Merge 4.2.0 to main - #111
Merged
Merged
Conversation
* ab90509 * docs: auto-generate README and documentation [skip ci] * ab90509 * docs: auto-generate README and documentation [skip ci] * ab90509 * docs: auto-generate README and documentation [skip ci] * ab90509 * docs: auto-generate README and documentation [skip ci] * ab90509 * docs: auto-generate README and documentation [skip ci] * ab90509 * ab90509 * ab90509 * ab90509 * ab90509 * ab90509 --------- Co-authored-by: leefine02 <kfadmin@LFINE-KF10-ORCH> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Automated merge of release-4.2.0 into main, updating the Remote File orchestrator to deprecate the legacy PKCS#12 encryption path, extend SSH authentication support, and align scripts/manifests/docs with the updated configuration surface.
Changes:
- Removed the
RequiresLegacyEncryptioncustom field and its code paths; PKCS#12 serialization now standardizes on modern algorithms. - Extended SSH handling to support SSH certificate authentication by parsing a
privateKey|||ssh-certificatesecret. - Enhanced RFKDB store creation to generate the full IBM key database file set and introduced a serializer hook (
ICustomFileCreator) for custom store-file creation.
Reviewed changes
Copilot reviewed 15 out of 21 changed files in this pull request and generated 11 comments.
Show a summary per file
| File | Description |
|---|---|
| scripts/store_types/powershell/restmethod_create_store_types.ps1 | Removes RequiresLegacyEncryption from store type definitions. |
| scripts/store_types/bash/curl_create_store_types.sh | Removes RequiresLegacyEncryption from store type definitions. |
| RemoteFile/RemoteHandlers/SSHHandler.cs | Adds SSH certificate auth parsing for private-key authentication flows. |
| RemoteFile/RemoteFileJobTypeBase.cs | Removes RequiresLegacyEncryption job property wiring. |
| RemoteFile/RemoteFile.csproj | Updates SSH.NET package version. |
| RemoteFile/RemoteCertificateStore.cs | Adds serializer-specific store-file creation via ICustomFileCreator. |
| RemoteFile/ReenrollmentBase.cs | Updates call site for legacy-encryption removal (GetCertificateStore() signature change). |
| RemoteFile/ManagementBase.cs | Updates call sites for legacy-encryption removal (GetCertificateStore() signature change). |
| RemoteFile/ImplementedStoreTypes/PKCS12/PKCS12CertificateStoreSerializer.cs | Stops explicitly setting legacy cert algorithm (now commented out). |
| RemoteFile/ImplementedStoreTypes/KDB/KDBCertificateStoreSerializer.cs | Implements custom store creation and updates gskcapicmd conversion behavior. |
| RemoteFile/ICustomFileCreator.cs | Introduces interface for serializer-specific store-file creation. |
| README.md | Updates docs for SSH auth options and removes legacy encryption field references. |
| integration-manifest.json | Removes RequiresLegacyEncryption field from manifest definitions. |
| docsource/images/RFPkcs12-custom-fields-store-type-dialog.svg | Updates documentation image to remove legacy encryption field. |
| docsource/images/RFPEM-custom-fields-store-type-dialog.svg | Updates documentation image to remove legacy encryption field. |
| docsource/images/RFORA-custom-fields-store-type-dialog.svg | Updates documentation image to remove legacy encryption field. |
| docsource/images/RFKDB-custom-fields-store-type-dialog.svg | Updates documentation image to remove legacy encryption field. |
| docsource/images/RFJKS-custom-fields-store-type-dialog.svg | Updates documentation image to remove legacy encryption field. |
| docsource/images/RFDER-custom-fields-store-type-dialog.svg | Updates documentation image to remove legacy encryption field. |
| docsource/content.md | Mirrors README SSH auth documentation updates. |
| CHANGELOG.md | Adds v4.2.0 release notes. |
Comments suppressed due to low confidence (1)
RemoteFile/ImplementedStoreTypes/PKCS12/PKCS12CertificateStoreSerializer.cs:99
- Leaving commented-out code for the legacy cert algorithm makes it unclear whether this line is meant to be removed permanently or temporarily. Prefer an explanatory comment describing why the algorithm is no longer set.
