Close CA/IaC drift: codify Linux SCEP provisioners + prune dead ACME#43
Merged
Conversation
Close the IaC drift: the live CA had 8 SCEP provisioners but the script only codified 2, so a rebuild would not reproduce the CA. Add the six gecko_t_linux_* provisioners with the exact SPIFFE roles verified from the live CA's x509 templates. The base template is already platform-agnostic (only __SPIFFE_ROLE__ differs), so the same template serves macOS and Linux. Note: the Linux provisioners are in service on the CA but their vault-* secrets are still empty (the Linux path is scaffolded, not live) — codified so the CA is reproducible from code, not because Linux is functional. (The dead acme-no-sip ACME provisioner is pruned from the live CA separately.) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
acme-no-sip (abandoned attestation experiment) was removed from the live CA, so the provisioner list now matches scripts/bootstrap-step-ca.sh exactly (admin JWK + 8 SCEP). Remove the dead ACME artifacts from the repo and update the docs: - rm mdm/acme-relops.mobileconfig.template + scripts/render-acme-mobileconfig.sh - README: drop the acme template from the repo tree; mark /acme/* as a now-unused LB route; note the CA is fully reproducible from code (drift closed) - deep-dive.html: update the follow-up — CA/IaC drift closed; only remaining tidy-up is dropping the dead /acme/* path rule from terraform/lb.tf Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #42 (which merged before these two commits landed). These finish the CA/IaC-drift cleanup so the live step-ca is fully reproducible from code.
scripts/bootstrap-step-ca.sh— the live CA had 8 SCEP provisioners but the script codified only 2, so a rebuild wouldn't reproduce it. Roles verified from the live provisioner x509 templates. Base template is already platform-agnostic. (Linux secrets are still empty / path not live — codified for reproducibility, not because Linux is functional.)acme-no-sipprovisioner was removed from the live CA; this removes its repo artifacts (mdm/acme-relops.mobileconfig.template,scripts/render-acme-mobileconfig.sh) and reconciles the docs.Live CA now =
admin@mozilla.com(JWK) + 8 SCEP provisioners, matchingbootstrap-step-ca.shexactly. One minor tidy-up remains (noted in the deep-dive): the harmless dead/acme/*route still interraform/lb.tf.🤖 Generated with Claude Code