CA handler Tests - Certifier #1312
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CA handler Tests - Certifier | |
| on: | |
| push: | |
| pull_request: | |
| branches: [ devel ] | |
| schedule: | |
| # * is a special character in YAML so you have to quote this string | |
| - cron: '0 2 * * 6' | |
| jobs: | |
| certifier_handler_tests: | |
| name: "certifier_handler_tests" | |
| runs-on: ubuntu-latest | |
| strategy: | |
| max-parallel: 2 | |
| fail-fast: false | |
| matrix: | |
| websrv: ['apache2', 'nginx'] | |
| dbhandler: ['wsgi', 'django'] | |
| steps: | |
| - name: "checkout GIT" | |
| uses: actions/checkout@v4 | |
| - name: "Build container" | |
| uses: ./.github/actions/container_prep | |
| with: | |
| DB_HANDLER: ${{ matrix.dbhandler }} | |
| WEB_SRV: ${{ matrix.websrv }} | |
| - name: "Setup tunnel" | |
| uses: ./.github/actions/wf_specific/certifier_ca_handler/tunnel_setup | |
| with: | |
| WCCE_SSH_USER: ${{ secrets.WCCE_SSH_USER }} | |
| WCCE_SSH_HOST: ${{ secrets.WCCE_SSH_HOST }} | |
| WCCE_SSH_PORT: ${{ secrets.WCCE_SSH_PORT }} | |
| NCM_API_HOST: ${{ secrets.NCM_API_HOST }} | |
| WCCE_SSH_KNOWN_HOSTS: ${{ secrets.WCCE_SSH_KNOWN_HOSTS }} | |
| WCCE_SSH_ACCESS_KEY: ${{ secrets.WCCE_SSH_ACCESS_KEY }} | |
| NCM_API_USER: ${{ secrets.NCM_API_USER }} | |
| NCM_API_PASSWORD: ${{ secrets.NCM_API_PASSWORD }} | |
| - name: "No profile - Setup a2c with certifier_ca_handler" | |
| run: | | |
| sudo cp .github/openssl_ca_handler.py_acme_srv_default_handler.cfg examples/Docker/data/acme_srv.cfg | |
| sudo chmod 777 examples/Docker/data/acme_srv.cfg | |
| sudo cp test/ca/certsrv_ca_certs.pem examples/Docker/data/ca_certs.pem | |
| sudo head -n -8 .github/openssl_ca_handler.py_acme_srv_default_handler.cfg > examples/Docker/data/acme_srv.cfg | |
| sudo echo "handler_file: examples/ca_handler/certifier_ca_handler.py" >> examples/Docker/data/acme_srv.cfg | |
| # sudo echo "api_host: $NCM_API_HOST" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "api_host: https://forwarder.acme:8084" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "ca_bundle: False" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "api_user: $NCM_API_USER" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "api_password: $NCM_API_PASSWORD" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "ca_name: $NCM_CA_NAME" >> examples/Docker/data/acme_srv.cfg | |
| # sudo echo "ca_bundle: $NCM_CA_BUNDLE" >> examples/Docker/data/acme_srv.cfg | |
| cd examples/Docker/ | |
| docker-compose restart | |
| env: | |
| NCM_API_HOST: ${{ secrets.NCM_API_HOST }} | |
| NCM_API_USER: ${{ secrets.NCM_API_USER }} | |
| NCM_API_PASSWORD: ${{ secrets.NCM_API_PASSWORD }} | |
| NCM_CA_NAME: ${{ secrets.NCM_CA_NAME }} | |
| NCM_CA_BUNDLE: ${{ secrets.NCM_CA_BUNDLE }} | |
| - name: "No profile - Enrollmnet" | |
| uses: ./.github/actions/wf_specific/certifier_ca_handler/enroll_no_profile | |
| - name: "Profile 101 - Setup a2c with certifier_ca_handler with profile 101" | |
| run: | | |
| sudo head -n -8 .github/openssl_ca_handler.py_acme_srv_default_handler.cfg > examples/Docker/data/acme_srv.cfg | |
| sudo echo "handler_file: examples/ca_handler/certifier_ca_handler.py" >> examples/Docker/data/acme_srv.cfg | |
| # sudo echo "api_host: $NCM_API_HOST" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "api_host: https://forwarder.acme:8084" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "ca_bundle: False" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "api_user: $NCM_API_USER" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "api_password: $NCM_API_PASSWORD" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "ca_name: $NCM_CA_NAME" >> examples/Docker/data/acme_srv.cfg | |
| # sudo echo "ca_bundle: $NCM_CA_BUNDLE" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "profile_id: 101" >> examples/Docker/data/acme_srv.cfg | |
