Keep parent ID cert PEM in history #870

src/commons/api/admin.rs

@@ -340,28 +340,28 @@ pub struct ParentServerInfo {
     /// The URI where the CA needs to send its RFC6492 messages
     service_uri: ServiceUri,
 
-    /// The parent CA's public key
-    public_key: PublicKey,
-
     /// The handle the parent CA likes to be called by.
     parent_handle: ParentHandle,
 
     /// The handle the parent CA chose for the child CA.
     child_handle: ChildHandle,
+
+    /// The parent's ID cert.
+    id_cert: IdCertInfo,
 }
 
 impl ParentServerInfo {
     pub fn new(
         service_uri: ServiceUri,
-        public_key: PublicKey,
         parent_handle: ParentHandle,
         child_handle: ChildHandle,
+        id_cert: IdCertInfo,
     ) -> Self {
         ParentServerInfo {
             service_uri,
-            public_key,
             parent_handle,
             child_handle,
+            id_cert,
         }
     }
 
@@ -369,10 +369,6 @@ impl ParentServerInfo {
         &self.service_uri
     }
 
-    pub fn public_key(&self) -> &PublicKey {
-        &self.public_key
-    }
-
     pub fn parent_handle(&self) -> &ParentHandle {
         &self.parent_handle
     }
@@ -380,14 +376,21 @@ impl ParentServerInfo {
     pub fn child_handle(&self) -> &ChildHandle {
         &self.child_handle
     }
+
+    pub fn id_cert(&self) -> &IdCertInfo {
+        &self.id_cert
+    }
 }
 
 impl fmt::Display for ParentServerInfo {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
         writeln!(f, "service uri:    {}", self.service_uri)?;
-        writeln!(f, "key identifier: {}", self.public_key.key_identifier())?;
         writeln!(f, "parent handle:  {}", self.parent_handle)?;
-        writeln!(f, "child handle:   {}", self.child_handle)
+        writeln!(f, "child handle:   {}", self.child_handle)?;
+        writeln!(f, "parent certificate:")?;
+        writeln!(f, "   key identifier: {}", self.id_cert().public_key().key_identifier())?;
+        writeln!(f, "   hash (of cert): {}", self.id_cert().hash())?;
+        writeln!(f, "   PEM:\n\n{}", self.id_cert().pem())
     }
 }
 
@@ -411,18 +414,17 @@ impl ParentCaContact {
 
     pub fn for_rfc8183_parent_response(response: idexchange::ParentResponse) -> Result<Self, idexchange::Error> {
         let id_cert = response.validate()?;
+        let id_cert = IdCertInfo::from(&id_cert);
 
         let service_uri = response.service_uri().clone();
-        let pub_key = id_cert.public_key().clone();
-
         let parent_handle = response.parent_handle().clone();
         let child_handle = response.child_handle().clone();
 
         Ok(ParentCaContact::Rfc6492(ParentServerInfo {
             service_uri,
-            public_key: pub_key,
             parent_handle,
             child_handle,
+            id_cert,
         }))
     }
 

src/daemon/ca/manager.rs

@@ -485,12 +485,7 @@ impl CaManager {
         let service_uri = Self::service_uri_for_ca(service_uri, ca_handle);
         let ca = self.get_ca(ca_handle).await?;
 
-        let server_info = ParentServerInfo::new(
-            service_uri,
-            ca.id_cert().public_key().clone(),
-            ca_handle.convert(),
-            child_handle,
-        );
+        let server_info = ParentServerInfo::new(service_uri, ca_handle.convert(), child_handle, ca.id_cert().clone());
         Ok(ParentCaContact::for_parent_server_info(server_info))
     }
 
@@ -1445,7 +1440,7 @@ impl CaManager {
                     cms_logger.err(format!("Could not decode CMS: {}", e))?;
                     Err(Error::Rfc6492(e))
                 }
-                Ok(cms) => match cms.validate(server_info.public_key()) {
+                Ok(cms) => match cms.validate(server_info.id_cert().public_key()) {
                     Err(e) => {
                         cms_logger.err(format!("Response invalid: {}", e))?;
                         Err(Error::Rfc6492(e))

src/upgrades/mod.rs

@@ -395,6 +395,10 @@ pub fn prepare_upgrade_data_migrations(mode: UpgradeMode, config: Arc<Config>) -
                 }
 
                 Ok(Some(UpgradeReport::new(true, versions)))
+            } else if versions.from < KrillVersion::candidate(0, 10, 0, 3) {
+                Err(PrepareUpgradeError::custom(
+                    "Cannot upgrade from 0.10.0 RC1 or RC2. Please contact rpki-team@nlnetlabs.nl",
+                ))
             } else {
                 Ok(Some(UpgradeReport::new(false, versions)))
             }

src/upgrades/pre_0_10_0/cas_migration.rs

@@ -9,7 +9,6 @@ use crate::{
     commons::{
         api::StorableCaCommand,
         eventsourcing::{AggregateStore, KeyStoreKey, KeyValueStore, StoredCommand, StoredValueInfo},
-        util::KrillVersion,
     },
     constants::{CASERVER_DIR, CA_OBJECTS_DIR, KRILL_VERSION},
     daemon::{
@@ -86,10 +85,7 @@ impl CasMigration {
 
 impl UpgradeStore for CasMigration {
     fn needs_migrate(&self) -> Result<bool, PrepareUpgradeError> {
-        Ok(self.current_kv_store.version_is_after(KrillVersion::release(0, 9, 0))?
-            && self
-                .current_kv_store
-                .version_is_before(KrillVersion::candidate(0, 10, 0, 1))?)
+        unimplemented!("This is checked in upgrades/mod.rs")
     }
 
     fn prepare_new_data(&self, mode: UpgradeMode) -> Result<(), PrepareUpgradeError> {

src/upgrades/pre_0_10_0/old_events.rs

@@ -22,7 +22,7 @@ use rpki::{
 use crate::{
     commons::{
         api::{
-            AspaCustomer, AspaDefinition, AspaProvidersUpdate, CertInfo, IssuedCertificate, ObjectName,
+            AspaCustomer, AspaDefinition, AspaProvidersUpdate, CertInfo, IdCertInfo, IssuedCertificate, ObjectName,
             ParentCaContact, ParentServerInfo, PublicationServerInfo, ReceivedCert, RepositoryContact, Revocation,
             Revocations, RoaAggregateKey, RtaName, SuspendedCert, TaCertDetails, TrustAnchorLocator, UnsuspendedCert,
         },
@@ -298,12 +298,8 @@ pub struct OldParentResponse {
 
 impl From<OldParentResponse> for ParentServerInfo {
     fn from(old: OldParentResponse) -> Self {
-        ParentServerInfo::new(
-            old.service_uri,
-            old.id_cert.public_key().clone(),
-            old.parent_handle,
-            old.child_handle,
-        )
+        let id_cert_info = IdCertInfo::from(&old.id_cert);
+        ParentServerInfo::new(old.service_uri, old.parent_handle, old.child_handle, id_cert_info)
     }
 }