Reporting certificate lifetimes for NTS servers - #160
Conversation
- Create `scripts/ntsUpdateCertValidity.py` to fetch certificate lifetimes from NTS servers. - Update `scripts/ntsServerConverter.py` to include a "Cert Validity" column in the Markdown output. - Add `ntp-bootstrap.ubuntu.com` (130-year validity) to `nts-sources.yml`. - Update `nts-sources.yml` with certificate validity for all servers. - Regenerate `README.md`, `chrony.conf`, and `ntp.toml`. This change allows users, particularly those on systems without a real-time clock, to identify servers with long-lived certificates to avoid boot-time TLS verification failures. Co-authored-by: jauderho <13562+jauderho@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
Review changes with Changed Files
|
|
|
||
| # Distro | ||
| server 1.ntp.ubuntu.com nts iburst | ||
| server ntp-bootstrap.ubuntu.com nts iburst |
There was a problem hiding this comment.
This will not work without
ntstrustedcerts /etc/chrony/nts-bootstrap-ubuntu.crt
or similar. Should there be a comment where the certificate can be downloaded?
2 participants
Extended the NTS server list and maintenance scripts to report observed certificate lifetimes.
Key changes:
scripts/ntsUpdateCertValidity.pywhich usesopenssl s_clientto query the NTS port (4460) of each server and calculate its certificate validity period.scripts/ntsServerConverter.pyto include the "Cert Validity" field in the generatedREADME.mdtables.ntp-bootstrap.ubuntu.comtonts-sources.yml. This server provides a self-signed certificate with a validity spanning 130 years, specifically intended for systems relying on disk-stored timestamps.nts-sources.ymlwith fetched validity data and regenerated all derived files (README.md,chrony.conf,ntp.toml).These updates improve the utility of the list for admins managing hardware with no RTC (e.g., many embedded systems and Raspberry Pis).
Fixes #158
PR created automatically by Jules for task 4613999865203117579 started by @jauderho