From: "Paul Smedley" <ecs-isp@2rosenthals.com>
Message-ID: <6e6819b7-e747-4caf-a869-4155b209aca1@smedley.id.au>
Date: Fri, 16 Aug 2024 07:28:17 +0930
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [eCS-ISP] Apache HTTPS
To: eCS ISP Mailing List <ecs-isp@2rosenthals.com>
References: <list-10601905@2rosenthals.com>
Content-Language: en-AU
In-Reply-To: <list-10601905@2rosenthals.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

Hi Steven

On 16/8/24 06:56, Steven Levine wrote:
> In <list-10601870@2rosenthals.com>, on 08/16/24
>     at 06:26 AM, "Paul Smedley" <ecs-isp@2rosenthals.com> said:
>
> Hi Paul,
>
>> https://smedley.id.au/tmp/uacme-1.0.19-os2-20240816.zip is there now.
> This one understands @unixroot.  Thanks.
>
>> Additional change is that it uses symlink() rather than link().
> I don't think this is going to work for use in practice.  When updating a
> certificate what uacme does is
>
>    create a new-crt.pem and new-key.pem
>    hardlink the existing key.pem to timestamped-key.pem
>    hardlink the existing crt.pem to timestamped-crt.pem
>    unlink key.pem
>    unlink crt.pem
>    rename new-crt.pem to crt.pem
>    rename new-key.pem to key.pem
>
> With a symlink timestamped-key.pem will not contain the the content of
> key.pem, so there will be no useful backup.  The is why is suggested that
> the link needed to be replaced with a copy operation.

OK... there is no copy() function in klibc - so I guess I'll find an 
implementation, the alternate option being to rely on the user having 
cp.exe available in path and calling that.

Cheers,

Paul