Merge 4.1.0 to main#109
Merged
Merged
Conversation
* Update generated docs * ab#82394 * Update generated docs * ab#82394 * Update generated docs * ab#82394 * ab#82394 * Update generated docs * ab#82394 * Update generated docs * ab82394 * ab#82394 * ab#82394 * ab#82394 * docs: auto-generate README and documentation [skip ci] * ab#82394 * ab#82394 * docs: auto-generate README and documentation [skip ci] * ab#82394 * ab#82394 * docs: auto-generate README and documentation [skip ci] * ab#82394 --------- Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> Co-authored-by: Lee Fine <lfine@keyfactor.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Automated merge of the 4.1.0 release branch into main, introducing new store-type behaviors (legacy PKCS#12 encryption option, post-job restart parameter handling) and updating supporting docs/scripts.
Changes:
- Add/propagate a RequiresLegacyEncryption custom field into PKCS#12 store serialization flows.
- Improve store-type behavior and messaging (PEM inventory/private-key constraint; RFKDB retry logic when
gskcapicmdis a binary). - Update docs/assets (Doctool screenshots), CI workflow reference, dependencies, and changelog.
Reviewed changes
Copilot reviewed 22 out of 182 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| scripts/store_types/powershell/kfutil_create_store_types.ps1 | New PowerShell helper script to create store types via kfutil. |
| scripts/store_types/bash/kfutil_create_store_types.sh | New bash helper script to create store types via kfutil. |
| RemoteFile/RemoteHandlers/SSHHandler.cs | Fix log message text for SCP download failures. |
| RemoteFile/RemoteFileJobTypeBase.cs | Add legacy encryption flag + refine post-job restart “None” handling. |
| RemoteFile/RemoteFile.csproj | Multi-target framework update and PowerShell SDK package update. |
| RemoteFile/RemoteCertificateStore.cs | Add legacy-encryption PKCS#12 store rebuild behavior. |
| RemoteFile/ReenrollmentBase.cs | Update reenrollment certificate export/add flow and pass legacy encryption option to serialization. |
| RemoteFile/ManagementBase.cs | Pass legacy encryption option to store serialization on add/delete operations. |
| RemoteFile/ImplementedStoreTypes/PEM/PEMCertificateStoreSerializer.cs | Throw clearer error when non-inventory jobs run with IgnorePrivateKeyOnInventory enabled. |
| RemoteFile/ImplementedStoreTypes/KDB/KDBCertificateStoreSerializer.cs | Retry gskcapicmd conversion without bash when binary execution fails; add path prefix handling. |
| docsource/rfora.md | Update RFORA overview content to reflect new implementation approach. |
| docsource/images/RFPkcs12-custom-field-UseShellCommands-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFPkcs12-custom-field-SudoImpersonatingUser-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFPkcs12-custom-field-SSHPort-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFPkcs12-custom-field-SSHPort-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFPkcs12-custom-field-RequiresLegacyEncryption-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFPkcs12-custom-field-RemoveRootCertificate-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFPkcs12-custom-field-PostJobApplicationRestart-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFPkcs12-custom-field-LinuxFilePermissionsOnStoreCreation-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFPkcs12-custom-field-LinuxFileOwnerOnStoreCreation-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFPkcs12-custom-field-IncludePortInSPN-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFPEM-custom-field-UseShellCommands-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFPEM-custom-field-SudoImpersonatingUser-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFPEM-custom-field-SSHPort-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFPEM-custom-field-SSHPort-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFPEM-custom-field-SeparatePrivateKeyFilePath-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFPEM-custom-field-RequiresLegacyEncryption-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFPEM-custom-field-RemoveRootCertificate-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFPEM-custom-field-PostJobApplicationRestart-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFPEM-custom-field-LinuxFilePermissionsOnStoreCreation-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFPEM-custom-field-LinuxFileOwnerOnStoreCreation-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFPEM-custom-field-IsTrustStore-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFPEM-custom-field-IncludesChain-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFPEM-custom-field-IncludePortInSPN-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFPEM-custom-field-IgnorePrivateKeyOnInventory-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFORA-custom-field-WorkFolder-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFORA-custom-field-WorkFolder-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFORA-custom-field-UseShellCommands-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFORA-custom-field-SudoImpersonatingUser-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFORA-custom-field-SudoImpersonatingUser-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFORA-custom-field-SSHPort-