lacme - Small ACME client written with process isolation and minimal privileges in mind

	Commit message (Collapse)	Author	Age	Files
...
\| *	lacme-accountd: Refactor logging logic.	Guilhem Moulin	2021-02-23	2
\| \|
\| *	lacme-accountd: don't log debug messages unless --debug is set.	Guilhem Moulin	2021-02-23	2
\| \|
\| *	Consolidate error messages.	Guilhem Moulin	2021-02-23	2
\| \|
\| *	lacme-accountd: panic() upon internal error of the signing routine.	Guilhem Moulin	2021-02-22	1
\| \| \| \| \| \| \| \|	It might croak and we want to log that error also.
\| *	test suite: Avoid setting twice the ACME API server URL.	Guilhem Moulin	2021-02-22	1
\| \|
\| *	test: Allow prefixing test names with 'tests/'.	Guilhem Moulin	2021-02-22	1
\| \| \| \| \| \| \| \|	It's handy to be able to run `./test tests/accountd*` or similar.
\| *	lacme-accountd: Refuse to sign JWS with an invalid Protected Header.	Guilhem Moulin	2021-02-22	3
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	“The JWS Protected Header is a JSON object” — RFC 7515 sec. 2. “The JWS Protected Header MUST include the following fields: - "alg" - "nonce" - "url" - either "jwk" or "kid"” — RFC 8555 sec. 6.2.
\| *	lacme-account: Improve log messages.	Guilhem Moulin	2021-02-22	5
\| \| \| \| \| \| \| \|	Again…
\| *	accountd::conn(): Minor refactoring.	Guilhem Moulin	2021-02-22	1
\| \|
\| *	In lacme's the [accountd] config, let lacme-accountd(1) do the %-expansion ↵	Guilhem Moulin	2021-02-22	3
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	for 'config'. This matches the arguably expected behavior that ‘config = %h/foo’ is passed as ‘--config=%h/foo’ and resolved by lacme-accountd(1) (possibly remote and with another passwd database).
* \|	Update standards version to 4.6.2, no changes needed.	Guilhem Moulin	2022-12-20	1
\| \| \| \| \| \| \| \| \| \| \| \|	Changes-By: lintian-brush Fixes: lintian: out-of-date-standards-version See-also: https://lintian.debian.org/tags/out-of-date-standards-version.html
* \|	Set field Upstream-Name in debian/copyright.	Guilhem Moulin	2022-12-20	1
\| \| \| \| \| \| \| \|	Changes-By: lintian-brush
* \|	Merge branch 'multiarch-fixes' into 'debian/latest'	Jelmer Vernooĳ	2022-10-30	1
\|\ \ \| \| \| \| \| \| \| \| \| \| \| \|	Apply hints suggested by the multi-arch hinter See merge request debian/lacme!1
\| * \|	Apply multi-arch hints.	Debian Janitor	2022-10-27	1
\|/ / \| \| \| \| \| \| \| \| \| \|	+ lacme-accountd: Add Multi-Arch: foreign. Changes-By: apply-multiarch-hints
* \|	d/control: Improve long package descriptions.	Guilhem Moulin	2022-08-16	1
\| \|
* \|	Salsa CI: Remove default configuration file.	Guilhem Moulin	2022-08-16	1
\| \| \| \| \| \| \| \| \| \| \| \|	Instead, set ‘recipes/debian.yml@salsa-ci-team/pipeline’ as CI/CD configuration file in the GitLab repository setting. Per recommendation from the Salsa CI maintainers: https://salsa.debian.org/salsa-ci-team/pipeline#debian-pipeline-for-developers .
* \|	Prepare new release.debian/0.8.0-2	Guilhem Moulin	2021-05-04	1
\| \|
* \|	d/lacme.postrm: Don't delete system users on purge.	Guilhem Moulin	2021-02-22	2
\| \| \| \| \| \| \| \| \| \| \| \| \| \|	_lacme-www shouldn't own any file or directories, but there might be files on disk owned by _lacme-client when 'challenge-directory' is used. See https://wiki.debian.org/AccountHandlingInMaintainerScripts#Reasons_for_not_deleting_accounts .
* \|	Prepare new release.debian/0.8.0-1	Guilhem Moulin	2021-02-22	3
\| \|
* \|	d/lacme.install: include new configuration files and snippets.	Guilhem Moulin	2021-02-22	2
\| \|
* \|	d/lacme.links: Remove /etc/apache2/conf-available/lacme.conf.	Guilhem Moulin	2021-02-22	2
\| \| \| \| \| \| \| \|	Now part of the upstream build system.
* \|	Add NEWS files with breaking changes.	Guilhem Moulin	2021-02-22	2
\| \|
* \|	d/control: Remove versioned Recommends: on lacme-accountd.	Guilhem Moulin	2021-02-22	2
\| \| \| \| \| \| \| \| \| \|	lacme also works with earlier accountds, but might yield bad suprises when the 'keyid' setting is set.
