mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-07 19:01:34 +00:00
certctl-copilot
d8d1436736
Two G-3 regression hits from the SCEP RFC 8894 docs that landed in
commit 35fcfa7's docs/legacy-est-scep.md addition:
1. CERTCTL_SCEP_PROFILE_CORP_* (5 vars) — the multi-profile dispatch
recipe used literal CORP placeholders in the example block, which
the G-3 scanner treats as phantom env vars (the loader expands
<NAME> at runtime; CORP is never a literal env-var key in Go
source). Replaced the literal example with a prose description
that uses the <NAME> token explicitly + cross-references
docs/features.md where the per-profile suffix table lives. The
G-3 scanner sees only CERTCTL_SCEP_PROFILES + the prefix
CERTCTL_SCEP_ (already on the ALLOWED list per commit 347365f),
matching the convention used elsewhere in the SCEP env-var docs.
2. CERTCTL_TLS_CERT_PATH — incorrect env var name in the RA-cert
rotation paragraph. The actual config field is
CERTCTL_SERVER_TLS_CERT_PATH (per internal/config/config.go:1130).
Fixed the reference. The CERTCTL_TLS_ prefix is already allowlisted
(covers e.g. CERTCTL_TLS_INSECURE_SKIP_VERIFY), but the literal
suffix _CERT_PATH was a typo that bypassed the prefix match.
Verification: local G-3 set difference (Go-defined ∖ docs-mentioned)
empty in BOTH directions after the fix.
Restores green CI on the env-var docs drift guard for the SCEP
plumbing PR.