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFORA-custom-field-SSHPort-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFORA-custom-field-RequiresLegacyEncryption-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFORA-custom-field-RemoveRootCertificate-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFORA-custom-field-PostJobApplicationRestart-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFORA-custom-field-PostJobApplicationRestart-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFORA-custom-field-LinuxFilePermissionsOnStoreCreation-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFORA-custom-field-LinuxFileOwnerOnStoreCreation-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFORA-custom-field-IncludePortInSPN-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFKDB-custom-field-UseShellCommands-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFKDB-custom-field-SudoImpersonatingUser-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFKDB-custom-field-SudoImpersonatingUser-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFKDB-custom-field-SSHPort-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFKDB-custom-field-SSHPort-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFKDB-custom-field-RequiresLegacyEncryption-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFKDB-custom-field-RemoveRootCertificate-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFKDB-custom-field-PostJobApplicationRestart-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFKDB-custom-field-PostJobApplicationRestart-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFKDB-custom-field-LinuxFilePermissionsOnStoreCreation-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFKDB-custom-field-LinuxFileOwnerOnStoreCreation-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFKDB-custom-field-IncludePortInSPN-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFJKS-custom-field-UseShellCommands-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFJKS-custom-field-SudoImpersonatingUser-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFJKS-custom-field-SSHPort-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFJKS-custom-field-SSHPort-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFJKS-custom-field-RequiresLegacyEncryption-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFJKS-custom-field-RemoveRootCertificate-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFJKS-custom-field-PostJobApplicationRestart-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFJKS-custom-field-LinuxFilePermissionsOnStoreCreation-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFJKS-custom-field-LinuxFileOwnerOnStoreCreation-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFJKS-custom-field-IncludePortInSPN-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFDER-custom-field-UseShellCommands-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFDER-custom-field-SudoImpersonatingUser-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFDER-custom-field-SSHPort-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFDER-custom-field-SSHPort-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFDER-custom-field-SeparatePrivateKeyFilePath-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFDER-custom-field-SeparatePrivateKeyFilePath-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFDER-custom-field-RequiresLegacyEncryption-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFDER-custom-field-RemoveRootCertificate-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFDER-custom-field-PostJobApplicationRestart-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFDER-custom-field-PostJobApplicationRestart-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFDER-custom-field-LinuxFilePermissionsOnStoreCreation-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFDER-custom-field-LinuxFileOwnerOnStoreCreation-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| docsource/images/RFDER-custom-field-IncludePortInSPN-validation-options-dialog.svg | Doctool-generated screenshot asset. |
| CHANGELOG.md | Add v4.1.0 release notes. |
| Certificate Store Type CURL Scripts/PKCS12.curl | Remove legacy curl script (superseded by newer store-type tooling). |
| Certificate Store Type CURL Scripts/PEM.curl | Remove legacy curl script (superseded by newer store-type tooling). |
| Certificate Store Type CURL Scripts/KDB.curl | Remove legacy curl script (superseded by newer store-type tooling). |
| Certificate Store Type CURL Scripts/JKS.curl | Remove legacy curl script (superseded by newer store-type tooling). |
| Certificate Store Type CURL Scripts/DER.curl | Remove legacy curl script (superseded by newer store-type tooling). |
| .github/workflows/keyfactor-starter-workflow.yml | Update reusable workflow reference to v5 and adjust formatting. |
Comments suppressed due to low confidence (1)
RemoteFile/ImplementedStoreTypes/KDB/KDBCertificateStoreSerializer.cs:70
- In the retry path, storePath is mutated to start with '|' and then reused in finally for RemoveCertificateFile. IRemoteHandler.RemoveCertificateFile expects a real remote path; passing a leading '|' will likely prevent cleanup of temp files. Also, the retry condition should be tied to whether the "bash " prefix was used, otherwise a repeated "cannot execute binary file" error could recurse indefinitely.
