Skip to content

Navigation Menu

Appearance settings

GitHub Copilot
Write better code with AI

GitHub Spark New
Build and deploy intelligent apps

GitHub Models New
Manage and compare prompts

GitHub Advanced Security
Find and fix vulnerabilities

Actions
Automate any workflow
Codespaces
Instant dev environments

Issues
Plan and track work

Code Review
Manage code changes

Discussions
Collaborate outside of code

Code Search
Find more, search less
Explore

Why GitHub

Documentation

GitHub Skills

Blog
Integrations

GitHub Marketplace

MCP Registry
View all features
By company size

Enterprises

Small and medium teams

Startups

Nonprofits
By use case

App Modernization

DevSecOps

DevOps

CI/CD

View all use cases
By industry

Healthcare

Financial services

Manufacturing

Government

View all industries
View all solutions
Topics

AI

DevOps

Security

Software Development

View all
Explore

Learning Pathways

Events & Webinars

Ebooks & Whitepapers

Customer Stories

Partners

Executive Insights
GitHub Sponsors
Fund open source developers
The ReadME Project
GitHub community articles
Repositories

Topics

Trending

Collections
Enterprise platform
AI-powered developer platform
Available add-ons

GitHub Advanced Security
Enterprise-grade security features

Copilot for business
Enterprise-grade AI features

Premium Support
Enterprise-grade 24/7 support
Pricing

Search code, repositories, users, issues, pull requests...

Search

Clear

Search syntax tips

Provide feedback

We read every piece of feedback, and take your input very seriously.

Include my email address so I can be contacted

Saved searches

Use saved searches to filter your results more quickly

Name

Query

To see all available qualifiers, see our documentation.

Appearance settings

You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

canonical / multipass Public

Fork 737
Star 8.7k

Code
Issues 431
Pull requests 46
Discussions
Actions
Projects 2
Wiki
Security
Insights

Additional navigation options

Code
Issues
Pull requests
Discussions
Actions
Projects
Wiki
Security
Insights

Standard grpc mTLS #3909

Merged

ricab merged 114 commits intomaincanonical/multipass:mainfrom

standard_grpc_mTLScanonical/multipass:standard_grpc_mTLSCopy head branch name to clipboard

Mar 31, 2025

Conversation Commits114 (114)Checks Files changed

Merged

Standard grpc mTLS #3909
ricab merged 114 commits intomainfrom
standard_grpc_mTLS

