Remove duplicate info from create/update reserved list command output (#2020)

It was repeating the domain label twice for every reserved list entry. It used
to look like this:

baddies=baddies,FULLY_BLOCKED

core/src/main/java/google/registry/batch/BatchModule.java

@@ -17,7 +17,6 @@ package google.registry.batch;
 import static google.registry.batch.AsyncTaskEnqueuer.PARAM_REQUESTED_TIME;
 import static google.registry.batch.AsyncTaskEnqueuer.PARAM_RESAVE_TIMES;
 import static google.registry.batch.AsyncTaskEnqueuer.PARAM_RESOURCE_KEY;
-import static google.registry.batch.CannedScriptExecutionAction.SCRIPT_PARAM;
 import static google.registry.request.RequestParameters.extractBooleanParameter;
 import static google.registry.request.RequestParameters.extractIntParameter;
 import static google.registry.request.RequestParameters.extractLongParameter;
@@ -139,11 +138,4 @@ public class BatchModule {
   static boolean provideIsDryRun(HttpServletRequest req) {
     return extractBooleanParameter(req, PARAM_DRY_RUN);
   }
-
-  // TODO(b/234424397): remove method after credential changes are rolled out.
-  @Provides
-  @Parameter(SCRIPT_PARAM)
-  static String provideScriptName(HttpServletRequest req) {
-    return extractRequiredParameter(req, SCRIPT_PARAM);
-  }
 }

core/src/main/java/google/registry/batch/CannedScriptExecutionAction.java

@@ -16,11 +16,9 @@ package google.registry.batch;
 
 import static google.registry.request.Action.Method.POST;
 
-import com.google.common.collect.ImmutableMap;
 import com.google.common.flogger.FluentLogger;
-import google.registry.batch.cannedscript.GroupsApiChecker;
+import google.registry.batch.cannedscript.CannedScripts;
 import google.registry.request.Action;
-import google.registry.request.Parameter;
 import google.registry.request.auth.Auth;
 import javax.inject.Inject;
 
@@ -35,7 +33,7 @@ import javax.inject.Inject;
  * <p>This action can be invoked using the Nomulus CLI command: {@code nomulus -e ${env} curl
  * --service BACKEND -X POST -u '/_dr/task/executeCannedScript?script=${script_name}'}
  */
-// TODO(b/234424397): remove class after credential changes are rolled out.
+// TODO(b/277239043): remove class after credential changes are rolled out.
 @Action(
     service = Action.Service.BACKEND,
     path = "/_dr/task/executeCannedScript",
@@ -45,29 +43,18 @@ import javax.inject.Inject;
 public class CannedScriptExecutionAction implements Runnable {
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();
 
-  static final String SCRIPT_PARAM = "script";
-
-  static final ImmutableMap<String, Runnable> SCRIPTS =
-      ImmutableMap.of("runGroupsApiChecks", GroupsApiChecker::runGroupsApiChecks);
-
-  private final String scriptName;
-
   @Inject
-  CannedScriptExecutionAction(@Parameter(SCRIPT_PARAM) String scriptName) {
-    logger.atInfo().log("Received request to run script %s", scriptName);
-    this.scriptName = scriptName;
+  CannedScriptExecutionAction() {
+    logger.atInfo().log("Received request to run scripts.");
   }
 
   @Override
   public void run() {
-    if (!SCRIPTS.containsKey(scriptName)) {
-      throw new IllegalArgumentException("Script not found:" + scriptName);
-    }
     try {
-      SCRIPTS.get(scriptName).run();
-      logger.atInfo().log("Finished running %s.", scriptName);
+      CannedScripts.runAllChecks();
+      logger.atInfo().log("Finished running scripts.");
     } catch (Throwable t) {
-      logger.atWarning().withCause(t).log("Error executing %s", scriptName);
+      logger.atWarning().withCause(t).log("Error executing scripts.");
       throw new RuntimeException("Execution failed.");
     }
   }

