Support multiple signers of different types behind a HSM feature flag, and support in principle selecting which signer to use for which purpose. (#539)
* Encrypt session state using ChaCha20-Poly1305 instead of AES-GCM.
* Replace config file users login use of insecure unsalted SHA2 password hashing with secure scrypt salted password hashing.
* Log the start of the request before determining the actor.
* Allow sufficient time for password hashing delays during login with config file user based tests..
* Synced with Lagosta commit b49f23de.
* Move child_request API endpoint for conststency. (#330)
* Move get RFC 8183 Publisher Request API endpoints (#330)
* Accept XML and json to add/update parent on same endpoints (#330)
* Simplify the JSON to add a child and remove unused fields. (#330)
* Update path to child_request in openapi spec.
* Update path to publisher request.
* Update api spec and documentation.
* Fix update parent API documentation and call by CLI.
* CLI stability
* Update pubd OpenAPI spec t o match changes made to the Krill API.
* Update the e2e test client code to submit only the id_cert and not the whole RFC8183 request, as required by changes made to the Krill API.
Co-authored-by: Ximon Eighteen <3304436+ximon18@users.noreply.github.com>
* Remove embedded repository contact option, migrate commands and events.
* Migrate old CA init events. Test upgrade from 0.6.0.
* Migrate embedded in CA history.
Co-authored-by: Ximon Eighteen <3304436+ximon18@users.noreply.github.com>
* Let users configure the AIA to use with TA certificates. Set 'ta_aia' in the config file. (#409)
* Use explicit configuration section for testbed, no longer rely on magic env variables.
Note: this will all be revised again if/when the Publication server and TA vs CA code is fully separated in future.
Co-authored-by: Ximon Eighteen <3304436+ximon18@users.noreply.github.com>
This allows us to keep the full history of semantically important events, while not spamming the history and avoiding excessive use of disk space. See issues #370 and #423.
This is a substantial change. Highlights follow:
* Added a developer documentation section
* No longer using events for manifest/crl generation (#370)
* No longer using events for publication deltas (#423)
* Removed pre 0.6.0 migration code - people will have to upgrade to at least 0.6.0 first
* Added migration code for 0.6.0-0.8.1 to this
* Migrate repository by doing a keyroll. (#370)
* Remove archiving code for commands (no longer applicable)
Minor other fixes:
* Use a swap file when writing (avoid corrupt json if disk is full) (#370)
* Make removing publisher content idempotent for publishers already removed.
Co-authored-by: Ximon Eighteen <3304436+ximon18@users.noreply.github.com>
Co-authored-by: Jasper den Hertog <jasper@plainspace.com>