| cd examples/Docker/ | |
| docker-compose restart | |
| env: | |
| NCM_API_HOST: ${{ secrets.NCM_API_HOST }} | |
| NCM_API_USER: ${{ secrets.NCM_API_USER }} | |
| NCM_API_PASSWORD: ${{ secrets.NCM_API_PASSWORD }} | |
| NCM_CA_NAME: ${{ secrets.NCM_CA_NAME }} | |
| NCM_CA_BUNDLE: ${{ secrets.NCM_CA_BUNDLE }} | |
| PROFILE: ${{ secrets.PROFILE }} | |
| - name: "Profile 101 - Enrollmnet" | |
| uses: ./.github/actions/wf_specific/certifier_ca_handler/enroll_101_profile | |
| - name: "Profile 102 - Setup a2c with certifier_ca_handler with Profile 102" | |
| run: | | |
| sudo head -n -8 .github/openssl_ca_handler.py_acme_srv_default_handler.cfg > examples/Docker/data/acme_srv.cfg | |
| sudo echo "handler_file: examples/ca_handler/certifier_ca_handler.py" >> examples/Docker/data/acme_srv.cfg | |
| # sudo echo "api_host: $NCM_API_HOST" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "api_host: https://forwarder.acme:8084" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "ca_bundle: False" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "api_user: $NCM_API_USER" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "api_password: $NCM_API_PASSWORD" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "ca_name: $NCM_CA_NAME" >> examples/Docker/data/acme_srv.cfg | |
| # sudo echo "ca_bundle: $NCM_CA_BUNDLE" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "profile_id: 102" >> examples/Docker/data/acme_srv.cfg | |
| cd examples/Docker/ | |
| docker-compose restart | |
| env: | |
| NCM_API_HOST: ${{ secrets.NCM_API_HOST }} | |
| NCM_API_USER: ${{ secrets.NCM_API_USER }} | |
| NCM_API_PASSWORD: ${{ secrets.NCM_API_PASSWORD }} | |
| NCM_CA_NAME: ${{ secrets.NCM_CA_NAME }} | |
| NCM_CA_BUNDLE: ${{ secrets.NCM_CA_BUNDLE }} | |
| - name: "Profile 102 - Enrollmnet" | |
| uses: ./.github/actions/wf_specific/certifier_ca_handler/enroll_102_profile | |
| - name: "Header-info - Setup a2c with certifier_ca_handler with header-info" | |
| run: | | |
| sudo head -n -8 .github/openssl_ca_handler.py_acme_srv_default_handler.cfg > examples/Docker/data/acme_srv.cfg | |
| sudo echo "handler_file: examples/ca_handler/certifier_ca_handler.py" >> examples/Docker/data/acme_srv.cfg | |
| # sudo echo "api_host: $NCM_API_HOST" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "api_host: https://forwarder.acme:8084" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "ca_bundle: False" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "api_user: $NCM_API_USER" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "api_password: $NCM_API_PASSWORD" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "ca_name: $NCM_CA_NAME" >> examples/Docker/data/acme_srv.cfg | |
| # sudo echo "ca_bundle: $NCM_CA_BUNDLE" >> examples/Docker/data/acme_srv.cfg | |
| sudo sed -i "s/tnauthlist_support: False/tnauthlist_support: False\nheader_info_list: [\"HTTP_USER_AGENT\"]/g" examples/Docker/data/acme_srv.cfg | |
| cd examples/Docker/ | |
| docker-compose restart | |
| env: | |
| NCM_API_HOST: ${{ secrets.NCM_API_HOST }} | |
| NCM_API_USER: ${{ secrets.NCM_API_USER }} | |
| NCM_API_PASSWORD: ${{ secrets.NCM_API_PASSWORD }} | |
| NCM_CA_NAME: ${{ secrets.NCM_CA_NAME }} | |
| NCM_CA_BUNDLE: ${{ secrets.NCM_CA_BUNDLE }} | |
| - name: "Header-info - Enrollmnet" | |
| uses: ./.github/actions/wf_specific/certifier_ca_handler/enroll_headerinfo | |
| - name: "EAB without headerinfo - Setup a2c with certifier_ca_handler" | |
| run: | | |
| sudo head -n -8 .github/openssl_ca_handler.py_acme_srv_default_handler.cfg > examples/Docker/data/acme_srv.cfg | |
| sudo echo "handler_file: examples/ca_handler/certifier_ca_handler.py" >> examples/Docker/data/acme_srv.cfg | |
