Added/updated host identity contributor docs. - #30651
Conversation
WalkthroughThe documentation was updated to clarify and expand details about the TPM-backed HTTP signing feature, now also called "Fleet host identity." It documents a new SCEP endpoint for host identity certificate retrieval, provides revised details on TPM ECC curve selection and file naming, and outlines additional configuration and troubleshooting steps. Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant FleetServer
Client->>FleetServer: GET /api/fleet/orbit/host_identity/scep (with enrollment secret)
FleetServer->>FleetServer: Validate enrollment secret
FleetServer->>FleetServer: Generate host identity certificate (ECC P-384 or P-256)
FleetServer->>Client: Return certificate (CN = hardware UUID or osquery identity)
Assessment against linked issues
Assessment against linked issues: Out-of-scope changes
Poem
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
Please merge after approval. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (7)
docs/Contributing/reference/api-for-contributors.md (1)
4995-5010: Add HTTP verb, parameters, and example for consistencyAll other endpoint docs explicitly state the HTTP method, show an example call, and outline parameters/response. Omitting those here breaks the established format and makes the new API harder to consume.
-`/api/fleet/orbit/host_identity/scep` +`GET /api/fleet/orbit/host_identity/scep` + +#### Parameters +None. + +#### Example + +`GET /api/fleet/orbit/host_identity/scep` + +##### Default response + +`Status: 200` +```pem +-----BEGIN CERTIFICATE----- +MIIC... +-----END CERTIFICATE----- +```Including a minimal example (even with an elided certificate) keeps this section on par with the rest of the document.
docs/Contributing/product-groups/orchestration/tpm-backed-http-signing.md (6)
140-141: Polish wording for flow & claritySmoother phrasing (drops the extra comma and uses active voice):
-The implementation determines TPM's P-384 support by attempting to create a test key, and falling back to P-256 if unsupported. +The implementation tests whether the TPM supports P-384 by creating a temporary key; if that fails, it falls back to P-256.
149-149: Terminate the sentence and fix redundant wordMinor grammar/typo:
-Filename used is `host_identity_tpm.pem` +The key file is saved as `host_identity_tpm.pem`.
206-206: Add missing article for Content-Type-... We did not include Content-Type header in the signature because not all requests have this header. +... We did not include the `Content-Type` header in the signature because not all requests have it.
247-252: Align list style & tighten wordingStatic-analysis flagged inconsistent bullet style and grammar. One compact fix:
-New configuration option for orbit and `fleetctl package`: `--fleet-managed-client-certificate` - -Server configuration option: none. The SCEP endpoint is always available on the server with Premium license and configured server private key. The server verifies that: -- requests with HTTP message signatures match the certificate public key and the host node key -- requests without HTTP message signatures do not have associated host identity certificates +*New orbit / `fleetctl package` flag*: `--fleet-managed-client-certificate` + +*Server configuration*: none required. With a Premium license and a configured server private key, the SCEP endpoint is always exposed. The server verifies: + - requests **with** HTTP signatures: the signature matches the certificate’s public key and the host node key + - requests **without** HTTP signatures: no host-identity certificate is attached
259-260: Fix typo and add missing articles-3. **Rate limits**: Limit the rate/number of certificates issues for the same host. This guards against agent issues. -4. **Fleet server visibility**: Allow IT admin to see which hosts have host identity certificates. For example, we can add a field to `orbit_info` table and IT admin could set up a policy to make sure all hosts have certificates. +3. **Rate limits**: Limit the number of certificates issued for the same host. This guards against agent issues. +4. **Fleet server visibility**: Allow IT administrators to see which hosts have host-identity certificates (e.g., add a field to the `orbit_info` table so policies can ensure every host has a certificate).
279-279: End the list item with a period- - Check device file permissions (`/dev/tpmrm0`) + - Check device-file permissions (`/dev/tpmrm0`).
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
docs/Contributing/product-groups/orchestration/tpm-backed-http-signing.md(7 hunks)docs/Contributing/reference/api-for-contributors.md(2 hunks)
🧰 Additional context used
🧠 Learnings (3)
📓 Common learnings
Learnt from: getvictor
PR: fleetdm/fleet#30589
File: server/datastore/mysql/schema.sql:501-517
Timestamp: 2025-07-07T22:21:15.721Z
Learning: In the host_identity_scep_certificates table schema, the VARBINARY(100) size for public_key_raw, the nullable host_id without a foreign key constraint, and the use of plain DATETIME instead of DATETIME(6) are intentional design decisions, not issues to be addressed.
