Skip to content

Commit 4784a1c

Browse files
marainomaraino
committed
Allow to disable smallstep extensions using the cli
This commit adds the flag --disable-smallstep-extensions to "step ca provisioner" commands. A provisioner created with this flag will have the claim DisableSmallstepExtensions set to true and certificates created using that provisioner will not have the smallstep provisioner extension. Related to smallstep/certificates#620
1 parent 9345996 commit 4784a1c

File tree

5 files changed

+19
-9
lines changed

5 files changed

+19
-9
lines changed

‎command/ca/provisioner/add.go‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -167,6 +167,7 @@ SCEP
167167
sshHostDefaultDurFlag,
168168
disableRenewalFlag,
169169
allowRenewalAfterExpiryFlag,
170+
disableSmallstepExtensionsFlag,
170171
//enableX509Flag,
171172
enableSSHFlag,
172173

@@ -360,8 +361,9 @@ func addAction(ctx *cli.Context) (err error) {
360361
HostDurations: &linkedca.Durations{},
361362
Enabled: !(ctx.IsSet("ssh") && !ctx.Bool("ssh")),
362363
},
363-
DisableRenewal: ctx.Bool("disable-renewal"),
364-
AllowRenewalAfterExpiry: ctx.Bool("allow-renewal-after-expiry"),
364+
DisableRenewal: ctx.Bool("disable-renewal"),
365+
AllowRenewalAfterExpiry: ctx.Bool("allow-renewal-after-expiry"),
366+
DisableSmallstepExtensions: ctx.Bool("disable-smallstep-extensions"),
365367
}
366368

367369
if ctx.IsSet("x509-min-dur") {

‎command/ca/provisioner/provisioner.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -248,6 +248,10 @@ unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns",
248248
Name: "allow-renewal-after-expiry",
249249
Usage: `Allow renewals for expired certificates generated by this provisioner.`,
250250
}
251+
disableSmallstepExtensionsFlag = cli.BoolFlag{
252+
Name: "disable-smallstep-extensions",
253+
Usage: `Disable the Smallstep extension for all certificates generated by this provisioner.`,
254+
}
251255
//enableX509Flag = cli.BoolFlag{
252256
// Name: "x509",
253257
// Usage: `Enable provisioning of x509 certificates.`,

‎command/ca/provisioner/update.go‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -166,6 +166,7 @@ SCEP
166166
sshHostDefaultDurFlag,
167167
disableRenewalFlag,
168168
allowRenewalAfterExpiryFlag,
169+
disableSmallstepExtensionsFlag,
169170
//enableX509Flag,
170171
enableSSHFlag,
171172

@@ -404,8 +405,11 @@ func updateClaims(ctx *cli.Context, p *linkedca.Provisioner) {
404405
if ctx.IsSet("allow-renewal-after-expiry") {
405406
p.Claims.AllowRenewalAfterExpiry = ctx.Bool("allow-renewal-after-expiry")
406407
}
407-
claims := p.Claims
408+
if ctx.IsSet("disable-smallstep-extensions") {
409+
p.Claims.DisableSmallstepExtensions = ctx.Bool("disable-smallstep-extensions")
410+
}
408411

412+
claims := p.Claims
409413
if claims.X509 == nil {
410414
claims.X509 = &linkedca.X509Claims{}
411415
}

‎go.mod‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ require (
2626
go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352
2727
go.step.sm/cli-utils v0.7.6
2828
go.step.sm/crypto v0.32.3
29-
go.step.sm/linkedca v0.19.1
29+
go.step.sm/linkedca v0.20.0
3030
golang.org/x/crypto v0.11.0
3131
golang.org/x/sys v0.10.0
3232
golang.org/x/term v0.10.0
@@ -132,7 +132,7 @@ require (
132132
google.golang.org/genproto v0.0.0-20230530153820-e85fd2cbaebc // indirect
133133
google.golang.org/genproto/googleapis/api v0.0.0-20230530153820-e85fd2cbaebc // indirect
134134
google.golang.org/genproto/googleapis/rpc v0.0.0-20230629202037-9506855d4529 // indirect
135-
google.golang.org/grpc v1.56.1 // indirect
135+
google.golang.org/grpc v1.56.2 // indirect
136136
gopkg.in/yaml.v3 v3.0.1 // indirect
137137
howett.net/plist v1.0.0 // indirect
138138
k8s.io/klog/v2 v2.90.0 // indirect

‎go.sum‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1060,8 +1060,8 @@ go.step.sm/cli-utils v0.7.6 h1:YkpLVrepmy2c5+eaz/wduiGxlgrRx3YdAStE37if25g=
10601060
go.step.sm/cli-utils v0.7.6/go.mod h1:j+FxFZ2gbWkAJl0eded/rksuxmNqWpmyxbkXcukGJaY=
10611061
go.step.sm/crypto v0.32.3 h1:lKR5MuIy2ZGorMKc5S7FI/32E4r0E0vJoC9vJvwQiwI=
10621062
go.step.sm/crypto v0.32.3/go.mod h1:A009Gtqx80nTz/9DreRMflMGgaSWTuhK8En6XycK9yA=
1063-
go.step.sm/linkedca v0.19.1 h1:uY0ByT/uB3FCQ8zIo9mU7MWG7HKf5sDXNEBeN94MuP8=
1064-
go.step.sm/linkedca v0.19.1/go.mod h1:vPV2ad3LFQJmV7XWt87VlnJSs6UOqgsbVGVWe3veEmI=
1063+
go.step.sm/linkedca v0.20.0 h1:bH41rvyDm3nSSJ5xgGsKUZOpzJcq5x2zacMIeqtq9oI=
1064+
go.step.sm/linkedca v0.20.0/go.mod h1:eybHw6ZTpuFmkUQnTBRWM2SPIGaP0VbYeo1bupfPT70=
10651065
go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
10661066
go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
10671067
go.uber.org/atomic v1.5.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
@@ -1602,8 +1602,8 @@ google.golang.org/grpc v1.39.0/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnD
16021602
google.golang.org/grpc v1.39.1/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
16031603
google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
16041604
google.golang.org/grpc v1.45.0/go.mod h1:lN7owxKUQEqMfSyQikvvk5tf/6zMPsrK+ONuO11+0rQ=
1605-
google.golang.org/grpc v1.56.1 h1:z0dNfjIl0VpaZ9iSVjA6daGatAYwPGstTjt5vkRMFkQ=
1606-
google.golang.org/grpc v1.56.1/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpXqQ9s=
1605+
google.golang.org/grpc v1.56.2 h1:fVRFRnXvU+x6C4IlHZewvJOVHoOv1TUuQyoRsYnB4bI=
1606+
google.golang.org/grpc v1.56.2/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpXqQ9s=
16071607
google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
16081608
google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
16091609
google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=

0 commit comments

Comments
 (0)