From dde500b056359573ae6483e791d2a8db047278b5 Mon Sep 17 00:00:00 2001 From: Tim Kimber Date: Fri, 3 Jul 2026 15:42:51 +0000 Subject: [PATCH 1/5] add 1s sleep to Pebble to fix test flakiness --- docker-compose.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/docker-compose.yml b/docker-compose.yml index e9355e82..728c2ee9 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -7,7 +7,6 @@ services: # with Go 1.13.x which defaults TLS 1.3 to on GODEBUG: "tls13=1" PEBBLE_ALTERNATE_ROOTS: 2 - PEBBLE_VA_NOSLEEP: 1 PEBBLE_VA_SLEEPTIME: 1 ports: - 14000:14000 # HTTPS ACME API From 9eda28c089ef719eb9129c11752aa74d974e8d5c Mon Sep 17 00:00:00 2001 From: Tim Kimber Date: Fri, 3 Jul 2026 15:43:39 +0000 Subject: [PATCH 2/5] Change default Key Algorithm from rsa to prime256v1 --- getssl | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/getssl b/getssl index f00ba250..74ec7378 100755 --- a/getssl +++ b/getssl @@ -311,7 +311,7 @@ VERSION="2.51" # defaults ACCOUNT_KEY_LENGTH=4096 -ACCOUNT_KEY_TYPE="rsa" +ACCOUNT_KEY_TYPE="prime256v1" ACME_RESPONSE_PENDING_WAIT=5 ARI_ENABLE="true" CA_CERT_LOCATION="" @@ -344,7 +344,7 @@ OCSP_MUST_STAPLE="false" ORIG_UMASK=$(umask) PREFERRED_CHAIN="" # Set this to use an alternative root certificate PREVIOUSLY_VALIDATED="true" -PRIVATE_KEY_ALG="rsa" +PRIVATE_KEY_ALG="prime256v1" PROFILE="" RELOAD_CMD="" RENEW_ALLOW="30" @@ -3171,7 +3171,7 @@ write_getssl_template() { # write out the main template file # Account key and private key types - can be rsa, prime256v1, secp384r1 or secp521r1 #ACCOUNT_KEY_TYPE="rsa" - PRIVATE_KEY_ALG="rsa" + PRIVATE_KEY_ALG="prime256v1" #REUSE_PRIVATE_KEY="true" # Preferred Chain - use an different certificate root from the default From ab4474757ea79eed9398171947df1f0a3c1e8249 Mon Sep 17 00:00:00 2001 From: Tim Kimber Date: Fri, 3 Jul 2026 15:44:37 +0000 Subject: [PATCH 3/5] Add -d which prints test output on success --- test/run-test.sh | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/test/run-test.sh b/test/run-test.sh index f6a7fed2..b3dce5c3 100755 --- a/test/run-test.sh +++ b/test/run-test.sh @@ -86,15 +86,21 @@ OS=$1 if [ $# -gt 1 ]; then shift + if [ $1 == "-d" ]; then + DEBUG="--verbose-run --show-output-of-passing-tests " + shift + else + DEBUG="" + fi COMMAND=$* if [[ $COMMAND != bash ]] && [[ $COMMAND != /getssl/test/debug-test.sh* ]]; then if [[ $COMMAND != "bats /getssl/test"* ]]; then if [[ $COMMAND == /getssl/test* ]]; then - COMMAND="bats $COMMAND" + COMMAND="bats ${DEBUG}$COMMAND" elif [[ $COMMAND == test/* ]]; then - COMMAND="bats /getssl/$COMMAND" + COMMAND="bats ${DEBUG}/getssl/$COMMAND" else - COMMAND="bats /getssl/test/$COMMAND" + COMMAND="bats ${DEBUG}/getssl/test/$COMMAND" fi fi if [[ $COMMAND != *.bats ]]; then @@ -102,7 +108,7 @@ if [ $# -gt 1 ]; then fi fi else - COMMAND="bats /getssl/test --timing" + COMMAND="bats ${DEBUG}/getssl/test --timing" fi echo "Running $COMMAND" From 5d18798b0d87c5638a4c6954222190ee1833f5b6 Mon Sep 17 00:00:00 2001 From: Tim Kimber Date: Fri, 3 Jul 2026 17:14:31 +0100 Subject: [PATCH 4/5] Add -d to the README-testing.md file --- test/README-Testing.md | 50 +++++++++++++++++++++--------------------- 1 file changed, 25 insertions(+), 25 deletions(-) diff --git a/test/README-Testing.md b/test/README-Testing.md index ec68df96..db70a381 100644 --- a/test/README-Testing.md +++ b/test/README-Testing.md @@ -37,46 +37,46 @@ For individual accounts, \ is your github account name. ## Testing locally using pebble +1. Start `pebble` and `challtestsrv` using ```docker compose up -d --build``` + ### To run all the tests on a single OS -1. Start `pebble` and `challtestsrv` using ```docker compose up -d --build``` -2. Run the test suite ```test/run-test.sh []``` -3. eg. `test/run-test.sh