core/src/main/java/google/registry/batch/cannedscript/CannedScripts.java

@@ -0,0 +1,199 @@
+// Copyright 2023 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.batch.cannedscript;
+
+import com.google.api.gax.core.FixedCredentialsProvider;
+import com.google.api.services.bigquery.Bigquery;
+import com.google.api.services.dataflow.Dataflow;
+import com.google.api.services.dns.Dns;
+import com.google.cloud.storage.Storage;
+import com.google.cloud.storage.StorageOptions;
+import com.google.cloud.tasks.v2.CloudTasksClient;
+import com.google.cloud.tasks.v2.CloudTasksSettings;
+import com.google.common.base.Supplier;
+import com.google.common.base.Suppliers;
+import com.google.common.flogger.FluentLogger;
+import dagger.Component;
+import dagger.Module;
+import dagger.Provides;
+import google.registry.config.CredentialModule;
+import google.registry.config.CredentialModule.ApplicationDefaultCredential;
+import google.registry.config.RegistryConfig.Config;
+import google.registry.config.RegistryConfig.ConfigModule;
+import google.registry.util.GoogleCredentialsBundle;
+import google.registry.util.UtilsModule;
+import java.io.IOException;
+import java.util.Optional;
+import javax.inject.Singleton;
+
+/** Canned actions invoked from {@link google.registry.batch.CannedScriptExecutionAction}. */
+// TODO(b/277239043): remove class after credential changes are rolled out.
+public class CannedScripts {
+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+
+  private static final Supplier<CannedScriptsComponent> COMPONENT_SUPPLIER =
+      Suppliers.memoize(DaggerCannedScripts_CannedScriptsComponent::create);
+
+  public static void runAllChecks() {
+    CannedScriptsComponent component = COMPONENT_SUPPLIER.get();
+    String projectId = component.projectId();
+    Bigquery bigquery = component.bigQuery();
+    try {
+      bigquery.datasets().list(projectId).execute().getDatasets().stream()
+          .findAny()
+          .ifPresent(
+              datasets ->
+                  logger.atInfo().log("Found a BQ dataset [%s]", datasets.getFriendlyName()));
+      logger.atInfo().log("Finished accessing BQ.");
+    } catch (IOException ioe) {
+      logger.atSevere().withCause(ioe).log("Failed to access bigquery.");
+    }
+    try {
+      Dataflow dataflow = component.dataflow();
+      dataflow.projects().jobs().list(projectId).execute().getJobs().stream()
+          .findAny()
+          .ifPresent(job -> logger.atInfo().log("Found a job [%s]", job.getName()));
+      logger.atInfo().log("Finished accessing Dataflow.");
+    } catch (IOException ioe) {
+      logger.atSevere().withCause(ioe).log("Failed to access dataflow.");
+    }
+    try {
+      Storage gcs = component.gcs();
+      gcs.listAcls(projectId + "-beam");
+      logger.atInfo().log("Finished accessing gcs.");
+    } catch (RuntimeException e) {
+      logger.atSevere().withCause(e).log("Failed to access gcs.");
+    }
+    try {
+      Dns dns = component.dns();
+      dns.managedZones().list(projectId).execute().getManagedZones().stream()
+          .findAny()
+          .ifPresent(zone -> logger.atInfo().log("Found one zone [%s].", zone.getName()));
+      logger.atInfo().log("Finished accessing dns.");
+    } catch (IOException ioe) {
+      logger.atSevere().withCause(ioe).log("Failed to access dns.");
+    }
+    try {
+      CloudTasksClient client = component.cloudtasksClient();
+      com.google.cloud.tasks.v2.Queue queue =
+          client.getQueue(
+              String.format(