Commits

Commits on Mar 27, 2025

[platform] added the platform root_cert path utility function.
georgeliao
committed
[platform] change the default root cert location
georgeliao
committed
[ssl cert] added root certificate generation utility function.
georgeliao
committed
[ssl cert] added the utility function of signing server certificate by root certificate
georgeliao
committed
[ssl cert] a small variable name improvement.
georgeliao
committed
[ssl cert][client] adapted the make_cert_key_pair function so it can generated signed server certificate. Client side ssl option is also updated accordingly.
georgeliao
committed
[unit test][ssl cert] fixed the unit tests in test_ssl_cert_provider.cpp
georgeliao
committed
[unit test] fixed the unit tests in test_cli_client.cpp file
georgeliao
committed
[unit test][daemon rpc] fixed the unt tests in test_daemon_rpc.cpp file
georgeliao
committed
[unit tests][daemon] fixes the unit tests in test_daemon.cpp
georgeliao
committed
[unit test][daemon find] fixed the unit tests in test_daemon_find.cpp
georgeliao
committed
[unit test][alias dict] fixed the unit tests in test_alias_dict.cpp
georgeliao
committed
[ssl cert] fixed the format.
georgeliao
committed
[unit test][client common] fixed the unit tests in test_client_common.cpp file
georgeliao
committed
[unit test] added constness to mock_utils and to corresponding functions.
georgeliao
committed
[unit test] added constness to MockUtils and corresponding function.
georgeliao
committed
[unit test] fixed the format.
georgeliao
committed
[ssl cert] added some missed constness.
georgeliao
committed
[unit test] removed daemon_cert and daemon_key.
georgeliao
committed
[ssl cert] Using OpenSSL's built-in function to create SAN field.
georgeliao
committed
[ssl cert] use default argument instead of function overload.
georgeliao
committed
[ssl cert] remove the cn_name_from function since the dispatch is done via X509Cert constructor overload.
georgeliao
committed
[ssl cert] added cert type enum to facilitate the deduplication of the 3 X509Cert constructors.
georgeliao
committed
[ssl cert] merged the root, client, signed server certificate generation x509 constructor into one.
georgeliao
committed
[ssl cert] modernize the key generation by using openssl 3.0 C apis
georgeliao
committed
[ssl cert] use decltype on function pointer directly. So it is consistent with other custom deleters. Meanwhile, it is also more explicit and preferred for clarity.
georgeliao
committed
[ssl cert] remove unneeded headers.
georgeliao
committed
[ssl cert] use std::array to replace C-style array to interface with function EVP_PKEY_CTX_set_params
georgeliao
committed
[ssl cert] added comment on the OSSL_PARAM_construct_utf8_string function.
georgeliao
committed
[ssl cert] rename x509 to cert for better match with variable name EVPKey::Key.
georgeliao
committed
[ssl cert] use nullptr instead of NULL to comply with Modern C++ style.
georgeliao
committed
[ssl cert] using add_extension function to deduplicate some code.
georgeliao
committed
[ssl cert] use std::unique_ptr and custom deleter to simplify the code
georgeliao
committed
[ssl cert] added check to the pointer and the function return code
georgeliao
committed
[ssl cert] added the root certificate existence check for server certificate migration when the user upgrades multipass to the version includes this.
georgeliao
committed
[vcpckg][grpc client] Switch the gRPC repository to the standard one and commit to release 1.52.1, which serves as the base for our patches. Then, remove the patch-related code.
georgeliao
committed
[platform] added snap root cert file path
georgeliao
committed
[ssl cert] fixes the snap version multipass can not overwrite the key file issue.
georgeliao
committed
[ssl cert] convert from std::function to function pointer to avoid the construction of std::function
georgeliao
committed
[ssl cert] added comment for why use hard coded function pointer
georgeliao
committed
[ssl cert] added a comment for the WritableFile constructor change
georgeliao
committed
[ssl cert] standardize the serial number format.
georgeliao
committed
[ssl cert] using std::unique_ptr to automate memory management.
georgeliao
committed
[ssl cert] replace fprint with throw.
georgeliao
committed
[ssl cert] use raw bitwise operation rather than calling BN_set_bit.
georgeliao
committed
[unit test][ssl cert] added a comment for creates_different_certs_per_server_name unit test.
georgeliao
committed
[ssl cert] fixes the ci compilation error.
georgeliao
committed
[ssl cert] addressed one review comment.
georgeliao
committed
Update tests/test_alias_dict.cpp

georgeliao
and
andrei-toterman
committed
Update tests/test_cli_client.cpp

georgeliao
and
andrei-toterman
committed
Update tests/test_client_common.cpp

georgeliao
and
andrei-toterman
committed
Update tests/test_daemon_find.cpp

georgeliao
and
andrei-toterman
committed
Update src/platform/platform_unix.cpp

georgeliao
and
andrei-toterman
committed
[ssl cert] use cached variable to avoid double conversion.
georgeliao
committed
[platform] fixes the lint.
georgeliao
committed
[platform] move the get_root_cert_path function from unix to linux.
georgeliao
committed
Update tests/test_daemon.cpp