Learnt from: getvictor
PR: fleetdm/fleet#30589
File: ee/server/service/hostidentity/depot/depot.go:104-119
Timestamp: 2025-07-08T16:06:54.566Z
Learning: In ee/server/service/hostidentity/depot/depot.go, the security concern where shared challenges allow certificate revocation (lines 104-119) is a known issue that will be addressed in a later feature, not an immediate concern to fix.
docs/Contributing/product-groups/orchestration/tpm-backed-http-signing.md (2)
Learnt from: getvictor
PR: fleetdm/fleet#30589
File: server/datastore/mysql/schema.sql:501-517
Timestamp: 2025-07-07T22:21:15.721Z
Learning: In the host_identity_scep_certificates table schema, the VARBINARY(100) size for public_key_raw, the nullable host_id without a foreign key constraint, and the use of plain DATETIME instead of DATETIME(6) are intentional design decisions, not issues to be addressed.
Learnt from: getvictor
PR: fleetdm/fleet#30589
File: ee/server/service/hostidentity/depot/depot.go:104-119
Timestamp: 2025-07-08T16:06:54.566Z
Learning: In ee/server/service/hostidentity/depot/depot.go, the security concern where shared challenges allow certificate revocation (lines 104-119) is a known issue that will be addressed in a later feature, not an immediate concern to fix.
docs/Contributing/reference/api-for-contributors.md (2)
undefined
<retrieved_learning>
Learnt from: getvictor
PR: #30589
File: server/datastore/mysql/schema.sql:501-517
Timestamp: 2025-07-07T22:21:15.721Z
Learning: In the host_identity_scep_certificates table schema, the VARBINARY(100) size for public_key_raw, the nullable host_id without a foreign key constraint, and the use of plain DATETIME instead of DATETIME(6) are intentional design decisions, not issues to be addressed.
</retrieved_learning>
<retrieved_learning>
Learnt from: getvictor
PR: #30589
File: ee/server/service/hostidentity/depot/depot.go:104-119
Timestamp: 2025-07-08T16:06:54.566Z
Learning: In ee/server/service/hostidentity/depot/depot.go, the security concern where shared challenges allow certificate revocation (lines 104-119) is a known issue that will be addressed in a later feature, not an immediate concern to fix.
</retrieved_learning>
🪛 LanguageTool
docs/Contributing/product-groups/orchestration/tpm-backed-http-signing.md
[grammar] ~140-~140: There might be a mistake here.
Context: ...pport by attempting to create a test key, and falling back to P-256 if unsupporte...
(QB_NEW_EN_OTHER)
[grammar] ~140-~140: Use proper spacing conventions.
Context: ...nd falling back to P-256 if unsupported. ### Key storage Keys are saved as to the fi...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~149-~149: Use proper spacing conventions.
Context: ...- Parent key template Filename used is host_identity_tpm.pem ## SCEP certificate enrollment ### Overvie...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~168-~168: Place a period at the end of declarative sentences.
Context: ...identity.crt` in the specified directory #### Key usage separation The SCEP implement...
(QB_NEW_EN_OTHER_ERROR_IDS_000178)
[grammar] ~206-~206: Use articles correctly.
Context: ...and HTTP forwarding. We did not include Content-Type header in the signature because not all...
(QB_NEW_EN_OTHER_ERROR_IDS_000004)
[grammar] ~206-~206: Use proper spacing conventions.
Context: ...cause not all requests have this header. Additional metadata included: - **`keyid...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~247-~247: Use proper spacing conventions.
Context: ...ption for orbit and fleetctl package: --fleet-managed-client-certificate Server configuration option: none. The S...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~249-~249: Use articles correctly.
Context: ... is always available on the server with Premium license and configured server private k...
(QB_NEW_EN_OTHER_ERROR_IDS_000004)
[grammar] ~249-~249: Use articles correctly.
Context: ... on the server with Premium license and configured server private key. The server verifies...
