From cab563d1d7b8b1b46dbc7f47bfa0412dd072fcba Mon Sep 17 00:00:00 2001 From: Arjan H Date: Fri, 30 Aug 2024 16:31:07 +0200 Subject: [PATCH] Bump boulder version to release-2024-07-29 --- .github/workflows/release.yml | 2 +- build/Dockerfile-boulder | 2 +- build/Dockerfile-control | 1 - build/Dockerfile-gui | 1 - build/build.sh | 4 +-- dev/versions | 18 ++++++++++++ gui/apply-boulder | 2 +- gui/apply-nginx | 6 +++- install | 2 +- nginx.conf | 9 ++++++ patch-cfg.sh | 2 ++ patch.sh | 6 ++++ patches/ca_ca.patch | 4 +-- patches/docker-compose.patch | 4 +-- patches/mail_mailer.patch | 14 +++++---- patches/ra_ra.patch | 6 ++-- patches/sfe_templates_layout.patch | 24 ++++++++++++++++ patches/wfe2_main.patch | 20 ++++++------- patches/wfe2_wfe.patch | 32 ++++++++++----------- utils/nameidtool.go | 46 ------------------------------ 20 files changed, 111 insertions(+), 94 deletions(-) create mode 100644 patches/sfe_templates_layout.patch delete mode 100644 utils/nameidtool.go diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index cd05d52..830bf7b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -13,7 +13,7 @@ jobs: fail-fast: false matrix: GO_VERSION: - - 1.22.3 + - 1.22.5 steps: - name: Checkout diff --git a/build/Dockerfile-boulder b/build/Dockerfile-boulder index 2a4caa7..61fbd56 100644 --- a/build/Dockerfile-boulder +++ b/build/Dockerfile-boulder @@ -1,4 +1,4 @@ -FROM letsencrypt/boulder-tools:go1.22.3_2024-05-22 AS boulder-tools +FROM letsencrypt/boulder-tools:go1.22.5_2024-07-03 AS boulder-tools FROM ubuntu:focal diff --git a/build/Dockerfile-control b/build/Dockerfile-control index ce220a0..373254b 100644 --- a/build/Dockerfile-control +++ b/build/Dockerfile-control @@ -50,7 +50,6 @@ COPY tmp/commander /opt/labca/ COPY tmp/control.sh /opt/labca/ COPY tmp/cron_d /opt/labca/ COPY tmp/mailer /opt/labca/ -COPY tmp/nameidtool /opt/labca/ COPY tmp/renew /opt/labca/ COPY tmp/restore /opt/labca/ COPY tmp/utils.sh /opt/labca/ diff --git a/build/Dockerfile-gui b/build/Dockerfile-gui index 7f1a2ee..dc072c3 100644 --- a/build/Dockerfile-gui +++ b/build/Dockerfile-gui @@ -40,7 +40,6 @@ COPY --from=builder /usr/bin/docker /usr/bin/docker COPY --from=builder /usr/libexec/docker/cli-plugins/docker-compose /usr/libexec/docker/cli-plugins/docker-compose COPY tmp/labca-gui /opt/labca/bin/ -COPY tmp/nameidtool /opt/labca/ COPY tmp/admin/setup.sh /opt/labca/ COPY tmp/admin/apply /opt/labca/ COPY tmp/admin/apply-boulder /opt/labca/ diff --git a/build/build.sh b/build/build.sh index ca7635e..23b4842 100755 --- a/build/build.sh +++ b/build/build.sh @@ -8,7 +8,7 @@ TMP_DIR=$(pwd)/tmp rm -rf $TMP_DIR && mkdir -p $TMP_DIR/{admin,bin,logs,src} boulderDir=$TMP_DIR/src -boulderTag="release-2024-07-10" +boulderTag="release-2024-07-29" boulderUrl="https://github.com/letsencrypt/boulder/" cloneDir=$(pwd)/.. @@ -44,7 +44,6 @@ docker run -v $boulderDir:$BASEDIR:cached -v $TMP_DIR/bin:$BASEDIR/bin -w $BASED cp $cloneDir/nginx.conf $TMP_DIR/ cp $cloneDir/proxy.inc $TMP_DIR/ -cp $cloneDir/utils/nameidtool.go $TMP_DIR/ cp -rp $cloneDir/gui/* $TMP_DIR/admin/ head -13 $cloneDir/gui/setup.sh > $TMP_DIR/admin/setup.sh sed -i '/^$/d' $TMP_DIR/admin/setup.sh @@ -52,7 +51,6 @@ sed -i '/^$/d' $TMP_DIR/admin/setup.sh echo BASEDIR=/go/src/labca docker run -v $TMP_DIR/admin:$BASEDIR:cached -v $TMP_DIR:$BASEDIR/bin -w $BASEDIR -e GIT_VERSION=$GIT_VERSION $BUILD_IMAGE ./setup.sh -docker run -v $TMP_DIR:/utils -w /utils $BUILD_IMAGE go build nameidtool.go cp -rp $cloneDir/gui/setup.sh $TMP_DIR/admin/ cp -rp $cloneDir/acme_tiny.py $TMP_DIR/ diff --git a/dev/versions b/dev/versions index 408dad0..3977246 100755 --- a/dev/versions +++ b/dev/versions @@ -65,6 +65,18 @@ colorGoVersion() { echo "$fileName:$res" } +colorGoVersion2() { + local fileName="$1" + local expectVersion="$2" + + if [ ! -z "$(grep GO_VERSION $fileName | sed -e "s/\s*GO_VERSION: //" | grep $expectVersion || echo "")" ]; then + res=$(grep GO_VERSION $fileName | sed -e "s/\s*GO_VERSION: / /" | sed -e "s/$expectVersion/${COL_LIGHT_GREEN}$expectVersion${COL_NC}/") + else + res=$(grep GO_VERSION $fileName | sed -e "s/\s*GO_VERSION: / /" | sed -e "s/\([0-9\.]*\)/${COL_LIGHT_RED}\1${COL_NC}/g") + fi + echo "$fileName:$res" +} + echo cd ../boulder @@ -93,3 +105,9 @@ grep GO_VERSION -A 3 ../boulder/.github/workflows/release.yml | egrep "\- [\"0-9 colorGoVersion .github/workflows/release.yml $goversion echo +goversion=$(grep GO_VERSION ../boulder/docker-compose.yml | sed -e "s/\s*GO_VERSION://") +echo -n "../boulder/docker-compose.yml" +grep GO_VERSION ../boulder/docker-compose.yml | sed -e "s/\s*GO_VERSION:/ /" +colorGoVersion2 build/docker-compose.yml $goversion +echo + diff --git a/gui/apply-boulder b/gui/apply-boulder index dfa9535..958b38d 100755 --- a/gui/apply-boulder +++ b/gui/apply-boulder @@ -18,7 +18,7 @@ PKI_ROOT_CERT_BASE="$dataDir/root-ca" PKI_INT_CERT_BASE="$dataDir/issuer/ca-int" PKI_ISSUER_NAME_ID=$(grep issuer_name_id $dataDir/config.json | sed -e 's/.*:[ ]*//' | sed -e 's/,//g' | sed -e 's/\"//g') if [ -z "$PKI_ISSUER_NAME_ID" ] && [ -e "$PKI_INT_CERT_BASE.pem" ]; then - nmid=$($baseDir/nameidtool $PKI_INT_CERT_BASE.pem) + nmid=$(/opt/boulder/bin/nameid -s $PKI_INT_CERT_BASE.pem) if [ $? == 0 ]; then PKI_ISSUER_NAME_ID=$nmid sed -i -e "s/\(^\s*\)\(\"keys\": {\)/\1\"issuer_name_id\": $PKI_ISSUER_NAME_ID,\n\1\2/g" $dataDir/config.json diff --git a/gui/apply-nginx b/gui/apply-nginx index 35c9489..3bb4305 100755 --- a/gui/apply-nginx +++ b/gui/apply-nginx @@ -13,7 +13,7 @@ PKI_ROOT_CERT_BASE="$dataDir/root-ca" PKI_INT_CERT_BASE="$dataDir/issuer/ca-int" PKI_ISSUER_NAME_ID=$(grep issuer_name_id $dataDir/config.json | sed -e 's/.*:[ ]*//' | sed -e 's/,//g' | sed -e 's/\"//g') if [ -z "$PKI_ISSUER_NAME_ID" ] && [ -e "$PKI_INT_CERT_BASE.pem" ]; then - nmid=$($baseDir/nameidtool $PKI_INT_CERT_BASE.pem) + nmid=$(/opt/boulder/bin/nameid -s $PKI_INT_CERT_BASE.pem) if [ $? == 0 ]; then PKI_ISSUER_NAME_ID=$nmid sed -i -e "s/\(^\s*\)\(\"keys\": {\)/\1\"issuer_name_id\": $PKI_ISSUER_NAME_ID,\n\1\2/g" $dataDir/config.json @@ -93,3 +93,7 @@ sed -i -e "s|<\!-- BEGIN PKI_COMPANY_NAME -->.*<\!-- END PKI_COMPANY_NAME -->|<\ sed -i -e "s|.*|Terms \| $PKI_WEB_TITLE|g" terms/v1.html sed -i -e "s|<\!