| # sudo echo "api_host: $NCM_API_HOST" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "api_host: https://forwarder.acme:8084" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "ca_bundle: False" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "api_user: $NCM_API_USER" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "api_password: $NCM_API_PASSWORD" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "ca_name: $NCM_CA_NAME" >> examples/Docker/data/acme_srv.cfg | |
| # sudo echo "ca_bundle: $NCM_CA_BUNDLE" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "profile_id: 100" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "eab_profiling: True" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo -e "\n[EABhandler]" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "eab_handler_file: /var/www/acme2certifier/examples/eab_handler/kid_profile_handler.py" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "key_file: volume/kid_profiles.json" >> examples/Docker/data/acme_srv.cfg | |
| sudo cp examples/eab_handler/kid_profiles.json examples/Docker/data/kid_profiles.json | |
| sudo chmod 777 examples/eab_handler/kid_profiles.json | |
| sudo sed -i "s/\"profile_id\"\: \[\"profile_1\", \"profile_2\", \"profile_3\"\]/\"profile_id\"\: \[\"102\", \"101\"\, \"100\"]/g" examples/Docker/data/kid_profiles.json | |
| sudo sed -i "s/\"profile_id\"\: \"profile_2\"/\"profile_id\"\: \"102\"/g" examples/Docker/data/kid_profiles.json | |
| sudo sed -i "s/\"ca_name\": \"example_ca_2\",/\"ca_name\": \"SubCA2\"/" examples/Docker/data/kid_profiles.json | |
| sudo sed -i "s/\"ca_name\": \"example_ca\",/\"unknown_key\": \"unknown_value\"/g" examples/Docker/data/kid_profiles.json | |
| sudo sed -i "s/example.net/acme/g" examples/Docker/data/kid_profiles.json | |
| sudo sed -i '18,19d' examples/Docker/data/kid_profiles.json | |
| sudo sed -i '8,9d' examples/Docker/data/kid_profiles.json | |
| cd examples/Docker/ | |
| docker-compose restart | |
| env: | |
| NCM_API_HOST: ${{ secrets.NCM_API_HOST }} | |
| NCM_API_USER: ${{ secrets.NCM_API_USER }} | |
| NCM_API_PASSWORD: ${{ secrets.NCM_API_PASSWORD }} | |
| NCM_CA_NAME: ${{ secrets.NCM_CA_NAME }} | |
| NCM_CA_BUNDLE: ${{ secrets.NCM_CA_BUNDLE }} | |
| - name: "EAB without headerinfo - Enrollment" | |
| uses: ./.github/actions/wf_specific/certifier_ca_handler/enroll_eab_wo_headerinfo | |
| - name: "EAB with headerinfo - Setup a2c with certifier_ca_handler" | |
| run: | | |
| sudo touch examples/Docker/data/acme_srv.cfg | |
| sudo chmod 777 examples/Docker/data/acme_srv.cfg | |
| sudo head -n -8 .github/openssl_ca_handler.py_acme_srv_default_handler.cfg > examples/Docker/data/acme_srv.cfg | |
| sudo echo "handler_file: examples/ca_handler/certifier_ca_handler.py" >> examples/Docker/data/acme_srv.cfg | |
| # sudo echo "api_host: $NCM_API_HOST" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "api_host: https://forwarder.acme:8084" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "ca_bundle: False" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "api_user: $NCM_API_USER" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "api_password: $NCM_API_PASSWORD" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "ca_name: $NCM_CA_NAME" >> examples/Docker/data/acme_srv.cfg | |
| # sudo echo "ca_bundle: $NCM_CA_BUNDLE" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "profile_id: 100" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "eab_profiling: True" >> examples/Docker/data/acme_srv.cfg | |
| sudo sed -i "s/tnauthlist_support: False/tnauthlist_support: False\nheader_info_list: [\"HTTP_USER_AGENT\"]/g" examples/Docker/data/acme_srv.cfg | |
| sudo echo -e "\n[EABhandler]" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "eab_handler_file: /var/www/acme2certifier/examples/eab_handler/kid_profile_handler.py" >> examples/Docker/data/acme_srv.cfg | |
| sudo echo "key_file: volume/kid_profiles.json" >> examples/Docker/data/acme_srv.cfg | |
