From 401a3c9a51b9573c8d1ec145f0e5512e979ef5d4 Mon Sep 17 00:00:00 2001 From: atlas Date: Sun, 25 Oct 2026 18:41:52 +0100 Subject: [PATCH] build the test certificate in code instead of committing one --- swarm-secret-client/src/cert.rs | 61 +++++++++++++++++++++++-- swarm-secret-client/src/cert_metrics.rs | 6 +-- swarm-secret-client/test-cert.pem | 11 ----- 3 files changed, 60 insertions(+), 18 deletions(-) delete mode 100644 swarm-secret-client/test-cert.pem diff --git a/swarm-secret-client/src/cert.rs b/swarm-secret-client/src/cert.rs index 6389a597..7998484e 100644 --- a/swarm-secret-client/src/cert.rs +++ b/swarm-secret-client/src/cert.rs @@ -49,15 +49,68 @@ pub fn file_validity(path: &Path) -> Result<(i64, i64), Error> { pub(crate) mod tests { use super::*; - /// Self-signed, CN `hive-agent-atlas`, valid 2026-01-01T00:00:00Z to - pub(crate) const CERT_PEM: &str = include_str!("../test-cert.pem"); + /// The window `certificate_pem` is built with: 2026-01-01T00:00:00Z to + /// 2026-04-01T00:00:00Z. pub(crate) const NOT_BEFORE: i64 = 1_767_225_600; pub(crate) const NOT_AFTER: i64 = 1_775_001_600; + /// A certificate valid from `not_before` to `not_after` (unix seconds), + /// PEM-encoded. The name, key and signature are placeholders: [`validity`] + /// reads the window and verifies nothing. + pub(crate) fn certificate_pem(not_before: i64, not_after: i64) -> String { + use x509_cert::der::{ + EncodePem as _, + asn1::{BitString, ObjectIdentifier, UtcTime}, + pem::LineEnding, + }; + use x509_cert::{ + Certificate, TbsCertificate, Version, + name::Name, + serial_number::SerialNumber, + spki::{AlgorithmIdentifierOwned, SubjectPublicKeyInfoOwned}, + time::{Time, Validity}, + }; + + let time = |secs: i64| { + let secs = u64::try_from(secs).expect("a date after 1970"); + Time::UtcTime( + UtcTime::from_unix_duration(std::time::Duration::from_secs(secs)) + .expect("a date UTCTime can hold"), + ) + }; + let algorithm = AlgorithmIdentifierOwned { + oid: ObjectIdentifier::new_unwrap("1.2.840.10045.4.3.2"), + parameters: None, + }; + let cert = Certificate { + tbs_certificate: TbsCertificate { + version: Version::V3, + serial_number: SerialNumber::new(&[1]).expect("a serial number"), + signature: algorithm.clone(), + issuer: Name::default(), + validity: Validity { + not_before: time(not_before), + not_after: time(not_after), + }, + subject: Name::default(), + subject_public_key_info: SubjectPublicKeyInfoOwned { + algorithm: algorithm.clone(), + subject_public_key: BitString::from_bytes(&[0]).expect("a bit string"), + }, + issuer_unique_id: None, + subject_unique_id: None, + extensions: None, + }, + signature_algorithm: algorithm, + signature: BitString::from_bytes(&[0]).expect("a bit string"), + }; + cert.to_pem(LineEnding::LF).expect("encodes") + } + #[test] fn the_window_is_read_from_the_certificate() { assert_eq!( - validity(CERT_PEM).expect("a well-formed certificate"), + validity(&certificate_pem(NOT_BEFORE, NOT_AFTER)).expect("a well-formed certificate"), (NOT_BEFORE, NOT_AFTER) ); } @@ -77,7 +130,7 @@ pub(crate) mod tests { std::env::temp_dir().join(format!("swarm-secret-client-cert-{}", std::process::id())); std::fs::create_dir_all(&dir).expect("scratch dir"); let path = dir.join("cert.pem"); - std::fs::write(&path, CERT_PEM).expect("write"); + std::fs::write(&path, certificate_pem(NOT_BEFORE, NOT_AFTER)).expect("write"); assert_eq!( file_validity(&path).expect("readable"), (NOT_BEFORE, NOT_AFTER) diff --git a/swarm-secret-client/src/cert_metrics.rs b/swarm-secret-client/src/cert_metrics.rs index 8396044f..ea3c7332 100644 --- a/swarm-secret-client/src/cert_metrics.rs +++ b/swarm-secret-client/src/cert_metrics.rs @@ -97,7 +97,7 @@ mod tests { use opentelemetry_sdk::metrics::{InMemoryMetricExporter, PeriodicReader, SdkMeterProvider}; use std::path::PathBuf; - use crate::cert::tests::{CERT_PEM, NOT_AFTER, NOT_BEFORE}; + use crate::cert::tests::{NOT_AFTER, NOT_BEFORE, certificate_pem}; /// A provider with both gauges registered for `path`, and the exporter it /// flushes into. @@ -152,7 +152,7 @@ mod tests { fn both_gauges_report_the_files_window_under_the_cert_label() { let dir = scratch("window"); let path = dir.join("cert.pem"); - std::fs::write(&path, CERT_PEM).expect("write"); + std::fs::write(&path, certificate_pem(NOT_BEFORE, NOT_AFTER)).expect("write"); let (provider, exporter) = registered(&path); assert_eq!( collect(&provider, &exporter), @@ -192,7 +192,7 @@ mod tests { let path = dir.join("cert.pem"); let (provider, exporter) = registered(&path); assert_eq!(collect(&provider, &exporter), []); - std::fs::write(&path, CERT_PEM).expect("write"); + std::fs::write(&path, certificate_pem(NOT_BEFORE, NOT_AFTER)).expect("write"); assert_eq!(collect(&provider, &exporter).len(), 2); std::fs::remove_dir_all(&dir).expect("cleanup"); } diff --git a/swarm-secret-client/test-cert.pem b/swarm-secret-client/test-cert.pem deleted file mode 100644 index b4725512..00000000 --- a/swarm-secret-client/test-cert.pem +++ /dev/null @@ -1,11 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIBizCCATGgAwIBAgIUSFpuYmy1UoHvq/MYiyrAudRaWXcwCgYIKoZIzj0EAwIw -GzEZMBcGA1UEAwwQaGl2ZS1hZ2VudC1hdGxhczAeFw0yNjAxMDEwMDAwMDBaFw0y -NjA0MDEwMDAwMDBaMBsxGTAXBgNVBAMMEGhpdmUtYWdlbnQtYXRsYXMwWTATBgcq -hkjOPQIBBggqhkjOPQMBBwNCAAR7p2eZAxjiE1RdsuSHE3CcTjbnd4swzfnmqUPW -9NJN7mvOtqEzxCKfOSFjaIhhyShIQ41/V6vGi80EPDB+uR56o1MwUTAdBgNVHQ4E -FgQUxgZFsN1VY3ODrPS1NUfY/x3EnmswHwYDVR0jBBgwFoAUxgZFsN1VY3ODrPS1 -NUfY/x3EnmswDwYDVR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAgNIADBFAiEAnU9e -WOioNTUNK9b6FignejpK5FpyrODUuH/iL4TqCh0CIAz6GzJeLebhRPvYlfVUofdV -hWx3sOwmUgjkRQXoxY+p ------END CERTIFICATE-----