+                  "projects/%s/locations/%s/queues/async-actions",
+                  projectId, component.locationId()));
+      logger.atInfo().log("Got async queue state [%s]", queue.getState().name());
+      logger.atInfo().log("Finished accessing cloudtasks.");
+    } catch (RuntimeException e) {
+      logger.atSevere().withCause(e).log("Failed to access cloudtasks.");
+    }
+  }
+
+  @Singleton
+  @Component(
+      modules = {
+        ConfigModule.class,
+        CredentialModule.class,
+        CannedScriptsModule.class,
+        UtilsModule.class
+      })
+  interface CannedScriptsComponent {
+    Bigquery bigQuery();
+
+    CloudTasksClient cloudtasksClient();
+
+    Dataflow dataflow();
+
+    Dns dns();
+
+    Storage gcs();
+
+    @Config("projectId")
+    String projectId();
+
+    @Config("locationId")
+    String locationId();
+  }
+
+  @Module
+  static class CannedScriptsModule {
+    @Provides
+    static Bigquery provideBigquery(
+        @ApplicationDefaultCredential GoogleCredentialsBundle credentialsBundle,
+        @Config("projectId") String projectId) {
+      return new Bigquery.Builder(
+              credentialsBundle.getHttpTransport(),
+              credentialsBundle.getJsonFactory(),
+              credentialsBundle.getHttpRequestInitializer())
+          .setApplicationName(projectId)
+          .build();
+    }
+
+    @Provides
+    static Dataflow provideDataflow(
+        @ApplicationDefaultCredential GoogleCredentialsBundle credentialsBundle,
+        @Config("projectId") String projectId) {
+      return new Dataflow.Builder(
+              credentialsBundle.getHttpTransport(),
+              credentialsBundle.getJsonFactory(),
+              credentialsBundle.getHttpRequestInitializer())
+          .setApplicationName(String.format("%s billing", projectId))
+          .build();
+    }
+
+    @Provides
+    static Storage provideGcs(
+        @ApplicationDefaultCredential GoogleCredentialsBundle credentialsBundle) {
+      return StorageOptions.newBuilder()
+          .setCredentials(credentialsBundle.getGoogleCredentials())
+          .build()
+          .getService();
+    }
+
+    @Provides
+    static Dns provideDns(
+        @ApplicationDefaultCredential GoogleCredentialsBundle credentialsBundle,
+        @Config("projectId") String projectId,
+        @Config("cloudDnsRootUrl") Optional<String> rootUrl,
+        @Config("cloudDnsServicePath") Optional<String> servicePath) {
+      Dns.Builder builder =
+          new Dns.Builder(
+                  credentialsBundle.getHttpTransport(),
+                  credentialsBundle.getJsonFactory(),
+                  credentialsBundle.getHttpRequestInitializer())
+              .setApplicationName(projectId);
+
+      rootUrl.ifPresent(builder::setRootUrl);
+      servicePath.ifPresent(builder::setServicePath);
+
+      return builder.build();
+    }
+
+    @Provides
+    public static CloudTasksClient provideCloudTasksClient(
+        @ApplicationDefaultCredential GoogleCredentialsBundle credentials) {
+      CloudTasksClient client;
+      try {
+        client =
+            CloudTasksClient.create(
+                CloudTasksSettings.newBuilder()
+                    .setCredentialsProvider(
+                        FixedCredentialsProvider.create(credentials.getGoogleCredentials()))
+                    .build());
+      } catch (IOException e) {
+        throw new RuntimeException(e);
+      }
+      return client;
+    }
+  }
+}

