Skip to content

Support setting certificate permissions for the modern Key Storage Provider#1675

Open
farhanalam wants to merge 4 commits intoOctopusDeploy:masterfrom
farhanalam:windows-certificate-grant-read-access/1
Open

Support setting certificate permissions for the modern Key Storage Provider#1675
farhanalam wants to merge 4 commits intoOctopusDeploy:masterfrom
farhanalam:windows-certificate-grant-read-access/1

Conversation

@farhanalam
Copy link
Copy Markdown
Contributor

Background

The existing step template only works for the legacy CSP but not the modern KSP on windows machines.
Changes in this PR add support for KSP and keep legacy support in place. The original template fails silently on modern Windows machines.

References:
https://www.gradenegger.eu/en/basics-cryptographic-service-provider-csp-and-key-storage-provider-ksp/
https://stackoverflow.com/questions/65417587/getting-private-keys-to-work-on-windows-7-powershell-version-2
https://stackoverflow.com/questions/66157349/privatekey-is-missing-when-importing-a-certificate

Results

Before

No log changes

After

No log changes

Pre-requisites

  • Id should be a GUID that is not 00000000-0000-0000-0000-000000000000
    • NOTE If you are modifying an existing step template, please make sure that you do not modify the Id property (updating the Id will break the Library sync functionality in Octopus).
  • Version should be incremented, otherwise the integration with Octopus won't update the step template correctly
  • Parameter names should not start with $
  • Step template parameter names (the ones declared in the JSON, not the script body) should be prefixed with a namespace so that they are less likely to clash with other user-defined variables in Octopus (see this issue). For example, use an abbreviated name of the step template or the category of the step template).
  • LastModifiedBy field must be present, and (optionally) updated with the correct author
  • The best practices documented here have been applied
  • If a new Category has been created:
    • An image with the name {categoryname}.png must be present under the step-templates/logos folder
    • The switch in the humanize function in gulpfile.babel.js must have a case statement corresponding to it

@github-actions
Copy link
Copy Markdown

Start Hyponome locally

docker pull ghcr.io/hnrkndrssn/hyponome:main
docker run --rm -p 8000:8080 -it ghcr.io/hnrkndrssn/hyponome:main

Review in Hyponome

@@ -30,8 +30,8 @@
}
],
"LastModifiedOn": "2015-01-30T14:37:16.927+00:00",
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@farhanalam: I would suggest updating this LastModifedOn value
-OR-
I know of at least some templates that do not have a LastModifiedOn value, so removing it might also be an option. @twerthi , @hnrkndrssn?

"$Meta": {
"ExportedAt": "2015-01-30T14:39:14.212+00:00",
"OctopusVersion": "2.6.0.778",
"Type": "ActionTemplate"
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@farhanalam: on my past PRs, i have been updating the ExportedAt value, as well as the OctopsVersion. The latter seems reasonably helpful as it identifies which version of Octopus Deploy this update template is known to work with at a minimum.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure I'll be happy to update these values. Does the pull_request_template need to be updated to reflect this change in submission requirements by the Octopus team?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants