCOTg0MjAxQjZDMTY4QTcxMzdFQTE3Mzk4M0U3MzA1MjREQzgxQjIzMzlCQzM2NURDQzExOERENkE5NDcyNkVERjc0MjNFRTNDNkU0OUVEM0Q3NkI3MjE2NjQ1RjFEOTFDQjhEODg2QTI0NzE3NDRDRjVFRDMyMzgwRERCQUUwNEJCM0JBRDU2NzkzRkQ4MzE5NjkwREMxRDU2QTVGRDQzQUY3RTRCQkFGRjRDOEY1RThCMDM0NUJGMjlFNDcwNkYwM0Q4OUNDRjU2QUY2REJCMDJEMEU4QTA2RTIyRUJBQTRCRDY0NjdCQUI1QkIyOTQ5RjY0Q0U2RkEzNkEyQTY5Q0E0NUJCRUI0QjcyRTI1MDNCOUEwMjQyRkI2NTBDMjVFNkI1QzA1MjJGRjUwMUYwN0EzNTE1NDJEREM3RjVFMkI1QzA5RTJBMzY5NjY2QkU1QTM3NzhDMEZFMTdFMzJDRjY1QTEwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsmn01gf+PSszG83TBG5RM9uC9sdL/E4qcwpGIYleAJUZc7R2aCEC+z3UKS4KimtCi6LLek5C4x2ho+nx24HK8JQIeF5IBtWZJ8UkXAz7mEIBtsFopxN+oXOYPnMFJNyBsjObw2XcwRjdapRybt90I+48bkntPXa3IWZF8dkcuNiGokcXRM9e0yOA3brgS7O61WeT/YMZaQ3B1Wpf1Dr35Luv9Mj16LA0W/KeRwbwPYnM9Wr227AtDooG4i66pL1kZ7q1uylJ9kzm+jaippykW760ty4lA7mgJC+2UMJea1wFIv9QHwejUVQt3H9eK1wJ4qNpZmvlo3eMD+F+Ms9loQIDAQABo4IBjzCCAYswDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUqXWSXyH8qWbZMdVswhLerEMTwPwwDgYDVR0PAQH/BAQDAgEGMIHiBggrBgEFBQcBCwSB1TCB0jAxBggrBgEFBQcwBYYlcnN5bmM6Ly90ZXN0YmVkLmtyaWxsLmNsb3VkL3JlcG8vdGEvMDBeBggrBgEFBQcwCoZScnN5bmM6Ly90ZXN0YmVkLmtyaWxsLmNsb3VkL3JlcG8vdGEvMC9BOTc1OTI1RjIxRkNBOTY2RDkzMUQ1NkNDMjEyREVBQzQzMTNDMEZDLm1mdDA9BggrBgEFBQcwDYYxaHR0cHM6Ly90ZXN0YmVkLmtyaWxsLmNsb3VkL3JyZHAvbm90aWZpY2F0aW9uLnhtbDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCcGCCsGAQUFBwEHAQH/BBgwFjAJBAIAATADAwEAMAkEAgACMAMDAQAwIQYIKwYBBQUHAQgBAf8EEjAQoA4wDDAKAgEAAgUA/////zANBgkqhkiG9w0BAQsFAAOCAQEAOcRy21AK7ctJFkgTGnzwSaSCNLKwZ6JWkfJym9DqTYe/lKgyLKHidTeAvU8AmCsHqB3y1KKbHzoRjXHVhFWZZNZVglz9vDxW81081S2RQvfkwI1vHNHaEF64K5FSRv8SpOt/h5ZtaqpD+/p7BevLS7KPu3/PvBSphK1UV2eZomeYGjUstKTT2nj96x3JZO844pM7XCWYqLPIeWj7SmqXWUoiszuL+XjtObfKvutnaMuBX/LdOgASZqFurl3F/DPiTQS4kaIFnwoAzxsvCVata17+KWRNfOzp+jLLTK/anQjRNujuvgee9wmB4UnKkqdsq7KtOBiKkitDtthPqZePGA==", - "resources": { - "asn": "AS0-AS4294967295", - "v4": "0.0.0.0/0", - "v6": "::/0" - }, - "tal": { - "uris": [ - "https://testbed.krill.cloud/ta/ta.cer" - ], - "encoded_ski": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsmn01gf+PSszG83TBG5RM9uC9sdL/E4qcwpGIYleAJUZc7R2aCEC+z3UKS4KimtCi6LLek5C4x2ho+nx24HK8JQIeF5IBtWZJ8UkXAz7mEIBtsFopxN+oXOYPnMFJNyBsjObw2XcwRjdapRybt90I+48bkntPXa3IWZF8dkcuNiGokcXRM9e0yOA3brgS7O61WeT/YMZaQ3B1Wpf1Dr35Luv9Mj16LA0W/KeRwbwPYnM9Wr227AtDooG4i66pL1kZ7q1uylJ9kzm+jaippykW760ty4lA7mgJC+2UMJea1wFIv9QHwejUVQt3H9eK1wJ4qNpZmvlo3eMD+F+Ms9loQIDAQAB" - } - } - }, - "next_class_name": 1, - "resources": { - "0": { - "name": "0", - "name_space": "0", - "parent_handle": "ta", - "parent_rc_name": "0", - "roas": {}, - "certificates": { - "inner": { - "62BC88453E78424F7F886712A4B904A07B98BEE7": { - "uri": "rsync://testbed.krill.cloud/repo/ta/0/62BC88453E78424F7F886712A4B904A07B98BEE7.cer", - "limit": { - "asn": "none", - "v4": "none", - "v6": "none" - }, - "resource_set": { - "asn": "AS0-AS4294967295", - "v4": "0.0.0.0/0", - "v6": "::/0" - }, - "cert": "MIIHVTCCBj2gAwIBAgIUQ7GgOP7b1fhnzKqDm7Y3vDb+u6MwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCMjY5RjRENjA3RkUzRDJCMzMxQkNERDMwNDZFNTEzM0RCODJGNkM3NEJGQzRFMkE3MzBBNDYyMTg5NUUwMDk1MTk3M0I0NzY2ODIxMDJGQjNERDQyOTJFMEE4QTZCNDI4QkEyQ0I3QTRFNDJFMzFEQTFBM0U5RjFEQjgxQ0FGMDk0MDg3ODVFNDgwNkQ1OTkyN0M1MjQ1QzBDRkI5ODQyMDFCNkMxNjhBNzEzN0VBMTczOTgzRTczMDUyNERDODFCMjMzOUJDMzY1RENDMTE4REQ2QTk0NzI2RURGNzQyM0VFM0M2RTQ5RUQzRDc2QjcyMTY2NDVGMUQ5MUNCOEQ4ODZBMjQ3MTc0NENGNUVEMzIzODBEREJBRTA0QkIzQkFENTY3OTNGRDgzMTk2OTBEQzFENTZBNUZENDNBRjdFNEJCQUZGNEM4RjVFOEIwMzQ1QkYyOUU0NzA2RjAzRDg5Q0NGNTZBRjZEQkIwMkQwRThBMDZFMjJFQkFBNEJENjQ2N0JBQjVCQjI5NDlGNjRDRTZGQTM2QTJBNjlDQTQ1QkJFQjRCNzJFMjUwM0I5QTAyNDJGQjY1MEMyNUU2QjVDMDUyMkZGNTAxRjA3QTM1MTU0MkREQzdGNUUyQjVDMDlFMkEzNjk2NjZCRTVBMzc3OEMwRkUxN0UzMkNGNjVBMTAyMDMwMTAwMDEwHhcNMjIwMjI1MTIyNjAxWhcNMjMwMjI0MTIzMTAxWjAzMTEwLwYDVQQDEyg2MkJDODg0NTNFNzg0MjRGN0Y4ODY3MTJBNEI5MDRBMDdCOThCRUU3MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0Jr8jBCAHqEWo7KWrdLFQTyXUk+Ifg7xWoKfXVjuTaVqOQ00V1qTWvUggMNmNd9EJsTzbO3ewauMPwYRsdVIzucewbEsJApKzFddAXTX0Q9B3qd+th5e2MyQBLtOF6ibC/4Qeg4i+q3aG67YEPU0cvyXbmNWBNa8d5wMazSEY8k7ZveK+gNZnIP0wpolNRGWrMvV4nkH9i1wKmo+wPyOdy73+s+ZhlygKUixfp/Dn4h/NKXiYVOrL3VHf7a+ucb90+P99Dz98he5ftzYDONCZF5rzgSxUJIO3bhJLZuRxC3z6/Cnf71FTFUG1uGDesaBQ8R0TKclYZIeIcKSdPzicQIDAQABo4ICYzCCAl8wDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUYryIRT54Qk9/iGcSpLkEoHuYvucwHwYDVR0jBBgwFoAUqXWSXyH8qWbZMdVswhLerEMTwPwwDgYDVR0PAQH/BAQDAgEGMGMGA1UdHwRcMFowWKBWoFSGUnJzeW5jOi8vdGVzdGJlZC5rcmlsbC5jbG91ZC9yZXBvL3RhLzAvQTk3NTkyNUYyMUZDQTk2NkQ5MzFENTZDQzIxMkRFQUM0MzEzQzBGQy5jcmwwQQYIKwYBBQUHAQEENTAzMDEGCCsGAQUFBzAChiVyc3luYzovL3Rlc3RiZWQua3JpbGwuY2xvdWQvdGEvdGEuY2VyMIHtBggrBgEFBQcBCwSB4DCB3TA3BggrBgEFBQcwBYYrcnN5bmM6Ly90ZXN0YmVkLmtyaWxsLmNsb3VkL3JlcG8vdGVzdGJlZC8wLzBjBggrBgEFBQcwCoZXcnN5bmM6Ly90ZXN0YmVkLmtyaWxsLmNsb3VkL3JlcG8vdGVzdGJlZC8wLzYyQkM4ODQ1M0U3ODQyNEY3Rjg4NjcxMkE0QjkwNEEwN0I5OEJFRTcubWZ0MD0GCCsGAQUFBzANhjFodHRwczovL3Rlc3RiZWQua3JpbGwuY2xvdWQvcnJkcC9ub3RpZmljYXRpb24ueG1sMBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwJwYIKwYBBQUHAQcBAf8EGDAWMAkEAgABMAMDAQAwCQQCAAIwAwMBADAhBggrBgEFBQcBCAEB/wQSMBCgDjAMMAoCAQACBQD/////MA0GCSqGSIb3DQEBCwUAA4IBAQAzefekijlB3SITIhWdjRK7mxBfDmv7yyF5st78AcsoU2l95D6ryECMZwXL0UIsuO4jY+C15VlXCld7nwGaAZB+QhPohQdqHOrbV8GLdrnIKp7WCGSI46mOlvSgzf8ceP2juTP/Vwk09t1WVJtxocglI7G0Gx6JHQQyNAPv4ZSgkCrMkOVZC3tZ8kGj76CCI1Mpjg0ZbWrhGO33NM9c//7PtU1l6IHmKs+w6Lg8pbg2q8QlMOOKtdgoBmC7iIMowCtQIdLnko7MFC3Osvt1S2CAxfnGqTw9n2JwBvKzoVIY4vViNxm/SkxxIyHtWEDkuXjw5QPekcoHDfh/kuDHel2R" - } - } - }, - "last_key_change": "2022-02-25T12:30:56.776208499Z", - "key_state": { - "active": { - "key_id": "A975925F21FCA966D931D56CC212DEAC4313C0FC", - "incoming_cert": { - "cert": "MIIIfzCCB2egAwIBAgIUEBe+IpSz9etWpgVDQxkZJG/a48QwDQYJKoZIhvcNAQELBQAwggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBCMjY5RjRENjA3RkUzRDJCMzMxQkNERDMwNDZFNTEzM0RCODJGNkM3NEJGQzRFMkE3MzBBNDYyMTg5NUUwMDk1MTk3M0I0NzY2ODIxMDJGQjNERDQyOTJFMEE4QTZCNDI4QkEyQ0I3QTRFNDJFMzFEQTFBM0U5RjFEQjgxQ0FGMDk0MDg3ODVFNDgwNkQ1OTkyN0M1MjQ1QzBDRkI5ODQyMDFCNkMxNjhBNzEzN0VBMTczOTgzRTczMDUyNERDODFCMjMzOUJDMzY1RENDMTE4REQ2QTk0NzI2RURGNzQyM0VFM0M2RTQ5RUQzRDc2QjcyMTY2NDVGMUQ5MUNCOEQ4ODZBMjQ3MTc0NENGNUVEMzIzODBEREJBRTA0QkIzQkFENTY3OTNGRDgzMTk2OTBEQzFENTZBNUZENDNBRjdFNEJCQUZGNEM4RjVFOEIwMzQ1QkYyOUU0NzA2RjAzRDg5Q0NGNTZBRjZEQkIwMkQwRThBMDZFMjJFQkFBNEJENjQ2N0JBQjVCQjI5NDlGNjRDRTZGQTM2QTJBNjlDQTQ1QkJFQjRCNzJFMjUwM0I5QTAyNDJGQjY1MEMyNUU2QjVDMDUyMkZGNTAxRjA3QTM1MTU0MkREQzdGNUUyQjVDMDlFMkEzNjk2NjZCRTVBMzc3OEMwRkUxN0UzMkNGNjVBMTAyMDMwMTAwMDEwIBcNMjIwMjI1MTIyNTU2WhgPMjEyMjAyMjUxMjMwNTZaMIICLTGCAikwggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQjI2OUY0RDYwN0ZFM0QyQjMzMUJDREQzMDQ2RTUxMzNEQjgyRjZDNzRCRkM0RTJBNzMwQTQ2MjE4OTVFMDA5NTE5NzNCNDc2NjgyMTAyRkIzREQ0MjkyRTBBOEE2QjQyOEJBMkNCN0E0RTQyRTMxREExQTNFOUYxREI4MUNBRjA5NDA4Nzg1RTQ4MDZENTk5MjdDNTI0NUMwQ0ZCOTg0MjAxQjZDMTY4QTcxMzdFQTE3Mzk4M0U3MzA1MjREQzgxQjIzMzlCQzM2NURDQzExOERENkE5NDcyNkVERjc0MjNFRTNDNkU0OUVEM0Q3NkI3MjE2NjQ1RjFEOTFDQjhEODg2QTI0NzE3NDRDRjVFRDMyMzgwRERCQUUwNEJCM0JBRDU2NzkzRkQ4MzE5NjkwREMxRDU2QTVGRDQzQUY3RTRCQkFGRjRDOEY1RThCMDM0NUJGMjlFNDcwNkYwM0Q4OUNDRjU2QUY2REJCMDJEMEU4QTA2RTIyRUJBQTRCRDY0NjdCQUI1QkIyOTQ5RjY0Q0U2RkEzNkEyQTY5Q0E0NUJCRUI0QjcyRTI1MDNCOUEwMjQyRkI2NTBDMjVFNkI1QzA1MjJGRjUwMUYwN0EzNTE1NDJEREM3RjVFMkI1QzA5RTJBMzY5NjY2QkU1QTM3NzhDMEZFMTdFMzJDRjY1QTEwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsmn01gf+PSszG83TBG5RM9uC9sdL/E4qcwpGIYleAJUZc7R2aCEC+z3UKS4KimtCi6LLek5C4x2ho+nx24HK8JQIeF5IBtWZJ8UkXAz7mEIBtsFopxN+oXOYPnMFJNyBsjObw2XcwRjdapRybt90I+48bkntPXa3IWZF8dkcuNiGokcXRM9e0yOA3brgS7O61WeT/YMZaQ3B1Wpf1Dr35Luv9Mj16LA0W/KeRwbwPYnM9Wr227AtDooG4i66pL1kZ7q1uylJ9kzm+jaippykW760ty4lA7mgJC+2UMJea1wFIv9QHwejUVQt3H9eK1wJ4qNpZmvlo3eMD+F+Ms9loQIDAQABo4IBjzCCAYswDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUqXWSXyH8qWbZMdVswhLerEMTwPwwDgYDVR0PAQH/BAQDAgEGMIHiBggrBgEFBQcBCwSB1TCB0jAxBggrBgEFBQcwBYYlcnN5bmM6Ly90ZXN0YmVkLmtyaWxsLmNsb3VkL3JlcG8vdGEvMDBeBggrBgEFBQcwCoZScnN5bmM6Ly90ZXN0YmVkLmtyaWxsLmNsb3VkL3JlcG8vdGEvMC9BOTc1OTI1RjIxRkNBOTY2RDkzMUQ1NkNDMjEyREVBQzQzMTNDMEZDLm1mdDA9BggrBgEFBQcwDYYxaHR0cHM6Ly90ZXN0YmVkLmtyaWxsLmNsb3VkL3JyZHAvbm90aWZpY2F0aW9uLnhtbDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCcGCCsGAQUFBwEHAQH/BBgwFjAJBAIAATADAwEAMAkEAgACMAMDAQAwIQYIKwYBBQUHAQgBAf8EEjAQoA4wDDAKAgEAAgUA/////zANBgkqhkiG9w0BAQsFAAOCAQEAOcRy21AK7ctJFkgTGnzwSaSCNLKwZ6JWkfJym9DqTYe/lKgyLKHidTeAvU8AmCsHqB3y1KKbHzoRjXHVhFWZZNZVglz9vDxW81081S2RQvfkwI1vHNHaEF64K5FSRv8SpOt/h5ZtaqpD+/p7BevLS7KPu3/PvBSphK1UV2eZomeYGjUstKTT2nj96x3JZO844pM7XCWYqLPIeWj7SmqXWUoiszuL+XjtObfKvutnaMuBX/LdOgASZqFurl3F/DPiTQS4kaIFnwoAzxsvCVata17+KWRNfOzp+jLLTK/anQjRNujuvgee9wmB4UnKkqdsq7KtOBiKkitDtthPqZePGA==", - "uri": "rsync://testbed.krill.cloud/ta/ta.cer", - "resources": { - "asn": "AS0-AS4294967295", - "v4": "0.0.0.0/0", - "v6": "::/0" - } - }, - "request": null - } - } - } - }, - "children": { - "testbed": { - "id_cert": "MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhERkZDOUYzNEREODIzOUI4MTZCNDM1MkMwNDU4NkNFNTNDRDczODNEMB4XDTIyMDIyNTEyMjU1N1oXDTM3MDIyNTEyMzA1N1owMzExMC8GA1UEAxMoREZGQzlGMzRERDgyMzlCODE2QjQzNTJDMDQ1ODZDRTUzQ0Q3MzgzRDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALtf+ZXpEzJa5E+Kix0HqRsnmiX14S1HI67byO6MgWE/pyWo5TwKD2J5Etquyl95e8DtPyzKMLerHKnX8ky865Awz0hNA2tpFI9XTzrf0DyBazLk0mrgjqmDcu+suusqbgt6BtV8BM3BfOWIFeUh3zjeayALbqo7V9a2yF1I0ro4CATQqf5ZAbsUCVYZ58wSoIvNlLsgosZnM2vL3ls8R6sT5ajxQMQoAfmsEWLQzHukQyi0l4MLBVO7SG5trCPB7pU8MJkJLPLfJs6MhEuaFgDaazwrcSnYHGmp43pPY4pRkDgAIdcNrzD+w3W171sb+Wdor7WW3NMgEWjSCdplkf8CAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU3/yfNN2CObgWtDUsBFhs5TzXOD0wHwYDVR0jBBgwFoAU3/yfNN2CObgWtDUsBFhs5TzXOD0wDQYJKoZIhvcNAQELBQADggEBAHXvUCM/wakhszwlVa+WpLQfpjzxXyLeTDprqJumtRWb/S0LnD/HduzPawO4H7JuO2vNc2DUvBQPP3fGfN2F3Hwuz0TbseP5T4YKynxtgZh420rM/aF8D5/LzjeNmeAxGLj0YC8RFH9AbHaVkD7d/59UBNJLYY+MjQ02aoHoy+gFMgDI70ivckfgJiAT6i9OOMTdeL+ZOI6BhEyirqQZMoMGruvJZ7RDJKZCcpyO9crFO/5A+VFLDAB5/vfDCeS7HoA5Pf1Z/oVImAf8Yr9+Hcq3CXDuTGfx/o0wKjQDTVr6doXwWGvVkbWFejRvZaWxgg+r+9QepPjPDTGOWT/4M78=", - "resources": { - "asn": "AS0-AS4294967295", - "v4": "0.0.0.0/0", - "v6": "::/0" - }, - "used_keys": { - "62BC88453E78424F7F886712A4B904A07B98BEE7": { - "current": "0" - } - } - } - }, - "routes": { - "map": {} - } -} \ No newline at end of file diff --git a/test-resources/ta/example-pkcs1.pem b/test-resources/ta/example-pkcs1.pem new file mode 100644 index 00000000..966528d2 --- /dev/null +++ b/test-resources/ta/example-pkcs1.pem @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEpgIBAAKCAQEAvctenvnkF0/Lr+2aOFVzCU/ElZ/OFFPyUyA4WV127snuCqLV +9IS3uW6TukI3oSbORd0GItccsmsMXk+xOldVxRhBEaEarQ9qAcdfY9XulACGzEDA +gk5vGom2w/6t9mYsq5lEsUrRLl7UqYQchK+eg8kNPNaaSDq6aeyHkFWCnqDKDEQf ++hix26uV547Z6g5rnmCJnzCKgsTaT8Y7OOey3ty56X7kBOLLUydI9d14vrSw1NAF +7114+J008EVzQQ5grXS57CubIyKHABVjD6OTW8tmzQZh9KJB25r2OB42M36b32j2 +hOTGVDRYnLu7qto+fuw63XoMkYES0i3EuXfUFwIDAQABAoIBAQClE8AG8j7Lb+Iv +8K+Uk+3siW7o3Qf3clRwrLOWNs79PrFGmv8RIGZUaLMg6/tKtV/wMB/oKcWSAb3O +Qe5aWiAFv+TImqGDKMcBKRH02dwa6qJUAXXvYJ0OLf3DVz6j85ai4jp3IiXy+RRr +JLdRSRbMdRCIe/fRHxOIkewPQ/DKWntYCj8/zrFsTyps63IoMGL01vR0DUfHJoSr +X2AkWgG8R1sH2b29yF1ztR2tOnA6SZuxQUCEUApnLw6BGULdmZjTcWHYWaz2z3sy +7s3tpn9FwaqKE31wGJdc6gpEeZGXvffuomfOrpTzA/47rjbYfyEFgTICxcmXq9VS +cNoJgywBAoGBAOuQjjX4bYvlyEMa5kamC2M87xtBBJq3caShmUd55rsS+ZHpk8Ik +A3mpGEX2c4K7l+HJkK0JjUErsyCVbc1xQorGy+hQ6+lXgd20RgWZprV4WycOqnpJ +W8Yr3jJStK9V5YJ8Do2NZdMZVY+RjawSb8n2FcKYa/Hi5KvfOZgVLX0BAoGBAM5C +V+/oVIcpJXuKxB5frKV2uy18Prpkus0xDd37zaAqVrAJq2yBEX8mR3MDL5anjKCl +tYa8S57R8mFijyBFNW186WmcxyX1knp9A6DXxkBN+vxepSpdATu3x3COue9EpKSH +Gb7gRnsmR2mlVFTafRPNkXG4zxDgQgBc3tSmrJkXAoGBAMfAE6dWWuY3WmL063Hb +GWr0X7lXn+TmS3qUAZsnlmzqATEmxUHqMfw3VDr3aingk0FGH+VrZRlvSf0GWU7N +jOSLAJumCvYaWyg51uqmyUO2pGzxNcRucmEQD+HSWh8YEn9cXSbRURf5sqEEhwLz +u1Gh1//kKhy6DrhjmL4Kr0EBAoGBAJ+JG0F6P59HyTE0lRs1P3HAU2kMN+yuKvq5 +XZN8x4CCHwkMgaZscp8ZeZxRM4bg09oSMkUj8Y3HsCV5OWFphrjILDY/SJ5owsKx +XZQUMcjdSCvZ/QC2bVTGgqHiE5kpS/vib5x/FqT8Z7IkagUz9hjSIRSIMMlJ3GMx +cj2jKc9DAoGBAKlVPL5q1QQaVtjOS18zGBu02Fy0ZLm9wkqrNWDltiZrl59JxIP6 +RxOr256S6EyBKxOBe+57lu9cswyAPuJFdBoo7PaPsoLx1ulkXBHW7DOGU51j5B0F +j1k7UvRL96Sr3TG/2ukZAshAMuUr4Samy9/m/6TWnbeFSXQieN7A7JpO +-----END RSA PRIVATE KEY----- diff --git a/test-resources/ta/example-pkcs8.pem b/test-resources/ta/example-pkcs8.pem new file mode 100644 index 00000000..f5352381 --- /dev/null +++ b/test-resources/ta/example-pkcs8.pem @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEwAIBADANBgkqhkiG9w0BAQEFAASCBKowggSmAgEAAoIBAQC9y16e+eQXT8uv +7Zo4VXMJT8SVn84UU/JTIDhZXXbuye4KotX0hLe5bpO6QjehJs5F3QYi1xyyawxe +T7E6V1XFGEERoRqtD2oBx19j1e6UAIbMQMCCTm8aibbD/q32ZiyrmUSxStEuXtSp +hByEr56DyQ081ppIOrpp7IeQVYKeoMoMRB/6GLHbq5XnjtnqDmueYImfMIqCxNpP +xjs457Le3LnpfuQE4stTJ0j13Xi+tLDU0AXvXXj4nTTwRXNBDmCtdLnsK5sjIocA +FWMPo5Nby2bNBmH0okHbmvY4HjYzfpvfaPaE5MZUNFicu7uq2j5+7DrdegyRgRLS +LcS5d9QXAgMBAAECggEBAKUTwAbyPstv4i/wr5ST7eyJbujdB/dyVHCss5Y2zv0+ +sUaa/xEgZlRosyDr+0q1X/AwH+gpxZIBvc5B7lpaIAW/5MiaoYMoxwEpEfTZ3Brq +olQBde9gnQ4t/cNXPqPzlqLiOnciJfL5FGskt1FJFsx1EIh799EfE4iR7A9D8Mpa +e1gKPz/OsWxPKmzrcigwYvTW9HQNR8cmhKtfYCRaAbxHWwfZvb3IXXO1Ha06cDpJ +m7FBQIRQCmcvDoEZQt2ZmNNxYdhZrPbPezLuze2mf0XBqooTfXAYl1zqCkR5kZe9 +9+6iZ86ulPMD/juuNth/IQWBMgLFyZer1VJw2gmDLAECgYEA65CONfhti+XIQxrm +RqYLYzzvG0EEmrdxpKGZR3nmuxL5kemTwiQDeakYRfZzgruX4cmQrQmNQSuzIJVt +zXFCisbL6FDr6VeB3bRGBZmmtXhbJw6qeklbxiveMlK0r1XlgnwOjY1l0xlVj5GN +rBJvyfYVwphr8eLkq985mBUtfQECgYEAzkJX7+hUhykle4rEHl+spXa7LXw+umS6 +zTEN3fvNoCpWsAmrbIERfyZHcwMvlqeMoKW1hrxLntHyYWKPIEU1bXzpaZzHJfWS +en0DoNfGQE36/F6lKl0BO7fHcI6570SkpIcZvuBGeyZHaaVUVNp9E82RcbjPEOBC +AFze1KasmRcCgYEAx8ATp1Za5jdaYvTrcdsZavRfuVef5OZLepQBmyeWbOoBMSbF +Qeox/DdUOvdqKeCTQUYf5WtlGW9J/QZZTs2M5IsAm6YK9hpbKDnW6qbJQ7akbPE1 +xG5yYRAP4dJaHxgSf1xdJtFRF/myoQSHAvO7UaHX/+QqHLoOuGOYvgqvQQECgYEA +n4kbQXo/n0fJMTSVGzU/ccBTaQw37K4q+rldk3zHgIIfCQyBpmxynxl5nFEzhuDT +2hIyRSPxjcewJXk5YWmGuMgsNj9InmjCwrFdlBQxyN1IK9n9ALZtVMaCoeITmSlL +++JvnH8WpPxnsiRqBTP2GNIhFIgwyUncYzFyPaMpz0MCgYEAqVU8vmrVBBpW2M5L +XzMYG7TYXLRkub3CSqs1YOW2JmuXn0nEg/pHE6vbnpLoTIErE4F77nuW71yzDIA+ +4kV0Gijs9o+ygvHW6WRcEdbsM4ZTnWPkHQWPWTtS9Ev3pKvdMb/a6RkCyEAy5Svh +JqbL3+b/pNadt4VJdCJ43sDsmk4= +-----END PRIVATE KEY----- diff --git a/tests/functional_aspa.rs b/tests/functional_aspa.rs index 42394ea8..631d7a36 100644 --- a/tests/functional_aspa.rs +++ b/tests/functional_aspa.rs @@ -10,7 +10,6 @@ use rpki::{ use krill::{ commons::api::{AspaCustomer, AspaDefinition, AspaDefinitionList, AspaProvidersUpdate, ObjectName}, - daemon::ca::ta_handle, test::*, }; use rpki::repository::aspa::ProviderAs; @@ -35,13 +34,10 @@ async fn functional_aspa() { info("##################################################################"); info(""); - let ta = ta_handle(); let testbed = ca_handle("testbed"); let ca = ca_handle("CA"); let ca_res = resources("AS65000", "10.0.0.0/16", ""); - let rcn_0 = rcn(0); - info("##################################################################"); info("# #"); info("# Wait for the *testbed* CA to get its certificate, this means #"); @@ -52,20 +48,6 @@ async fn functional_aspa() { info(""); assert!(ca_contains_resources(&testbed, &ResourceSet::all()).await); - // Verify that the TA published expected objects - { - let mut expected_files = expected_mft_and_crl(&ta, &rcn_0).await; - expected_files.push(expected_issued_cer(&testbed, &rcn_0).await); - assert!( - will_publish_embedded( - "TA should have manifest, crl and cert for testbed", - &ta, - &expected_files - ) - .await - ); - } - { info("##################################################################"); info("# #"); diff --git a/tests/functional_bgpsec.rs b/tests/functional_bgpsec.rs index b7a7ead4..4ba691c4 100644 --- a/tests/functional_bgpsec.rs +++ b/tests/functional_bgpsec.rs @@ -10,7 +10,6 @@ use rpki::{ use krill::{ commons::api::{BgpSecAsnKey, BgpSecCsrInfo, BgpSecDefinition}, - daemon::ca::ta_handle, test::*, }; @@ -34,14 +33,11 @@ async fn functional_bgpsec() { info("##################################################################"); info(""); - let ta = ta_handle(); let testbed = ca_handle("testbed"); let ca = ca_handle("CA"); let ca_res = resources("AS65000", "10.0.0.0/16", ""); let ca_res_shrunk = resources("", "10.0.0.0/16", ""); - let rcn_0 = rcn(0); - info("##################################################################"); info("# #"); info("# Wait for the *testbed* CA to get its certificate, this means #"); @@ -52,20 +48,6 @@ async fn functional_bgpsec() { info(""); assert!(ca_contains_resources(&testbed, &ResourceSet::all()).await); - // Verify that the TA published expected objects - { - let mut expected_files = expected_mft_and_crl(&ta, &rcn_0).await; - expected_files.push(expected_issued_cer(&testbed, &rcn_0).await); - assert!( - will_publish_embedded( - "TA should have manifest, crl and cert for testbed", - &ta, - &expected_files - ) - .await - ); - } - { info("##################################################################"); info("# #"); diff --git a/tests/functional_ca_import.rs b/tests/functional_ca_import.rs index 76887091..f7742f4c 100644 --- a/tests/functional_ca_import.rs +++ b/tests/functional_ca_import.rs @@ -11,7 +11,10 @@ use krill::{ async fn functional_ca_import() { // Start an empty Krill instance. let krill_dir = tmp_dir(); - let config = test_config(&krill_dir, false, false, false, false); + let mut config = test_config(&krill_dir, false, false, false, false); + config.ta_support_enabled = true; + config.ta_signer_enabled = true; + start_krill(config).await; // Import CA structure. We expect: diff --git