Remote root fetching documentation #688
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
AlCutter
approved these changes
Jan 29, 2026
cmd/tesseract/aws/main.go
Outdated
| rootsRemoteFetchInterval = flag.Duration("roots_remote_fetch_interval", time.Duration(0), "WIP DO NOT USE - Interval between two fetches from roots_fetch_url.") | ||
| rootsPemFile = flag.String("roots_pem_file", "", "Path to the file containing root certificates that are acceptable to the log.") | ||
| rootsRemoteFetchURL = flag.String("roots_remote_fetch_url", "https://ccadb.my.salesforce-sites.com/ccadb/RootCACertificatesIncludedByRSReportCSV", "URL to fetch additional trusted roots from.") | ||
| rootsRemoteFetchInterval = flag.Duration("roots_remote_fetch_interval", time.Duration(0), "Interval between two fetches from roots_fetch_url, e.g. \"1h\".") |
Collaborator
There was a problem hiding this comment.
Add something about the zero value (disables fetching?)
cmd/tesseract/README.md
Outdated
Comment on lines
42
to
47
| The URL of that endpoint is set via `roots_remote_fetch_url`. Roots are first | ||
| fetched at startup, and then every `roots_remote_fetch_interval`. Each time | ||
| roots are fetched from this remote endpoint, newly found roots are backed up in | ||
| the log's storage, under `roots/`. Roots are never removed from this directory. | ||
| Roots in the `roots/` directory are loaded once, at startup. This backup mechanism | ||
| ensures that the log can start with all its roots, even if the remote endpoint is down. |
Collaborator
There was a problem hiding this comment.
It's not clear from this whether roots fetched from the URL immediately become "trusted" for the purposes of add-chain or the binary must be restarted for them to take effect, might be worth adding a few words to make it clear that it's the former?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Towards #212.