[BUG] x509_v2 certificate_managed is passing newline stripped data to append_certs
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 15.7k
- Forks
- 5.6k
- Avg merge
- 2d 44m
- Merged PRs (30d)
- 80
Description
Description
x509_v2 certificate_managed append_certs parameter is stripping newlines from PEM certificates.
When using the below state the minion will throw a invalid index error in salt/utils/x509.py:814 because the pems = split_pems(cert) is receiving PEM pillar data with its newlines replaced with spaces. On the master split_pems receives proper pillar data with the newlines included. But the minion seems to have newlines replaced with spaces.
For now as a workaround I've just changed the append_certs to run the pillar data into base64_encode which works.
Setup
x509.certificate_managed:
- name: /etc/pki/fqdn/public.crt.pem
- ca_server: master.local
- signing_policy: encipher
- private_key: /etc/pki/fqdn/private.key.pem
- CN: fqdn
- days_valid: 90
- days_remaining: 60
- makedirs: True
- dir_mode: 0700
- mode: 0600
- subjectAltName: 'DNS: fqdn'
- encoding: pem
- append_certs:
- {{pillar['cacerts']['int_ca']}}
- {{pillar['cacerts']['root_ca']}}
Versions Report
Salt Version:
Salt: 3007.0
Python Version:
Python: 3.12.3 (main, Apr 23 2024, 09:16:07) [GCC 13.2.1 20240417]
Dependency Versions:
cffi: 1.16.0
cherrypy: Not Installed
dateutil: Not Installed
docker-py: Not Installed
gitdb: Not Installed
gitpython: Not Installed
Jinja2: 3.1.3
libgit2: Not Installed
looseversion: 1.3.0
M2Crypto: 0.40.1
Mako: Not Installed
msgpack: 1.0.5
msgpack-pure: Not Installed
mysql-python: Not Installed
packaging: 23.2
pycparser: 2.22
pycrypto: Not Installed
pycryptodome: 3.12.0
pygit2: Not Installed
python-gnupg: Not Installed
PyYAML: 6.0.1
PyZMQ: 25.1.2
relenv: Not Installed
smmap: Not Installed
timelib: Not Installed
Tornado: 6.4
ZMQ: 4.3.5
Salt Package Information:
Package Type: Not Installed
System Versions:
dist: arch
locale: utf-8
machine: x86_64
release: 6.5.11-8-pve
system: Linux
version: Arch Linux
Both master and minion are Arch Linux on 3007.0
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in salt/utils/x509.py around line 814 and trace x509.certificate_managed handling of append_certs and split_pems. Reproduce the provided state on the reported Salt 3007.0 setup, comparing the pillar data received by the master and minion. Done means PEM newlines remain intact on the minion and the invalid index error no longer occurs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- devops, infrastructure, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100