Add certificate profile

[ooraini]

Notes:
Changing the profile will not delete and re-issue the certificate.
I'm not sure how would I write a test with the self-signed provider. I have tested it with IPA and it works as expected.

[richm]

[citest]

[richm]

please rebase on top of latest master branch

[ooraini]

@richm Done.

[richm]

[citest commit:e9187301a2a16ff54bebb7b7065d6bd9fa6d771d]

[richm]

Notes: Changing the profile will not delete and re-issue the certificate.

That sounds like the right behavior.

I'm not sure how would I write a test with the self-signed provider.

It sounds like this feature isn't applicable to self-signed provider?

I have tested it with IPA and it works as expected.

There is a test for ipa - https://github.com/linux-system-roles/certificate/blob/master/tests/tests_basic_ipa.yml#L13 - can you add a profile to one of these requests?

[richm]

[citest commit:b7d1b659eacf1ba2b014c138fb1a161fe283529d]

[richm]

[citest commit:2e75c67c125946f363a9e6231c7c14d701c356e8]

[ooraini]

This is disappointing. I will try to get things running locally and push again. Apologies.

[richm]

This is disappointing. I will try to get things running locally and push again. Apologies.

Looks like your ide/editor is not putting a newline at EOF?

[richm]

https://linux-system-roles.github.io/contribute.html - so you can use tox -e yamllint to check - just be aware that if you are using fedora, you will need to install tox using pip - pip install tox --user - then install the tox-lsr plugin - because the Fedora RPM tox package does not allow user plugins

the contribute page also has instructions about how to run tests locally using qemu/kvm

[ooraini]

[citest commit:fbabc95a3771b1d3698970d130e36f20a83313a0]

[richm]

[citest commit:fbabc95a3771b1d3698970d130e36f20a83313a0]

[ooraini]

Hi @richm,

The last CI failure was due to RHEL/CentOS 7 not outputting the profile in getcert list. The new test is quite brittle. I think that we might be better off without it. What do you think?

[richm]

Hi @richm,

The last CI failure was due to RHEL/CentOS 7 not outputting the profile in getcert list. The new test is quite brittle. I think that we might be better off without it. What do you think?

Can the test be made less brittle? We need some way to test this functionality (in addition, the test serves as a form of documentation for end users who may be trying to use this feature, and want to see a working example).

If there really is no way to test this functionality in an automated way with our current test framework, then we will need some detailed documentation about how a QE team can verify and validate the feature.

[richm]

[citest commit:8b9c5868eb3199b188c5b7814e3f4df0165d8455]

[ooraini]

@richm I think this ready now. Not sure why is the CI is still pending.

[richm]

@richm I think this ready now.

yeah - lgtm - @rjeffman

Not sure what is why the CI is still pending.

fixed

[richm]

please rebase the PR on top of the latest master branch

[richm]

please rebase the PR on top of the latest master branch

[ooraini]

@richm rebased.

[rjeffman]

@ooraini and @richm, I'll be running a few tests against this PR today and tomorrow. On a first look, it looks good.

[richm]

[citest commit:d55578fe212cbb03c1edfbbf391459d37ff2f4f6]

[richm]

ping

[richm]

closing due to inactivity