mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-07 21:31:34 +00:00
certctl-copilot
197904759f
Phase 1.5 added two new env-var literals to internal/config/config.go
that the G-3 docs-drift CI guard picked up but I forgot to document
when shipping commit 6d30493:
* CERTCTL_SCEP_PROFILES — comma-list of profile names enabling
multi-endpoint dispatch (e.g. 'corp,iot' produces /scep/corp +
/scep/iot).
* CERTCTL_SCEP_PROFILE_ — the prefix string used in
loadSCEPProfilesFromEnv's getEnv calls (e.g.
getEnv('CERTCTL_SCEP_PROFILE_'+envName+'_ISSUER_ID', ...)). The
G-3 regex extracts string literals between double quotes; the
prefix is a literal even though the suffix is concatenated at
runtime, so the scanner correctly flags it as 'defined in Go but
not documented'.
Added 7 rows to the SCEP env-vars table in docs/features.md:
* CERTCTL_SCEP_PROFILES (the explicit list var)
* CERTCTL_SCEP_PROFILE_<NAME>_ISSUER_ID (per-profile issuer)
* CERTCTL_SCEP_PROFILE_<NAME>_PROFILE_ID (per-profile cert profile)
* CERTCTL_SCEP_PROFILE_<NAME>_CHALLENGE_PASSWORD (per-profile secret)
* CERTCTL_SCEP_PROFILE_<NAME>_RA_CERT_PATH (per-profile RA cert)
* CERTCTL_SCEP_PROFILE_<NAME>_RA_KEY_PATH (per-profile RA key)
Each row notes the per-profile validation contract (required for every
profile in the list, file modes, fail-loud-with-PathID semantics).
Verification: local G-3 set difference (Go-defined ∖ docs-mentioned)
empty. The literal prefix CERTCTL_SCEP_PROFILE_ now appears in
docs/features.md as the documented env-var prefix, satisfying the
scanner's substring match.