Try a different approach to determining what certs to use #37
Conversation
There was a problem hiding this comment.
This seems reasonable. I think it might mess up if the node was once a CA, but that seems like an uncommon problem.
That said, I'm pretty sure I'm missing some important stuff. I don't really understand why you need to special case the CA — if this code is running on the CA, then the CA must be a compile master. Why can't it treat the CA like any other compile master?
Also, I don't think this will fix @frizop's comment
#25 (comment) where it gives a “Need a node name to encrypt” error. That error is generated before any of this code is run.
Like I said, though, I missing something important. :)
Just check to see if the files exist and trust that they will on the CA server and not the compile masters. I'm just putting this up there to experiment with it. I'm not expecting to merge it right away. Maybe fixes #25
The compile masters and the CA master will always have the proper certs to encrypt *as this master*, so let's just simplify that logic and always use that set of certificates.
binford2k
force-pushed
the
just_look_for_files
branch
from
dc5ae49
to
cffffc1
Compare
|
@danielparks yeah, you're right. I think there used to be a reason for treating them differently, but I didn't document it and I can't find a reason for doing so any more. This drastically simplifies, and all the tests pass, including manual acceptance testing. Thoughts? |
Just check to see if the files exist and trust that they will on the CA
server and not the compile masters.
I'm just putting this up there to experiment with it. I'm not expecting
to merge it right away.
Maybe fixes #25