lacme/Changelog, branch debian/0.8.1-1 Small ACME client written with process isolation and minimal privileges in mind Prepare new release v0.8.1. 2023-01-25T02:23:51+00:00 Guilhem Moulin guilhem@fripost.org 2023-01-25T02:23:51+00:00 b3af3526b293f396da02a6276ea86ca17dcd2d03 






Adjust test suite against current Let's Encrypt staging environment.
2023-01-25T02:23:45+00:00

Guilhem Moulin
guilhem@fripost.org

2023-01-25T02:12:13+00:00

cb0b301e7a62a71d9e4454f9f7af5358c857c48c












Replace '$(dir $@)' with '$(@D)' in Makefile.
2023-01-25T02:11:22+00:00

Guilhem Moulin
guilhem@fripost.org

2023-01-25T02:11:22+00:00

40a4c9b9be51f9c41edd8b421dd629e001659fb4












lacme: pass a temporary JSON file with the client configuration to the internal client.
2021-02-25T09:30:22+00:00

Guilhem Moulin
guilhem@fripost.org

2021-02-25T00:41:59+00:00

9a8f705eddd18ccc9a24fe0e7efe6b5a87b2be09

So it doesn't have to parse the INI file again.  Also, while lacme.conf
is world-readable by default, one might restrict permissions and add
private information in there, not realizing that everything, including
comments, will be readable by the client.





So it doesn't have to parse the INI file again.  Also, while lacme.conf
is world-readable by default, one might restrict permissions and add
private information in there, not realizing that everything, including
comments, will be readable by the client.







lacme: split certificates using Net::SSLeay::PEM_* instead of calling openssl.
2021-02-24T23:37:17+00:00

Guilhem Moulin
guilhem@fripost.org

2021-02-24T23:30:37+00:00

f09c95ea97c9bdee92f7c7622689aed540373a73












lacme: Return an error when the 'mode'/'chown' isn't a number.
2021-02-24T20:32:06+00:00

Guilhem Moulin
guilhem@fripost.org

2021-02-24T20:28:31+00:00

ea5a51ecaa72c8277b4f878cf3635025d757fa37

oct("foobar") is 0, definitely not what we want.





oct("foobar") is 0, definitely not what we want.







lacme: Add 'owner' resp. 'mode' as (prefered) alias for 'chown' resp. 'chmod'.
2021-02-24T20:32:06+00:00

Guilhem Moulin
guilhem@fripost.org

2021-02-24T20:24:13+00:00

c6a4aaa6128d55ba5f7f3cd2bd75f789f69ae407












lacme: Default mode for certificate(-chain) creation is 0644 minus umask restrictions.
2021-02-24T20:32:01+00:00

Guilhem Moulin
guilhem@fripost.org

2021-02-24T20:01:12+00:00

c612a7ff44995f4f9c39fa0fb68470d90c88decf

Also, always spawn the client with umask 0022 so a starting lacme(8)
with a restrictive umask doesn't impede serving challenge response
files.





Also, always spawn the client with umask 0022 so a starting lacme(8)
with a restrictive umask doesn't impede serving challenge response
files.







lacme: Don't write certificate(-chain) file on chown/chmod failure.
2021-02-24T20:09:02+00:00

Guilhem Moulin
guilhem@fripost.org

2021-02-24T19:03:44+00:00

cdd025133a306cd8d3e81aa832ac056119d65f3a

Otherwise we end up with files with mode 0644 owned by root:root, and
subsequent lacme(8) invocations will likely not renew them for a while.

This change also saves a chown(2) call.  And the new logic (chown resp.
chmod from root:root resp. 0600) is safe if we ever include private key
material in there too.





Otherwise we end up with files with mode 0644 owned by root:root, and
subsequent lacme(8) invocations will likely not renew them for a while.

This change also saves a chown(2) call.  And the new logic (chown resp.
chmod from root:root resp. 0600) is safe if we ever include private key
material in there too.







If restricting access via umask() fails, don't include errno in the error message.
2021-02-24T20:08:28+00:00

Guilhem Moulin
guilhem@fripost.org

2021-02-24T20:06:48+00:00

faab30461b0f2b920e3dd19489ce458c0b38e6d9

errno is not set on umask failure, see
https://perldoc.perl.org/functions/umask.





errno is not set on umask failure, see
https://perldoc.perl.org/functions/umask.