mokhtar
5b3d1cd65c
Gates / frontend (push) Successful in 1m2s
Gates / test (push) Successful in 1m38s
Gates / package (push) Successful in 5m5s
Gates / test-aarch64 (push) Successful in 6m30s
Gates / container (push) Successful in 15s
CI / gates (push) Successful in 13m30s
32 lines
1.5 KiB
Markdown
32 lines
1.5 KiB
Markdown
# Test fixtures
|
|
|
|
`self_signed_cert.pem`/`self_signed_key.pem` and `self_signed_cert2.pem`/`self_signed_key2.pem` are **test fixtures**. The private keys are **intentionally committed** to this public repository. They are not secrets and must never protect anything real.
|
|
|
|
Properties:
|
|
|
|
- EC P-256 (`prime256v1`), SHA-256 signature
|
|
- Subject `CN=localhost`
|
|
- SAN `DNS:localhost`, `IP:127.0.0.1`
|
|
- Validity 36500 days from generation
|
|
|
|
The loopback TLS test in `src/platform/tls_server.zig` uses the first pair. The second pair exists so certificate-reload tests can swap between two valid identities (milestone-10 ruling 13). Nothing in the shipped binary reads either.
|
|
|
|
Regenerate with (substitute `2` in both file names for the second pair):
|
|
|
|
```sh
|
|
openssl ecparam -name prime256v1 -genkey -noout -out self_signed_key.pem
|
|
openssl req -new -x509 -key self_signed_key.pem -out self_signed_cert.pem \
|
|
-days 36500 -sha256 -subj "/CN=localhost" \
|
|
-addext "subjectAltName=DNS:localhost,IP:127.0.0.1"
|
|
```
|
|
|
|
`mismatched_key.pem` is a second EC P-256 key with no certificate. It parses, but it does not belong to `self_signed_cert.pem`, so `ServerContext.init` must reject the pair with `error.KeyMismatch`. It is not a secret either.
|
|
|
|
Regenerate with:
|
|
|
|
```sh
|
|
openssl ecparam -name prime256v1 -genkey -noout -out mismatched_key.pem
|
|
```
|
|
|
|
`container-smoke.zon` is the smallest configuration that lets the daemon reach `serving`. `tools/container_check.zig` copies it into the smoke container, which is the only thing that reads it.
|