Skip to content

Commit b3f7188

Browse files
phbnfphbnf
committed
address comments
1 parent 92de712 commit b3f7188

File tree

3 files changed

+33
-30
lines changed

3 files changed

+33
-30
lines changed

‎cmd/gcp/main.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ func main() {
8383
}
8484

8585
chainValidationConfig := sctfe.ChainValidationConfig{
86-
RootsPemFile: *rootsPemFile,
86+
RootsPEMFile: *rootsPemFile,
8787
RejectExpired: *rejectExpired,
8888
RejectUnexpired: *rejectUnexpired,
8989
ExtKeyUsages: *extKeyUsages,
@@ -94,7 +94,7 @@ func main() {
9494

9595
vCfg, err := sctfe.ValidateLogConfig(chainValidationConfig, *origin, signer)
9696
if err != nil {
97-
klog.Exitf("Failed to initialize log config: %v", err)
97+
klog.Exitf("Invalid log config: %v", err)
9898
}
9999

100100
cpSigner, err := sctfe.NewCpSigner(signer, vCfg.Origin, timeSource)
@@ -104,7 +104,7 @@ func main() {
104104

105105
storage, err := newGCPStorage(ctx, cpSigner)
106106
if err != nil {
107-
klog.Exitf("Failed to initiate storage backend: %v", err)
107+
klog.Exitf("Failed to initialize storage backend: %v", err)
108108
}
109109

110110
opts := sctfe.HandlerOptions{

‎config.go

Lines changed: 17 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -29,24 +29,27 @@ import (
2929
"k8s.io/klog/v2"
3030
)
3131

32+
// ChainValidationConfig contains all the parameters chains will be filtered on.
3233
type ChainValidationConfig struct {
33-
// Path to the file containing root certificates that are acceptable to the
34-
// log. The certs are served through get-roots endpoint.
35-
RootsPemFile string
36-
// If RejectExpired is true then the certificate validity period will be
34+
// RootsPEMFile is the path to the file containing root certificates that
35+
// are acceptable to the log. The certs are served through get-roots
36+
// endpoint.
37+
RootsPEMFile string
38+
// RejectExpired controls if true then the certificate validity period will be
3739
// checked against the current time during the validation of submissions.
3840
// This will cause expired certificates to be rejected.
3941
RejectExpired bool
40-
// If RejectUnexpired is true then CTFE rejects certificates that are either
41-
// currently valid or not yet valid.
42+
// RejectUnexpired controls if the SCTFE rejects certificates that are
43+
// either currently valid or not yet valid.
44+
// TODO(phboneff): evaluate whether we need to keep this one.
4245
RejectUnexpired bool
43-
// If set, ExtKeyUsages will restrict the set of such usages that the
44-
// server will accept. By default all are accepted. The values specified
45-
// must be ones known to the x509 package, comma separated.
46+
// ExtKeyUsages lists Extended Key Usage values that newly submitted
47+
// certificates MUST contain. By default all are accepted. The
48+
// values specified must be ones known to the x509 package, comma separated.
4649
ExtKeyUsages string
47-
// A comma separated list of X.509 extension OIDs, in dotted string form
48-
// (e.g. "2.3.4.5") which, if present, should cause submissions to be
49-
// rejected.
50+
// RejectExtensions lists X.509 extension OIDs that newly submitted
51+
// certificates MUST NOT contain. Empty by default. Values must be
52+
// specificed in dotted string form (e.g. "2.3.4.5").
5053
RejectExtensions string
5154
// NotAfterStart defines the start of the range of acceptable NotAfter
5255
// values, inclusive.
@@ -85,11 +88,11 @@ func ValidateLogConfig(cfg ChainValidationConfig, origin string, signer crypto.S
8588
}
8689

8790
// Load the trusted roots.
88-
if cfg.RootsPemFile == "" {
91+
if cfg.RootsPEMFile == "" {
8992
return nil, errors.New("empty rootsPemFile")
9093
}
9194
roots := x509util.NewPEMCertPool()
92-
if err := roots.AppendCertsFromPEMFile(cfg.RootsPemFile); err != nil {
95+
if err := roots.AppendCertsFromPEMFile(cfg.RootsPEMFile); err != nil {
9396
return nil, fmt.Errorf("failed to read trusted roots: %v", err)
9497
}
9598

