bolyai/CIS490
3
0
Fork 0
Code Issues 5 Pull requests Projects 1 Releases Packages Wiki Activity Actions

Lab-host cert delivery: integrate with wg-enroll USB flow #3

New issue
Open
opened 2026-04-29 23:45:34 -05:00 by max · 0 comments
max commented 2026-04-29 23:45:34 -05:00
Owner
Copy link

User intent (2026-04-29 conversation): the lab-host mTLS leaf cert (issued by wg-pki/scripts/issue-cis490-client-cert.sh) should be installed automatically as part of the wg-enroll USB enrollment flow, not hand-carried via tarball.

Today:

  • wg-pki/scripts/issue-cis490-client-cert.sh <host_id> mints a leaf + bundles it as <host_id>.tar.
  • The lab-host install script (scripts/install-lab-host.sh) does not touch certs — operator drops them at /etc/cis490/certs/{lab-host.pem,key,wg-ca.pem} by hand.

Desired:

  • wg-enroll USBs carry an issued CIS490 client cert (or a pointer to one issued at enrollment time) that the enrollment process places at /etc/cis490/certs/.
  • The lab-host shipper picks them up automatically at first run.

Cross-repo: this needs a coordinated change between spectral/wg-enroll and spectral/CIS490. Per the repo memory, wg-enroll itself stays creation-only — the cert can be embedded in the per-USB enrollment artifact rather than minted by wg-enroll at provision time.

Blocks: end-to-end Tier 0 smoke test from a real lab host. Until this lands, the manual tarball flow in wg-pki/README.md is the workaround.

User intent (2026-04-29 conversation): the lab-host mTLS leaf cert (issued by wg-pki/scripts/issue-cis490-client-cert.sh) should be installed automatically as part of the wg-enroll USB enrollment flow, not hand-carried via tarball. Today: - `wg-pki/scripts/issue-cis490-client-cert.sh <host_id>` mints a leaf + bundles it as `<host_id>.tar`. - The lab-host install script (`scripts/install-lab-host.sh`) does not touch certs — operator drops them at `/etc/cis490/certs/{lab-host.pem,key,wg-ca.pem}` by hand. Desired: - `wg-enroll` USBs carry an issued CIS490 client cert (or a pointer to one issued at enrollment time) that the enrollment process places at `/etc/cis490/certs/`. - The lab-host shipper picks them up automatically at first run. Cross-repo: this needs a coordinated change between `spectral/wg-enroll` and `spectral/CIS490`. Per the repo memory, wg-enroll itself stays creation-only — the cert can be embedded in the per-USB enrollment artifact rather than minted by wg-enroll at provision time. Blocks: end-to-end Tier 0 smoke test from a real lab host. Until this lands, the manual tarball flow in `wg-pki/README.md` is the workaround.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
Dev_REL3_050126
Dev_REL2_043026
Dev_REL1_043026
No results found.
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: bolyai/CIS490#3
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?