| sudo cp examples/eab_handler/kid_profiles.json examples/Docker/data/kid_profiles.json | |
| sudo chmod 777 examples/eab_handler/kid_profiles.json | |
| sudo sed -i "s/\"profile_id\"\: \[\"profile_1\", \"profile_2\", \"profile_3\"\]/\"profile_id\"\: \[\"102\", \"101\"\, \"100\"]/g" examples/Docker/data/kid_profiles.json | |
| sudo sed -i "s/\"profile_id\"\: \"profile_2\"/\"profile_id\"\: \"102\"/g" examples/Docker/data/kid_profiles.json | |
| sudo sed -i "s/\"ca_name\": \"example_ca_2\",/\"ca_name\": \"SubCA2\"/" examples/Docker/data/kid_profiles.json | |
| sudo sed -i "s/\"ca_name\": \"example_ca\",/\"unknown_key\": \"unknown_value\"/g" examples/Docker/data/kid_profiles.json | |
| sudo sed -i "s/example.net/acme/g" examples/Docker/data/kid_profiles.json | |
| sudo sed -i '18,19d' examples/Docker/data/kid_profiles.json | |
| sudo sed -i '8,9d' examples/Docker/data/kid_profiles.json | |
| cd examples/Docker/ | |
| docker-compose restart | |
| env: | |
| NCM_API_HOST: ${{ secrets.NCM_API_HOST }} | |
| NCM_API_USER: ${{ secrets.NCM_API_USER }} | |
| NCM_API_PASSWORD: ${{ secrets.NCM_API_PASSWORD }} | |
| NCM_CA_NAME: ${{ secrets.NCM_CA_NAME }} | |
| NCM_CA_BUNDLE: ${{ secrets.NCM_CA_BUNDLE }} | |
| - name: "EAB with headerinfo - Enrollment" | |
| uses: ./.github/actions/wf_specific/certifier_ca_handler/enroll_eab_w_headerinfo | |
| - name: "EAB with headerinfo - Reconfigure key_file without restarting" | |
| run: | | |
| sudo sed -i "s/\"allowed_domainlist\": \[\"www.example.com\", \"www.example.org\"\]/\"allowed_domainlist\": \[\"www.example.com\", \"www.example.org\", \"*.acme\"\]/g" examples/Docker/data/kid_profiles.json | |
| sudo sed -i '26,27d' examples/Docker/data/kid_profiles.json | |
| sudo sed -i "s/ \"hmac\": \"YW5kX2ZpbmFsbHlfdGhlX2xhc3RfaG1hY19rZXlfd2hpY2hfaXNfbG9uZ2VyX3RoYW5fMjU2X2JpdHNfYW5kX3Nob3VsZF93b3Jr\"/ \"hmac\": \"YW5kX2ZpbmFsbHlfdGhlX2xhc3RfaG1hY19rZXlfd2hpY2hfaXNfbG9uZ2VyX3RoYW5fMjU2X2JpdHNfYW5kX3Nob3VsZF93b3Jr\"\n },\n \"keyid_04\": {\n \"hmac\": \"YW5kX2hlcmVfaXNfYW5vdGhlcl92ZXJ5X2xvbmdfbWFja19obWFjX2tleV90b19jaGVja19pZl9jaGFuZ2VzX2FmZmVjdF9pbW1lZGF0ZWx5\",\n \"cahandler\": {}\n }\n}/g" examples/Docker/data/kid_profiles.json | |
| - name: "EAB with headerinfo - Enrollment after reconfiguration" | |
| uses: ./.github/actions/wf_specific/certifier_ca_handler/enroll_eab_w_headerinfo | |
| with: | |
| RECONFIGURE: true | |
| - name: "kid-file in yaml format - Reconfiguration" | |
| run: | | |
| sudo sed -i "s/kid_profiles.json/kid_profiles.yml/g" examples/Docker/data/acme_srv.cfg | |
| sudo pip3 install yq | |
| sudo pip3 install jq | |
| sudo sh -c "cat examples/Docker/data/kid_profiles.json | yq -y '.' > examples/Docker/data/kid_profiles.yml" | |
| sudo rm examples/Docker/data/kid_profiles.json | |
| sudo sed -i '33,34d' examples/Docker/data/kid_profiles.yml | |
| # sudo cat examples/Docker/data/kid_profiles.yml | |
| - name: "kid-file in yaml format - Enrollment after reconfiguration" | |
| uses: ./.github/actions/wf_specific/certifier_ca_handler/enroll_eab_w_headerinfo | |
| with: | |
| RECONFIGURE: true | |
| - name: "Check container configuration" | |
| uses: ./.github/actions/container_check | |
| with: | |
| DB_HANDLER: ${{ matrix.dbhandler }} | |
| WEB_SRV: ${{ matrix.websrv }} | |
| - name: "[ * ] collecting test logs" | |
| if: ${{ failure() }} | |
| run: | | |
| mkdir -p ${{ github.workspace }}/artifact/upload | |
| sudo cp -rp examples/Docker/data/ ${{ github.workspace }}/artifact/data/ | |
| sudo cp -rp acme-sh/ ${{ github.workspace }}/artifact/acme-sh/ | |
| sudo cp -rp certbot/ ${{ github.workspace }}/artifact/certbot/ | |
| sudo cp -rp lego/ ${{ github.workspace }}/artifact/lego/ | |
| cd examples/Docker | |
| docker-compose logs > ${{ github.workspace }}/artifact/docker-compose.log | |
