Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix CI & tests #104

Merged
merged 6 commits into from
Oct 30, 2023
Merged

Fix CI & tests #104

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
ce5688c
ci: Update Go matrix
akerouanton Oct 27, 2023
8c00429
tests: Replace embedded Let's Encrypt cert with Amazon Root CA 1
akerouanton Oct 27, 2023
d5807de
tests: Skip tests failing on darwin
akerouanton Oct 28, 2023
d50e6dd
ci: Disable fail-fast strategy
akerouanton Oct 28, 2023
a85ee0f
ci: Bump golangci-lint version
akerouanton Oct 28, 2023
fdf5cfb
ci: Increase golangci-lint timeout
akerouanton Oct 28, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,9 @@ jobs:
name: Test ${{ matrix.platform }} (${{ matrix.go }})
timeout-minutes: 10
strategy:
fail-fast: false
matrix:
go: ["1.13.x", "1.15.x", "1.16.x"]
go: ["1.13.x", "1.20.x", "1.21.x"]
platform: [ubuntu-20.04]
runs-on: ${{ matrix.platform }}
steps:
Expand All @@ -34,8 +35,9 @@ jobs:
name: Test ${{ matrix.platform }} (${{ matrix.go }})
timeout-minutes: 10
strategy:
fail-fast: false
matrix:
go: ["1.13.x", "1.15.x", "1.16.x"]
go: ["1.13.x", "1.20.x", "1.21.x"]
platform: [windows-latest, macos-latest]
runs-on: ${{ matrix.platform }}
steps:
Expand All @@ -54,6 +56,7 @@ jobs:
name: Lint ${{ matrix.platform }}
timeout-minutes: 10
strategy:
fail-fast: false
matrix:
platform: [ubuntu-20.04, windows-latest, macos-latest]
runs-on: ${{ matrix.platform }}
Expand All @@ -62,4 +65,5 @@ jobs:
- uses: golangci/golangci-lint-action@v2
with:
# must be specified without patch version
version: v1.41
version: v1.55
args: --timeout=5m
64 changes: 28 additions & 36 deletions tlsconfig/config_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,37 +12,31 @@ import (
"testing"
)

// This is the currently active Let’s Encrypt R3 (RSA 2048, O = Let's Encrypt, CN = R3)
// cross-signed CA Intermediate cert, downloaded from: https://letsencrypt.org/certs/lets-encrypt-r3-cross-signed.pem
// It expires Sep 29 19:21:40 2021 GMT
// download updated versions from https://letsencrypt.org/certificates/
// This is the currently active Amazon Root CA 1 (CN=Amazon Root CA 1,O=Amazon,C=US),
// downloaded from: https://www.amazontrust.com/repository/AmazonRootCA1.pem
// It's valid since May 26 00:00:00 2015 GMT and expires on Jan 17 00:00:00 2038 GMT.
// Download updated versions from https://www.amazontrust.com/repository/
Comment on lines +15 to +18
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Curious; couldn't we use an updated version of the letsencrypt cert? (letsencrypt seems a bit more "independent" than some vendor's root-ca)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Initially, I tried updating the intermediate Let's Encrypt R3 cert but it was failing with the error message I documented in commit tests: Skip tests failing on darwin.

I wrote a small reproducer to verify the validity of that cert in a Windows 11 VM and it was working properly. Then, I thought that system-wide cert bundle was not up-to-date on Windows and MacOS on GHA runners.

Although it was a dubious theory, I tried to replace that Let's Encrypt cert with the Amazon Root CA 1 cert, but to no avail. Out of laziness (honestly!), I chose to keep this cert but then realized it's valid for a much longer period:

$ openssl crl2pkcs7 -nocrl -certfile ~/Downloads/lets-encrypt-r3.pem | openssl pkcs7 -print_certs -text -noout
            Not Before: Sep  4 00:00:00 2020 GMT
            Not After : Sep 15 16:00:00 2025 GMT
$ openssl crl2pkcs7 -nocrl -certfile ~/Downloads/AmazonRootCA1.pem | openssl pkcs7 -print_certs -text -noout
            Not Before: May 26 00:00:00 2015 GMT
            Not After : Jan 17 00:00:00 2038 GMT

So I came to the conclusion it's better to keep it.

Also, Let's Encrypt "independence" doesn't mean much in this context. This cert is only used to make sure we can XOR system-wide cert pool and a custom pool.