-- BEGIN WEBTITLE -->.*<\!-- END WEBTITLE -->|<\!-- BEGIN WEBTITLE -->$PKI_WEB_TITLE<\!-- END WEBTITLE -->|g" terms/v1.html +if [ -e /opt/boulder/sfe/templates/layout.html ]; then + # TODO: move the SFE pages to nginx static files ? + sed -i -e "s|<\!-- BEGIN WEBTITLE -->.*<\!-- END WEBTITLE -->|<\!-- BEGIN WEBTITLE -->$PKI_WEB_TITLE<\!-- END WEBTITLE -->|g" /opt/boulder/sfe/templates/layout.html +fi diff --git a/install b/install index a33c253..d9c3f83 100755 --- a/install +++ b/install @@ -30,7 +30,7 @@ dockerComposeVersion="v2.5.0" labcaUrl="https://github.com/hakwerk/labca/" boulderUrl="https://github.com/letsencrypt/boulder/" -boulderTag="release-2024-07-10" +boulderTag="release-2024-07-29" # Feature flags flag_skip_redis=true diff --git a/nginx.conf b/nginx.conf index 015f037..73528c1 100644 --- a/nginx.conf +++ b/nginx.conf @@ -34,6 +34,10 @@ server { proxy_pass http://boulder:4002/; } + location /sfe { + return 301 https://$host$request_uri; + } + location /rate-limits { try_files $uri $uri.html $uri/ =404; } @@ -106,6 +110,11 @@ server { proxy_pass http://boulder:4002/; } + location /sfe { + include conf.d/proxy.inc; + proxy_pass http://boulder:4003/; + } + location /rate-limits { try_files $uri $uri.html $uri/ =404; } diff --git a/patch-cfg.sh b/patch-cfg.sh index 04a2fb1..a271cb9 100755 --- a/patch-cfg.sh +++ b/patch-cfg.sh @@ -83,6 +83,8 @@ sed -i -e "s/\"stdoutlevel\": 4,/\"stdoutlevel\": 6,/" config/remoteva-a.json sed -i -e "s/\"stdoutlevel\": 4,/\"stdoutlevel\": 6,/" config/remoteva-b.json sed -i -e "s/\"stdoutlevel\": 4,/\"stdoutlevel\": 6,/" config/va-remote-a.json sed -i -e "s/\"stdoutlevel\": 4,/\"stdoutlevel\": 6,/" config/va-remote-b.json +sed -i -e "s/\"endpoint\": \".*\"/\"endpoint\": \"\"/" config/sfe.json +sed -i -e "s/sleep 1/sleep 5/g" wait-for-it.sh sed -i -e "s|test/certs|/opt/boulder/labca/certs|" consul/config.hcl diff --git a/patch.sh b/patch.sh index b28624d..af6de84 100755 --- a/patch.sh +++ b/patch.sh @@ -51,6 +51,7 @@ if [ "$SUDO" == "" ]; then # TODO: should include this into startservers.patch $SUDO patch -p1 < $cloneDir/build/tmp2.patch fi +$SUDO patch -p1 < $cloneDir/patches/sfe_templates_layout.patch $SUDO patch -p1 < $cloneDir/patches/storer_storer.patch $SUDO patch -p1 < $cloneDir/patches/test_health-checker_main.patch $SUDO patch -p1 < $cloneDir/patches/updater_updater.patch @@ -69,3 +70,8 @@ sed -i -e "s/proxysql:6033/mysql:3306/" sa/db/dbconfig.yml mkdir -p "cmd/mail-tester" cp $cloneDir/mail-tester.go cmd/mail-tester/main.go perl -i -p0e "s/(\n\t\"github.com\/letsencrypt\/boulder\/cmd\")/\t_ \"github.com\/letsencrypt\/boulder\/cmd\/mail-tester\"\n\1/igs" cmd/boulder/main.go + +perl -i -p0e "s/If you continue to encounter.*for troubleshooting and advice.//igs" sfe/pages/index.html +perl -i -p0e "s/Note:<\/b> If you encounter.*troubleshooting and advice.//igs" sfe/pages/unpause-form.html +perl -i -p0e "s/If you continue to encounter.*for troubleshooting and advice.//igs" sfe/pages/unpause-invalid-request.html +perl -i -p0e "s/ If you face continued.*for troubleshooting and advice.