| sudo tar -C ${{ github.workspace }}/artifact/ -cvzf ${{ github.workspace }}/artifact/upload/artifact.tar.gz docker-compose.log data acme-sh certbot lego | |
| - name: "[ * ] uploading artificates" | |
| uses: actions/upload-artifact@v4 | |
| if: ${{ failure() }} | |
| with: | |
| name: ncm-${{ matrix.websrv }}-${{ matrix.dbhandler }}.tar.gz | |
| path: ${{ github.workspace }}/artifact/upload/ | |
| certifier_handler_tests_rpm: | |
| name: "certifier_handler_tests_rpm" | |
| runs-on: ubuntu-latest | |
| # needs: certifier_handler_tests | |
| strategy: | |
| fail-fast: false | |
| max-parallel: 1 | |
| matrix: | |
| rhversion: [8, 9] | |
| steps: | |
| - name: "checkout GIT" | |
| uses: actions/checkout@v4 | |
| - name: "Prepare Alma environment" | |
| uses: ./.github/actions/rpm_prep | |
| with: | |
| GH_SBOM_USER: ${{ secrets.GH_SBOM_USER }} | |
| GH_SBOM_TOKEN: ${{ secrets.GH_SBOM_TOKEN }} | |
| RH_VERSION: ${{ matrix.rhversion }} | |
| - name: "Setup tunnel" | |
| uses: ./.github/actions/wf_specific/certifier_ca_handler/tunnel_setup | |
| with: | |
| WCCE_SSH_USER: ${{ secrets.WCCE_SSH_USER }} | |
| WCCE_SSH_HOST: ${{ secrets.WCCE_SSH_HOST }} | |
| WCCE_SSH_PORT: ${{ secrets.WCCE_SSH_PORT }} | |
| NCM_API_HOST: ${{ secrets.NCM_API_HOST }} | |
| WCCE_SSH_KNOWN_HOSTS: ${{ secrets.WCCE_SSH_KNOWN_HOSTS }} | |
| WCCE_SSH_ACCESS_KEY: ${{ secrets.WCCE_SSH_ACCESS_KEY }} | |
| NCM_API_USER: ${{ secrets.NCM_API_USER }} | |
| NCM_API_PASSWORD: ${{ secrets.NCM_API_PASSWORD }} | |
| - name: "No profile - Setup a2c with certifier_ca_handler" | |
| run: | | |
| mkdir -p data/acme_ca | |
| sudo cp test/ca/certsrv_ca_certs.pem data/acme_ca/ca_certs.pem | |
| sudo touch data/acme_srv.cfg | |
| sudo chmod 777 data/acme_srv.cfg | |
| sudo head -n -8 .github/openssl_ca_handler.py_acme_srv_default_handler.cfg > data/acme_srv.cfg | |
| sudo echo "handler_file: examples/ca_handler/certifier_ca_handler.py" >> data/acme_srv.cfg | |
| # sudo echo "api_host: $NCM_API_HOST" >> data/acme_srv.cfg | |
| sudo echo "api_host: https://forwarder.acme:8084" >> data/acme_srv.cfg | |
| sudo echo "ca_bundle: False" >> data/acme_srv.cfg | |
| sudo echo "api_user: $NCM_API_USER" >> data/acme_srv.cfg | |
| sudo echo "api_password: $NCM_API_PASSWORD" >> data/acme_srv.cfg | |
| sudo echo "ca_name: $NCM_CA_NAME" >> data/acme_srv.cfg | |
| # sudo echo "ca_bundle: $NCM_CA_BUNDLE" >> data/acme_srv.cfg | |
| env: | |
| NCM_API_HOST: ${{ secrets.NCM_API_HOST }} | |
| NCM_API_USER: ${{ secrets.NCM_API_USER }} | |
| NCM_API_PASSWORD: ${{ secrets.NCM_API_PASSWORD }} | |
| NCM_CA_NAME: ${{ secrets.NCM_CA_NAME }} | |
| NCM_CA_BUNDLE: ${{ secrets.NCM_CA_BUNDLE }} | |
| - name: "Execute install scipt" | |
| run: | | |
| docker exec acme-srv sh /tmp/acme2certifier/rpm_tester.sh | |
| - name: "No profile - Enrollmnet" | |
| uses: ./.github/actions/wf_specific/certifier_ca_handler/enroll_no_profile | |
| - name: "Profile 101 - Setup a2c with certifier_ca_handler with profile 101" | |
| run: | | |
| sudo head -n -8 .github/openssl_ca_handler.py_acme_srv_default_handler.cfg > data/acme_srv.cfg | |
| sudo echo "handler_file: examples/ca_handler/certifier_ca_handler.py" >> data/acme_srv.cfg | |
| # sudo echo "api_host: $NCM_API_HOST" >> data/acme_srv.cfg | |
| sudo echo "api_host: https://forwarder.acme:8084" >> data/acme_srv.cfg | |
| sudo echo "ca_bundle: False" >> data/acme_srv.cfg | |
| sudo echo "api_user: $NCM_API_USER" >> data/acme_srv.cfg | |
| sudo echo "api_password: $NCM_API_PASSWORD" >> data/acme_srv.cfg | |
| sudo echo "ca_name: $NCM_CA_NAME" >> data/acme_srv.cfg | |
| # sudo echo "ca_bundle: $NCM_CA_BUNDLE" >> data/acme_srv.cfg | |
| sudo echo "profile_id: 101" >> data/acme_srv.cfg | |
| env: | |
| NCM_API_HOST: ${{ secrets.NCM_API_HOST }} | |
| NCM_API_USER: ${{ secrets.NCM_API_USER }} | |
