mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-07 17:51:29 +00:00
shankar0123
7f57b1d3bf
Continuing Phase 9 ARCH-M2 closure. Sprint 7 is the LAST in-config
cut of Phase 9. After this commit lands, the remaining sub-splits
target non-config hotspots (cmd/server/main.go, service/acme.go,
mcp/tools.go, auth_session_oidc.go, cmd/agent/main.go).
What moved
==========
internal/config/issuers.go (new, 435 lines including BSL header +
Phase 9 doc-comment + 12 structs)
Twelve issuer-related structs collected in one place for the first
time:
- KeygenConfig global key-generation policy (agent vs server)
- CAConfig Local CA mode (self-signed vs sub-CA)
- StepCAConfig step-ca (URL + JWK provisioner)
- VaultConfig HashiCorp Vault PKI
- DigiCertConfig DigiCert CertCentral
- SectigoConfig Sectigo Certificate Manager
- GoogleCASConfig Google Cloud CA Service
- AWSACMPCAConfig AWS ACM Private CA
- EntrustConfig Entrust Certificate Services
- GlobalSignConfig GlobalSign Atlas HVCA
- EJBCAConfig EJBCA / Keyfactor
- OpenSSLConfig OpenSSL / custom CA
Simplest split shape of Phase 9 so far
======================================
- ZERO helpers move. Every issuer config is pure data — strings,
ints, bools. No time.Duration, no nested struct, no helper
function reference.
- ZERO imports needed in issuers.go beyond the package declaration.
Verified by: `awk 'NR>=136 && NR<=269 || NR>=355 && NR<=527 ||
NR>=586 && NR<=609' internal/config/config.go | grep -E '\btime\.
|\bos\.|\bfmt\.'` returned empty before the move.
Three sed passes (Sprint-6 pattern, scattered targets)
======================================================
The 12 issuer types were SCATTERED across config.go interleaved
with non-issuer types (OCSPResponderConfig, EncryptionConfig, the
discovery family, DigestConfig, HealthCheckConfig, NetworkScanConfig,
VerificationConfig, ApprovalConfig). Three independent sed deletes
from highest-line to lowest:
Block 3 (line 586-609): OpenSSLConfig alone (24 lines)
Block 2 (line 355-527): KeygenConfig + CAConfig + StepCAConfig +
VaultConfig + DigiCertConfig +
SectigoConfig + GoogleCASConfig
(173 lines)
Block 1 (line 136-269): AWSACMPCAConfig + EntrustConfig +
GlobalSignConfig + EJBCAConfig
(134 lines)
Total: 331 lines deleted.
Highest-line-first ordering keeps every range pre-shift-stable —
no mid-edit re-derivation.
What stayed in config.go
========================
- OCSPResponderConfig (server-side OCSP responder; not issuer-side)
- EncryptionConfig (config-at-rest encryption; not issuer-side)
- CloudDiscoveryConfig + AWSSecretsMgrDiscoveryConfig +
AzureKVDiscoveryConfig + GCPSecretMgrDiscoveryConfig
(cloud-DISCOVERY sources reading certs others issued; not issuer
connectors. Could form a future config/discovery.go split.)
- DigestConfig + HealthCheckConfig (notifier-policy /
health-monitor cadence; not issuer-related)
- NetworkScanConfig + VerificationConfig (discovery / verify;
not issuer-related)
- ApprovalConfig (RBAC issuance-approval workflow; Sprint 6's
deliberate exclusion still applies)
- The Config struct itself (line 67) + every Load() / Validate()
body that references issuer configs by field name.
Public-surface invariant
========================
Every type, exported field, and doc-comment is byte-identical to
pre-split. Package stays `config`. No issuer-config type exports
a method (the entire surface is fields — preserved verbatim).
Every external caller path (`config.AWSACMPCAConfig` /
`config.EntrustConfig` / etc.) resolves the same way.
Verification (all clean):
gofmt -l internal/config/ → clean
go build ./internal/config/... → clean
go test ./internal/config/... -count=1 → ok (0.67s)
staticcheck ./internal/config/... → clean
go build ./cmd/server/...
./internal/auth/...
./internal/api/router/...
./internal/api/handler/...
./internal/scheduler/...
./internal/connector/issuer/... → clean (broader build
expanded to include
issuer packages
this sprint since
they're the most
likely external
consumers of the
moved types)
grep -nE '^type (KeygenConfig|CAConfig|StepCAConfig|VaultConfig|
DigiCertConfig|SectigoConfig|GoogleCASConfig|
OpenSSLConfig|AWSACMPCAConfig|EntrustConfig|
GlobalSignConfig|EJBCAConfig)'
internal/config/config.go → empty (none remain)
grep -nE '^type (KeygenConfig|CAConfig|...)' internal/config/issuers.go
→ 12 types (correct)
LOC delta:
config.go: 1673 → 1342 (-331 lines: -134 Block 1, -173 Block 2,
-24 Block 3)
issuers.go: new, 435 lines (incl. 102-line Phase 9 doc-comment +
BSL header + package decl)
Cumulative Phase 9 progress (Sprints 1-7 from config.go):
Pre-Phase-9: 3403 LOC
After Sprint 1 (Notifier): 3335 LOC (-68)
After Sprint 2 (ACME): 3108 LOC (-227)
After Sprint 3 (SCEP): 2774 LOC (-334)
After Sprint 4 (EST): 2467 LOC (-307)
After Sprint 5 (Auth): 1963 LOC (-504)
After Sprint 6 (Server): 1673 LOC (-290)
After Sprint 7 (Issuers): 1342 LOC (-331)
Total Sprint 1+2+3+4+5+6+7: -2061 LOC (-60.6%)
Notable milestones (Sprint 7)
==============================
- config.go has lost MORE than 60% of its original lines.
- 6 sibling config-package files now exist alongside config.go,
each scoped to a single concern. Total config package size
3898 LOC across 7 files (was 3403 LOC in 1 file pre-Phase-9 —
net 14.6% growth from per-file Phase 9 doc-comments + the file
headers; in exchange, the largest single file dropped from
3403 → 1342 LOC, a 60.6% concentration reduction).
- This is the LAST cut from config.go. The remaining 5 sub-splits
target non-config hotspots and use entirely different file-shape
patterns (subpackage creation for service/acme; per-verb file
splits for handlers; pure-domain grouping for mcp/tools).
Next queued (Sprint 8): cmd/server/main.go split into main.go
(entrypoint) + cmd/server/wire.go (DI assembly) +
cmd/server/migrations.go (boot-time migration path). main.go is
the SECOND-LARGEST hotspot at 2966 LOC. Different from
config.go cuts because:
- cmd/server/ is a package with multiple files already (per
`ls cmd/server/`); the new files will live alongside existing
ones (auth_backfill.go, tls.go, etc.) which means no new
subdirectory needed.
- The cut is by FUNCTIONAL CONCERN (boot sequencing) rather
than by TYPE FAMILY (struct grouping), so the boundary lines
are different in nature.
- Phase 4's migration-hook code (in main.go today) inherits
into migrations.go without code-change — the Phase 9 prompt
explicitly says "Phase 4's pre-install migration hook adds
a path to cmd/server/migrations.go; doing the split first
means double-touching the same lines."
Closes: cowork/certctl-architecture-diligence-audit.html#fix-ARCH-M2
(partial — 7 of 12 — full ARCH-M2 closure is the aggregate)