core/src/main/java/google/registry/batch/cannedscript/GroupsApiChecker.java

@@ -1,122 +0,0 @@
-// Copyright 2022 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.batch.cannedscript;
-
-import static com.google.common.collect.ImmutableList.toImmutableList;
-import static google.registry.util.RegistrarUtils.normalizeRegistrarId;
-
-import com.google.api.services.admin.directory.Directory;
-import com.google.api.services.groupssettings.Groupssettings;
-import com.google.common.base.Supplier;
-import com.google.common.base.Suppliers;
-import com.google.common.base.Throwables;
-import com.google.common.collect.Streams;
-import com.google.common.flogger.FluentLogger;
-import dagger.Component;
-import dagger.Module;
-import dagger.Provides;
-import google.registry.config.CredentialModule;
-import google.registry.config.CredentialModule.AdcDelegatedCredential;
-import google.registry.config.RegistryConfig.Config;
-import google.registry.config.RegistryConfig.ConfigModule;
-import google.registry.groups.DirectoryGroupsConnection;
-import google.registry.model.registrar.Registrar;
-import google.registry.model.registrar.RegistrarPoc;
-import google.registry.util.GoogleCredentialsBundle;
-import google.registry.util.UtilsModule;
-import java.util.List;
-import java.util.Set;
-import javax.inject.Singleton;
-
-/**
- * Verifies that the credential with the {@link AdcDelegatedCredential} annotation can be used to
- * access the Google Workspace Groups API.
- */
-// TODO(b/234424397): remove class after credential changes are rolled out.
-public class GroupsApiChecker {
-  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
-
-  private static final Supplier<GroupsConnectionComponent> COMPONENT_SUPPLIER =
-      Suppliers.memoize(DaggerGroupsApiChecker_GroupsConnectionComponent::create);
-
-  public static void runGroupsApiChecks() {
-    GroupsConnectionComponent component = COMPONENT_SUPPLIER.get();
-    DirectoryGroupsConnection groupsConnection = component.groupsConnection();
-
-    List<Registrar> registrars =
-        Streams.stream(Registrar.loadAllCached())
-            .filter(registrar -> registrar.isLive() && registrar.getType() == Registrar.Type.REAL)
-            .collect(toImmutableList());
-    for (Registrar registrar : registrars) {
-      for (final RegistrarPoc.Type type : RegistrarPoc.Type.values()) {
-        String groupKey =
-            String.format(
-                "%s-%s-contacts@%s",
-                normalizeRegistrarId(registrar.getRegistrarId()),
-                type.getDisplayName(),
-                component.gSuiteDomainName());
-        try {
-          Set<String> currentMembers = groupsConnection.getMembersOfGroup(groupKey);
-          logger.atInfo().log("Found %s members for %s.", currentMembers.size(), groupKey);
-        } catch (Exception e) {
-          Throwables.throwIfUnchecked(e);
-          throw new RuntimeException(e);
-        }
-      }
-    }
-  }
-
-  @Singleton
-  @Component(
-      modules = {
-        ConfigModule.class,
-        CredentialModule.class,
-        GroupsApiModule.class,
-        UtilsModule.class
-      })
-  interface GroupsConnectionComponent {
-    DirectoryGroupsConnection groupsConnection();
-
-    @Config("gSuiteDomainName")
-    String gSuiteDomainName();
-  }
-
-  @Module
-  static class GroupsApiModule {
-    @Provides
-    static Directory provideDirectory(
-        @AdcDelegatedCredential GoogleCredentialsBundle credentialsBundle,
-        @Config("projectId") String projectId) {
-      return new Directory.Builder(
-              credentialsBundle.getHttpTransport(),
-              credentialsBundle.getJsonFactory(),
-              credentialsBundle.getHttpRequestInitializer())
-          .setApplicationName(projectId)
-          .build();
-    }
-
-    @Provides
-    static Groupssettings provideGroupsSettings(
-        @AdcDelegatedCredential GoogleCredentialsBundle credentialsBundle,
-        @Config("projectId") String projectId) {
-      return new Groupssettings.Builder(
-              credentialsBundle.getHttpTransport(),
-              credentialsBundle.getJsonFactory(),
-              credentialsBundle.getHttpRequestInitializer())
-          .setApplicationName(projectId)
-          .build();
-    }
-  }
-}

core/src/main/java/google/registry/env/crash/default/WEB-INF/cloud-scheduler-tasks.xml

@@ -158,16 +158,4 @@
     </description>
     <schedule>7 3 * * *</schedule>
   </task>
-
-  <!--
-    The next two wipeout jobs are required when crash has production data.
-   -->
-  <task>
-    <url><![CDATA[/_dr/task/wipeOutCloudSql]]></url>
-    <name>wipeOutCloudSql</name>
-    <description>
-      This job runs an action that deletes all data in Cloud SQL.
-    </description>
-    <schedule>7 3 * * 6</schedule>
-  </task>
 </taskentries>

core/src/main/java/google/registry/tools/CreateOrUpdateReservedListCommand.java

@@ -20,6 +20,7 @@ import google.registry.model.tld.label.ReservedList;
 import google.registry.model.tld.label.ReservedListDao;
 import google.registry.tools.params.PathParameter;
 import java.nio.file.Path;
+import java.util.stream.Collectors;
 import javax.annotation.Nullable;
 
