Jordan Montgomery
c70f6796a0
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46226 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Add CA certificate rollover CLI to renew MDM CA certs with an extend-years option while preserving the private key and certificate properties. * **Improvements** * Decryption logic updated to accept previously-rolled CA certificates so escrowed disk-encryption keys can be decrypted after rollover. * **Tests** * Expanded tests and mocks to cover rollover and decryption scenarios. * **Chores** * Updated ignore rules and added a changelog entry for the rollover process. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46226?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai -->
136 lines
2.5 KiB
Plaintext
136 lines
2.5 KiB
Plaintext
# binaries
|
|
*.exe
|
|
|
|
# output directories
|
|
/build
|
|
vendor
|
|
node_modules
|
|
dist
|
|
|
|
# generated artifacts
|
|
assets/bundle*.*
|
|
assets/*@*.svg
|
|
assets/*@*.png
|
|
assets/*@*.gif
|
|
assets/*@*.eot
|
|
assets/*@*.woff
|
|
assets/*@*.woff2
|
|
assets/*@*.ttf
|
|
assets/*@*.mp4
|
|
frontend/templates/react.tmpl
|
|
bindata.go
|
|
server/bindata/generated.go
|
|
*.cover
|
|
*.test
|
|
*.log
|
|
coverage.txt
|
|
storybook-static
|
|
frontend/coverage
|
|
|
|
# typescript generated test files
|
|
tmp/
|
|
|
|
# test debug files
|
|
debug.test*
|
|
|
|
# operating system artifacts
|
|
.DS_Store
|
|
|
|
# test mysql server data
|
|
mysqldata/
|
|
|
|
# test helm charts
|
|
helm-temp
|
|
charts/fleet/charts/*.tgz
|
|
|
|
#editors
|
|
.idea
|
|
.swp
|
|
|
|
# Fleet local development DB backups
|
|
backup.sql.gz
|
|
|
|
# Common mistake for new developers to run npm install and then end up
|
|
# committing a package-lock.json. Fleet app uses Yarn with yarn.lock.
|
|
package-lock.json
|
|
!website/package-lock.json
|
|
|
|
# infra
|
|
.terraform
|
|
.terraform.tfstate*
|
|
terraform.tfstate*
|
|
|
|
# generated orbit installers and artifacts
|
|
fleet-osquery*
|
|
desktop.app.tar.gz
|
|
osqueryd.app.tar.gz
|
|
desktop.tar.gz
|
|
nudge.app.tar.gz
|
|
swiftDialog.app.tar.gz
|
|
|
|
# residual files when running the cpe command
|
|
cmd/cpe/etagenv
|
|
cmd/cpe/cpe*.sqlite
|
|
cmd/cpe/cpe*.sqlite.gz
|
|
|
|
# Testing TUF server
|
|
test_tuf
|
|
|
|
# Residual files when running the msrc generate command
|
|
msrc_in/
|
|
msrc_out/
|
|
|
|
# Residual files when running cmd/macoffice/generate.go
|
|
macoffice_rel_notes/
|
|
|
|
# Keys and certificates that may be generated in the root of the repo
|
|
# (e.g. with ./build/fleetctl generate ...).
|
|
/*.key
|
|
/*.crt
|
|
|
|
# IDE
|
|
.vscode
|
|
.cursor
|
|
|
|
# residual files when running the build-windows tool
|
|
orbit/cmd/desktop/manifest.xml
|
|
orbit/cmd/desktop/resource_windows.syso
|
|
orbit/cmd/orbit/manifest.xml
|
|
orbit/cmd/orbit/resource_windows.syso
|
|
|
|
# Residual files from osqueryd loadtests.
|
|
osquery_worker_*.jpg
|
|
|
|
# Residual files when building fleetd_tables extension.
|
|
fleetd_tables_*
|
|
|
|
# Location of test extensions executables
|
|
tools/test_extensions/hello_world/macos
|
|
tools/test_extensions/hello_world/linux
|
|
tools/test_extensions/hello_world/linux-arm64
|
|
tools/test_extensions/hello_world/windows
|
|
tools/test_extensions/hello_world/windows-arm64
|
|
|
|
# typical screencap output dir
|
|
tools/screencap/screenshots
|
|
|
|
# MDM asset manager build output (binary matches the package dir name)
|
|
tools/mdm/assets/assets
|
|
|
|
# Residual files when building fleet_tables extension.
|
|
fleet_tables_*.ext
|
|
|
|
# Local dev files
|
|
.env
|
|
.tool-versions
|
|
.zed/
|
|
third_party/vuln-check/go.sum
|
|
cvefeed
|
|
|
|
# Required to not make `fleet-desktop` macOS executable built with a `dirty` flag (see #35006).
|
|
Fleet\ Desktop.app
|
|
|
|
# custom golangci-lint executable
|
|
custom-gcl
|
|
/fleet
|