Ceremony: require configs to specify a profile URL#8770
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
aarongable
force-pushed
the
ceremony-profiles
branch
from
894bf58 to
c99b0f3
Compare
aarongable
force-pushed
the
ceremony-profiles
branch
from
c99b0f3 to
d0601b9
Compare
| policyURLRegex := regexp.MustCompile( | ||
| `^https://github\.com/letsencrypt/cp-cps/blob/v[0-9.]+/CP-CPS.md#[0-9a-zA-Z-]+$`) | ||
| if !policyURLRegex.MatchString(profile.PolicyURL) { | ||
| return errors.New("PolicyURL must point to a specific subsection of a specific version of our markdown CPS") |
There was a problem hiding this comment.
When we error, we should print the regex. That way it's easy to see, for instance, that the tool is looking for the github version of the URL rather than the website version.
Also, the regex should be provided as a flag with this github URL as a default. That way if the base URL changes, or someone other than us wants to use this tool, it's possible.
There was a problem hiding this comment.
I've updated the error message.
I'm leery of letting this URL be overridden by a flag. Even though yes, it would work, it
a) makes the testing much more complex, and
b) would be the only flag taken by the ceremony tool.
I'm not fully convinced that providing an easier experience to unknown and unnamed third parties who may be using our ceremony tool rises quite to the level of justifying adding a whole new configuration mechanism to a compliance-critical tool.
5 participants
The idea here is that, by putting the profile URL directly in front of the people planning and executing ceremonies, it will improve correspondence between configured profiles and the profiles we commit to in our CPS. It will also eliminate issuance under undocumented profiles.
This addresses the fourth action item from https://bugzilla.mozilla.org/show_bug.cgi?id=2038351#c12
Fixes #8760