We warned long enough, also sysmerge(8) should have handled the
removal of the agreement url by now.

OK benno

Deprecate agreement url config option and get the information from the
directory call. This way we don't need to update the acme-client.conf
file every time it changes. Still parse the option, ignore

Deprecate agreement url config option and get the information from the
directory call. This way we don't need to update the acme-client.conf
file every time it changes. Still parse the option, ignore and warn about
it for a release. Sysmerge should be able to handle the removal.
"nice" deraadt@
OK benno

show more ...

fix a use after free and a memory leak in error paths
ok deraadt@ florian@

It is perfectly valid to have a cert / key not owned by root; remove
useless check.
OK benno

Complete jsing's coccinelle cleanup... by hand
ok jsing

whitespace

find the first authority works better this way, now that we use a tailq
ok florian@

move config data structures mostly to TAILQs, because that way we
preserve order.

ok florian@

dont print config if its broken
ok florian@

it's chain certificate not certificate chain

Enforce minimum config in the parser.
Based on a diff by & OK benno@

add option 'domain full chain certificate "path"',
revokation works, the fullchain file will be unlinked.

ok florian

Implement domain chain certificate.
OK benno

acme-client use configuration file [5 of 5]
implement new -n option to check and print configuration

ok florian

acme-client use configuration file [2 of 5]

- add challengedir option to config file
- remove -C option from command line

ok florian

acme-client use configuration file [1 of 5]

start using the configuration file and delete command line arguments:

-a agreement -> agreement url ...
-c certdir -> domain certificate "path"
-

acme-client use configuration file [1 of 5]

start using the configuration file and delete command line arguments:

-a agreement -> agreement url ...
-c certdir -> domain certificate "path"
-f accountkey -> account key "path"
-k domainkey -> domain key "path"
-s authority -> sign with "name"

new argument:
-f configfile

the changes needed to use the new configuration are local to main.c for now.
While the configuration could be passed directly to netproc(), keyproc() etc,
the diff is smaller this way.

This also removes the multidir (-m) mode for now - specify different paths in
each domain {} block instead.

ok florian

show more ...

Replace hand-rolled for(;;) emptying of 'symhead' TAILQ with more
modern TAILQ_FOREACH_SAFE().

No intentional functional change.

ok millert@ bluhm@ gilles@

Replace symset()'s hand-rolled for(;;) traversal of 'symhead' TAILQ
with more modern TAILQ_FOREACH(). This what symget() was already
doing.

Add paranoia '{}' around body of symget()'s TAILQ_FOREACH(

Replace symset()'s hand-rolled for(;;) traversal of 'symhead' TAILQ
with more modern TAILQ_FOREACH(). This what symget() was already
doing.

Add paranoia '{}' around body of symget()'s TAILQ_FOREACH().

No intentional functional change.

ok bluhm@ otto@

show more ...

reoorder includes,
noticed by & ok florian@

add a config file parser to acme-client (unused at the moment, so that
it can be worked on in the tree).
ok florian@ deraadt@