From 892615de808c15f8f70b561324a5d9c008a0165d Mon Sep 17 00:00:00 2001 From: Arjan H Date: Sat, 17 Sep 2022 12:40:44 +0200 Subject: [PATCH] Bump boulder version to release-2022-09-14 --- install | 4 +-- patches/config_bad-key-revoker.patch | 6 ++-- patches/config_crl-updater.patch | 9 ++---- patches/config_expiration-mailer.patch | 6 ++-- patches/db_migrations.patch | 40 +++++++++++++------------- patches/docker-compose.patch | 2 +- patches/storer_storer.patch | 6 ++-- patches/test_config_ca_a.patch | 30 +++++++++---------- patches/test_config_ca_b.patch | 30 +++++++++---------- 9 files changed, 60 insertions(+), 73 deletions(-) diff --git a/install b/install index fd20649..49e9260 100755 --- a/install +++ b/install @@ -24,7 +24,7 @@ dockerComposeVersion="v2.5.0" labcaUrl="https://github.com/hakwerk/labca/" boulderUrl="https://github.com/letsencrypt/boulder/" -boulderTag="release-2022-09-06" +boulderTag="release-2022-09-14" # Feature flags flag_skip_redis=true @@ -591,7 +591,7 @@ config_boulder() { cp ratelimit/rate-limits.go "$boulderLabCADir/.backup/" cp errors/errors.go "$boulderLabCADir/.backup/" cp log/log.go "$boulderLabCADir/.backup/" - cp sa/_db/migrations/20210223140000_CombinedSchema.sql "$boulderLabCADir/.backup/" + cp sa/db/boulder_sa/20210223140000_CombinedSchema.sql "$boulderLabCADir/.backup/" cp Makefile "$boulderLabCADir/.backup/" $cloneDir/patch-cfg.sh "sudo -u labca -H" "$boulderLabCADir" &>>$installLog diff --git a/patches/config_bad-key-revoker.patch b/patches/config_bad-key-revoker.patch index 2ee82dd..6b3bd37 100644 --- a/patches/config_bad-key-revoker.patch +++ b/patches/config_bad-key-revoker.patch @@ -23,10 +23,10 @@ index dc8c7da5..8f65f3a0 100644 "backoffIntervalMax": "2s" }, "syslog": { -@@ -36,5 +41,9 @@ - "beeline": { +@@ -37,5 +42,9 @@ "mute": true, - "dataset": "Test" + "serviceName": "Test", + "writeKey": {"passwordFile": "test/secrets/honeycomb_fake_password"} + }, + "common": { + "dnsTimeout": "3s", diff --git a/patches/config_crl-updater.patch b/patches/config_crl-updater.patch index dbfb5ff..91692dc 100644 --- a/patches/config_crl-updater.patch +++ b/patches/config_crl-updater.patch @@ -1,15 +1,10 @@ diff --git a/test/config/crl-updater.json b/test/config/crl-updater.json -index 875fc7ab..9c0ea6ed 100644 +index f6b70123f..a6c1471e5 100644 --- a/test/config/crl-updater.json +++ b/test/config/crl-updater.json -@@ -14,16 +14,18 @@ - "serverAddress": "ca.boulder:9106", +@@ -19,15 +19,13 @@ "timeout": "15s" }, -+ "crlStorerService": { -+ "serverAddress": "crl-storer.boulder:9109", -+ "timeout": "15s" -+ }, "issuerCerts": [ - "/hierarchy/intermediate-cert-rsa-a.pem", - "/hierarchy/intermediate-cert-rsa-b.pem", diff --git a/patches/config_expiration-mailer.patch b/patches/config_expiration-mailer.patch index ecf58d0..c7bf74c 100644 --- a/patches/config_expiration-mailer.patch +++ b/patches/config_expiration-mailer.patch @@ -14,10 +14,10 @@ index 4519fe4d..f52a408c 100644 "tls": { "caCertFile": "test/grpc-creds/minica.pem", "certFile": "test/grpc-creds/expiration-mailer.boulder/cert.pem", -@@ -34,5 +39,9 @@ - "beeline": { +@@ -35,5 +40,9 @@ "mute": true, - "dataset": "Test" + "serviceName": "Test", + "writeKey": {"passwordFile": "test/secrets/honeycomb_fake_password"} + }, + "common": { + "dnsTimeout": "3s", diff --git a/patches/db_migrations.patch b/patches/db_migrations.patch index 5325384..91096cb 100644 --- a/patches/db_migrations.patch +++ b/patches/db_migrations.patch @@ -1,9 +1,9 @@ -diff --git a/sa/_db/migrations/20210223140000_CombinedSchema.sql