From wyllys@borg.sfbay.sun.com Wed Jan 16 08:03:06 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m0GG36XN019515 for ; Wed, 16 Jan 2008 08:03:06 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m0GG33ot013162 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@Sun.Com>; Wed, 16 Jan 2008 08:03:06 -0800 (PST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JUQ0091FV93EB00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@Sun.Com (ORCPT PSARC-ext@Sun.Com); Wed, 16 Jan 2008 08:03:03 -0800 (PST) Received: from borg.SFBay.Sun.COM ([10.6.50.138]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JUQ00I5HV920R80@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@Sun.Com (ORCPT PSARC-ext@Sun.Com); Wed, 16 Jan 2008 08:03:02 -0800 (PST) Received: from borg.SFBay.Sun.COM (localhost [127.0.0.1]) by borg.SFBay.Sun.COM (8.14.2+Sun/8.14.2) with ESMTP id m0GFtWRo026211; Wed, 16 Jan 2008 07:55:32 -0800 (PST) Received: (from wyllys@localhost) by borg.SFBay.Sun.COM (8.14.2+Sun/8.14.2/Submit) id m0GFtW1o026207; Wed, 16 Jan 2008 07:55:32 -0800 (PST) Date: Wed, 16 Jan 2008 07:55:32 -0800 (PST) From: Wyllys Ingersoll Subject: new EKU support for pktool and kmfcfg [PSARC/2008/037 FastTrack timeout 01/30/2008] To: PSARC-ext@sun.com Cc: kmf-discuss@opensolaris.org Message-id: <200801161555.m0GFtW1o026207@borg.SFBay.Sun.COM> Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 14306 Template Version: @(#)sac_nextcase 1.64 07/13/07 SMI This information is Copyright 2008 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: new EKU support for pktool and kmfcfg 1.2. Name of Document Author/Supplier: Author: Wyllys Ingersoll 1.3 Date of This Document: 16 January, 2008 4. Technical Description Project: new EKU support for pktool and kmfcfg Submitter: Wyllys Ingersoll Interfaces: pktool = Uncommitted, kmfcfg = Uncommitted Releast Binding: Patch Description: In order to better support the needs of applications that use X.509 certificates pktool(1) needs to be able to sign certificate requests and also apply some new extended key usage (EKU) and subjectAltName extensions. This project will add support for 3 new EKU OIDs, 2 new subjectAltName forms, and a new "signcsr" command option for pktool(1). Additionally, the kmfcfg(1) command needs to support additional EKU values to be used in the KMF policies it creates. The following EKU object identifier values will be supported by both pktool(1) and kmfcfg(1): KPClientAuth = { 1 3 6 1 5 2 3 4 } - Kerberos PKINIT Client Authentication (id-pkinit-KPClientAuth) - This EKU also implies that the digitalSignature keyUsage value must also be set in the certificate. KPKdc = { 1 3 6 1 5 2 3 5 } - Kerberos PKINIT KDC EKU (id-pkinit-KPKdc) - This EKU also implies that the digitalSignature keyUsage value must also be set in the certificate. SCLogon = { 1 3 6 1 4 1 311 20 2 2 } - Microsoft Smart Card Logon EKU (id-ms-kp-sc-logon) - This EKU is required by Windows 2000 and 2003 Server KDCs The following subjectAltName types will be supported in pktool(1): id-pkinit-san = {1 3 6 1 5 2 2} - The "AnotherName" field in the SAN data will contain the KRB5 Principal Name associated with this certificate. id-ms-san-sc-logon-upn = {1 3 6 1 4 1 311 20 2 3} From RFC4556 (Kerberos PKINIT): Client certificates accepted by Windows 2000 and Windows 2003 Server KDCs must contain an id-ms-san-sc-logon-upn (1.3.6.1.4.1.311.20.2.3) SAN and the id-ms-kp-sc-logon EKU. The id-ms-san-sc-logon-upn SAN contains a UTF8-encoded string whose value is that of the Directory Service attribute UserPrincipalName of the client account object, and the purpose of including the id-ms-san-sc-logon-upn SAN in the client certificate is to validate the client mapping (in other words, the client's public key is bound to the account that has this UserPrincipalName value). In order to create certificates that will work with an AD server (Win2000 or 2003), we must be able to add the Microsoft-specific name type to that certificate. INTERFACE CHANGES The pktool(1) CLI will be modified as follows: 1. The 'gencsr' and 'gencert' commands will support a new attr/value pair that allows the user to specify the EKUs