File: CHANGES

package info (click to toggle)
fetch-crl 2.8.5-2
  • links: PTS, VCS
  • area: main
  • in suites: squeeze
  • size: 160 kB
  • ctags: 15
  • sloc: sh: 914; makefile: 104
file content (226 lines) | stat: -rw-r--r-- 9,116 bytes parent folder | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
Changes in version EGP 2.8.5
----------------------------
(2010.06.03)

* fetch-crl was occasionally leaving behind {hash}.r0.XXXXXX.r0 files
  This has been fixed in this release (patch thanks to Jason Smith, BNL)
* man page was not compliant to Debian guidelines, this has been fixed
  (patch thanks to Mattias Ellert, Uppsala University)

Changes in version EGP 2.8.4
----------------------------
(2010.04.04)

* Fixes error when randomWait is not set [RH Bug 579488]

Changes in version EGP 2.8.3
----------------------------
(2010.03.28)

* Preserve SELinux context for CRL files if SElinux status program exists
  and selinux is enabled (RH bug 577403)
* Fix argument parsing on syslog facility specification (RH bug 577387)
* Increase granularity of the RandomWait and allow for 0 in -r option

Changes in version EGP 2.8.2
----------------------------
(2010.03.03)

* Improved support for multiple CRL URLs by downloading until a success
  is achieved, instead of downloading all of them
* Imported randomwait patch from Steve Traylen

Changes in version EGP 2.8.1
----------------------------
(2010.01.26)

* The installed CRL file is re-checked for validity to catch file system
  errors and local disk corruption. When possible, it will try to restore
  a backup copy. Failures are not subject to aging tolerance.

Changes in version EGP 2.8.0
----------------------------
(2009.09.22)

* The RPM packaging has been overhauled and is now sufficiently conformant
  to EPEL and FedoraProject guidelines. 
* Configuration file has moved from /etc/sysconfig to /etc/fetch-crl.conf
* New init scripts and a cron job entry have been added to allow management 
  of fetch-crl via the chkconfig mechanism. 
  Please REMOVE any manually installed cron jobs to prevent duplicate download

These changes were contributed by Steve Traylen (CERN, Geneva, CH).

Changes in version EGP 2.7.0
----------------------------
(2009.01.25)

* Warnings and errors are now counted. If there are errors in the download
  or verification process for one or more CRLs, the exit status will be 1; 
  if there are errors in the local setup or in the script invocation, the
  exit status will be 2.
* The installed CRLs no longer have the textual representation of the CRL,
  but only the PEM data blob, thus reducing IO and memory requirements.
* the CRL aging threshold is now set by default to 24 hours. The previous
  default was 0. The CRL aging threshold is set in the config file using
  CRL_AGING_THRESHOLD=<xx>, or with the "-a" command-line argument.
* Default network timeouts reduced to 10 seconds (was 30) and retries to 2
* Added caching and conditional downloading. When CACHEDIR is set, the
  original downloads are preserved and wget timestamping mode enabled.
  When the content did not change, only the timestamp on the installed
  CRL is updated. If SLOPPYCRLHASHES is set, the has is calculated based 
  on the name of the crl_url file, otherwise it is taken from the CRL itself.
  - The CACHEDIR must be exclusively writable by the user running fetch-crl
  - Setting CACHEDIR significantly reduced the bandwidth used by fetch-crl
* Added RESETPATHMODE setting in sysconfig. It defines whether or not to
  set re-set $PATH to "/bin:/usr/bin" before start. The search for OpenSSL
  may be done based on the old path.
  yes=always replace; searchopenssl=search for openssl first and then reset; 
  no=keep original path, whatever that me be (may be empty if called from cron)
  Default="yes". This replaces the hard-coded path in the tool!
* Hidden "FORCE_OVERWRITE" option now has a regular name. This is backwards-
  compatible. Set FORCE_OVERWRITE=yes if you want files overwritten that
  have a CRL-like name and ought to have CRL content, but currently do not.
* Addresses gLite Savannah bugs 28418 and 29559. Bug 27023 is partially
  addressed. Bug 20062 can be remedied with WGET_OPTS arguments. 
  Addresses OSG ticket 4673.