a/tests/functional_keyroll.rs b/tests/functional_keyroll.rs index 87906b1c..bca1ff8e 100644 --- a/tests/functional_keyroll.rs +++ b/tests/functional_keyroll.rs @@ -18,7 +18,6 @@ use krill::{ AspaDefinition, BgpSecDefinition, ObjectName, ReceivedCert, RoaConfiguration, RoaConfigurationUpdates, RoaPayload, }, - daemon::ca::ta_handle, test::*, }; @@ -44,7 +43,6 @@ async fn functional_keyroll() { info("##################################################################"); info(""); - let ta = ta_handle(); let testbed = ca_handle("testbed"); let ca = ca_handle("CA"); let ca_resources = resources("AS65000", "10.0.0.0/16", ""); @@ -77,21 +75,6 @@ async fn functional_keyroll() { info(""); assert!(ca_contains_resources(&testbed, &ResourceSet::all()).await); - // Verify that the TA published expected objects - { - let mut expected_files = expected_mft_and_crl(&ta, &dflt_rc_name).await; - expected_files.push(expected_issued_cer(&testbed, &dflt_rc_name).await); - assert!( - will_publish_embedded( - "TA should have manifest, crl and cert for testbed", - &ta, - &expected_files - ) - .await - ); - assert_manifest_files_current_key("List CRL and issued cert on mft", &ta, &expected_files).await; - } - // Verify that the Testbed publishes a new empty key set { assert_manifest_number_current_key("Publish a new empty manifest with serial 1", &testbed, 1).await; diff --git a/tests/functional_parent_child.rs b/tests/functional_parent_child.rs index 010ce464..7344af33 100644 --- a/tests/functional_parent_child.rs +++ b/tests/functional_parent_child.rs @@ -4,7 +4,7 @@ use std::fs; use rpki::repository::resources::ResourceSet; -use krill::{daemon::ca::ta_handle, test::*}; +use krill::test::*; #[tokio::test] async fn functional_parent_child() { @@ -36,7 +36,6 @@ async fn functional_parent_child() { info("##################################################################"); info(""); - let ta = ta_handle(); let testbed = ca_handle("testbed"); let ca1 = ca_handle("CA1"); @@ -65,20 +64,6 @@ async fn functional_parent_child() { info(""); assert!(ca_contains_resources(&testbed, &ResourceSet::all()).await); - // Verify that the TA published expected objects - { - let mut expected_files = expected_mft_and_crl(&ta, &rcn_0).await; - expected_files.push(expected_issued_cer(&testbed, &rcn_0).await); - assert!( - will_publish_embedded( - "TA should have manifest, crl and cert for testbed", - &ta, - &expected_files - ) - .await - ); - } - { info("##################################################################"); info("# #"); diff --git a/tests/functional_roas.rs b/tests/functional_roas.rs index 536bba54..b3c9b85e 100644 --- a/tests/functional_roas.rs +++ b/tests/functional_roas.rs @@ -5,7 +5,7 @@ use std::fs; use hyper::StatusCode; use rpki::{ repository::resources::ResourceSet}; -use krill::{commons::api::RoaConfigurationUpdates, daemon::ca::ta_handle, test::*}; +use krill::{commons::api::RoaConfigurationUpdates, test::*}; #[tokio::test] async fn functional_roas() { @@ -27,7 +27,6 @@ async fn functional_roas() { info("##################################################################"); info(""); - let ta = ta_handle(); let testbed = ca_handle("testbed"); let ca = ca_handle("CA"); let ca_res = resources("AS65000", "10.0.0.0/8", ""); @@ -53,20 +52,6 @@ async fn functional_roas() { info(""); assert!(ca_contains_resources(&testbed, &ResourceSet::all()).await); - // Verify that the TA published expected objects - { - let mut expected_files = expected_mft_and_crl(&ta, &rcn_0).await; - expected_files.push(expected_issued_cer(&testbed, &rcn_0).await); - assert!