const (
systemRootTrustedCert = `
-----BEGIN CERTIFICATE-----
MIIEZTCCA02gAwIBAgIQQAF1BIMUpMghjISpDBbN3zANBgkqhkiG9w0BAQsFADA/
MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT
DkRTVCBSb290IENBIFgzMB4XDTIwMTAwNzE5MjE0MFoXDTIxMDkyOTE5MjE0MFow
MjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxCzAJBgNVBAMT
AlIzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuwIVKMz2oJTTDxLs
jVWSw/iC8ZmmekKIp10mqrUrucVMsa+Oa/l1yKPXD0eUFFU1V4yeqKI5GfWCPEKp
Tm71O8Mu243AsFzzWTjn7c9p8FoLG77AlCQlh/o3cbMT5xys4Zvv2+Q7RVJFlqnB
U840yFLuta7tj95gcOKlVKu2bQ6XpUA0ayvTvGbrZjR8+muLj1cpmfgwF126cm/7
gcWt0oZYPRfH5wm78Sv3htzB2nFd1EbjzK0lwYi8YGd1ZrPxGPeiXOZT/zqItkel
/xMY6pgJdz+dU/nPAeX1pnAXFK9jpP+Zs5Od3FOnBv5IhR2haa4ldbsTzFID9e1R
oYvbFQIDAQABo4IBaDCCAWQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8E
BAMCAYYwSwYIKwYBBQUHAQEEPzA9MDsGCCsGAQUFBzAChi9odHRwOi8vYXBwcy5p
ZGVudHJ1c3QuY29tL3Jvb3RzL2RzdHJvb3RjYXgzLnA3YzAfBgNVHSMEGDAWgBTE
p7Gkeyxx+tvhS5B1/8QVYIWJEDBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEE
AYLfEwEBATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2Vu
Y3J5cHQub3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuaWRlbnRydXN0
LmNvbS9EU1RST09UQ0FYM0NSTC5jcmwwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYf
r52LFMLGMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjANBgkqhkiG9w0B
AQsFAAOCAQEA2UzgyfWEiDcx27sT4rP8i2tiEmxYt0l+PAK3qB8oYevO4C5z70kH
ejWEHx2taPDY/laBL21/WKZuNTYQHHPD5b1tXgHXbnL7KqC401dk5VvCadTQsvd8
S8MXjohyc9z9/G2948kLjmE6Flh9dDYrVYA9x2O+hEPGOaEOa1eePynBgPayvUfL
qjBstzLhWVQLGAkXXmNs+5ZnPBxzDJOLxhF2JIbeQAcH5H0tZrUlo5ZYyOqA7s9p
O5b85o3AM/OJ+CktFBQtfvBhcJVd9wvlwPsk+uyOy2HI7mNxKKgsBTt375teA2Tw
UdHkhVNcsAKX1H7GNNLOEADksd86wuoXvg==
MIIDQTCCAimgAwIBAgITBmyfz5m/jAo54vB4ikPmljZbyjANBgkqhkiG9w0BAQsF
ADA5MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6
b24gUm9vdCBDQSAxMB4XDTE1MDUyNjAwMDAwMFoXDTM4MDExNzAwMDAwMFowOTEL
MAkGA1UEBhMCVVMxDzANBgNVBAoTBkFtYXpvbjEZMBcGA1UEAxMQQW1hem9uIFJv
b3QgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALJ4gHHKeNXj
ca9HgFB0fW7Y14h29Jlo91ghYPl0hAEvrAIthtOgQ3pOsqTQNroBvo3bSMgHFzZM
9O6II8c+6zf1tRn4SWiw3te5djgdYZ6k/oI2peVKVuRF4fn9tBb6dNqcmzU5L/qw
IFAGbHrQgLKm+a/sRxmPUDgH3KKHOVj4utWp+UhnMJbulHheb4mjUcAwhmahRWa6
VOujw5H5SNz/0egwLX0tdHA114gk957EWW67c4cX8jJGKLhD+rcdqsq08p8kDi1L
93FcXmn/6pUCyziKrlA4b9v7LWIbxcceVOF34GfID5yHI9Y/QCB/IIDEgEw+OyQm
jgSubJrIqg0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC
AYYwHQYDVR0OBBYEFIQYzIU07LwMlJQuCFmcx7IQTgoIMA0GCSqGSIb3DQEBCwUA
A4IBAQCY8jdaQZChGsV2USggNiMOruYou6r4lK5IpDB/G/wkjUu0yKGX9rbxenDI
U5PMCCjjmCXPI6T53iHTfIUJrU6adTrCC2qJeHZERxhlbI1Bjjt/msv0tadQ1wUs
N+gDS63pYaACbvXy8MWy7Vu33PqUXHeeE6V/Uq2V8viTO96LXFvKWlJbYK8U90vv
o/ufQJVtMVT8QtPHRh8jrdkPSHCa2XV4cdFyQzR1bldZwgJcJmApzyMZFo6IQ6XU
5MsI+yMRQ+hDKXJioaldXgjUkK642M4UwtBV8ob2xJNDd2ZhwLnoQdeXeGADbkpy
rqXRfboQnoZsG4q5WTP468SQvvG5
-----END CERTIFICATE-----
`
rsaPrivateKeyFile = "fixtures/key.pem"
Expand Down Expand Up @@ -205,10 +199,9 @@ func TestConfigServerTLSClientCASet(t *testing.T) {
// Exclusive root pools determines whether the CA pool will be a union of the system
// certificate pool and custom certs, or an exclusive or of the custom certs and system pool
func TestConfigServerExclusiveRootPools(t *testing.T) {
if runtime.GOOS == "windows" {
// FIXME TestConfigServerExclusiveRootPools is failing on windows:
// config_test.go:244: Unable to verify certificate 1: x509: certificate signed by unknown authority
t.Skip("FIXME: failing on Windows")
if runtime.GOOS == "windows" || runtime.GOOS == "darwin" {
// FIXME: see https://github.com/docker/go-connections/issues/105.
t.Skip("FIXME: failing on Windows and darwin")
}
key, cert := getCertAndKey()
ca := getMultiCert()
Expand Down Expand Up @@ -570,10 +563,9 @@ func TestConfigClientTLSNotSetWithInvalidPassphrase(t *testing.T) {
// Exclusive root pools determines whether the CA pool will be a union of the system
// certificate pool and custom certs, or an exclusive or of the custom certs and system pool
func TestConfigClientExclusiveRootPools(t *testing.T) {
if runtime.GOOS == "windows" {
// FIXME TestConfigClientExclusiveRootPools is failing on windows:
// config_test.go:597: Unable to verify certificate 1: x509: certificate signed by unknown authority
t.Skip("FIXME: failing on Windows")
if runtime.GOOS == "windows" || runtime.GOOS == "darwin" {
// FIXME: see https://github.com/docker/go-connections/issues/105.
t.Skip("FIXME: failing on Windows and darwin")
}
ca := getMultiCert()

Expand Down
Loading