(QB_NEW_EN_OTHER_ERROR_IDS_000004)
[grammar] ~249-~249: Avoid interrupting sentences with colons.
Context: ...er private key. The server verifies that: - requests with HTTP message signatures ma...
(QB_NEW_EN_OTHER_ERROR_IDS_000069)
[grammar] ~250-~250: There might be a mistake here.
Context: ...ificate public key and the host node key - requests without HTTP message signatures...
(QB_NEW_EN_OTHER)
[grammar] ~251-~251: Place a period at the end of declarative sentences.
Context: ...ve associated host identity certificates ## Future enhancements As this an initial ...
(QB_NEW_EN_OTHER_ERROR_IDS_000178)
[grammar] ~253-~253: Use proper spacing conventions.
Context: ...ity certificates ## Future enhancements As this an initial implementation, futur...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~255-~255: There might be a mistake here.
Context: ...ertificates ## Future enhancements As this an initial implementation, future featu...
(QB_NEW_EN_OTHER)
[grammar] ~255-~255: Use proper spacing conventions.
Context: ...ementation, future features may include: 1. One-time enrollment secret: This provi...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~257-~257: Use proper spacing conventions.
Context: ...dentity certificate and enroll in Fleet. 2. Key Rotation/Renewal: Automatic key ro...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~259-~259: There might be a mistake here.
Context: ...: Limit the rate/number of certificates issues for the same host. This guards against ...
(QB_NEW_EN_OTHER)
[grammar] ~259-~259: Use proper spacing conventions.
Context: ... host. This guards against agent issues. 4. Fleet server visibility: Allow IT admi...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~260-~260: There might be a mistake here.
Context: .... Fleet server visibility: Allow IT admin to see which hosts have host identity c...
(QB_NEW_EN_OTHER)
[grammar] ~260-~260: Use articles correctly.
Context: ...icates. For example, we can add a field to orbit_info table and IT admin could s...
(QB_NEW_EN_OTHER_ERROR_IDS_000004)
[grammar] ~260-~260: Correctly pair commas and coordinating conjunctions.
Context: ...ple, we can add a field to orbit_info table and IT admin could set up a policy to m...
(QB_NEW_EN_OTHER_ERROR_IDS_000073)
[grammar] ~260-~260: Use articles correctly.
Context: ...n add a field to orbit_info table and IT admin could set up a policy to make sur...
(QB_NEW_EN_OTHER_ERROR_IDS_000004)
[grammar] ~260-~260: Use proper spacing conventions.
Context: ...o make sure all hosts have certificates. 5. Windows Support: TPM support for Windo...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~263-~263: Use proper spacing conventions.
Context: ...cates, like a separate key for WiFi/VPN. 8. Hardware Attestation: TPM-based device...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~266-~266: Use proper spacing conventions.
Context: ...ol instead of SCEP to get a certificate. ## Troubleshooting ### Common issues 1. *...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~279-~279: Place a period at the end of declarative sentences.
Context: ... device file permissions (/dev/tpmrm0) 3. Key Creation Failures - Verify TPM ...
(QB_NEW_EN_OTHER_ERROR_IDS_000178)
🪛 markdownlint-cli2 (0.17.2)
docs/Contributing/product-groups/orchestration/tpm-backed-http-signing.md
250-250: Unordered list style
Expected: asterisk; Actual: dash
(MD004, ul-style)
251-251: Unordered list style
Expected: asterisk; Actual: dash
(MD004, ul-style)
279-279: Unordered list style
Expected: asterisk; Actual: dash
(MD004, ul-style)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
- GitHub Check: build-binaries
- GitHub Check: publish
- GitHub Check: markdown-link-check
- GitHub Check: build (20.x)
🔇 Additional comments (1)
docs/Contributing/reference/api-for-contributors.md (1)
17-17: TOC entry looks goodAnchor and formatting are consistent with the surrounding items.