Changes in version EGP 2.6.6
----------------------------
(2007.09.16)
(version 2.5.5 is invalid and was not publicly released)

* Added obscure configuration parameter to allow overwriting of
  arbitrary data files with a downloaded CRL (on request of
  CERN, see https://savannah.cern.ch/bugs/index.php?29559)

Changes in version EGP 2.6.4
----------------------------
(2007.08.15)

* Expired CA issuer certificate now gives a warning instead of an error
  with the full verification result message
* additional logfile output target can be selected via the configuration file
* CRL aging threshold documented in manual page. Errors will now also be 
  generated in the CRL download failed consistently and the current CRL
  has already expired

Changes in version EGP 2.6.3
----------------------------
(2006.11.13)

* cron job example: fetch-crl invocation syntax error corrected

Changes in version EGP 2.6.2
----------------------------
(2006.10.27)

* fixed bug: older wget versions do not recognise --no-check-certificate

Changes in version EGP 2.6.1
----------------------------
(2006.10.25)

* fixed local timezone vs UTC error in LastUpdate CRL validation comparison
* fixed time comparison is the one-hour LastUpdate/download tolerance 
  (both fixes thanks to Alain Roy)
* added support for directory names containing whitespace
* added support for syslog reporting (via -f option or SYSLOGFACILITY directive)
* SERVERCERTCHECK=no is now the default. It can be reset via the configuration
  file, or using the "--check-server-certificate" commandline option
* the main configuration file location (formerly fixed to be
  /etc/sysconfig/fetch-crl) can now be set via the variable $FETCH_CRL_SYSCONFIG
* logfile format timestamp and tag have been normalised

Changes in version EGP 2.6
--------------------------
(2006.05.20)

* if the current local CRL has a lastUpdate time in the future, and the
  newly downloaded CRL is older that the current one, allow the installation
  of the newly downloaded CRL and issue a warning. 
* added non-suppressable warning in case the newly downloaded CRL has a 
  lastUpdate time in the future, but install that CRL anyway (as the local
  clock might have been wrong).

Changes in version EGP 2.5
--------------------------
(2006.01.16)

* added additional configuration arguments and configuration variables
  to skip the server certificate check in wget
  (to support https:// URLs where the server is authenticated with
  a certificate that is not part of it's own trusted domain, such as
  the KISTI URL)

Changes in version EGP 2.4
--------------------------
(2005.11.15)

* for those platforms that support the stat(1) command, and in case the
  .crl_url file is named after the hash of the crl subject name to download,
  error eporting for individual download errors can be suppressed for 
  a configurable amount of time as set via the "-a" option (unit: hours).

Changes in version EGP 2.3
--------------------------
(2005.11.05)

* do not replace recent CRLs with ones that have an older lastUpdate
  timestamp (prevents ARP/DNS DoS attacks)

Changes in version EGP 2.2
--------------------------
(2005.10.27)

* secure http download by wget recognise the CAs in the trusted directory.
  solves the issue described in the LCG bug tracking system
  https://savannah.cern.ch/bugs/index.php?func=detailitem&item_id=12182

Changes in version EGP 2.1
--------------------------
(2005.08.12)
* specifically look for the most recent version of OpenSSL. The
  one in GLOBUS_LOCATION (which used to take precedence in the
  previous releases) is outdated in many cases and caused
  troubles on the LCG  production systems in validating v2 CRLs
* added manual page fetch-crl(8)

Changes in version EGP 2.0
--------------------------
(2005.02.28)
* name of the installed script changed to "fetch-crl"
* the cronjob script is no longer installed by default, but supplied
  as an example in the %doc directory
* RPM is now relocatable (default install in /usr)
* READMA and CHANGES file now inclued in %doc tree
* make install now installs
* version increased to 2.0

Changes in version EGP 1.9
--------------------------
(2005.02.24)
* the content of the final target CRL file is now checked for
  containing a valid CRL if it already exists. If it does not
  contain a CRL, an error is displayed and the file left untouched
  So making the final ".r0" file in ${outdir} a link to something else
  will not work, preventing an escalation in the final stage.

Changes in version EGP 1.8
--------------------------
(changes from Fabio's version 1.7, 2005.02.24)

* All temporary files (the initial CRL download using wget
  and the PEM-converted version of that file) are now created using
  mktemp
* the RetrieveFileByURL function will not overwrite files that
  have any data in them
* Note that the script can be run by a non-priviledged user, but 
  that the output directory must be made writable by that user 
  in an out-of-band way.

EDG version 1.7
---------------
Imported with consent of Fabio Hernandez and Steve Traylen from
the original EDG repository. 
The EU DataGrid License applies, see http://www.eu-datagrid.org/