‎config_test.go

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ func TestValidateLogConfig(t *testing.T) {
6666
bucket: "bucket",
6767
spannerDB: "spanner",
6868
cvcfg: ChainValidationConfig{
69-
RootsPemFile: "./testdata/bogus.cert",
69+
RootsPEMFile: "./testdata/bogus.cert",
7070
},
7171
signer: signer,
7272
},
@@ -78,7 +78,7 @@ func TestValidateLogConfig(t *testing.T) {
7878
bucket: "bucket",
7979
spannerDB: "spanner",
8080
cvcfg: ChainValidationConfig{
81-
RootsPemFile: "./testdata/fake-ca.cert",
81+
RootsPEMFile: "./testdata/fake-ca.cert",
8282
RejectExpired: true,
8383
RejectUnexpired: true},
8484
signer: signer,
@@ -91,7 +91,7 @@ func TestValidateLogConfig(t *testing.T) {
9191
bucket: "bucket",
9292
spannerDB: "spanner",
9393
cvcfg: ChainValidationConfig{
94-
RootsPemFile: "./testdata/fake-ca.cert",
94+
RootsPEMFile: "./testdata/fake-ca.cert",
9595
ExtKeyUsages: "wrong_usage"},
9696
signer: signer,
9797
},
@@ -103,7 +103,7 @@ func TestValidateLogConfig(t *testing.T) {
103103
bucket: "bucket",
104104
spannerDB: "spanner",
105105
cvcfg: ChainValidationConfig{
106-
RootsPemFile: "./testdata/fake-ca.cert",
106+
RootsPEMFile: "./testdata/fake-ca.cert",
107107
ExtKeyUsages: "ClientAuth,ServerAuth,TimeStomping",
108108
},
109109
signer: signer,
@@ -116,7 +116,7 @@ func TestValidateLogConfig(t *testing.T) {
116116
bucket: "bucket",
117117
spannerDB: "spanner",
118118
cvcfg: ChainValidationConfig{
119-
RootsPemFile: "./testdata/fake-ca.cert",
119+
RootsPEMFile: "./testdata/fake-ca.cert",
120120
ExtKeyUsages: "Any ",
121121
},
122122
signer: signer,
@@ -129,7 +129,7 @@ func TestValidateLogConfig(t *testing.T) {
129129
bucket: "bucket",
130130
spannerDB: "spanner",
131131
cvcfg: ChainValidationConfig{
132-
RootsPemFile: "./testdata/fake-ca.cert",
132+
RootsPEMFile: "./testdata/fake-ca.cert",
133133
RejectExtensions: "1.2.3.4,one.banana.two.bananas",
134134
},
135135
signer: signer,
@@ -141,7 +141,7 @@ func TestValidateLogConfig(t *testing.T) {
141141
bucket: "bucket",
142142
spannerDB: "spanner",
143143
cvcfg: ChainValidationConfig{
144-
RootsPemFile: "./testdata/fake-ca.cert",
144+
RootsPEMFile: "./testdata/fake-ca.cert",
145145
NotAfterStart: &t200,
146146
NotAfterLimit: &t100,
147147
},
@@ -154,7 +154,7 @@ func TestValidateLogConfig(t *testing.T) {
154154
bucket: "bucket",
155155
spannerDB: "spanner",
156156
cvcfg: ChainValidationConfig{
157-
RootsPemFile: "./testdata/fake-ca.cert",
157+
RootsPEMFile: "./testdata/fake-ca.cert",
158158
},
159159
signer: signer,
160160
},
@@ -165,7 +165,7 @@ func TestValidateLogConfig(t *testing.T) {
165165
bucket: "bucket",
166166
spannerDB: "spanner",
167167
cvcfg: ChainValidationConfig{
168-
RootsPemFile: "./testdata/fake-ca.cert",
168+
RootsPEMFile: "./testdata/fake-ca.cert",
169169
ExtKeyUsages: "ServerAuth,ClientAuth,OCSPSigning",
170170
},
171171
signer: signer,
@@ -177,7 +177,7 @@ func TestValidateLogConfig(t *testing.T) {
177177
bucket: "bucket",
178178
spannerDB: "spanner",
179179
cvcfg: ChainValidationConfig{
180-
RootsPemFile: "./testdata/fake-ca.cert",
180+
RootsPEMFile: "./testdata/fake-ca.cert",
181181
RejectExtensions: "1.2.3.4,5.6.7.8",
182182
},
183183
signer: signer,
@@ -189,7 +189,7 @@ func TestValidateLogConfig(t *testing.T) {
189189
bucket: "bucket",
190190
spannerDB: "spanner",
191191
cvcfg: ChainValidationConfig{
192-
RootsPemFile: "./testdata/fake-ca.cert",
192+
RootsPEMFile: "./testdata/fake-ca.cert",
193193
NotAfterStart: &t100,
194194
},
195195
signer: signer,
@@ -201,7 +201,7 @@ func TestValidateLogConfig(t *testing.T) {
201201
bucket: "bucket",
202202
spannerDB: "spanner",
203203
cvcfg: ChainValidationConfig{
204-
RootsPemFile: "./testdata/fake-ca.cert",
204+
RootsPEMFile: "./testdata/fake-ca.cert",
205205
NotAfterStart: &t200,
206206
},
207207
signer: signer,
@@ -213,7 +213,7 @@ func TestValidateLogConfig(t *testing.T) {
213213
bucket: "bucket",
214214
spannerDB: "spanner",
215215
cvcfg: ChainValidationConfig{
216-
RootsPemFile: "./testdata/fake-ca.cert",
216+
RootsPEMFile: "./testdata/fake-ca.cert",
217217
NotAfterStart: &t100,
218218
NotAfterLimit: &t200,
219219
},

0 commit comments

Comments
 (0)