mirror/munki
1
0
Fork 0
mirror of https://github.com/munki/munki.git synced 2026-01-26 00:49:21 -06:00
Code Issues Packages Projects Releases Wiki Activity

Rebuild the client keychain if the client cert or key is newer than the keychain

Browse Source
This commit is contained in:
Greg Neagle
2014-10-22 14:33:38 -07:00
parent 38ebbf79ec
commit 69fd00beeb
1 changed files with 22 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
code/client/munkilib/keychain.py
View File

@@ -406,6 +406,25 @@ def remove_from_keychain_list(keychain_path):
'Could not set new keychain list: %s', err)
def client_certs_newer_than_keychain():
'''Returns True if we have client certs that are newer than our
client keychain, False otherwise'''
certdata = get_munki_client_cert_data()
client_cert_path = certdata['client_cert_path']
client_key_path = certdata['client_key_path']
keychain_path = get_keychain_path()
if not os.path.exists(client_cert_path):
return False
if not os.path.exists(keychain_path):
return False
keychain_mod_time = os.stat(keychain_path).st_mtime
if os.stat(client_cert_path).st_mtime > keychain_mod_time:
return True
if os.stat(client_key_path).st_mtime > keychain_mod_time:
return True
return False
def debug_output():
'''Debugging output for keychain'''
try:
@@ -477,6 +496,9 @@ class MunkiKeychain(object):
Creates a new client keychain if needed.'''
add_ca_certs_to_system_keychain()
self.keychain_path = get_keychain_path()
if client_certs_newer_than_keychain():
# updated client certs; we should build a new keychain
os.unlink(self.keychain_path)
if os.path.exists(self.keychain_path):
# ensure existing keychain is available for use
self.added_keychain = add_to_keychain_list(self.keychain_path)