 /**
@@ -69,4 +70,12 @@ public abstract class CreateOrUpdateReservedListCommand extends ConfirmingComman
     }
     return message;
   }
+
+  String outputReservedListEntries(ReservedList rl) {
+    return "["
+        + rl.getReservedListEntries().values().stream()
+            .map(rle -> String.format("(%s)", rle.toString()))
+            .collect(Collectors.joining(", "))
+        + "]";
+  }
 }

core/src/main/java/google/registry/tools/CreateReservedListCommand.java

@@ -28,7 +28,6 @@ import com.google.common.base.Strings;
 import google.registry.model.tld.label.ReservedList;
 import java.nio.file.Files;
 import java.util.List;
-import java.util.stream.Collectors;
 import org.joda.time.DateTime;
 
 /** Command to create a {@link ReservedList}. */
@@ -64,11 +63,8 @@ final class CreateReservedListCommand extends CreateOrUpdateReservedListCommand
             .setCreationTimestamp(now)
             .build();
 
-    String entries =
-        reservedList.getReservedListEntries().entrySet().stream()
-            .map(entry -> String.format("%s=%s", entry.getKey(), entry.getValue()))
-            .collect(Collectors.joining(", "));
-    return String.format("%s\nreservedListMap={%s}\n", reservedList, entries);
+    return String.format(
+        "%s\nreservedListMap=%s\n", reservedList, outputReservedListEntries(reservedList));
   }
 
   private static void validateListName(String name) {

core/src/main/java/google/registry/tools/RequestFactoryModule.java

@@ -24,7 +24,7 @@ import com.google.api.client.util.GenericData;
 import com.google.auth.oauth2.UserCredentials;
 import dagger.Module;
 import dagger.Provides;
-import google.registry.config.CredentialModule.DefaultCredential;
+import google.registry.config.CredentialModule.ApplicationDefaultCredential;
 import google.registry.config.RegistryConfig;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.util.GoogleCredentialsBundle;
@@ -56,7 +56,7 @@ class RequestFactoryModule {
 
   @Provides
   static HttpRequestFactory provideHttpRequestFactory(
-      @DefaultCredential GoogleCredentialsBundle credentialsBundle,
+      @ApplicationDefaultCredential GoogleCredentialsBundle credentialsBundle,
       @Config("iapClientId") Optional<String> iapClientId) {
     if (RegistryConfig.areServersLocal()) {
       return new NetHttpTransport()

core/src/main/java/google/registry/tools/UpdateReservedListCommand.java

@@ -22,7 +22,6 @@ import com.google.common.base.Strings;
 import google.registry.model.tld.label.ReservedList;
 import java.nio.file.Files;
 import java.util.List;
-import java.util.stream.Collectors;
 
 /** Command to safely update {@link ReservedList}. */
 @Parameters(separators = " =", commandDescription = "Update a ReservedList.")
@@ -52,17 +51,11 @@ final class UpdateReservedListCommand extends CreateOrUpdateReservedListCommand
     if (!existingReservedList
         .getReservedListEntries()
         .equals(reservedList.getReservedListEntries())) {
-      String oldEntries =
-          existingReservedList.getReservedListEntries().entrySet().stream()
-              .map(entry -> String.format("%s=%s", entry.getKey(), entry.getValue()))
-              .collect(Collectors.joining(", "));
-      String newEntries =
-          reservedList.getReservedListEntries().entrySet().stream()
-              .map(entry -> String.format("%s=%s", entry.getKey(), entry.getValue()))
-              .collect(Collectors.joining(", "));
       return String.format(
-          "Update reserved list for %s?\nOld List: %s\n New List: %s",
-          name, oldEntries, newEntries);
+          "Update reserved list for %s?\nOld list: %s\n New list: %s",
+          name,
+          outputReservedListEntries(existingReservedList),
+          outputReservedListEntries(reservedList));
     }
     return "No entity changes to apply.";
   }

core/src/test/java/google/registry/tools/CreateReservedListCommandTest.java

@@ -190,8 +190,8 @@ class CreateReservedListCommandTest
     command.init();
     assertThat(command.prompt())
         .contains(
-            "reservedListMap={baddies=baddies,FULLY_BLOCKED, "
-                + "ford=ford,FULLY_BLOCKED # random comment}");
+            "reservedListMap=[(baddies,FULLY_BLOCKED), "
+                + "(ford,FULLY_BLOCKED # random comment)]");
   }
 