* \|	d/copyright: Point Source: to the upstream repository.	Guilhem Moulin	2021-02-22	2
\| \|
* \|	d/copyright: Bump copyright years.	Guilhem Moulin	2021-02-22	1
\| \|
* \|	Bump copyright years.	Guilhem Moulin	2021-02-22	1
\| \|
* \|	d/control: lacme now require openssl 1.1.0 or later.	Guilhem Moulin	2021-02-22	2
\| \|
* \|	d/control: Remove libtypes-serialiser-perl from lacme's Depends.	Guilhem Moulin	2021-02-22	2
\| \| \| \| \| \| \| \|	See b54d248515357297d84a01cf45a42a6787c21240.
* \|	Bump upstream version number.	Guilhem Moulin	2021-02-22	1
\| \|
* \|	Use dedicated system users for internal components.	Guilhem Moulin	2021-02-22	5
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	* The internal webserver now runs as a dedicated system user _lacme-www (and group nogroup) instead of www-data:www-data. This is configurable in the [webserver] section of the lacme(8) configuration file. * The internal ACME client now runs as a dedicated system user _lacme-client (and group nogroup) instead of nobody:nogroup. This is configurable in the [client] section of the lacme(8) configuration file. * The _lacme-www and _lacme-client system users are created automatically by lacme.postinst (hence a new Depends: adduser), and deleted on purge. (So make sure not to chown any file to these internal users.)
* \|	Refresh patches.	Guilhem Moulin	2021-02-22	2
\| \| \| \| \| \| \| \|	And add "Forwarded: not-needed" annotations when relevant.
* \|	Merge tag 'v0.8.0' into debian/latest	Guilhem Moulin	2021-02-22	48
\|\\| \| \| \| \| \| \|	Release version 0.8.0
\| *	Prepare new release v0.8.0.v0.8.0	Guilhem Moulin	2021-02-22	4
\| \|
\| *	tests: Check presence of extra greeting data.	Guilhem Moulin	2021-02-22	1
\| \|
\| *	Fix `./test --deb`.	Guilhem Moulin	2021-02-22	3
\| \| \| \| \| \| \| \|	The staging environment wasn't set properly for the Debian packages.
\| *	Print error messages only once.	Guilhem Moulin	2021-02-22	1
\| \|
\| *	space damage	Guilhem Moulin	2021-02-22	1
\| \|
\| *	client: Print Terms of Service URL for 'account' command.	Guilhem Moulin	2021-02-22	2
\| \|
\| *	logfile: treat empty values as unset.	Guilhem Moulin	2021-02-22	1
\| \|
\| *	Add 'logfile' to lacme-account.conf.	Guilhem Moulin	2021-02-22	1
\| \|
\| *	lacme-accountd(1): new setting 'keyid'.	Guilhem Moulin	2021-02-22	6
\| \| \| \| \| \| \| \| \| \|	This saves a round trip and provides a safeguard against malicious clients.
\| *	accountd: Improve log message for incoming requests.	Guilhem Moulin	2021-02-21	3
\| \|
\| *	accountd: Pass JWA and JWK thumbprint via extended greeting data.	Guilhem Moulin	2021-02-21	3
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Passing the JWA to the ACME client is required if we want to support account keys other than RSA. As of 0.7 both lacme-accountd(1) and lacme(8) hardcode “RS256” (SHA256withRSA per RFC 7518 sec. A.1). Passing the JWK thumbprint is handy as it gives more flexibility if RFC 8555 sec. 8.1 were to be updated with another digest algorithm (it's currently hardcoded to SHA-256). A single lacme-account(1) instance might be used to sign requests from many clients, and it's easier to upgrade a single ‘lacme-accountd’ than many ‘lacme’. Moreover, in some restricted environments lacme-accountd might hide the JWK from the client to prevent ‘newAccount’ requests (such as contact updates); passing its thumbprint is enough for ‘newOrder’ requests.
\| *	Add IPC tests with an old lacme(8) resp. lacme-accountd(1).	Guilhem Moulin	2021-02-21	2
\| \|
\| *	wording	Guilhem Moulin	2021-02-21	5
\| \|
\| *	wording	Guilhem Moulin	2021-02-21	2
\| \|
\| *	accountd: Fix prototype.	Guilhem Moulin	2021-02-21	1
\| \|
\| *	test suite: Don't try to show stderr if it's empty.	Guilhem Moulin	2021-02-21	1
\| \|
\| *	test suite: Indicate which tests have passed.	Guilhem Moulin	2021-02-21	1
\| \|
\| *	Make the ACME API server URL configurable at build time.	Guilhem Moulin	2021-02-21	5
\| \|