Repository navigation
Reject bootstrap CA files without certificates - #6160
Open
sarankumar1325 wants to merge 1 commit into
Open
sarankumar1325 wants to merge 1 commit into
sarankumar1325 wants to merge 1 commit into
Conversation
flux bootstrap read --ca-file without checking its contents. A file with no PEM certificates was silently ignored by the provider client, which then failed later with an unknown authority error, and the file was still written to the cluster as the Git source CA. Check that the file contains at least one PEM certificate and fail early with a clear error. Signed-off-by: Saran Kumar <120080287+sarankumar1325@users.noreply.github.com> Assisted-by: Grok Bot/grok
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
flux bootstrapread--ca-filewithout checking what was in it. If the file had no PEM certificates (wrong path to a key or DER file, empty file, bad copy),AppendCertsFromPEMin the provider transport returned false and the result was ignored. The command then failed later with a genericx509: certificate signed by unknown authorityerror, which doesn't point at the CA file. The same bytes were also used asca.crtfor the Git source secret.This adds a
readCAFilehelper incmd/flux/bootstrap.go. It reads the file and checks that it has at least one PEM certificate. The five bootstrap commands (git, github, gitlab, gitea, bitbucket-server) now use it instead of their copies ofos.ReadFile. The error for a file that can't be read stays the same.Tests:
TestReadCAFilecovers a valid CA file, a missing file, an empty file and non-PEM content. I rango test ./cmd/flux/ -run 'TestReadCAFile|TestBootstrapValidate',go vet(no tags,unitande2e) andgofmt.AI disclosure: prepared with an AI assistant (Grok Bot), following AGENTS.md. I reviewed the change.