   @Test
@@ -201,6 +201,6 @@ class CreateReservedListCommandTest
     CreateReservedListCommand command = new CreateReservedListCommand();
     command.input = tmpPath;
     command.init();
-    assertThat(command.prompt()).contains("reservedListMap={}");
+    assertThat(command.prompt()).contains("reservedListMap=[]");
   }
 }

core/src/test/java/google/registry/tools/UpdateReservedListCommandTest.java

@@ -130,5 +130,8 @@ class UpdateReservedListCommandTest
     command.init();
 
     assertThat(command.prompt()).contains("Update reserved list for xn--q9jyb4c_common-reserved?");
+    assertThat(command.prompt()).contains("Old list: [(helicopter,FULLY_BLOCKED)]");
+    assertThat(command.prompt())
+        .contains("New list: [(baddies,FULLY_BLOCKED), (ford,FULLY_BLOCKED # random comment)]");
   }
 }

release/cloudbuild-nomulus.yaml

@@ -74,6 +74,35 @@ steps:
     sed -i s/'nomulus-tool:latest'/nomulus-tool@$digest/g release/cloudbuild-deploy-*.yaml
     # schema-deploy and schema-verify scripts
     sed -i s/'nomulus-tool:latest'/nomulus-tool@$digest/g release/cloudbuild-schema-*.yaml
+# Build the prober_cert_updater image and upload it to GCR. This image extends
+# from the `builder` and the nomulus.jar built earlier.
+- name: 'gcr.io/cloud-builders/docker'
+  entrypoint: /bin/bash
+  args:
+  - -c
+  - |
+    set -e
+    # The nomulus jar is not under the working dir. Must be copied over. 
+    cp ../../output/nomulus.jar .
+    docker build -t gcr.io/${PROJECT_ID}/prober_cert_updater:${TAG_NAME} \
+      --build-arg TAG_NAME=${TAG_NAME} --build-arg PROJECT_ID=${PROJECT_ID} .
+    docker tag gcr.io/${PROJECT_ID}/prober_cert_updater:${TAG_NAME} \
+      gcr.io/${PROJECT_ID}/prober_cert_updater:latest
+    docker push gcr.io/${PROJECT_ID}/prober_cert_updater:latest
+    docker push gcr.io/${PROJECT_ID}/prober_cert_updater:${TAG_NAME}
+  dir: 'release/prober-cert-updater/'
+# Update the prober_updater image digest in relevant GCB files.
+- name: 'gcr.io/${PROJECT_ID}/builder:latest'
+  entrypoint: /bin/bash
+  args:
+  - -c
+  - |
+    set -e
+    digest=$(gcloud container images list-tags \
+      gcr.io/${PROJECT_ID}/prober_cert_updater \
+      --format="get(digest)" --filter="tags = ${TAG_NAME}")
+    sed -i s/'prober_cert_updater:latest'/prober_cert_updater@$digest/g \
+      release/cloudbuild-renew-prober-certs-*.yaml
 # Build and stage Dataflow Flex templates.
 - name: 'gcr.io/${PROJECT_ID}/builder:latest'
   entrypoint: /bin/bash
@@ -141,6 +170,7 @@ artifacts:
     - 'release/cloudbuild-sync.yaml'
     - 'release/cloudbuild-deploy-*.yaml'
     - 'release/cloudbuild-delete-*.yaml'
+    - 'release/cloudbuild-renew-prober-certs-*.yaml'
     - 'release/cloudbuild-schema-deploy-*.yaml'
     - 'release/cloudbuild-schema-verify-*.yaml'
 