| NCM_API_PASSWORD: ${{ secrets.NCM_API_PASSWORD }} | |
| NCM_CA_NAME: ${{ secrets.NCM_CA_NAME }} | |
| NCM_CA_BUNDLE: ${{ secrets.NCM_CA_BUNDLE }} | |
| PROFILE: ${{ secrets.PROFILE }} | |
| - name: "Profile 101 - Reconfigure a2c " | |
| run: | | |
| docker exec acme-srv sh /tmp/acme2certifier/rpm_tester.sh restart | |
| - name: "Profile 101 - Enrollmnet" | |
| uses: ./.github/actions/wf_specific/certifier_ca_handler/enroll_101_profile | |
| - name: "Profile 102 - Setup a2c with certifier_ca_handler with profile 101" | |
| run: | | |
| sudo head -n -8 .github/openssl_ca_handler.py_acme_srv_default_handler.cfg > data/acme_srv.cfg | |
| sudo echo "handler_file: examples/ca_handler/certifier_ca_handler.py" >> data/acme_srv.cfg | |
| # sudo echo "api_host: $NCM_API_HOST" >> data/acme_srv.cfg | |
| sudo echo "api_host: https://forwarder.acme:8084" >> data/acme_srv.cfg | |
| sudo echo "ca_bundle: False" >> data/acme_srv.cfg | |
| sudo echo "api_user: $NCM_API_USER" >> data/acme_srv.cfg | |
| sudo echo "api_password: $NCM_API_PASSWORD" >> data/acme_srv.cfg | |
| sudo echo "ca_name: $NCM_CA_NAME" >> data/acme_srv.cfg | |
| # sudo echo "ca_bundle: $NCM_CA_BUNDLE" >> data/acme_srv.cfg | |
| sudo echo "profile_id: 102" >> data/acme_srv.cfg | |
| env: | |
| NCM_API_HOST: ${{ secrets.NCM_API_HOST }} | |
| NCM_API_USER: ${{ secrets.NCM_API_USER }} | |
| NCM_API_PASSWORD: ${{ secrets.NCM_API_PASSWORD }} | |
| NCM_CA_NAME: ${{ secrets.NCM_CA_NAME }} | |
| NCM_CA_BUNDLE: ${{ secrets.NCM_CA_BUNDLE }} | |
| PROFILE: ${{ secrets.PROFILE }} | |
| - name: "Profile 102 - Reconfigure a2c " | |
| run: | | |
| docker exec acme-srv sh /tmp/acme2certifier/rpm_tester.sh restart | |
| - name: "Profile 102 - Enrollmnet" | |
| uses: ./.github/actions/wf_specific/certifier_ca_handler/enroll_102_profile | |
| - name: "Header-info - Setup a2c with certifier_ca_handler" | |
| run: | | |
| sudo head -n -8 .github/openssl_ca_handler.py_acme_srv_default_handler.cfg > data/acme_srv.cfg | |
| sudo echo "handler_file: examples/ca_handler/certifier_ca_handler.py" >> data/acme_srv.cfg | |
| # sudo echo "api_host: $NCM_API_HOST" >> data/acme_srv.cfg | |
| sudo echo "api_host: https://forwarder.acme:8084" >> data/acme_srv.cfg | |
| sudo echo "ca_bundle: False" >> data/acme_srv.cfg | |
| sudo echo "api_user: $NCM_API_USER" >> data/acme_srv.cfg | |
| sudo echo "api_password: $NCM_API_PASSWORD" >> data/acme_srv.cfg | |
| sudo echo "ca_name: $NCM_CA_NAME" >> data/acme_srv.cfg | |
| # sudo echo "ca_bundle: $NCM_CA_BUNDLE" >> data/acme_srv.cfg | |
| sudo sed -i "s/tnauthlist_support: False/tnauthlist_support: False\nheader_info_list: [\"HTTP_USER_AGENT\"]/g" data/acme_srv.cfg | |
| env: | |
| NCM_API_HOST: ${{ secrets.NCM_API_HOST }} | |
| NCM_API_USER: ${{ secrets.NCM_API_USER }} | |
| NCM_API_PASSWORD: ${{ secrets.NCM_API_PASSWORD }} | |
| NCM_CA_NAME: ${{ secrets.NCM_CA_NAME }} | |
| NCM_CA_BUNDLE: ${{ secrets.NCM_CA_BUNDLE }} | |
| PROFILE: ${{ secrets.PROFILE }} | |
| - name: "Header-info - Reconfigure a2c " | |
| run: | | |
| docker exec acme-srv sh /tmp/acme2certifier/rpm_tester.sh restart | |
| - name: "Header-info - Enrollmnet" | |
| uses: ./.github/actions/wf_specific/certifier_ca_handler/enroll_headerinfo | |
| - name: "EAB without headerinfo - Setup a2c with certifier_ca_handler" | |
| run: | | |
| sudo head -n -8 .github/openssl_ca_handler.py_acme_srv_default_handler.cfg > data/acme_srv.cfg | |
| sudo echo "handler_file: examples/ca_handler/certifier_ca_handler.py" >> data/acme_srv.cfg | |
| # sudo echo "api_host: $NCM_API_HOST" >> data/acme_srv.cfg | |
| sudo echo "api_host: https://forwarder.acme:8084" >> data/acme_srv.cfg | |
| sudo echo "ca_bundle: False" >> data/acme_srv.cfg | |
| sudo echo "api_user: $NCM_API_USER" >> data/acme_srv.cfg | |
| sudo echo "api_password: $NCM_API_PASSWORD" >> data/acme_srv.cfg | |
| sudo echo "ca_name: $NCM_CA_NAME" >> data/acme_srv.cfg | |
| # sudo echo "ca_bundle: $NCM_CA_BUNDLE" >> data/acme_srv.cfg | |
| sudo echo "profile_id: 100" >> data/acme_srv.cfg | |
| sudo echo "eab_profiling: True" >> data/acme_srv.cfg | |
| sudo echo -e "\n\n[EABhandler]" >> data/acme_srv.cfg | |
| sudo echo "eab_handler_file: /opt/acme2certifier/examples/eab_handler/kid_profile_handler.py" >> data/acme_srv.cfg | |
| sudo echo "key_file: /opt/acme2certifier/volume/acme_ca/kid_profiles.json" >> data/acme_srv.cfg | |
| sudo cp examples/eab_handler/kid_profiles.json data/acme_ca/kid_profiles.json | |
| sudo chmod 777 data/acme_ca/kid_profiles.json | |
| sudo sed -i "s/\"profile_id\"\: \[\"profile_1\", \"profile_2\", \"profile_3\"\]/\"profile_id\"\: \[\"102\", \"101\"\, \"100\"]/g" data/acme_ca/kid_profiles.json | |
| sudo sed -i "s/\"profile_id\"\: \"profile_2\"/\"profile_id\"\: \"102\"/g" data/acme_ca/kid_profiles.json | |
| sudo sed -i "s/\"ca_name\": \"example_ca_2\",/\"ca_name\": \"SubCA2\"/" data/acme_ca/kid_profiles.json | |
| sudo sed -i "s/\"ca_name\": \"example_ca\",/\"unknown_key\": \"unknown_value\"/g" data/acme_ca/kid_profiles.json | |
| sudo sed -i "s/example.net/acme/g" data/acme_ca/kid_profiles.json | |
| sudo sed -i '18,19d' data/acme_ca/kid_profiles.json | |
| sudo sed -i '8,9d' data/acme_ca/kid_profiles.json | |
| env: | |
| NCM_API_HOST: ${{ secrets.NCM_API_HOST }} | |
| NCM_API_USER: ${{ secrets.NCM_API_USER }} | |
| NCM_API_PASSWORD: ${{ secrets.NCM_API_PASSWORD }} | |
| NCM_CA_NAME: ${{ secrets.NCM_CA_NAME }} | |
| NCM_CA_BUNDLE: ${{ secrets.NCM_CA_BUNDLE }} | |
| PROFILE: ${{ secrets.PROFILE }} | |
| - name: "EAB without headerinfo - Reconfigure a2c " | |
| run: | | |
| docker exec acme-srv sh /tmp/acme2certifier/rpm_tester.sh restart | |
| - name: "EAB without headerinfo - Enrollment" | |
| uses: ./.github/actions/wf_specific/certifier_ca_handler/enroll_eab_wo_headerinfo | |
| - name: "EAB with headerinfo - Setup a2c with certifier_ca_handler" | |
| run: | | |
| sudo head -n -8 .github/openssl_ca_handler.py_acme_srv_default_handler.cfg > data/acme_srv.cfg | |
| sudo echo "handler_file: examples/ca_handler/certifier_ca_handler.py" >> data/acme_srv.cfg | |
| # sudo echo "api_host: $NCM_API_HOST" >> data/acme_srv.cfg | |
| sudo echo "api_host: https://forwarder.acme:8084" >> data/acme_srv.cfg | |
| sudo echo "ca_bundle: False" >> data/acme_srv.cfg | |
| sudo echo "api_user: $NCM_API_USER" >> data/acme_srv.cfg | |
| sudo echo "api_password: $NCM_API_PASSWORD" >> data/acme_srv.cfg | |
| sudo echo "ca_name: $NCM_CA_NAME" >> data/acme_srv.cfg | |
| # sudo echo "ca_bundle: $NCM_CA_BUNDLE" >> data/acme_srv.cfg | |
| sudo echo "profile_id: 100" >> data/acme_srv.cfg | |
| sudo echo "eab_profiling: True" >> data/acme_srv.cfg | |
| sudo sed -i "s/tnauthlist_support: False/tnauthlist_support: False\nheader_info_list: [\"HTTP_USER_AGENT\"]/g" data/acme_srv.cfg | |
| sudo echo -e "\n\n[EABhandler]" >> data/acme_srv.cfg | |
| sudo echo "eab_handler_file: /opt/acme2certifier/examples/eab_handler/kid_profile_handler.py" >> data/acme_srv.cfg | |
| sudo echo "key_file: /opt/acme2certifier/volume/acme_ca/kid_profiles.json" >> data/acme_srv.cfg | |
| sudo cp examples/eab_handler/kid_profiles.json data/acme_ca/kid_profiles.json | |
| sudo chmod 777 data/acme_ca/kid_profiles.json | |
| sudo sed -i "s/\"profile_id\"\: \[\"profile_1\", \"profile_2\", \"profile_3\"\]/\"profile_id\"\: \[\"102\", \"101\"\, \"100\"]/g" data/acme_ca/kid_profiles.json | |
| sudo sed -i "s/\"profile_id\"\: \"profile_2\"/\"profile_id\"\: \"102\"/g" data/acme_ca/kid_profiles.json | |
| sudo sed -i "s/\"ca_name\": \"example_ca_2\",/\"ca_name\": \"SubCA2\"/" data/acme_ca/kid_profiles.json | |