georgeliao
and
andrei-toterman
committed
[platform] fix the lint.
georgeliao
committed
[platform][linux] used the mp::StandardPaths::AppDataLocation instead of mp::utils::snap_common_dir() to access the multipass data storage location.
georgeliao
committed
[ssl cert] restore the accidentally deleted X509_set_version call.
georgeliao
committed
[platform][linux] change the snap case storage location back to snap dir utility function.
georgeliao
committed
[platform][linux] fix the snap path mistake.
georgeliao
committed
[ssl cert] make sure the parent directory of key, certificate file always exist.
georgeliao
committed
[ssl cert] fixed the windows build failure.
georgeliao
committed
[ssl cert] replace the remove file with adding owner write permission to the file.
georgeliao
committed
[client][cert] removed the unneeded check and create directory.
georgeliao
committed
[ssl cert] move the permission change from WritableFile to EVPKey::write so it only affects the key file.
georgeliao
committed
[daemon_config] remove the unneeded MP_UTILS.make_dir call .
georgeliao
committed
[unit test][ssl cert] removed the unneeded MP_UTILS.make_dir call.
georgeliao
committed
[unit test][platform linux] added a unit test to cover multipass_final_storage_location function code.
georgeliao
committed
[platform][linux] moved "/data/multipassd" out so the user defined storage location also gets the right path for root certificate.
georgeliao
committed
[ssl cert] moved the creating file pointer logic to a function, so the initialization can be done in the initializer list.
georgeliao
committed
[ssl cert] moved the raw key pointer creation into a function so the construction of EVPKey can be done in the initializer list.
georgeliao
committed
[ssl cert] used the chrono time units to improve the readability.
georgeliao
committed
[ssl cert] added assertion to the end BIGNUM value.
georgeliao
committed
[ssl cert] changed the remaining NULL to nullptr
georgeliao
committed
[ssl cert] added comment for the usage of the SSLCertProvider class.
georgeliao
committed
[ssl cert] fixed the linter.
georgeliao
committed
[platform] for just testing snap standardpaths values.
georgeliao
committed
[platform linuxj] removed the logs and use constant variable for multipassd directory name.
georgeliao
committed
[daemon config] remove the restrict_permissions on data folder.
georgeliao
committed
[cert store] enforce ower_all permission to authenticated-certs sub-folder.
georgeliao
committed
[qemu platform] enforce ower_all permission to network sub-folder.
georgeliao
committed
[open ssh] enforce permission to ssh-keys sub-folder.
georgeliao
committed
[vault] enforce ower_all permission to vault sub-folder.
georgeliao
committed
[daemon] enforce ower_all permission to multipassd-vm-instances.json file.
georgeliao
committed
[daemon config] added explicit permission setting for overwriting purpose.
georgeliao
committed
[daemon] use toStdU16String for windows possible non-latin characters.
georgeliao
committed
[ssl cert] enforced zero initialization for some objects creation.
georgeliao
committed
[ssl cert] added some return code check for some open ssl apis.
georgeliao
committed
[ssl cert] improve the key creation function by returning unique pointer instead of raw pointer
georgeliao
committed
[ssl cert] changed create_key to be static private function and made an alias on unique pointer type.
georgeliao
committed
[ssl cert] changing open_file to return unique pointer.
georgeliao
committed
[ssl cert] move the open_file into the WritableFile class.
georgeliao
committed
[ssl cert] added nodiscard attribute to some functions.
georgeliao
committed
[utils] added check utility function for checking c-api return.
georgeliao
committed
[ssl cert] used the check function checking raw file pointer.
georgeliao
committed
[ssl cert] more invocations of the check utility function.
georgeliao
committed
[ssl cert] more mp::utils::check based refactors
georgeliao
committed
[ssl cert] more refactor based on mp::utils::check.
georgeliao
committed
[ssl cert] more refactor based on mp::utils::check.
georgeliao
committed
[ssl cert] refined the check utility function.
georgeliao
committed
[ssl cert] more refactor based mp::utils::check function.
georgeliao
committed
[ssl cert] more refactor based on the mp::utils::check function.
georgeliao
committed
[ssl cert] confined the check utility function into ssl_cert_provider.cpp
georgeliao
committed
Update src/daemon/daemon_config.cpp

georgeliao
and
ricab
committed
[file permission] use restrictive default permission, and only open up the certificates folder and cert files.
georgeliao
committed
Revert "[cert store] enforce ower_all permission to authenticated-certs sub-folder."
georgeliao
committed
[daemon config] used two steps approach for permission setting.
georgeliao
committed
[snap] make snap to setup necessary directory for multipass
georgeliao
committed
[daemon config][ssl cert] added group user needed permission for accessing root certificate.
georgeliao
committed
[ssl cert] fixed the server restart causes the root certificate lose the other users access
georgeliao
committed
[ssl cert] added comment for the existing root cert permission overwrite.
georgeliao
committed
Update src/cert/ssl_cert_provider.cpp

georgeliao
and
ricab
authored

Footer

© 2025 GitHub, Inc.

Footer navigation

Terms
Privacy
Security
Status
Community
Docs
Contact

You can’t perform that action at this time.