Add backends for managing certificates, CA bundles, and fingerprints.
Review Request #13163 — Created July 28, 2023 and submitted
This introduces support for storage backends for certificate-related
data. Backends are responsible for adding, deleting, fetching, and
iterating through SSL/TLS certificates, CA bundles, and verified
certificate fingerprints, along with providing stats on the data stored.These can all be tied to a specific Local Site or to the global site.
Each object has an ID specific to the backend, which can be used for
lookup or deletions. IDs must be set by the backend, and consumers of
the backends must take care not to allow user-provided input to be used
without validation.Backends are given a space within the site's data directory where they
can store files. Most libraries and tools expect a file path to PEMs, so
the backend is responsible for ensuring that those files exist when
needed.Each object type being managed has a "stored" counterpart class. These
are subclassed by the backend and used to associate any necessary
information needed to identify or place the object somewhere in a
storage system.By default, we ship a file-based storage backend. This is designed for
most single-server or managed-sitedir needs. All data is managed on the
filesystem, using known paths and filenames. These files can be
hand-added to the correct directory, so long as they follow the correct
naming and file format schemes.For most standard deployments, this will more than suffice. However,
we'll be providing a database-managed solution in Power Pack, for
handling very large numbers of certificates across unlimited numbers of
Local Sites in a manner that allows for synchronizing across servers.For Review Board 6.0.0, we may not include any UI for interfacing with
storage, but rather can provide documentation for file-based storage. UI
would come in a follow-up release.
Unit tests pass.
Summary | ID |
---|---|
283b256ea9ba74a0c829240001318b46eeb7dcf3 |
Description | From | Last Updated |
---|---|---|
'typing.TYPE_CHECKING' imported but unused Column: 1 Error code: F401 |
reviewbot | |
'typing.Union' imported but unused Column: 1 Error code: F401 |
reviewbot | |
'djblets.testing.decorators.add_fixtures' imported but unused Column: 1 Error code: F401 |
reviewbot | |
This should have an "or" in it. Same for several other instances throughout this change. |
david |
- Change Summary:
-
Removed unused imports.
- Commits:
-
Summary ID aa66d8bc794e060f58562b057430adaa7d5ff997 a5619bf0c1c29f0fc25bf7c940ce16c9d2c30592 - Diff:
-
Revision 2 (+12634)
Checks run (2 succeeded)
- Change Summary:
-
- Added a
get_ca_bundles_dir()
method for storage backends. - Moves some imports to
TYPE_CHECKING
-only.
- Added a
- Commits:
-
Summary ID a5619bf0c1c29f0fc25bf7c940ce16c9d2c30592 e2e29e170ad1d4a9f0e56356bb84771e08b79b39 - Diff:
-
Revision 3 (+12714)
Checks run (2 succeeded)
- Change Summary:
-
- Added a missing "or" in some docstrings.
- Commits:
-
Summary ID e2e29e170ad1d4a9f0e56356bb84771e08b79b39 283b256ea9ba74a0c829240001318b46eeb7dcf3 - Diff:
-
Revision 4 (+12714)