catch (Exception ex)
{
if (ex.Message.Contains("cannot execute binary file", StringComparison.InvariantCultureIgnoreCase) && storePath.Substring(0, 1) == "/")
{
storePath = "|" + storePath.Substring(1);
store = DeserializeRemoteCertificateStore(storeContentBytes, storePath, storePassword, remoteHandler, isInventory);
}
else
throw;
}
finally
{
try { remoteHandler.RemoveCertificateFile(storePath, tempStoreFile); } catch (Exception) { };
try { remoteHandler.RemoveCertificateFile(storePath, tempCertFile); } catch (Exception) { };
}
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
103
to
+105
| // save certificate | ||
| certificateStore.AddCertificate(config.Alias ?? cert.Thumbprint, Convert.ToBase64String(cert.Export(X509ContentType.Pfx)), config.Overwrite, null, RemoveRootCertificate); | ||
| certificateStore.SaveCertificateStore(certificateStoreSerializer.SerializeRemoteCertificateStore(certificateStore.GetCertificateStore(), storePathFile.Path, storePathFile.File, StorePassword, certificateStore.RemoteHandler)); | ||
| certificateStore.AddCertificate(config.Alias ?? cert.Thumbprint, Convert.ToBase64String(cert.Export(X509ContentType.Pfx, "password")), config.Overwrite, "password", RemoveRootCertificate); | ||
| certificateStore.SaveCertificateStore(certificateStoreSerializer.SerializeRemoteCertificateStore(certificateStore.GetCertificateStore(RequiresLegacyEncryption), storePathFile.Path, storePathFile.File, StorePassword, certificateStore.RemoteHandler)); |
Comment on lines
+80
to
+86
| PostJobApplicationRestart = properties.PostJobApplicationRestart == null || string.IsNullOrEmpty(properties.PostJobApplicationRestart.Value) || properties.PostJobApplicationRestart.Value == POST_JOB_APPLICATION_RESTART_NO_VALUE ? | ||
| null : | ||
| properties.PostJobApplicationRestart; | ||
|
|
||
| RequiresLegacyEncryption = properties.RequiresLegacyEncryption == null || string.IsNullOrEmpty(properties.RequiresLegacyEncryption.Value) ? | ||
| false : | ||
| properties.RequiresLegacyEncryption; |
Comment on lines
+103
to
117
| catch (Exception ex) | ||
| { | ||
| throw; | ||
| if (ex.Message.Contains("cannot execute binary file", StringComparison.InvariantCultureIgnoreCase) && storePath.Substring(0, 1) == "/") | ||
| { | ||
| storePath = "|" + storePath.Substring(1); | ||
| storeInfo = SerializeRemoteCertificateStore(certificateStore, storePath, storeFileName, storePassword, remoteHandler); | ||
| } | ||
| else | ||
| throw; | ||
| } | ||
| finally | ||
| { | ||
| try { remoteHandler.RemoveCertificateFile(storePath, tempStoreFile); } catch (Exception) { }; | ||
| try { remoteHandler.RemoveCertificateFile(storePath, tempCertFile); } catch (Exception) { }; | ||
| } |
|
|
||
| > NOTE: This should work for `PKCS12` Oracle Wallets installed on both Windows and Linux servers, this has only been tested on wallets installed on Windows. | ||
| > NOTE: When entering the Store Path for an Oracle Wallet in Keyfactor Command, make sure to INCLUDE the `eWallet.p12` file name that by convention is the name of the `PKCS12` wallet file that gets created. | ||
| The `RFORA` store type can be used to manage `PKCS12` Oracle wallets. Although implemented as a separate store type, Oracle wallets are accessed and managed identically to RFPkcs12 store types. The file is expected to compatible with the Pkcs#12 standard. |
Comment on lines
+3
to
+4
|
|
||
| Write-Host "Creating store type: RFJKS" |
| - Add custom field to select legacy encryption for certificate stores | ||
| - Improve error message when attempting a management or ODKG job and Ignore Private Key on Inventory is selected. | ||
| - For RFKDB, retry gskcapicmd commands without "bash" on Linux if gskcapicmd CLI utility is a binary file. | ||
| - Added Post Job Application Restart Entry Parameter for RFPkcs12, RFDER, RFORA and RFKDB. Intitialized each with a default "None" option. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merge release-4.1 to main - Automated PR