( - will_publish_embedded( - "TA should have manifest, crl and cert for testbed", - &ta, - &expected_files - ) - .await - ); - } - { info("##################################################################"); info("# #"); diff --git a/tests/functional_rtas.rs b/tests/functional_rtas.rs index 6362ce2a..e2c254e6 100644 --- a/tests/functional_rtas.rs +++ b/tests/functional_rtas.rs @@ -3,7 +3,7 @@ use std::fs; use bytes::Bytes; -use krill::{commons::api::RtaList, daemon::ca::ta_handle, test::*}; +use krill::{commons::api::RtaList, test::*}; use rpki::repository::resources::ResourceSet; #[tokio::test] @@ -28,7 +28,6 @@ async fn functional_rtas() { info("##################################################################"); info(""); - let ta = ta_handle(); let testbed = ca_handle("testbed"); let ca1 = ca_handle("CA1"); @@ -37,8 +36,6 @@ async fn functional_rtas() { let ca2 = ca_handle("CA2"); let ca2_res = resources("", "10.1.0.0/16", ""); - let rcn_0 = rcn(0); - info("##################################################################"); info("# #"); info("# Wait for the *testbed* CA to get its certificate, this means #"); @@ -49,20 +46,6 @@ async fn functional_rtas() { info(""); assert!(ca_contains_resources(&testbed, &ResourceSet::all()).await); - // Verify that the TA published expected objects - { - let mut expected_files = expected_mft_and_crl(&ta, &rcn_0).await; - expected_files.push(expected_issued_cer(&testbed, &rcn_0).await); - assert!( - will_publish_embedded( - "TA should have manifest, crl and cert for testbed", - &ta, - &expected_files - ) - .await - ); - } - { info("##################################################################"); info("# #"); diff --git a/tests/migrate_repository.rs b/tests/migrate_repository.rs index 527e0752..5d6e9ad9 100644 --- a/tests/migrate_repository.rs +++ b/tests/migrate_repository.rs @@ -11,10 +11,9 @@ use rpki::repository::resources::ResourceSet; use krill::{ commons::{ - api::{ObjectName, RepoFileDeleteCriteria, RoaConfigurationUpdates, RoaPayload}, + api::{ObjectName, RoaConfigurationUpdates, RoaPayload}, util::httpclient, }, - daemon::ca::ta_handle, test::*, }; @@ -46,7 +45,6 @@ async fn migrate_repository() { info(""); let pubd_dir = start_krill_pubd(5).await; - let ta = ta_handle(); let testbed = ca_handle("testbed"); let ca1 = ca_handle("CA1"); @@ -65,78 +63,6 @@ async fn migrate_repository() { info(""); assert!(ca_contains_resources(&testbed, &ResourceSet::all()).await); - // Verify that the TA published expected objects - { - let mut expected_files = expected_mft_and_crl(&ta, &rcn_0).await; - expected_files.push(expected_issued_cer(&testbed, &rcn_0).await); - assert!( - will_publish_embedded( - "TA should have manifest, crl and cert for testbed", - &ta, - &expected_files - ) - .await - ); - } - - // Test the repository purging and re-syncing (healing from the CA's perspective) works as well. - { - info("##################################################################"); - info("# #"); - info("# Test that purging files and re-syncing works: #"); - info("# - remove a single file under the TA #"); - info("# - remove the complete TA dir #"); - info("# - re-sync, now it should all be published again #"); - info("# #"); - info("##################################################################"); - info(""); - - { - // Remove single file - let's remove the issued certificate - let issued = expected_issued_cer(&testbed, &rcn_0).await; - let issued_uri = rsync(&format!