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (4)
docs/Contributing/product-groups/orchestration/tpm-backed-http-signing.md (4)
30-34: Unify unordered-list marker to satisfy MD004The rest of the document uses
*for unordered lists. Switching these four-items keeps the style consistent and silences markdownlint.- - [TPM 2.0 Library specification](https://trustedcomputinggroup.org/resource/tpm-library-specification/) - - [TPM 2.0 Key Files](https://www.hansenpartnership.com/draft-bottomley-tpm2-keys.html) - de facto standard used by OpenConnect VPN and other tools - - [RFC 9421 - HTTP Message Signatures](https://datatracker.ietf.org/doc/html/rfc9421) - - [RFC 8894 - Simple Certificate Enrolment Protocol](https://datatracker.ietf.org/doc/html/rfc8894) (SCEP) + * [TPM 2.0 Library specification](https://trustedcomputinggroup.org/resource/tpm-library-specification/) + * [TPM 2.0 Key Files](https://www.hansenpartnership.com/draft-bottomley-tpm2-keys.html) – de-facto standard used by OpenConnect VPN and other tools + * [RFC 9421 – HTTP Message Signatures](https://datatracker.ietf.org/doc/html/rfc9421) + * [RFC 8894 – Simple Certificate Enrolment Protocol](https://datatracker.ietf.org/doc/html/rfc8894) (SCEP)
149-150: Grammar/clarity: add article and drop superfluous word-Filename used is `host_identity_tpm.pem` +The filename used is `host_identity_tpm.pem`.
206-207: Missing definite article around header name-We did not include Content-Type header in the signature because not all requests have this header. +We did not include the `Content-Type` header in the signature because not all requests include this header.
275-276: Typo: “issues” → “issued”-3. **Rate limits**: Limit the rate/number of certificates issues for the same host. This guards against agent issues. +3. **Rate limits**: Limit the rate/number of certificates issued for the same host. This guards against agent issues.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
docs/Contributing/product-groups/orchestration/tpm-backed-http-signing.md(7 hunks)
🧰 Additional context used
🧠 Learnings (2)
📓 Common learnings
Learnt from: getvictor
PR: fleetdm/fleet#30589
File: server/datastore/mysql/schema.sql:501-517
Timestamp: 2025-07-07T22:21:15.721Z
Learning: In the host_identity_scep_certificates table schema, the VARBINARY(100) size for public_key_raw, the nullable host_id without a foreign key constraint, and the use of plain DATETIME instead of DATETIME(6) are intentional design decisions, not issues to be addressed.
Learnt from: getvictor
PR: fleetdm/fleet#30589
File: ee/server/service/hostidentity/depot/depot.go:104-119
Timestamp: 2025-07-08T16:06:54.566Z
Learning: In ee/server/service/hostidentity/depot/depot.go, the security concern where shared challenges allow certificate revocation (lines 104-119) is a known issue that will be addressed in a later feature, not an immediate concern to fix.
docs/Contributing/product-groups/orchestration/tpm-backed-http-signing.md (2)
Learnt from: getvictor
PR: fleetdm/fleet#30589
File: ee/server/service/hostidentity/depot/depot.go:104-119
Timestamp: 2025-07-08T16:06:54.566Z
Learning: In ee/server/service/hostidentity/depot/depot.go, the security concern where shared challenges allow certificate revocation (lines 104-119) is a known issue that will be addressed in a later feature, not an immediate concern to fix.
Learnt from: getvictor
PR: fleetdm/fleet#30589
File: server/datastore/mysql/schema.sql:501-517
Timestamp: 2025-07-07T22:21:15.721Z
Learning: In the host_identity_scep_certificates table schema, the VARBINARY(100) size for public_key_raw, the nullable host_id without a foreign key constraint, and the use of plain DATETIME instead of DATETIME(6) are intentional design decisions, not issues to be addressed.
🪛 LanguageTool
docs/Contributing/product-groups/orchestration/tpm-backed-http-signing.md
[grammar] ~3-~3: Use proper spacing conventions.
Context: ...d refinements are currently being added. ## Overview TPM-backed HTTP signing is a s...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~24-~24: Use proper spacing conventions.
Context: ...with TPM * Trusted device authentication ## Architecture ### Reference links - [TP...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~26-~26: Use proper spacing conventions.
Context: ...d device authentication ## Architecture ### Reference links - [TPM 2.0 Library spec...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~28-~28: Use proper spacing conventions.
Context: ...on ## Architecture ### Reference links - [TPM 2.0 Library specification](https://t...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~33-~33: Use proper spacing conventions.