| sudo sed -i "s/\"ca_name\": \"example_ca\",/\"unknown_key\": \"unknown_value\"/g" data/acme_ca/kid_profiles.json | |
| sudo sed -i "s/example.net/acme/g" data/acme_ca/kid_profiles.json | |
| sudo sed -i '18,19d' data/acme_ca/kid_profiles.json | |
| sudo sed -i '8,9d' data/acme_ca/kid_profiles.json | |
| env: | |
| NCM_API_HOST: ${{ secrets.NCM_API_HOST }} | |
| NCM_API_USER: ${{ secrets.NCM_API_USER }} | |
| NCM_API_PASSWORD: ${{ secrets.NCM_API_PASSWORD }} | |
| NCM_CA_NAME: ${{ secrets.NCM_CA_NAME }} | |
| NCM_CA_BUNDLE: ${{ secrets.NCM_CA_BUNDLE }} | |
| PROFILE: ${{ secrets.PROFILE }} | |
| - name: "EAB with headerinfo - Reconfigure a2c " | |
| run: | | |
| docker exec acme-srv sh /tmp/acme2certifier/rpm_tester.sh restart | |
| - name: "EAB with headerinfo - Enrollment" | |
| uses: ./.github/actions/wf_specific/certifier_ca_handler/enroll_eab_w_headerinfo | |
| - name: "EAB with headerinfo - Reconfigure key_file without restarting" | |
| run: | | |
| sudo sed -i "s/\"allowed_domainlist\": \[\"www.example.com\", \"www.example.org\"\]/\"allowed_domainlist\": \[\"www.example.com\", \"www.example.org\", \"*.acme\"\]/g" data/acme_ca/kid_profiles.json | |
| sudo sed -i '26,27d' data/acme_ca/kid_profiles.json | |
| sudo sed -i "s/ \"hmac\": \"YW5kX2ZpbmFsbHlfdGhlX2xhc3RfaG1hY19rZXlfd2hpY2hfaXNfbG9uZ2VyX3RoYW5fMjU2X2JpdHNfYW5kX3Nob3VsZF93b3Jr\"/ \"hmac\": \"YW5kX2ZpbmFsbHlfdGhlX2xhc3RfaG1hY19rZXlfd2hpY2hfaXNfbG9uZ2VyX3RoYW5fMjU2X2JpdHNfYW5kX3Nob3VsZF93b3Jr\"\n },\n \"keyid_04\": {\n \"hmac\": \"YW5kX2hlcmVfaXNfYW5vdGhlcl92ZXJ5X2xvbmdfbWFja19obWFjX2tleV90b19jaGVja19pZl9jaGFuZ2VzX2FmZmVjdF9pbW1lZGF0ZWx5\",\n \"cahandler\": {}\n }\n}/g" data/acme_ca/kid_profiles.json | |
| - name: "Update configuration" | |
| run: | | |
| docker exec acme-srv sh /tmp/acme2certifier/rpm_tester.sh update | |
| - name: "EAB with headerinfo - Enrollment after reconfiguration" | |
| uses: ./.github/actions/wf_specific/certifier_ca_handler/enroll_eab_w_headerinfo | |
| with: | |
| RECONFIGURE: true | |
| - name: "kid-file in yaml format - Reconfiguration" | |
| run: | | |
| sudo sed -i "s/kid_profiles.json/kid_profiles.yml/g" data/acme_srv.cfg | |
| sudo pip3 install yq | |
| sudo pip3 install jq | |
| sudo sh -c "cat data/acme_ca/kid_profiles.json | yq -y '.' > data/acme_ca/kid_profiles.yml" | |
| sudo rm data/acme_ca/kid_profiles.json | |
| sudo sed -i '33,34d' data/acme_ca/kid_profiles.yml | |
| - name: "kid-file in yaml format - update a2c " | |
| run: | | |
| docker exec acme-srv sh /tmp/acme2certifier/rpm_tester.sh restart | |
| - name: "kid-file in yaml format - Enrollment after reconfiguration" | |
| uses: ./.github/actions/wf_specific/certifier_ca_handler/enroll_eab_w_headerinfo | |
| with: | |
| RECONFIGURE: true | |
| - name: "[ * ] collecting test logs" | |
| if: ${{ failure() }} | |
| run: | | |
| mkdir -p ${{ github.workspace }}/artifact/upload | |
| docker exec acme-srv tar cvfz /tmp/acme2certifier/a2c.tgz /opt/acme2certifier | |
| sudo cp -rp data/ ${{ github.workspace }}/artifact/data/ | |
| sudo rm ${{ github.workspace }}/artifact/data/*.rpm | |
| sudo cp -rp acme-sh/ ${{ github.workspace }}/artifact/acme-sh/ | |
| docker exec acme-srv cat /etc/nginx/nginx.conf.orig > ${{ github.workspace }}/artifact/data/nginx.conf.orig | |
| docker exec acme-srv cat /etc/nginx/nginx.conf > ${{ github.workspace }}/artifact/data/nginx.conf | |
| docker exec acme-srv cat /var/log/messages > ${{ github.workspace }}/artifact/acme-srv.log | |
| sudo tar -C ${{ github.workspace }}/artifact/ -cvzf ${{ github.workspace }}/artifact/upload/artifact.tar.gz data acme-srv.log acme-sh | |
| - name: "[ * ] uploading artificates" | |
| uses: actions/upload-artifact@v4 | |
| if: ${{ failure() }} | |
| with: | |
| name: certifier_ca_handler_rpm-rh${{ matrix.rhversion }}.tar.gz | |
| path: ${{ github.workspace }}/artifact/upload/ | |