Pre-release: v0.2.1

NOTICE

@@ -33,6 +33,88 @@ Copyright 2013-2017 Opera Software AS
    See the License for the specific language governing permissions and
    limitations under the License.
 
+Component: jsbn
+
+Copyright (c) 2003-2005  Tom Wu
+All Rights Reserved.
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND, 
+EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY 
+WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.  
+
+IN NO EVENT SHALL TOM WU BE LIABLE FOR ANY SPECIAL, INCIDENTAL,
+INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND, OR ANY DAMAGES WHATSOEVER
+RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER OR NOT ADVISED OF
+THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF LIABILITY, ARISING OUT
+OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+In addition, the following condition applies:
+
+All redistributions must retain an intact copy of this copyright notice
+and disclaimer.
+
+Component: crypto-js
+
+(c) 2009-2013 by Jeff Mott. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, 
+are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this list 
+of conditions, and the following disclaimer.
+* Redistributions in binary form must reproduce the above copyright notice, this 
+list of conditions, and the following disclaimer in the documentation or other 
+materials provided with the distribution.
+* Neither the name CryptoJS nor the names of its contributors may be used to 
+endorse or promote products derived from this software without specific prior 
+written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS," AND 
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ARE DISCLAIMED. 
+IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, 
+INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 
+NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 
+PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, 
+WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 
+POSSIBILITY OF SUCH DAMAGE.
+
+Component: PHP Secure Communications Library
+
+Copyright 2007-2016 TerraFrost and other contributors
+http://phpseclib.sourceforge.net/
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
 Component: Bootstrap Framework
 
 The MIT License (MIT)

docker/entrypoint.sh

@@ -7,12 +7,12 @@ if [ `whoami` == 'cert-sync' ]; then
   fi
   if [ ! -r /sca/config/cert-sync ]; then
       echo "private key not found or incorrect permissions."
-      echo "Permissions must be $(id -u cert-sync):$(id -g cert-sync) with 400"
+      echo "Permissions must be $(id -u cert-sync):$(id -g nobody) with 440"
       exit 1
   fi
   if [ ! -r /sca/config/cert-sync.pub ]; then
       echo "public key not found or incorrect permissions."
-      echo "Permissions must be $(id -u cert-sync):$(id -g cert-sync) with at least 400"
+      echo "Permissions must be $(id -u cert-sync):$(id -g nobody) with at least 440"
       exit 1
   fi
   if ! grep "^timeout_util = BusyBox$" /sca/config/config.ini > /dev/null; then

scripts/sync.php

@@ -655,6 +655,23 @@ function profile_sync($ssh, $hostname, $server, $certdir, $profiles) {
 function restart_services($ssh, $hostname, $server, $certdir, $services) {
 	global $sync_request_dir;
 	foreach($services as $service) {
+		$check_script = $service->check_script;
+		if($check_script->name != "") {
+			try {		
+				$success = false;			
+				$result = $ssh->exec('/usr/bin/env sh -c ". '.escapeshellarg("$certdir/variable/$service->name").'; sh '.escapeshellarg("$certdir/script/$check_script->name").'"');
+				$err = $ssh->getStdError();
+				$success = !is_bool($ssh->getExitStatus()) && $ssh->getExitStatus() == 0;
+				if($err != "") {
+					echo date('c')." {$hostname}: check script returned: $err\n";
+				}
+				if("$result" == "$service->cert_serial\n") {
+					echo date('c')." {$hostname}: Service {$service->name} does not require a restart\n";
+					continue;
+				}
+			} catch(ErrorException $e) {}
+		}
+
 		echo date('c')." {$hostname}: Restarting service {$service->name}\n";
 
 		$restart_script = $service->restart_script;
@@ -700,13 +717,13 @@ function restart_services($ssh, $hostname, $server, $certdir, $services) {
 		if($check_script->name != "") {
 			try {		
 				$success = false;			
-				$ssh->exec('/usr/bin/env sh -c ". '.escapeshellarg("$certdir/variable/$service->name").'; sh '.escapeshellarg("$certdir/script/$check_script->name").'"');
+				$result = $ssh->exec('/usr/bin/env sh -c ". '.escapeshellarg("$certdir/variable/$service->name").'; sh '.escapeshellarg("$certdir/script/$check_script->name").'"');
 				$err = $ssh->getStdError();
 				$success = !is_bool($ssh->getExitStatus()) && $ssh->getExitStatus() == 0;
 				if($err != "") {
 					echo date('c')." {$hostname}: check script returned: $err\n";
 				}
-				if($result != $service->cert_serial) {
+				if("$result" != "$service->cert_serial\n") {
 					echo date('c')." {$hostname}: Check script returned incorrect certificate serial: $result\n";
 					$server->sync_report('sync failure', 'Check script returned incorrect certificate serial');
 					$sync_request_dir->delete_all_sync_requests();

templates/base.php

@@ -52,7 +52,7 @@
 </div>
 <div id="footer">
 	<div class="container">
-		<p class="text-muted credit"><?php out($web_config['footer'], ESC_NONE)?> (v0.1.0)</p>
+		<p class="text-muted credit"><?php out($web_config['footer'], ESC_NONE)?> (v0.2.1)</p>
 		<?php if($this->get('active_user') && $this->get('active_user')->developer) { ?>
 		<?php } ?>
 	</div>

templates/server_deployment.php

@@ -38,8 +38,11 @@
                             Script changes will not trigger a restart of services.
                         </li>
                     </ul>
+                    Changes are detected using the check script. If there is no check script, services
+                    always get restarted.<br><br>
+
                     SCA will only display generic error messages as server synchronisation status.
-                    To quickly react to difficultes it is advices to follow the error log file using
+                    To quickly react to difficultes it is adviced to follow the error log file using
                     a command like: <br> <code>tail -f /var/log/cert/sync.log</code><br><br>
 
                     Note that only one server and service will be deployed/restarted at a time. If a

templates/servers.php

@@ -46,7 +46,7 @@
 									foreach ($options as $value => $label) {
 										$checked = in_array($value, $this->get('filter')['sync_status']) ? ' checked' : '';
 									?>
-									<div class="checkbox"><label><input type="checkbox" name="type[]" value="<?php out($value)?>"<?php out($checked)?>> <?php out($label)?></label></div>
+									<div class="checkbox"><label><input type="checkbox" name="sync_status[]" value="<?php out($value)?>"<?php out($checked)?>> <?php out($label)?></label></div>
 									<?php }?>
 								</div>
 							</div>