("rsync://localhost/repo/ta/0/{}", issued)); - let criteria = RepoFileDeleteCriteria::new(issued_uri); - krill_admin(krill::cli::options::Command::PubServer( - krill::cli::options::PubServerCommand::DeleteFiles(criteria), - )) - .await; - let expected_files = expected_mft_and_crl(&ta, &rcn_0).await; - assert!( - will_publish_embedded( - "TA should have manifest, crl but NO more cert for testbed", - &ta, - &expected_files - ) - .await - ); - } - - { - // removing a directory should also work - let criteria = RepoFileDeleteCriteria::new(rsync("rsync://localhost/repo/ta/")); - krill_admin(krill::cli::options::Command::PubServer( - krill::cli::options::PubServerCommand::DeleteFiles(criteria), - )) - .await; - assert!(will_publish_embedded("TA should have NO content now", &ta, &[]).await); - } - - { - // re-sync - all should be back - cas_sync_all().await; - let mut expected_files = expected_mft_and_crl(&ta, &rcn_0).await; - expected_files.push(expected_issued_cer(&testbed, &rcn_0).await); - assert!( - will_publish_embedded( - "TA should have manifest, crl and cert for testbed", - &ta, - &expected_files - ) - .await - ); - } - } - { info("##################################################################"); info("# #"); diff --git a/tests/remote_parent_and_repo.rs b/tests/remote_parent_and_repo.rs index 58071d09..3bbaf4b6 100644 --- a/tests/remote_parent_and_repo.rs +++ b/tests/remote_parent_and_repo.rs @@ -2,11 +2,10 @@ //! use std::{fs, str::FromStr}; -use rpki::ca::provisioning::ResourceClassName; +use rpki::{ca::provisioning::ResourceClassName, repository::resources::ResourceSet}; use krill::{ commons::api::{ObjectName, ParentCaReq, RoaConfigurationUpdates, RoaPayload}, - daemon::ca::ta_handle, test::*, }; @@ -19,7 +18,6 @@ async fn remote_parent_and_repo() { let krill_dir = start_krill_testbed_with_rrdp_interval(5).await; let second_krill_dir = start_second_krill().await; - let ta = ta_handle(); let testbed = ca_handle("testbed"); let ca1 = ca_handle("CA1"); let ca1_res = ipv4_resources("10.0.0.0/16"); @@ -27,18 +25,7 @@ async fn remote_parent_and_repo() { let rcn_0 = ResourceClassName::from(0); // Verify that the TA and testbed are ready - { - let mut expected_files = expected_mft_and_crl(&ta, &rcn_0).await; - expected_files.push(expected_issued_cer(&testbed, &rcn_0).await); - assert!( - will_publish_embedded( - "TA should have manifest, crl and cert for testbed", - &ta, - &expected_files - ) - .await - ); - } + assert!(ca_contains_resources(&testbed, &ResourceSet::all()).await); // Create up CA1 in second server { diff --git a/tests/testbed.rs b/tests/testbed.rs index 3db79384..1b46b813 100644 --- a/tests/testbed.rs +++ b/tests/testbed.rs @@ -104,10 +104,9 @@ async fn add_and_remove_certificate_authority() { add_parent_to_ca(&dummy_ca_handle, parent_ca_req).await; // verify that the child CA now has the correct parent - let parent_contact_for_child = ParentCaContact::for_rfc8183_parent_response(parent_response).unwrap(); let dummy_ca = ca_details(&dummy_ca_handle).await; let dummy_ca_parents = dummy_ca.parents(); - let expected_parent_info = ParentInfo::new(testbed_ca_handle.convert(), parent_contact_for_child); + let expected_parent_info = ParentInfo::new(testbed_ca_handle.convert()); let actual_parent_info = &dummy_ca_parents[0]; assert_eq!(1, dummy_ca_parents.len()); assert_eq!(&expected_parent_info, actual_parent_info);