release/cloudbuild-release.yaml

@@ -126,7 +126,8 @@ steps:
     docker push gcr.io/${PROJECT_ID}/schema_verifier:latest
     docker push gcr.io/${PROJECT_ID}/schema_verifier:${TAG_NAME}
   dir: 'release/schema-verifier/'
-# Do text replacement in the schema-deploy and schema-verify configs.
+# Do text replacement in the schema-deploy, schema-verify and
+# prober_cert_updater configs.
 - name: 'gcr.io/cloud-builders/gcloud'
   entrypoint: /bin/bash
   args:
@@ -142,10 +143,16 @@ steps:
     schema_verifier_digest=$( \
       gcloud container images list-tags gcr.io/${PROJECT_ID}/schema_verifier \
       --format='get(digest)' --filter='tags = ${TAG_NAME}')
+    prober_cert_updater_digest=$( \
+      gcloud container images list-tags \
+      gcr.io/${PROJECT_ID}/prober_cert_updater \
+      --format='get(digest)' --filter='tags = ${TAG_NAME}')
     sed -i s/builder:latest/builder@$builder_digest/g \
       release/cloudbuild-schema-deploy.yaml
     sed -i s/builder:latest/builder@$builder_digest/g \
       release/cloudbuild-schema-verify.yaml
+    sed -i s/builder:latest/builder@$builder_digest/g \
+      release/cloudbuild-renew-prober-certs.yaml
     sed -i s/schema_deployer:latest/schema_deployer@$schema_deployer_digest/g \
       release/cloudbuild-schema-deploy.yaml
     sed -i s/schema_verifier:latest/schema_verifier@$schema_verifier_digest/g \
@@ -156,6 +163,8 @@ steps:
         > release/cloudbuild-schema-deploy-${environment}.yaml
       sed s/'$${_ENV}'/${environment}/g release/cloudbuild-schema-verify.yaml \
         > release/cloudbuild-schema-verify-${environment}.yaml
+      sed s/'$${_ENV}'/${environment}/g release/cloudbuild-renew-prober-certs.yaml \
+        > release/cloudbuild-renew-prober-certs-${environment}.yaml
     done
 # Upload the gradle binary to GCS if it does not exist and point URL in gradle wrapper to it.
 - name: 'gcr.io/cloud-builders/gsutil'