to add to the cert (or csr) being created: [eku=[critical:]EKU Name,[critical:]EKU Name, ...] EKU Name must be one of the following: serverAuth | clientAuth | codeSigning | emailProtection | ipsecEndSystem | ipsecTunnel | ipsecUser | timeStamping | OCSPSigning | KPClientAuth | KPKdc | scLogon 2. The 'altname' attr/value pair option (used by several pktool subcommands) will be modified to support 2 new forms: KRB5 and UPN (Microsoft SCLogon UserPrincipalName) pktool(1) currently supports the following types of SAN values: IP, DNS, EMAIL, URI, DN, RID This project will add 2 more SAN tags: KRB5 and UPN Examples: altname="KRB5=joeuser@REALM.COMPANY.COM" altname="UPN=joeuser@REALM.COMPANY.COM" 3. A new "signcsr" command will be added so that pktool can sign a PKCS#10 Certificate Signing Request and generate a certificate. The syntax will be: pktool signcsr signkey=label/filename of signing key (label if keystore=PKCS11 or NSS, filename if file) csr=CSR filename serial=serial number hex string outcert=filename for resulting certificate. [issuer=issuer-DN] ( DN to use for issuer field. Not needed if a the key has an associated certificate in the keystore. The subject of the associated cert will be the issuer of the new one ) [keystore=pkcs11|file|nss] ( PKCS11 is default ) [token=token[:manuf[:serial]]] ( PKCS11 token name, default is to use metaslot ) [format=pem|der] ( format of output cert, PEM is default) [subject=subjectDN] ( override the subject in the original request ) [store=y|n] ( store the new cert, default = n ) [label=cert label] ( label to use when storing in PKCS11 or NSS ) [altname=subjectAltName] ( add a SAN ) [keyusage=[critical:]usage,..] ( add key usage bits ) [eku=[critical:]EKU Name, ...] ( add EKU values ) The kmfcfg(1) CLI will be modified as follows: 1. The "ekunames" attr/value pair support will be extended to support KPClientAuth, KPKdc, and scLogon names. Ex: [ekunames=serverAuth | clientAuth | codeSigning | emailProtection | ipsecEndSystem | ipsecTunnel | ipsecUser | timeStamping | OCSPSigning | KPClientAuth | KPKdc | scLogon],[...] MANPAGE DIFFS --- pktool.1.orig Mon Jan 14 16:07:04 2008 +++ pktool.1.new Mon Jan 14 16:36:00 2008 @@ -278,11 +278,13 @@ [prefix=DBprefix] [keytype=rsa|dsa] [keylen=key-size] [trust=trust-value] [lifetime=number-hour|number-day|number-year] + [eku=[critical:]EKU Name,[critical:]EKU Name, ...] + pktool gencert [-i] [ keystore=pkcs11] label=key/cert-label subject=subject-DN serial=hex_serial_number [altname=[critical:]subjectAltName] @@ -290,10 +292,11 @@ [token=token[:manuf[:serial]]] [dir=directory-path] [keytype=rsa|dsa] [keylen=key-size] [lifetime=number-hour|number-day|number-year] + [eku=[critical:]EKU Name,[critical:]EKU Name, ...] pktool gencert [-i] keystore=file outcert=cert-fn outkey=key-fn subject=subject-DN @@ -303,10 +306,11 @@ [format=der|pem] [dir=directory-path] [keytype=rsa|dsa] [keylen=key-size] [lifetime=number-hour|number-day|number-year] + [eku=[critical:]EKU Name,[critical:]EKU Name, ...] Generates a self-signed certificate and installs it and its associated private key to the specified keystore. @@ -343,10 +347,11 @@ [dir= NSS directory-path] [prefix=DBprefix] [keytype=rsa|dsa] [keylen=key-size] [format=pem|der] + [eku=[critical:]EKU Name,[critical:]EKU Name, ...] pktool gencsr [-i] keystore=pkcs11 label=key-label outcsr=csr-fn subject=subject-DN [altname=[critical:]subjectAltName] @@ -353,10 +358,11 @@ [keyusage=[critical:]usage,usage...] [token=token[:manuf[:serial]]] [keytype=rsa|dsa] [keylen=key-size] [format=pem|der] + [eku=[critical:]EKU Name,[critical:]EKU Name, ...] pktool gencsr [-i] keystore=file outcsr=csr-fn outkey=key-fn subject=subject-DN @@ -364,10 +370,11 @@ [keyusage=[critical:]usage,usage...] [dir=directory-path] [keytype=rsa|dsa] [keylen=key-size] [format=pem|der] + [eku=[critical:]EKU Name,[critical:]EKU Name, ...] Creates a PKCS#10 certificate signing request (CSR) file. This CSR can be sent to a Certifying Authority (CA) for signing. The result is then a real signed cer- @@ -615,11 +622,47 @@ default passphrase changeme as the old passphrase to change the passphrase of the object store. This