On 7/12/2016 8:27 PM, Christina Fu wrote:
man page for AuditVerify
https://fedorahosted.org/pki/ticket/2246
Some comments/questions:
1. I think the -P option would unlikely be used. Can we remove this
option in the future?
2. In the description for the -a option, there's a missing space before
the left parenthesis:
... paths(in chronological order) ...
3. Do we assume the auditor to have an access to the machine running the
PKI server? Does the auditor have a read access to the files in the
instance folder?
4. Normally the server does not export the system certificate into
files, so the admin has to do that before the auditor can import the
file with this command:
certutil -d ~jsmith/auditVerifyDir/ -A -n "CA Certificate" -t
"CT,CT,CT" -a -i /var/lib/instance_ID/alias/cacert.txt
I think we should replace the path with "-i cacert.txt". Here we're
assuming the auditor already has the certificate file.
5. Similarly, the path to the audit certificate file should be replaced
with "-i logsigncert.txt":
certutil -d ~jsmith/auditVerifyDir -A -n "Log Signing Certificate"-t
",,P" -a -i /var/lib/instance_ID/alias/logsigncert.txt
6. There should be a space before the -t in #5.
7. The following phrase assumes the auditor has a write access to
/etc/audit, is that the case? Or do we expect someone else to prepare
the file for the auditor?
... this file could be logListFile in the /etc/audit directory ...
8. The database path in the description does not match the command:
... in the user home directory, such as /home/smith/.mozilla, ...
AuditVerify -d ~jsmith/auitVerifyDir ...
9. The "auditVerifyDir" is misspelled in #8.
10. When viewed using the man tool, the quotes surrounding
"auditsigningcert" disappear causing an extra space before the comma:
... and the signing certificate nickname is auditsigningcert , ...
11. The "auditsigningcert" nickname is inconsistent with the "Log
Signing Certificate" used in #5.
12. The explanation for the verification failure in the following ticket
is not included yet:
https://fedorahosted.org/pki/ticket/2217
Is it going to be added in a separate patch?
--
Endi S. Dewata
_______________________________________________
Pki-devel mailing list
Pki-devel@redhat.com
https://www.redhat.com/mailman/listinfo/pki-devel