ubuntu16` +Run the test suite ```test/run-test.sh []``` +eg. `test/run-test.sh ubuntu16` ### To run a single bats test on a single OS -1. Start `pebble` and `challtestsrv` using ```docker compose up -d --build``` -2. ```test/run-test.sh bats ``` -3. e.g. `test/run-test.sh ubuntu bats /getssl/test/1-simple-http01.bats` +`test/run-test.sh ` +e.g. `test/run-test.sh ubuntu test/1-simple-http01.bats` -## To debug a test +### To print the output of a test when it succeeds (automatically printed if it fails) -1. Start `pebble` and `challtestsrv` using ```docker compose up -d --build``` -2. ```run-test.sh /getssl/test/debug-test.sh ``` -3. e.g. `test/run-test.sh ubuntu /getssl/test/debug-test.sh -d /getssl/test/test-config/getssl-http01.cfg` -4. or (`test/run-test.sh ubuntu /getssl/test/debug-test.sh -d getssl-http01.cfg`) +`test/run-test.sh -d ` +e.g. `test/run-test.sh ubuntu -d test/1-simple-http01-dig.bats` + +### To debug a test + +`run-test.sh /getssl/test/debug-test.sh ` +e.g. `test/run-test.sh ubuntu /getssl/test/debug-test.sh -d /getssl/test/test-config/getssl-http01.cfg` +or `test/run-test.sh ubuntu /getssl/test/debug-test.sh -d getssl-http01.cfg` ### To start a shell and debug a test -1. Start `pebble` and `challtestsrv` using ```docker compose up -d --build``` -2. ```run-test.sh bash``` -3. `cd /getssl` -4. `test/debug-test.sh -d /getssl/test/test-config/getssl-http01.cfg` +```bash +run-test.sh bash +cd /getssl +test/debug-test.sh -d /getssl/test/test-config/getssl-http01.cfg +``` Note: If curl to pebble:14000 fails, change debug-test.sh to use the pebble.minica.pem file Note: Certificates will be created in /etc/nginx/pki ### To run bats on a file manually -1. Start `pebble` and `challtestsrv` using ```docker compose up -d --build``` -2. ```run-test.sh bash``` -3. `cd /root` -4. `bats /getssl/test/.bats` +```bash +run-test.sh bash +cd /root +bats /getssl/test/.bats +``` Note: This doesn't work if run inside the `getssl` directory - -### TODO - -1. Test wildcards -2. Test SSH, SFTP, SCP -3. Test change of key algorithm (should automatically delete and re-create account.key) From de4400a239557e120c6f448ed701e0c3ab498327 Mon Sep 17 00:00:00 2001 From: Tim Kimber Date: Fri, 3 Jul 2026 16:44:08 +0000 Subject: [PATCH 5/5] Fix test now default key algorithm has changed --- test/39-private-key-alg-changed.bats | 4 ++-- test/test_helper.bash | 3 +++ 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/test/39-private-key-alg-changed.bats b/test/39-private-key-alg-changed.bats index 68108641..6a194ba4 100644 --- a/test/39-private-key-alg-changed.bats +++ b/test/39-private-key-alg-changed.bats @@ -29,7 +29,7 @@ teardown_file() { create_certificate assert_success check_output_for_errors - # save a coy of the private key + # save a copy of the private key cp "${INSTALL_DIR}/.getssl/${GETSSL_CMD_HOST}/${GETSSL_CMD_HOST}.key" "${INSTALL_DIR}/.getssl/${GETSSL_CMD_HOST}/${GETSSL_CMD_HOST}.key.orig" } @@ -73,7 +73,7 @@ teardown_file() { ORIG_KEY_HASH="$(cat ${INSTALL_DIR}/.getssl/${GETSSL_CMD_HOST}/${GETSSL_CMD_HOST}.key | sha256sum)" cat <<- 'EOF' > ${INSTALL_DIR}/.getssl/${GETSSL_CMD_HOST}/getssl_test_specific.cfg -PRIVATE_KEY_ALG="prime256v1" +PRIVATE_KEY_ALG="rsa" EOF run ${CODE_DIR}/getssl -U -d $GETSSL_HOST diff --git a/test/test_helper.bash b/test/test_helper.bash index bbe6b5a3..50345ebf 100644 --- a/test/test_helper.bash +++ b/test/test_helper.bash @@ -90,6 +90,9 @@ check_output_for_errors() { } cleanup_environment() { + if [ -f ${INSTALL_DIR}/.getssl/${GETSSL_CMD_HOST}/getssl_test_specific.cfg ]; then + rm ${INSTALL_DIR}/.getssl/${GETSSL_CMD_HOST}/getssl_test_specific.cfg + fi if [ -z "$STAGING" ]; then curl --silent -X POST -d '{"host":"'"$GETSSL_HOST"'"}' http://10.30.50.3:8055/clear-a fi