action is needed to initialize and set the passphrase to a newly created token object store. + signcsr + The format for the signcsr subcommand is as follows: + pktool signcsr + signkey=label/filename of signing key + csr=CSR filename + serial=serial number hex string + outcert=filename for resulting certificate. + [issuer=issuer-DN] + [keystore=pkcs11|file|nss] + [token=token[:manuf[:serial]]] + [format=pem|der] + [subject=subjectDN] + [store=y|n] + [label=cert label] + [altname=subjectAltName] + [keyusage=[critical:]usage,..] + [eku=[critical:]EKU Name, [critical:]EKU Name, ...] + + issuer-DN is not needed if the key has an associated certificate + already in the keystore. The subject of the signing cert will + be the issuer of the newly issued certificate. + + PEM is the default format of the resulting certificate unless + otherwise specified. + + By default, the resulting certificate is not stored anyplace + other than in the file specified by the 'outcert' option. If + "store=y" is given and the keystore is designated as pkcs11 + or NSS, a copy of the resulting certificate will also be stored in + the keystore using the (optional) label given. + + The administrator executing this command may override the + subject, subjectAltName, keyusage, or extended key usage + values in the original CSR by using the subject, altname, + keyusage, or eku options. + tokens The format for the tokens subcommand is as follows: pktool tokens @@ -645,13 +688,13 @@ altname=[critical:]subjectAltName Subject Alternative Names the certificate. The argument that follows the -A option should be in the form of - tag=value. Valid tags are IP, DNS, EMAIL, URI, DN, and - RID. The SubjectAltName extension is marked as critical - if the altname string is prepeneded with the + tag=value. Valid tags are IP, DNS, EMAIL, URI, DN, RID, + KRB5, and UPN. The SubjectAltName extension is marked as + critical if the altname string is prepeneded with the SunOS 5.11 Last change: 10 Aug 2007 10 @@ -675,11 +718,22 @@ dir=directory_path Specifies the NSS database directory, or OpenSSL key- store directory where the requested object is stored. + eku=[critical:]EKU Name,[critical:]EKU Name, ...] + Specifies the extended key usage X.509v3 extension values + to add to the certificate or certificate request. The + "EKU Name" must be one of the following: + serverAuth | clientAuth | codeSigning | emailProtection | + ipsecEndSystem | ipsecTunnel | ipsecUser | timeStamping | + OCSPSigning | KPClientAuth | KPKdc | scLogon + + example: + eku=KPClientAuth,clientAuth + extractable=y | n Specifies the resulting symmetric key in the PKCS#11 token is extractable or not extractable. The valid values are: y and n. The default value is y. @@ -1145,11 +1199,11 @@ ____________________________________________________________ | ATTRIBUTE TYPE | ATTRIBUTE VALUE | |_____________________________|_____________________________| | Availability | SUNWcsu | |_____________________________|_____________________________| - | Interface Stability | Evolving | + | Interface Stability | Uncommitted | |_____________________________|_____________________________| SEE ALSO attributes(5), pkcs11_softtoken(5) --- kmfcfg.1.orig Mon Jan 14 16:14:18 2008 +++ kmfcfg.1.new Mon Jan 14 16:16:16 2008 @@ -72,11 +72,12 @@ codeSigning | emailProtection | ipsecEndSystem | ipsecTunnel | ipsecUser | timeStamping | - OCSPSigning],[...] + OCSPSigning | KPClientAuth | + KPKdc | scLogon],[...] [ekuoids=OID,OID,OID...] The create subcommand supports the following options: @@ -178,11 +179,11 @@ A comma separated list of Extended Key Usage names that are required by the policy being defined. The list of values allowed for EKUNAMES are: serverAuth, clientAuth, codeSigning, emailProtection, ipsecEndSystem, ipsecTunnel, ipsecUser, timeStamp- - ing, and OCSPSigning + ing, OCSPSigning, KPClientAuth, KPKdc, and scLogon. The OCSP, CRL, key usage and extended key usage checkings are off by default. To turn on any one of them, specify one or more attributes for the partic- ular checking. For example, if the ocsp-responder @@ -531,11 +532,12 @@ User Commands kmfcfg(1) - OCSPSigning],[...] + OCSPSigning | KPClientAuth | + KPKdc | scLogon],[...] [ekuoids=OID,OID,OID] [eku-none=true|false] The modify subcommand supports many of the same options 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: ON 6.5. ARC review type: FastTrack 6.6. ARC Exposure: open From carlsonj@phorcys.east.sun.com Wed Jan 16 08:56:21 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m0GGuLsc020623 for ; Wed, 16 Jan 2008 08:56:21 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m0GGuBDu029295 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 16 Jan 2008 08:56:21 -0800 (PST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JUQ00E2PXPVDQ00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 16 Jan 2008 09:56:19 -0700 (MST) Received: from phorcys.east.sun.com ([129.148.174.143]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JUQ006O4XPQ4O90@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 16 Jan 2008 09:56:14 -0700 (MST) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.2+Sun/8.14.2) with ESMTP id m0GGlJoC029906; Wed, 16 Jan 2008 11:47:19 -0500 (EST) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.2+Sun/8.14.2/Submit) id m0GGlJML029903; Wed, 16 Jan 2008 11:47:19 -0500 (EST) Date: Wed, 16 Jan 2008 11:47:18 -0500 From: James Carlson Subject: Re: new EKU support for pktool and kmfcfg [PSARC/2008/037 FastTrack timeout 01/30/2008] In-reply-to: <200801161555.m0GFtW1o026207@borg.SFBay.Sun.COM> To: Wyllys Ingersoll Cc: PSARC-ext@sun.com, kmf-discuss@opensolaris.org Message-id: <18318.13590.892394.871528@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <200801161555.m0GFtW1o026207@borg.SFBay.Sun.COM> Status: RO Content-Length: 992 Wyllys Ingersoll writes: > @@ -1145,11 +1199,11 @@ > ____________________________________________________________ > | ATTRIBUTE TYPE | ATTRIBUTE VALUE | > |_____________________________|_____________________________| > | Availability | SUNWcsu | > |_____________________________|_____________________________| > - | Interface Stability | Evolving | > + | Interface Stability | Uncommitted | > |_____________________________|_____________________________| What's the story behind this? The taxonomy says that previously "Evolving" things delivered via ON and reviewed by PSARC are ordinarily assumed to be "Committed." -- James Carlson, Solaris Networking Sun Microsystems / 35 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From wyllys.ingersoll@sun.com Wed Jan 16 09:14:01 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m0GHE0G6021074 for ; Wed, 16 Jan 2008 09:14:01 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m0GHDe3v025455; Thu, 17 Jan 2008 01:13:57 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JUQ00F0HYJ6UH00@nwk-avmta-1.sfbay.Sun.COM>; Wed, 16 Jan 2008 09:13:54 -0800 (PST) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.59]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JUQ00I4IYJ60LC0@nwk-avmta-1.sfbay.Sun.COM>; Wed, 16 Jan 2008 09:13:54 -0800 (PST) Received: from [10.7.251.182] (punchin-wyllys.SFBay.Sun.COM [10.7.251.182]) by jurassic-x4600.sfbay.sun.com (8.14.2+Sun/8.14.2) with ESMTP id m0GHDq9r976682 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 16 Jan 2008 09:13:53 -0800 (PST) Date: Wed, 16 Jan 2008 12:13:52 -0500 From: Wyllys Ingersoll Subject: Re: new EKU support for pktool and kmfcfg [PSARC/2008/037 FastTrack timeout 01/30/2008] In-reply-to: <18318.13590.892394.871528@gargle.gargle.HOWL> To: James Carlson Cc: Wyllys Ingersoll , PSARC-ext@sun.com, kmf-discuss@opensolaris.org Message-id: <478E3B50.1010007@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <200801161555.m0GFtW1o026207@borg.SFBay.Sun.COM> <18318.13590.892394.871528@gargle.gargle.HOWL> User-Agent: Thunderbird 2.0.0.4 (X11/20070827) Status: RO Content-Length: 1207 James Carlson wrote: > Wyllys Ingersoll writes: > >> @@ -1145,11 +1199,11 @@ >> ____________________________________________________________ >> | ATTRIBUTE TYPE | ATTRIBUTE VALUE | >> |_____________________________|_____________________________| >> | Availability | SUNWcsu | >> |_____________________________|_____________________________| >> - | Interface Stability | Evolving | >> + | Interface Stability | Uncommitted | >> |_____________________________|_____________________________| >> > > What's the story behind this? The taxonomy says that previously > "Evolving" things delivered via ON and reviewed by PSARC are > ordinarily assumed to be "Committed." > > The original case for KMF (2005/074) had pktool(1) as Uncommitted . I think this was overlooked when the man page was updated. The man page diffs included in this case are just changing that to be reflect the original case. However, if this (and also kmfcfg(1)) should have been "Committed" in the first place, then I have no problem with making that change here. -Wyllys From carlsonj@phorcys.east.sun.com Wed Jan 16 09:31:31 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m0GHVV8C021498 for ; Wed, 16 Jan 2008 09:31:31 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m0GHVSKa010208; Wed, 16 Jan 2008 09:31:30 -0800 (PST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JUQ00H0TZCHJC00@brm-avmta-1.central.sun.com>; Wed, 16 Jan 2008 10:31:29 -0700 (MST) Received: from phorcys.east.sun.com ([129.148.174.143]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JUQ006HEZCG4QB0@brm-avmta-1.central.sun.com>; Wed, 16 Jan 2008 10:31:28 -0700 (MST) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.2+Sun/8.14.2) with ESMTP id m0GHMXbZ000123; Wed, 16 Jan 2008 12:22:33 -0500 (EST) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.2+Sun/8.14.2/Submit) id m0GHMXpE000120; Wed, 16 Jan 2008 12:22:33 -0500 (EST) Date: Wed, 16 Jan 2008 12:22:33 -0500 From: James Carlson Subject: Re: new EKU support for pktool and kmfcfg [PSARC/2008/037 FastTrack timeout 01/30/2008] In-reply-to: <478E3B50.1010007@sun.com> To: Wyllys Ingersoll Cc: Wyllys Ingersoll , PSARC-ext@sun.com, kmf-discuss@opensolaris.org Message-id: <18318.15705.276426.801910@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <200801161555.m0GFtW1o026207@borg.SFBay.Sun.COM> <18318.13590.892394.871528@gargle.gargle.HOWL> <478E3B50.1010007@sun.com> Status: RO Content-Length: 1341 Wyllys Ingersoll writes: > James Carlson wrote: > > What's the story behind this? The taxonomy says that previously > > "Evolving" things delivered via ON and reviewed by PSARC are > > ordinarily assumed to be "Committed." > > > > > > The original case for KMF (2005/074) had pktool(1) as Uncommitted . > I think this was overlooked when the man page was updated. The man page > diffs > included in this case are just changing that to be reflect the original > case. OK; I see. > However, if this (and also kmfcfg(1)) should have been "Committed" in > the first place, > then I have no problem with making that change here. The question should be about what stability the users of the tool need, and what you're able to provide rather than a "should." My guess is that there are at least a few subcommands that would be likely to be used within scripts, meaning that users will need something that they can rely on. If that's something you can provide -- a promise that you're not going to break things in a later Minor release without prior notice -- then I think "Committed" would probably be better. -- James Carlson, Solaris Networking Sun Microsystems / 35 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From wyllys.ingersoll@sun.com Wed Jan 16 10:24:08 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m0GIO8pc024160 for ; Wed, 16 Jan 2008 10:24:08 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m0GIO303024764; Wed, 16 Jan 2008 10:24:07 -0800 (PST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JUR00I0N1S6R400@nwk-avmta-2.sfbay.sun.com>; Wed, 16 Jan 2008 10:24:06 -0800 (PST) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.59]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JUR00F4J1S53X80@nwk-avmta-2.sfbay.sun.com>; Wed, 16 Jan 2008 10:24:05 -0800 (PST) Received: from [10.7.251.182] (punchin-wyllys.SFBay.Sun.COM [10.7.251.182]) by jurassic-x4600.sfbay.sun.com (8.14.2+Sun/8.14.2) with ESMTP id m0GIO45U988803 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 16 Jan 2008 10:24:04 -0800 (PST) Date: Wed, 16 Jan 2008 13:24:03 -0500 From: Wyllys Ingersoll Subject: Re: new