directdownload: fix keytool importcert#11113
Conversation
``` $ /usr/bin/keytool -importcert file /etc/cloudstack/agent/CSCERTIFICATE-full -keystore /etc/cloudstack/agent/cloud.jks -alias full -storepass DAWsfkJeeGrmhta6 Illegal option: file keytool -importcert [OPTION]... Imports a certificate or a certificate chain Options: -noprompt do not prompt -trustcacerts trust certificates from cacerts -protected password through protected mechanism -alias <alias> alias name of the entry to process -file <file> input file name -keypass <arg> key password -keystore <keystore> keystore name -cacerts access the cacerts keystore -storepass <arg> keystore password -storetype <type> keystore type -providername <name> provider name -addprovider <name> add security provider by name (e.g. SunPKCS11) [-providerarg <arg>] configure argument for -addprovider -providerclass <class> add security provider by fully-qualified class name [-providerarg <arg>] configure argument for -providerclass -providerpath <list> provider classpath -v verbose output Use "keytool -?, -h, or --help" for this help message ```
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## 4.19 #11113 +/- ##
=========================================
Coverage 15.17% 15.18%
+ Complexity 11363 11362 -1
=========================================
Files 5416 5415 -1
Lines 475911 475860 -51
Branches 58096 58093 -3
=========================================
+ Hits 72241 72266 +25
+ Misses 395584 395506 -78
- Partials 8086 8088 +2
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
@blueorangutan package |
|
@kiranchavala a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress. |
|
Packaging result [SF]: ✖️ el8 ✖️ el9 ✔️ debian ✖️ suse15. SL-JID 13975 |
|
@blueorangutan package |
|
@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress. |
|
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 13979 |
|
@blueorangutan package |
|
@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress. |
|
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 14005 |
|
@blueorangutan test |
|
@weizhouapache a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests |
...oud/hypervisor/kvm/resource/wrapper/LibvirtSetupDirectDownloadCertificateCommandWrapper.java
Show resolved
Hide resolved
|
[SF] Trillian test result (tid-13669)
|
kiranchavala
left a comment
kiranchavala
left a comment
There was a problem hiding this comment.
LGTM
Tested with ol8 and direct download template registration works fine after the API is executed
https://cloudstack.apache.org/api/apidocs-4.20/apis/uploadTemplateDirectDownloadCertificate.html
Steps
- Execute the command
openssl s_client -showcerts -servername download.cloudstack.org -connect download.cloudstack.org:443 </dev/null 2>/dev/null | awk '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/{ print }' > cloudstack.pem
- Upload to cloudstack
cmk upload templatedirectdownloadcertificate certificate="$(cat cloudstack.pem)" hypervisor=kvm name=cloudstackdownload zoneid=6732a2ff-b30d-4f4b-b520-c8f5809d693e
- Login to the kvm host to verify if the certificate got uploaded
keytool -list -keystore /etc/cloudstack/agent/cloud.jks -storepass $(grep keystore.passphrase /etc/cloudstack/agent//agent.properties |cut -d "=" -f2)
|
Merged based on approvals and manual test by @kiranchavala |
* directdownload: fix keytool importcert ``` $ /usr/bin/keytool -importcert file /etc/cloudstack/agent/CSCERTIFICATE-full -keystore /etc/cloudstack/agent/cloud.jks -alias full -storepass DAWsfkJeeGrmhta6 Illegal option: file keytool -importcert [OPTION]... Imports a certificate or a certificate chain Options: -noprompt do not prompt -trustcacerts trust certificates from cacerts -protected password through protected mechanism -alias <alias> alias name of the entry to process -file <file> input file name -keypass <arg> key password -keystore <keystore> keystore name -cacerts access the cacerts keystore -storepass <arg> keystore password -storetype <type> keystore type -providername <name> provider name -addprovider <name> add security provider by name (e.g. SunPKCS11) [-providerarg <arg>] configure argument for -addprovider -providerclass <class> add security provider by fully-qualified class name [-providerarg <arg>] configure argument for -providerclass -providerpath <list> provider classpath -v verbose output Use "keytool -?, -h, or --help" for this help message ``` * DirectDownload: drop HttpsMultiTrustManager
5 participants
This fixes #11112
the command does not work on oraclelinux 8, which causes registration of direct download with https failed.
Description
This PR...
Types of changes
Feature/Enhancement Scale or Bug Severity
Feature/Enhancement Scale
Bug Severity
Screenshots (if appropriate):
How Has This Been Tested?
How did you try to break this feature and the system with this change?