<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en" style='--code-editor-font: var(--default-mono-font, "GitLab Mono"), JetBrains Mono, Menlo, DejaVu Sans Mono, Liberation Mono, Consolas, Ubuntu Mono, Courier New, andale mono, lucida console, monospace;'>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
<title>
GitLab
</title>
<style data-premailer="ignore" type="text/css">
a { color: #1068bf; }
</style>
<style>img {
max-width: 100%; height: auto;
}
body {
font-size: .875rem;
}
body {
-webkit-text-shadow: hsla(0,0%,100%,.01) 0 0 1px;
}
body {
font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"; font-size: inherit;
}
</style>
</head>
<body style='font-size: inherit; -webkit-text-shadow: hsla(0,0%,100%,.01) 0 0 1px; font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";'>
<div class="content">
<p class="details" style="font-style: italic; color: #626168;">
Issue created by <a href="https://gitlab.com/rockdaboot">Tim Rühsen</a>: <a href="https://gitlab.com/gnutls/gnutls/-/work_items/1911">#1911</a>
</p>
<div class="md" style="position: relative; z-index: 1; color: #3a383f; word-wrap: break-word;">
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial">Opening this as discussion to clarify if we want this change or not.</p>
<h2 id="user-content-problem" dir="auto" style="margin-top: 20px; margin-bottom: 10px;" align="initial">Problem<a href="#problem" aria-label="Link to heading 'Problem'" data-heading-content="Problem" class="anchor" style="margin-top: 0px;"></a>
</h2>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial">When having a non-matching or wrongly-spelled option in a template file (e.g., to create a certificate), <code style='font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; margin-top: 0px; font-weight: inherit; overflow-wrap: break-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25rem;'>certool</code> prints a warning but then creates the possibly wrong certificate and exits with status 0.</p>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial">The danger here is to overlook the warning. On a console, the warning lines easily scrolls out of the window, and from what the user sees all looks good.</p>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial">Scripting / automation that relies on the exit status will just continue, potentially creating certificates that are missing necessary KU or EKU extensions.</p>
<h2 id="user-content-suggestion" dir="auto" style="margin-top: 20px; margin-bottom: 10px;" align="initial">Suggestion<a href="#suggestion" aria-label="Link to heading 'Suggestion'" data-heading-content="Suggestion" class="anchor" style="margin-top: 0px;"></a>
</h2>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial"><code style='font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; margin-top: 0px; font-weight: inherit; overflow-wrap: break-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25rem;'>certtool</code> should be very strict with malformed input. Unknown template options should not be skipped, but lead to an error without creating any certificate.</p>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial">The alternative, testing the status code <em style="margin-top: 0px;">and</em> grepping the console output for <code style='font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; font-weight: inherit; overflow-wrap: break-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25rem;'>warning</code> seems to put too much burden on the user. And it's not expected or common sense.</p>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial">This would be a breaking change for anyone who has malformed template files. But IMO it's better to force people to think about why something breaks in their build pipeline then possibly introducing security issues.</p>
<p dir="auto" style="color: #3a383f; margin: 0px;" align="initial">Are there any use cases where a new CLI option to revert to the old behavior is beneficial?</p>
</div>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #626168;">
—
<br>
Reply to this email directly or <a href="https://gitlab.com/gnutls/gnutls/-/work_items/1911">view it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target="_blank" rel="noopener noreferrer" href="https://gitlab.com">gitlab.com</a>. <a href="https://gitlab.com/-/namespace/17175643/sent_notifications/5-cgr6kvmrhjvrawy8kjr5k15w8-a84t7/unsubscribe" target="_blank" rel="noopener noreferrer">Unsubscribe</a> from this thread · <a href="https://gitlab.com/-/profile/notifications" target="_blank" rel="noopener noreferrer" class="mng-notif-link">Manage all notifications</a> · <a href="https://gitlab.com/help" target="_blank" rel="noopener noreferrer" class="help-link">Help</a>
<span style="color: transparent; font-size: 0; display: none; overflow: hidden; opacity: 0; width: 0; height: 0; max-width: 0; max-height: 0;">
Notification message regarding https://gitlab.com/gnutls/gnutls/-/work_items/1911 at 1782211144
</span>
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Work item","url":"https://gitlab.com/gnutls/gnutls/-/work_items/1911"}}</script>
</p>
</div>
</body>
</html>