//storeBuilder.SetCertAlgorithm(PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc);
storeBuilder.SetKeyAlgorithm(NistObjectIdentifiers.IdAes256Cbc, PkcsObjectIdentifiers.IdHmacWithSha256);
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+57
to
63
| string privateKey = string.Empty; | ||
|
|
||
| string[] sshSecret = serverPassword.Split(new[] { "|||" }, 2, StringSplitOptions.TrimEntries | StringSplitOptions.RemoveEmptyEntries); | ||
| try | ||
| { | ||
| using (MemoryStream ms = new MemoryStream(Encoding.ASCII.GetBytes(FormatPrivateKey(serverPassword)))) | ||
| { | ||
| privateKeyFile = new PrivateKeyFile(ms); | ||
| } | ||
| privateKey = FormatPrivateKey(sshSecret[0]); | ||
| } |
| remoteHandler.UploadCertificateFile(storePath, tempStoreFile, storeContentBytes); | ||
|
|
||
| string command = $"{bashCommand}gskcapicmd -keydb -convert -db \"{storePath}{tempStoreFile}\" -pw \"{storePassword}\" -type kdb -new_db \"{storePath}{tempCertFile}\" -new_pw \"{storePassword}\" -new_format p12"; | ||
| string command = $"{bashCommand}gskcapicmd -keydb -convert -db \"{storePath}{tempStoreFile}\" -pw \"{storePassword}\" -new_db \"{storePath}{tempCertFile}\" -new_pw \"{storePassword}\" -new_format p12"; |
Comment on lines
+134
to
+145
| string pathDelim = storePath.Substring(0, 1) == "/" ? "/" : "\\"; | ||
| int fileNameIdx = storePath.LastIndexOf(pathDelim) + 1; | ||
| if (fileNameIdx == -1) | ||
| throw new Exception("Invalid format for store path."); | ||
|
|
||
| string bashCommand = storePath.Substring(0, 1) == "/" ? "bash " : string.Empty; | ||
| if (storePath.Substring(0, 1) == "|") | ||
| storePath = "/" + storePath.Substring(1); | ||
|
|
||
| string path = storePath.Substring(0, fileNameIdx); | ||
| string fileName = storePath.Substring(fileNameIdx, extIdx - fileNameIdx); | ||
|
|
Comment on lines
+159
to
+162
| remoteHandler.RunCommand($"cp {path}{tempStoreFile}.kdb {path}{fileName}.kdb", null, ApplicationSettings.UseSudo, null); | ||
| remoteHandler.RunCommand($"cp {path}{tempStoreFile}.rdb {path}{fileName}.rdb", null, ApplicationSettings.UseSudo, null); | ||
| remoteHandler.RunCommand($"cp {path}{tempStoreFile}.crl {path}{fileName}.crl", null, ApplicationSettings.UseSudo, null); | ||
| remoteHandler.RunCommand($"cp {path}{tempStoreFile}.sth {path}{fileName}.sth", null, ApplicationSettings.UseSudo, null); |
Comment on lines
+8
to
+12
| using Org.BouncyCastle.Pkcs; | ||
| using Keyfactor.Extensions.Orchestrator.RemoteFile.RemoteHandlers; | ||
| using Keyfactor.Extensions.Orchestrator.RemoteFile.Models; | ||
| using System.Collections.Generic; | ||
|
|
Comment on lines
+3
to
+5
| - Modification to suppor SSH certificate authentication for Linux managed servers. If a certificate is used, the private key must be in OpenSSH format and the public key must be in OpenSSH format or PEM format. | ||
| - Modify Management-Create job for RFKDB to create all 4 IBM key dabase files - kdb, rdb, sth, and crl. Actual certificate management, however, remains centered on the kdb file. The other 3 files are | ||
| created to ensure that the kdb file can be used by IBM applications that require all 4 files to be present, such as IBM MQ. |
| This method is similar to SSH Private Key Authentication, but requires you to enter a valid Linux user id and the full SSH private key | ||
| concatenated with the accompanying SSH certificate into the server username and server password fields respectively when creating | ||
| the Keyfactor Command certificate store or discovery job. The private key and certificate must be delimited using 3 pipe characters | ||
| ("|||") as the delimiter (i.e. "...-----END OPENSSH PRIVATE KEY-----|||ssh-ed25519-cert-v01`@`openssh.com AAAAIHNzaC1lZDI1NTE5L...". |
|
|
||
| If using this method, make sure that: | ||
|
|
||
| - The SSH certificate is trusted on the destination Linux server. Set the TrustedUserCAKeys option in the `/etc/ssh/sshd_config` file to points |
| This method is similar to SSH Private Key Authentication, but requires you to enter a valid Linux user id and the full SSH private key | ||
| concatenated with the accompanying SSH certificate into the server username and server password fields respectively when creating | ||
| the Keyfactor Command certificate store or discovery job. The private key and certificate must be delimited using 3 pipe characters | ||
| ("|||") as the delimiter (i.e. "...-----END OPENSSH PRIVATE KEY-----|||ssh-ed25519-cert-v01`@`openssh.com AAAAIHNzaC1lZDI1NTE5L...". |
|
|
||
| If using this method, make sure that: | ||
|
|
||
| - The SSH certificate is trusted on the destination Linux server. Set the TrustedUserCAKeys option in the `/etc/ssh/sshd_config` file to points |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merge release-4.2 to main - Automated PR