EKU support for pktool and kmfcfg [PSARC/2008/037 FastTrack timeout 01/30/2008] In-reply-to: <18318.15705.276426.801910@gargle.gargle.HOWL> To: James Carlson Cc: Wyllys Ingersoll , PSARC-ext@sun.com, kmf-discuss@opensolaris.org Message-id: <478E4BC3.3040103@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <200801161555.m0GFtW1o026207@borg.SFBay.Sun.COM> <18318.13590.892394.871528@gargle.gargle.HOWL> <478E3B50.1010007@sun.com> <18318.15705.276426.801910@gargle.gargle.HOWL> User-Agent: Thunderbird 2.0.0.4 (X11/20070827) Status: RO Content-Length: 899 James Carlson wrote: >> However, if this (and also kmfcfg(1)) should have been "Committed" in >> the first place, >> then I have no problem with making that change here. >> > > The question should be about what stability the users of the tool > need, and what you're able to provide rather than a "should." > > My guess is that there are at least a few subcommands that would be > likely to be used within scripts, meaning that users will need > something that they can rely on. If that's something you can provide > -- a promise that you're not going to break things in a later Minor > release without prior notice -- then I think "Committed" would > probably be better. > > We designed the interfaces so they could be scripted and we would prefer to not make incompatible changes in the future, so I am fine with switching them both to "Committed" (both pktool and kmfcfg). -Wyllys From wyllys.ingersoll@sun.com Tue Jan 22 17:21:27 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m0N1LQVS004262 for ; Tue, 22 Jan 2008 17:21:26 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m0N1LFNu005500 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 23 Jan 2008 09:21:25 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JV200001P3M4H00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 22 Jan 2008 17:21:22 -0800 (PST) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.63]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JV200K6VP3LIT40@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 22 Jan 2008 17:21:22 -0800 (PST) Received: from [10.7.251.182] (punchin-wyllys.SFBay.Sun.COM [10.7.251.182]) by jurassic-x4600.sfbay.sun.com (8.14.2+Sun/8.14.2) with ESMTP id m0N1LLeZ959302 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 22 Jan 2008 17:21:21 -0800 (PST) Date: Tue, 22 Jan 2008 20:21:21 -0500 From: Wyllys Ingersoll Subject: PSARC 2008/037 new EKU support for pktool and kmfcfg To: PSARC-ext@sun.com Cc: kmf-discuss@opensolaris.org Message-id: <47969691.80005@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 User-Agent: Thunderbird 2.0.0.6 (X11/20070802) Status: RO Content-Length: 184 Based on email exchanges from last week, I updated the man pages in the case directory to reflect that both kmfcfg(1) and pktool(1) are being moved to "Committed" status. -Wyllys From wyllys.ingersoll@sun.com Wed Jan 23 11:21:00 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m0NJKxcJ014111 for ; Wed, 23 Jan 2008 11:21:00 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m0NJKwxV045330 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 23 Jan 2008 12:20:59 -0700 (MST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JV400E0932Z1G00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 23 Jan 2008 12:20:59 -0700 (MST) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.63]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JV4003QO32WES70@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 23 Jan 2008 12:20:56 -0700 (MST) Received: from [10.7.251.182] (punchin-wyllys.SFBay.Sun.COM [10.7.251.182]) by jurassic-x4600.sfbay.sun.com (8.14.2+Sun/8.14.2) with ESMTP id m0NJKtuI261373 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 23 Jan 2008 11:20:56 -0800 (PST) Date: Wed, 23 Jan 2008 14:20:50 -0500 From: Wyllys Ingersoll Subject: PSARC 2008/037 new EKU support for pktool and kmfcfg To: PSARC-ext@sun.com, kmf-discuss@opensolaris.org Message-id: <47979392.1030704@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 User-Agent: Thunderbird 2.0.0.6 (X11/20070802) Status: RO Content-Length: 54 This case was approved in today's meeting. -Wyllys