Context: ...racker.ietf.org/doc/html/rfc8894) (SCEP) ### Components The TPM-backed HTTP signing ...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~140-~140: There might be a mistake here.
Context: ...pport by attempting to create a test key, and falling back to P-256 if unsupporte...
(QB_NEW_EN_OTHER)
[grammar] ~140-~140: Use proper spacing conventions.
Context: ...nd falling back to P-256 if unsupported. ### Key storage Keys are saved as to the fi...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~149-~149: Use proper spacing conventions.
Context: ...- Parent key template Filename used is host_identity_tpm.pem ## SCEP certificate enrollment ### Overvie...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~168-~168: Place a period at the end of declarative sentences.
Context: ...identity.crt` in the specified directory #### Key usage separation The SCEP implement...
(QB_NEW_EN_OTHER_ERROR_IDS_000178)
[grammar] ~206-~206: Use articles correctly.
Context: ...and HTTP forwarding. We did not include Content-Type header in the signature because not all...
(QB_NEW_EN_OTHER_ERROR_IDS_000004)
[grammar] ~206-~206: Use proper spacing conventions.
Context: ...cause not all requests have this header. Additional metadata included: - **`keyid...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~247-~247: Use proper spacing conventions.
Context: ... Configuration ### Client configuration Enable TPM-backed HTTP signing when pack...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~249-~249: Use proper spacing conventions.
Context: ...igning when packaging or running fleetd: bash # Package with TPM signing enabled fleetctl package --fleet-managed-client-certificate ... # Run orbit with TPM signing enabled orbit --fleet-managed-client-certificate ... ### Server configuration No additional serv...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~259-~259: Use proper spacing conventions.
Context: ...ficate ... ``` ### Server configuration No additional server configuration is re...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~263-~263: Use proper spacing conventions.
Context: ...ense** - Configured server private key The server automatically verifies that: ...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~266-~266: There might be a mistake here.
Context: ...ertificate public key and the host node key - Requests without HTTP message signatu...
(QB_NEW_EN_OTHER)
[grammar] ~267-~267: Place a period at the end of declarative sentences.
Context: ...ve associated host identity certificates ## Future enhancements As this an initial ...
(QB_NEW_EN_OTHER_ERROR_IDS_000178)
[grammar] ~269-~269: Use proper spacing conventions.
Context: ...ity certificates ## Future enhancements As this an initial implementation, futur...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~271-~271: There might be a mistake here.
Context: ...ertificates ## Future enhancements As this an initial implementation, future featu...
(QB_NEW_EN_OTHER)
[grammar] ~271-~271: Use proper spacing conventions.
Context: ...ementation, future features may include: 1. One-time enrollment secret: This provi...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~273-~273: Use proper spacing conventions.
Context: ...dentity certificate and enroll in Fleet. 2. Key Rotation/Renewal: Automatic key ro...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~275-~275: There might be a mistake here.
Context: ...: Limit the rate/number of certificates issues for the same host. This guards against ...
(QB_NEW_EN_OTHER)
[grammar] ~275-~275: Use proper spacing conventions.
Context: ... host. This guards against agent issues. 4. Fleet server visibility: Allow IT admi...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~276-~276: There might be a mistake here.
Context: .... Fleet server visibility: Allow IT admin to see which hosts have host identity c...
(QB_NEW_EN_OTHER)
[grammar] ~276-~276: Use articles correctly.
Context: ...icates. For example, we can add a field to orbit_info table and IT admin could s...
(QB_NEW_EN_OTHER_ERROR_IDS_000004)
[grammar] ~276-~276: Correctly pair commas and coordinating conjunctions.
Context: ...ple, we can add a field to orbit_info table and IT admin could set up a policy to m...
(QB_NEW_EN_OTHER_ERROR_IDS_000073)
[grammar] ~276-~276: Use articles correctly.
Context: ...n add a field to orbit_info table and IT admin could set up a policy to make sur...
(QB_NEW_EN_OTHER_ERROR_IDS_000004)
[grammar] ~276-~276: Use proper spacing conventions.
Context: ...o make sure all hosts have certificates. 5. Windows Support: TPM support for Windo...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~279-~279: Use proper spacing conventions.
Context: ...cates, like a separate key for WiFi/VPN. 8. Hardware Attestation: TPM-based device...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~282-~282: Use proper spacing conventions.
