pki-core: Add missing EC/ML-DSA profiles to EnableEST upgrade scriptlet

[vmishraredhat]

EST deployments using EC or Post-Quantum (ML-DSA) algorithms fail system certificate enrollment with 403 Forbidden because 01-EnableEST.py misses these profiles from ACL updates. This patch adds caECInternalAuthServerCert and the ML-DSA server/subsystem profiles to the upgrade scriptlet.

Summary by CodeRabbit

• Bug Fixes
  • Upgrade processing now includes additional internal authentication certificate profiles.
  • Internal profile access controls and configuration remain consistent across supported certificate types after upgrading to version 11.9.0.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[coderabbitai]

📝 Walkthrough

Walkthrough

The 11.9.0 EnableEST upgrade script now updates additional internal authentication profile configuration targets for EC Server and ML-DSA Server/Subsystem profiles.

Changes

EnableEST internal profile update

Layer / File(s)	Summary
Expand internal profile targets base/server/upgrade/11.9.0/01-EnableEST.py	update_internal_profiles() adds EC Server and ML-DSA Server/Subsystem internal authentication profile configuration files to profiles_to_update.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the change: adding missing EC and ML-DSA profiles to the EnableEST upgrade scriptlet.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@base/server/upgrade/11.9.0/01-EnableEST.py`:
- Around line 93-96: In update_internal_profiles(), replace the early return at
the existing EST ACL check with continue so an already-updated profile does not
stop processing. Ensure every profile, including caECInternalAuthServerCert and
the ML-DSA profiles, is checked independently.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 21bb1d1d-a3c1-4be4-8d05-b52e2785fbff

📥 Commits

Reviewing files that changed from the base of the PR and between da07c70 and cf0eeaa.

📒 Files selected for processing (1)

• base/server/upgrade/11.9.0/01-EnableEST.py

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Do not exit when an earlier profile is already updated.

If caECInternalAuthSubsystemCert or another earlier profile already contains the EST ACL, the return at Lines 107-109 exits update_internal_profiles() before the newly added EC Server and ML-DSA profiles are processed. Partially upgraded installations will therefore still miss these ACLs and can continue returning 403 errors.

Replace that early return with continue so every profile is checked independently.

Proposed fix

             if 'group="Enterprise EST Administrators"' in config['authz.acl']:
                 logger.info('Internal profile ACLs already updated.')
-                return
+                continue

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	'caInternalAuthSubsystemCert',
	'caECInternalAuthServerCert', # Add EC Server profile (Fixes 403 Forbidden on EC EST)
	'caMLDSAInternalAuthServerCert', # Add ML-DSA Server profile
	'caMLDSAInternalAuthSubsystemCert' # Add ML-DSA Subsystem profile
	if 'group="Enterprise EST Administrators"' in config['authz.acl']:
	logger.info('Internal profile ACLs already updated.')
	continue

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@base/server/upgrade/11.9.0/01-EnableEST.py` around lines 93 - 96, In
update_internal_profiles(), replace the early return at the existing EST ACL
check with continue so an already-updated profile does not stop processing.
Ensure every profile, including caECInternalAuthServerCert and the ML-DSA
profiles, is checked independently.