[__opendkim_genkey]: Key always gets replaced against remote hosts #19

New issue

Closed

opened 2022-03-15 07:57:18 +00:00 by evilham · 0 comments

evilham commented

2022-03-15 07:57:18 +00:00

Collaborator

Due to:

if ! [ -f "${DIRECTORY}${SELECTOR}.private" ]; then

Running __opendkim_genkey with the same arguments against a remote host results in:

# After first cdist run
root@tests:/var/db/dkim # sha256 default.private 
SHA256 (default.private) = 571d5b85185d6434930b9e03efe0144706757db24dfb0e64a57b520793febfdc
# Second cdist run, where the private key has been replaced
root@tests:/var/db/dkim # sha256 default.private
SHA256 (default.private) = c75c270ef5aa6f2556269a1deb56179f4f48a64e7fd8d719549a8f4aa28f6ba2

This is an issue wherever the type has already deployed the service as replacing the key requires DNS changes.

Due to: https://code.ungleich.ch/ungleich-public/cdist-contrib/src/commit/af04f7464b3130a48dd9eee2668cd8da906c4fbb/type/__opendkim_genkey/gencode-remote#L51 Running `__opendkim_genkey` with the same arguments against a remote host results in: ``` # After first cdist run root@tests:/var/db/dkim # sha256 default.private SHA256 (default.private) = 571d5b85185d6434930b9e03efe0144706757db24dfb0e64a57b520793febfdc # Second cdist run, where the private key has been replaced root@tests:/var/db/dkim # sha256 default.private SHA256 (default.private) = c75c270ef5aa6f2556269a1deb56179f4f48a64e7fd8d719549a8f4aa28f6ba2 ``` This is an issue wherever the type has already deployed the service as replacing the key requires DNS changes.