Red Hat Bugzilla – Bug 1154693
trust export output differs for empty filter option and given default filter option
Last modified: 2017-08-01 12:52:09 EDT
Description of problem: When you extract certificates via trust util you'll get different output for not specified filter option and filter option set to the default value. Also, trus utility will throw a warning message about "multiple purposes" in the second case ---> "p11-kit: format does not support multiple purposes, defaulting to 'server-auth'" i:ppc64|m:ppc64 root@ibm-p8-kvm-03-guest-14 [~]# rm -rf certs i:ppc64|m:ppc64 root@ibm-p8-kvm-03-guest-14 [~]# trust extract --format=pem-directory certs i:ppc64|m:ppc64 root@ibm-p8-kvm-03-guest-14 [~]# ls certs/ | wc -l 168 i:ppc64|m:ppc64 root@ibm-p8-kvm-03-guest-14 [~]# ls certs/ >cert_list.txt i:ppc64|m:ppc64 root@ibm-p8-kvm-03-guest-14 [~]# sha256sum cert_list.txt 4508aea05d767d8215f493972c53a00ab5f3a0bdfde082df3dc17a1fa3212a6c cert_list.txt i:ppc64|m:ppc64 root@ibm-p8-kvm-03-guest-14 [~]# rm -rf certs i:ppc64|m:ppc64 root@ibm-p8-kvm-03-guest-14 [~]# trust extract --filter=ca-anchors --format=pem-directory certs p11-kit: format does not support multiple purposes, defaulting to 'server-auth' i:ppc64|m:ppc64 root@ibm-p8-kvm-03-guest-14 [~]# ls certs/ | wc -l 153 i:ppc64|m:ppc64 root@ibm-p8-kvm-03-guest-14 [~]# ls certs/ >cert_list.txt i:ppc64|m:ppc64 root@ibm-p8-kvm-03-guest-14 [~]# sha256sum cert_list.txt dd001ddcb85fc99a8cb542f0574d45bd6f1407e8c600d86ff84d40f6235817cf cert_list.txt Version-Release number of selected component (if applicable): p11-kit-0.20.7-2.el7 How reproducible: Always Steps to Reproduce: 1. trust extract --format=pem-directory certs; echo $? 2. rm -rf certs 3. rust extract --filter=ca-anchors --format=pem-directory certs; echo $? Actual results: 0 p11-kit: format does not support multiple purposes, defaulting to 'server-auth' 0 Expected results: 0 0 Additional info: i:ppc64|m:ppc64 root@ibm-p8-kvm-03-guest-14 [~]# trust extract --help - SNIP - --filter=<what> filter of what to export ca-anchors certificate anchors (default) - SNIP -
I tend to agree that the error message is confusing. Here is a proposed change to it: https://github.com/ueno/p11-kit/commit/aa0ab218df915238a657527947dc309f70889f27 With this: $ trust extract --format=pem-directory certs p11-kit: format requires a purpose, specify it with --purpose; defaulting to 'server-auth' $ trust extract --format pem-directory --filter ca-anchors --purpose server-auth --purpose client-auth certs p11-kit: format does not support multiple purposes, defaulting to 'server-auth'
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2017:1981