//igs" sfe/pages/unpause-status.html diff --git a/patches/ca_ca.patch b/patches/ca_ca.patch index afedb48..1c0823f 100644 --- a/patches/ca_ca.patch +++ b/patches/ca_ca.patch @@ -1,8 +1,8 @@ diff --git a/ca/ca.go b/ca/ca.go -index d38f7e2e5..f8364d1d6 100644 +index b99fe702f..ddd5ebfe3 100644 --- a/ca/ca.go +++ b/ca/ca.go -@@ -156,10 +156,10 @@ func makeIssuerMaps(issuers []*issuance.Issuer) (issuerMaps, error) { +@@ -154,10 +154,10 @@ func makeIssuerMaps(issuers []*issuance.Issuer) (issuerMaps, error) { } } if i, ok := issuersByAlg[x509.ECDSA]; !ok || len(i) == 0 { diff --git a/patches/docker-compose.patch b/patches/docker-compose.patch index 3643209..6b064bf 100644 --- a/patches/docker-compose.patch +++ b/patches/docker-compose.patch @@ -1,5 +1,5 @@ diff --git a/docker-compose.yml b/docker-compose.yml -index 79ed8c4e4..3562b8fb8 100644 +index e931382ed..18ca6c9e7 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -1,3 +1,4 @@ @@ -27,7 +27,7 @@ index 79ed8c4e4..3562b8fb8 100644 bouldernet: ipv4_address: 10.77.77.77 @@ -48,20 +51,25 @@ services: - - 4003:4003 # OCSP + - 4003:4003 # SFE depends_on: - bmysql - - bproxysql diff --git a/patches/mail_mailer.patch b/patches/mail_mailer.patch index 72c875d..d14c4c2 100644 --- a/patches/mail_mailer.patch +++ b/patches/mail_mailer.patch @@ -1,12 +1,16 @@ diff --git a/mail/mailer.go b/mail/mailer.go -index 4249108e..ee8b6fb4 100644 +index 31ebd40b1..d8ab68969 100644 --- a/mail/mailer.go +++ b/mail/mailer.go -@@ -21,10 +21,14 @@ import ( - "time" +@@ -2,6 +2,7 @@ package mail - "github.com/jmhodges/clock" -+ "golang.org/x/net/context" + import ( + "bytes" ++ "context" + "crypto/rand" + "crypto/tls" + "crypto/x509" +@@ -24,7 +25,10 @@ import ( "github.com/prometheus/client_golang/prometheus" "github.com/letsencrypt/boulder/core" diff --git a/patches/ra_ra.patch b/patches/ra_ra.patch index a2d9304..8758ace 100644 --- a/patches/ra_ra.patch +++ b/patches/ra_ra.patch @@ -1,8 +1,8 @@ diff --git a/ra/ra.go b/ra/ra.go -index a873276f5..b984a9731 100644 +index bfd2386ef..40c49834f 100644 --- a/ra/ra.go +++ b/ra/ra.go -@@ -46,7 +46,6 @@ import ( +@@ -44,7 +44,6 @@ import ( "github.com/letsencrypt/boulder/issuance" blog "github.com/letsencrypt/boulder/log" "github.com/letsencrypt/boulder/metrics" @@ -10,7 +10,7 @@ index a873276f5..b984a9731 100644 "github.com/letsencrypt/boulder/probs" pubpb "github.com/letsencrypt/boulder/publisher/proto" rapb "github.com/letsencrypt/boulder/ra/proto" -@@ -581,7 +580,7 @@ func (ra *RegistrationAuthorityImpl) validateContacts(contacts []string) error { +@@ -571,7 +570,7 @@ func (ra *RegistrationAuthorityImpl) validateContacts(contacts []string) error { contact, ) } diff --git a/patches/sfe_templates_layout.patch b/patches/sfe_templates_layout.patch new file mode 100644 index 0000000..d280628 --- /dev/null +++ b/patches/sfe_templates_layout.patch @@ -0,0 +1,24 @@ +diff --git a/sfe/templates/layout.html b/sfe/templates/layout.html +index 30f947aac..2511e9e13 100644 +--- a/sfe/templates/layout.html ++++ b/sfe/templates/layout.html +@@ -4,8 +4,8 @@ + + + +- Let's Encrypt - Self-Service Portal +- ++ Self-Service Portal | LabCA ++ +