Context: ...ol instead of SCEP to get a certificate. ## Troubleshooting ### TPM hardware issues...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~284-~284: Use proper spacing conventions.
Context: ...o get a certificate. ## Troubleshooting ### TPM hardware issues 1. **TPM device not...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~286-~286: Use proper spacing conventions.
Context: ...Troubleshooting ### TPM hardware issues 1. TPM device not found - Verify TPM i...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~288-~288: There might be a mistake here.
Context: ...PM hardware issues 1. TPM device not found - Verify TPM is enabled in BIOS/UE...
(QB_NEW_EN_OTHER)
[grammar] ~289-~289: There might be a mistake here.
Context: ...t found** - Verify TPM is enabled in BIOS/UEFI - Check kernel TPM driver is loaded ...
(QB_NEW_EN_OTHER)
[grammar] ~290-~290: There might be a mistake here.
Context: ...OS/UEFI - Check kernel TPM driver is loaded - Ensure device files exist with pro...
(QB_NEW_EN_OTHER)
[grammar] ~291-~291: Place a period at the end of declarative sentences.
Context: ...vice files exist with proper permissions 2. Permission denied - Add user to `ts...
(QB_NEW_EN_OTHER_ERROR_IDS_000178)
[grammar] ~293-~293: There might be a mistake here.
Context: ...ith proper permissions 2. Permission denied - Add user to tss group for TPM ...
(QB_NEW_EN_OTHER)
[grammar] ~294-~294: There might be a mistake here.
Context: ...** - Add user to tss group for TPM access - Check device file permissions (`/d...
(QB_NEW_EN_OTHER)
[grammar] ~295-~295: Place a period at the end of declarative sentences.
Context: ... device file permissions (/dev/tpmrm0) 3. Key creation failures - Verify TPM ...
(QB_NEW_EN_OTHER_ERROR_IDS_000178)
[grammar] ~297-~297: There might be a mistake here.
Context: ...ions (/dev/tpmrm0) 3. Key creation failures - Verify TPM is not locked or in f...
(QB_NEW_EN_OTHER)
[grammar] ~298-~298: There might be a mistake here.
Context: ... Verify TPM is not locked or in failure mode - Clear TPM if necessary (will lose ...
(QB_NEW_EN_OTHER)
[grammar] ~299-~299: There might be a mistake here.
Context: ...ar TPM if necessary (will lose existing keys) - Check available TPM resources ###...
(QB_NEW_EN_OTHER)
[grammar] ~300-~300: Place a period at the end of declarative sentences.
Context: ...keys) - Check available TPM resources ### Certificate enrollment issues 1. **SCEP...
(QB_NEW_EN_OTHER_ERROR_IDS_000178)
[grammar] ~302-~302: Use proper spacing conventions.
Context: ...urces ### Certificate enrollment issues 1. SCEP server connection issues - Ver...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~304-~304: There might be a mistake here.
Context: ...ent issues 1. SCEP server connection issues - Verify SCEP server URL is access...
(QB_NEW_EN_OTHER)
[grammar] ~305-~305: Use articles correctly.
Context: ... server connection issues** - Verify SCEP server URL is accessible (and your Flee...
(QB_NEW_EN_OTHER_ERROR_IDS_000004)
[grammar] ~305-~305: There might be a mistake here.
Context: ...essible (and your Fleet server has this feature) - Check network connectivity and fir...
(QB_NEW_EN_OTHER)
[grammar] ~306-~306: Place a period at the end of declarative sentences.
Context: ... network connectivity and firewall rules 2. Challenge password authentication -...
(QB_NEW_EN_OTHER_ERROR_IDS_000178)
[grammar] ~308-~308: There might be a mistake here.
Context: ...firewall rules 2. Challenge password authentication - Confirm challenge password is co...
(QB_NEW_EN_OTHER)
[grammar] ~309-~309: Place a period at the end of declarative sentences.
Context: ...word is correct (a valid enrollment key) 3. Certificate enrollment failures - R...
(QB_NEW_EN_OTHER_ERROR_IDS_000178)
[grammar] ~311-~311: There might be a mistake here.
Context: ...lment key) 3. Certificate enrollment failures - Review SCEP server logs for reje...