b/sa/_db/migrations/20210223140000_CombinedSchema.sql -index f9705d018..035c5009f 100644 ---- a/sa/_db/migrations/20210223140000_CombinedSchema.sql -+++ b/sa/_db/migrations/20210223140000_CombinedSchema.sql +diff --git a/sa/db/boulder_sa/20210223140000_CombinedSchema.sql b/sa/db/boulder_sa/20210223140000_CombinedSchema.sql +index 21030b33d..7f6a93da9 100644 +--- a/sa/db/boulder_sa/20210223140000_CombinedSchema.sql ++++ b/sa/db/boulder_sa/20210223140000_CombinedSchema.sql @@ -1,7 +1,9 @@ - -- +goose Up + -- +migrate Up -- SQL in section 'Up' is executed when this migration is applied -CREATE TABLE `authz2` ( @@ -175,9 +175,9 @@ index f9705d018..035c5009f 100644 `id` bigint(20) NOT NULL AUTO_INCREMENT, `registrationID` bigint(20) NOT NULL, `serial` varchar(255) NOT NULL, -@@ -223,15 +241,71 @@ DROP TABLE `precertificates` - DROP TABLE `requestedNames` - DROP TABLE `serials` +@@ -223,15 +241,71 @@ DROP TABLE `precertificates`; + DROP TABLE `requestedNames`; + DROP TABLE `serials`; +CREATE TABLE `authz` ( + `id` varchar(255) NOT NULL, @@ -191,11 +191,11 @@ index f9705d018..035c5009f 100644 + CONSTRAINT `regId_authz` FOREIGN KEY (`registrationID`) REFERENCES `registrations` (`id`) ON DELETE NO ACTION ON UPDATE NO ACTION +) ENGINE=InnoDB DEFAULT CHARSET=utf8; + - DROP TABLE `authz2` - DROP TABLE `blockedKeys` - DROP TABLE `certificateStatus` - DROP TABLE `certificatesPerName` --DROP TABLE `crls` + DROP TABLE `authz2`; + DROP TABLE `blockedKeys`; + DROP TABLE `certificateStatus`; + DROP TABLE `certificatesPerName`; +-DROP TABLE `crls`; + +CREATE TABLE `crls` ( + `serial` varchar(255) NOT NULL, @@ -204,10 +204,10 @@ index f9705d018..035c5009f 100644 + PRIMARY KEY (`serial`) +) ENGINE=InnoDB DEFAULT CHARSET=utf8; + - DROP TABLE `fqdnSets` - DROP TABLE `issuedNames` - DROP TABLE `keyHashToSerial` - DROP TABLE `newOrdersRL` + DROP TABLE `fqdnSets`; + DROP TABLE `issuedNames`; + DROP TABLE `keyHashToSerial`; + DROP TABLE `newOrdersRL`; + +CREATE TABLE `orderToAuthz` ( + `orderID` bigint(20) NOT NULL, @@ -216,9 +216,9 @@ index f9705d018..035c5009f 100644 + KEY `authzID` (`authzID`) +) ENGINE=InnoDB DEFAULT CHARSET=utf8; + - DROP TABLE `orderToAuthz2` - DROP TABLE `orders` --DROP TABLE `registrations` + DROP TABLE `orderToAuthz2`; + DROP TABLE `orders`; +-DROP TABLE `registrations`; + +CREATE TABLE `pendingAuthorizations` ( + `id` varchar(255) NOT NULL, diff --git a/patches/docker-compose.patch b/patches/docker-compose.patch index 38f1931..e111905 100644 --- a/patches/docker-compose.patch +++ b/patches/docker-compose.patch @@ -3,7 +3,7 @@ index 0cd8c8dd..36619190 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -8,7 +8,7 @@ services: - image: &boulder_image letsencrypt/boulder-tools:${BOULDER_TOOLS_TAG:-go1.18.4_2022-08-11} + image: &boulder_image letsencrypt/boulder-tools:${BOULDER_TOOLS_TAG:-go1.18.6_2022-09-06} environment: FAKE_DNS: 10.77.77.77 - BOULDER_CONFIG_DIR: test/config diff --git a/patches/storer_storer.patch b/patches/storer_storer.patch index 8786935..79dbfd7 100644 --- a/patches/storer_storer.patch +++ b/patches/storer_storer.patch @@ -1,5 +1,5 @@ diff --git a/crl/storer/storer.go b/crl/storer/storer.go -index 859abc9f..749b3818 100644 +index dfc497daa..077f3576d 100644 --- a/crl/storer/storer.go +++ b/crl/storer/storer.go @@ -9,6 +9,9 @@ import ( @@ -36,7 +36,7 @@ index 859abc9f..749b3818 100644 uploadCount: uploadCount, sizeHistogram: sizeHistogram, latencyHistogram: latencyHistogram, -@@ -160,15 +166,19 @@ func (cs *crlStorer) UploadCRL(stream