release/cloudbuild-renew-prober-certs.yaml

@@ -0,0 +1,91 @@
+# To run the build locally, install cloud-build-local first.
+# Then run:
+# cloud-build-local --config=cloudbuild-renew-prober-certs.yaml --dryrun=false \
+# --substitutions=_ENV=[ENV] ..
+#
+# This will generate a new SSL certificate and apply it to the probers in the
+# environment specified by ${_ENV}.
+#
+# To manually trigger a build on GCB, run:
+# gcloud builds submit --config=cloudbuild-renew-prober-certs.yaml \
+# --substitutions=_ENV=[ENV] ..
+#
+# To manually trigger a build on GCB using a released version, with TAG being
+# the release tag and _ENV being the environment, run:
+# cd $(mktemp -d);
+# gcloud storage cp \
+#   gs://domain-registry-dev-deploy/{TAG}/cloudbuild-renew-prober-certs-{_ENV}.yaml .
+# gcloud builds submit --config="./cloudbuild-renew-prober-certs-{_ENV}.yaml"
+#
+# To trigger a build automatically, follow the instructions below and add a trigger:
+# https://cloud.google.com/cloud-build/docs/running-builds/automate-builds
+#
+# Note that the release process hardens the tags and variables in this file:
+# - The 'latest' tag on docker images will be replaced by their image digests.
+# - The ${_ENV} pattern will be replaced by the actual environment name.
+# Please refer to ./cloudbuild-release.yaml for more details.
+steps:
+# Generate new SSL certs
+- name: 'gcr.io/$PROJECT_ID/builder:latest'
+  entrypoint: /bin/bash
+  args:
+  - -c
+  - |
+    set -e
+    # Download the CA certificate files for signing the new certificate.
+    gcloud storage cp gs://$PROJECT_ID-prober-certs/ca.* .
+    # Get the passphrase
+    gcloud secrets versions access latest \
+      --secret=epp-prober-passphrase-${_ENV} \
+      --out-file=./passphrase.txt
+    openssl req -new -newkey rsa:4096 -nodes \
+      -out prober-client-tls.req \
+      -keyout prober-client-tls.key \
+      -subj "/C=US/ST=New York/L=New York/O=Google/OU=gTLD/CN=Google Registry/emailAddress=example@example.com" \
+      -passout file:./passphrase.txt
+    openssl x509 -CA ca.pem  -CAkey ca.key -CAserial ca.srl -req -days 398  \
+      -in prober-client-tls.req \
+      -out prober-client-tls.pem
+    openssl pkcs12 -export -in prober-client-tls.pem \
+      -inkey prober-client-tls.key -out prober-client-tls.p12 \
+      -password file:./passphrase.txt
+# Download the nomulus-tools credential, which has the privilege to invoke tools
+# commands. Also download the list of probers.
+- name: 'gcr.io/$PROJECT_ID/builder:latest'
+  entrypoint: /bin/bash
+  args:
+  - -c
+  - |
+    set -e
+    # Download the list of prober registrars in a file.
+    prober_list_name=prober_registrars.${_ENV}
+    gcloud storage cp \
+      gs://$PROJECT_ID-prober-certs/$prober_list_name ./prober-list
+    # Get the nomulus-tools credential, which is needed by the next step for
+    # invoking nomulus-tools commands.
+    gcloud secrets versions access latest \
+      --secret nomulus-tool-cloudbuild-credential \
+      > nomulus_tool_credential.json
+# Install the new pem cert in the Nomulus server. After this step, both the
+# current cert and the new cert are accepted for login by the server.
+- name: 'gcr.io/$PROJECT_ID/prober_cert_updater:latest'
+  args:
+  - ${_ENV}
+  - ./prober-client-tls.pem
+  - ./prober-list
+  - ./nomulus_tool_credential.json
+# Add the p12 cert to SecretManager. Prober instances will start using this
+# cert when they restart.
+- name: 'gcr.io/$PROJECT_ID/builder:latest'
+  entrypoint: /bin/bash
+  args:
+  - -c
+  - |
+    set -e
+    if [ ${_ENV} == production ]; then
+      secret_id="prober-keys"
+    else
+      secret_id="prober-keys-${_ENV}"
+    fi
+    gcloud secrets versions add $secret_id \
+      --data-file="./prober-client-tls.p12"

release/prober-cert-updater/Dockerfile

@@ -0,0 +1,27 @@
+# Copyright 2023 The Nomulus Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This Dockerfile updates the SSL certs used by the probers. It uses the builder
+# image, and should be built after the builder in the release process. It also
+# needs the :core:nomulus jar in this directory, which is the caller's
+# responsibility to copy it here.
+
+ARG PROJECT_ID
+ARG TAG_NAME
+FROM gcr.io/${PROJECT_ID}/builder:${TAG_NAME}
+
+COPY nomulus.jar /
+COPY rotate_prober_certs.sh /usr/local/bin
+
+ENTRYPOINT [ "rotate_prober_certs.sh" ]

release/prober-cert-updater/rotate_prober_certs.sh

@@ -0,0 +1,44 @@
+#!/bin/bash
+# Copyright 2023 The Nomulus Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Rotates SSL certs for prober registars. This script expects the following
+# parameters in order:
+# - env: The Nomulus environment, production, sandbox, etc.
+# - prober_cert: The SSL cert file (.pem) to be installed.
+# - prober_list: The probers' registrar-ids in a file, one per line.
+# - tools_credential: The credential (.json) needed to run the nomulus command.
+
+set -e
+if [ "$#" -ne 4 ]; then
+  echo "Expecting four parameters in order: env prober_cert_file prober_list" \
+      "tools_credential"
+  exit 1
+fi
+
+nomulus_env="${1}"
+cert_file="${2}"
+prober_list="${3}"
+tools_credential="${4}"
+
+echo ${nomulus_env} ${cert_file} ${prober_list}
+
+cat "${prober_list}" | while IFS= read -r prober; do
+  echo "Updating client certificate for ${prober}."
+  java -jar /nomulus.jar -e "${nomulus_env}" \
+      --credential "${tools_credential}" \
+      update_registrar "${prober}" -f \
+      --rotate_primary_cert \
+      --cert_file  "${cert_file}"
+done