(QB_NEW_EN_OTHER)
[grammar] ~312-~312: Place a period at the end of declarative sentences.
Context: ...w SCEP server logs for rejection reasons ### General debugging Enable fleetd/server ...
(QB_NEW_EN_OTHER_ERROR_IDS_000178)
[grammar] ~314-~314: Use proper spacing conventions.
Context: ...rejection reasons ### General debugging Enable fleetd/server debug logging to tr...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~316-~316: Use proper spacing conventions.
Context: ...er debug logging to troubleshoot issues.
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
🪛 markdownlint-cli2 (0.17.2)
docs/Contributing/product-groups/orchestration/tpm-backed-http-signing.md
30-30: Unordered list style
Expected: asterisk; Actual: dash
(MD004, ul-style)
31-31: Unordered list style
Expected: asterisk; Actual: dash
(MD004, ul-style)
32-32: Unordered list style
Expected: asterisk; Actual: dash
(MD004, ul-style)
33-33: Unordered list style
Expected: asterisk; Actual: dash
(MD004, ul-style)
262-262: Unordered list style
Expected: asterisk; Actual: dash
(MD004, ul-style)
263-263: Unordered list style
Expected: asterisk; Actual: dash
(MD004, ul-style)
266-266: Unordered list style
Expected: asterisk; Actual: dash
(MD004, ul-style)
267-267: Unordered list style
Expected: asterisk; Actual: dash
(MD004, ul-style)
289-289: Unordered list style
Expected: asterisk; Actual: dash
(MD004, ul-style)
290-290: Unordered list style
Expected: asterisk; Actual: dash
(MD004, ul-style)
291-291: Unordered list style
Expected: asterisk; Actual: dash
(MD004, ul-style)
294-294: Unordered list style
Expected: asterisk; Actual: dash
(MD004, ul-style)
295-295: Unordered list style
Expected: asterisk; Actual: dash
(MD004, ul-style)
298-298: Unordered list style
Expected: asterisk; Actual: dash
(MD004, ul-style)
299-299: Unordered list style
Expected: asterisk; Actual: dash
(MD004, ul-style)
300-300: Unordered list style
Expected: asterisk; Actual: dash
(MD004, ul-style)
305-305: Unordered list style
Expected: asterisk; Actual: dash
(MD004, ul-style)
306-306: Unordered list style
Expected: asterisk; Actual: dash
(MD004, ul-style)
309-309: Unordered list style
Expected: asterisk; Actual: dash
(MD004, ul-style)
312-312: Unordered list style
Expected: asterisk; Actual: dash
(MD004, ul-style)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
- GitHub Check: markdown-link-check
- GitHub Check: publish
- GitHub Check: build (20.x)
- GitHub Check: build-binaries
🔇 Additional comments (1)
docs/Contributing/product-groups/orchestration/tpm-backed-http-signing.md (1)
259-264: “No additional server configuration” is misleadingA premium licence and a configured private key are explicit configuration requirements. Consider re-phrasing to avoid confusion for operators.
Fixes #30458 Contributor docs PR: #30651 # Checklist for submitter - We will add changes file later. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) - [x] If database migrations are included, checked table schema to confirm autoupdate - For database migrations: - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). - [x] Added/updated automated tests - Did not do manual QA since the SCEP client I have doesn't support ECC. Will rely on next subtasks for manual QA. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Introduced Host Identity SCEP (Simple Certificate Enrollment Protocol) support, enabling secure host identity certificate enrollment and management. * Added new API endpoints for Host Identity SCEP, including certificate issuance and retrieval. * Implemented MySQL-backed storage and management for host identity SCEP certificates and serials. * Added new database tables for storing host identity SCEP certificates and serial numbers. * Provided utilities for encoding certificates and keys, and handling ECDSA public keys. * **Bug Fixes** * None. * **Tests** * Added comprehensive integration and unit tests for Host Identity SCEP functionality, including certificate issuance, validation, and error scenarios. * **Chores** * Updated test utilities to support unique test names and new SCEP storage options. * Extended mock datastore and interfaces for new host identity certificate methods. * **Documentation** * Added comments and documentation for new SCEP-related interfaces, methods, and database schema changes. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
4 participants
Fixes #30458
Summary by CodeRabbit