cspb.CRLStorer_UploadCRLServer) error { +@@ -157,15 +163,19 @@ func (cs *crlStorer) UploadCRL(stream cspb.CRLStorer_UploadCRLServer) error { checksum := sha256.Sum256(crlBytes) checksumb64 := base64.StdEncoding.EncodeToString(checksum[:]) crlContentType := "application/pkix-crl" @@ -65,7 +65,7 @@ index 859abc9f..749b3818 100644 if err != nil { cs.uploadCount.WithLabelValues(issuer.Subject.CommonName, "failed").Inc() cs.log.AuditErrf("CRL upload failed: id=[%s] err=[%s]", crlId, err) -@@ -189,3 +199,46 @@ func (cs *crlStorer) UploadCRL(stream cspb.CRLStorer_UploadCRLServer) error { +@@ -186,3 +196,46 @@ func (cs *crlStorer) UploadCRL(stream cspb.CRLStorer_UploadCRLServer) error { return stream.SendAndClose(&emptypb.Empty{}) } diff --git a/patches/test_config_ca_a.patch b/patches/test_config_ca_a.patch index a7606ae..89b6c66 100644 --- a/patches/test_config_ca_a.patch +++ b/patches/test_config_ca_a.patch @@ -1,23 +1,8 @@ diff --git a/test/config/ca-a.json b/test/config/ca-a.json -index 9cb9720e..3c4a0a3c 100644 +index 1233a9c95..3c4a0a3ca 100644 --- a/test/config/ca-a.json +++ b/test/config/ca-a.json -@@ -24,6 +24,14 @@ - "orphan-finder.boulder" - ] - }, -+ "grpcCRLGenerator": { -+ "maxConnectionAge": "30s", -+ "address": ":9106", -+ "clientNames": [ -+ "health-checker.boulder", -+ "crl-updater.boulder" -+ ] -+ }, - "saService": { - "serverAddress": "sa.boulder:9095", - "timeout": "15s" -@@ -60,19 +68,7 @@ +@@ -68,30 +68,7 @@ "crlURL": "http://example.com/crl", "location": { "configFile": "test/test-ca.key-pkcs11.json", @@ -27,6 +12,17 @@ index 9cb9720e..3c4a0a3c 100644 - }, - { - "useForRSALeaves": false, +- "useForECDSALeaves": true, +- "issuerURL": "http://127.0.0.1:4001/aia/issuer/5214744660557630", +- "ocspURL": "http://127.0.0.1:4002/", +- "location": { +- "configFile": "/hierarchy/intermediate-signing-key-ecdsa.pkcs11.json", +- "certFile": "/hierarchy/intermediate-cert-ecdsa-a.pem", +- "numSessions": 2 +- } +- }, +- { +- "useForRSALeaves": false, - "useForECDSALeaves": false, - "issuerURL": "http://127.0.0.1:4001/aia/issuer/41127673797486028", - "ocspURL": "http://127.0.0.1:4002/", diff --git a/patches/test_config_ca_b.patch b/patches/test_config_ca_b.patch index 5000566..deebcee 100644 --- a/patches/test_config_ca_b.patch +++ b/patches/test_config_ca_b.patch @@ -1,23 +1,8 @@ diff --git a/test/config/ca-b.json b/test/config/ca-b.json -index 122bcfa7..54b25dd8 100644 +index 960d62f95..54b25dd81 100644 --- a/test/config/ca-b.json +++ b/test/config/ca-b.json -@@ -24,6 +24,14 @@ - "orphan-finder.boulder" - ] - }, -+ "grpcCRLGenerator": { -+ "maxConnectionAge": "30s", -+ "address": ":9106", -+ "clientNames": [ -+ "health-checker.boulder", -+ "crl-updater.boulder" -+ ] -+ }, - "saService": { - "serverAddress": "sa.boulder:9095", - "timeout": "15s" -@@ -60,19 +68,7 @@ +@@ -68,30 +68,7 @@ "crlURL": "http://example.com/crl", "location": { "configFile": "test/test-ca.key-pkcs11.json", @@ -27,6 +12,17 @@ index 122bcfa7..54b25dd8 100644 - }, - { - "useForRSALeaves": false, +- "useForECDSALeaves": true, +- "issuerURL": "http://127.0.0.1:4001/aia/issuer/5214744660557630", +- "ocspURL": "http://127.0.0.1:4002/", +- "location": { +- "configFile": "/hierarchy/intermediate-signing-key-ecdsa.pkcs11.json", +- "certFile": "/hierarchy/intermediate-cert-ecdsa-a.pem", +- "numSessions": 2 +- } +- }, +- { +- "useForRSALeaves": false, - "useForECDSALeaves": false, - "issuerURL": "http://127.0.0.1:4001/aia/issuer/41127673797486028", - "ocspURL": "http://127.0.0.1:4002/",