[Bug]: `x509_v2.certificate_managed` can be non-idempotent with PKCS#7
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 15.7k
- Forks
- 5.6k
- Avg merge
- 2d 44m
- Merged PRs (30d)
- 80
Description
What happened?
PKCS#7 stores certificates in a SET, not a SEQUENCE. The current certificate loading logic in salt.utils.x509.load_cert assumes that the format is ordered though, which means it can return a chain certificate as the leaf. This can result in unnecessary changes when the encoded order does not match the expected one by chance. The test suite does not catch it because of this chance.
Reproduction in PR.
Type of salt install
Official deb
Major version
3006.x
What supported OS are you seeing the problem on? Can select multiple. (If bug appears on an unsupported OS, please open a GitHub Discussion instead)
ubuntu-24.04
salt --versions-report output
Current HEAD of `3006.x` branch
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in salt/utils/x509.py at load_cert and inspect the existing certificate-management tests. Reproduce the PKCS#7 case described in the issue, then add coverage for unordered certificate storage and verify that repeated certificate management is idempotent without unnecessary changes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100