Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

update cert_handler charm lib to version that has stable hashes #18

Open
ca-scribner opened this issue Oct 18, 2024 · 0 comments
Open

Comments

@ca-scribner
Copy link
Contributor

Enhancement Proposal

#15 includes a local fix to the cert_handler library to fix an issue with the hashing of cert input config

def _csr_hash(self) -> str:
"""A hash of the config that constructs the CSR.
Only include here the config options that, should they change, should trigger a renewal of
the CSR.
TODO: This is a custom _csr_hash implementation that fixes a bug where the old hash was session dependent.
It should be pushed to the library and then we should import the new version.
"""
immutable_config = (str(self.sans_dns) + str(self.sans_ip)).encode("utf-8")
return hashlib.sha256(immutable_config).hexdigest()

This was required because previously the hashing was python session dependent, meaning sequential charm calls generated different hash values for the same inputs. The cert_handler recently received a similar fix, but it removed the refresh_events feature which we rely on here so we cannot immediately update to the new library. To fix this, we need to restore the refresh_events feature in cert_handler or find a new pattern to use here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant