|
| 1 | +#!/usr/bin/env bash |
| 2 | + |
| 3 | +source _unit-test/_test_setup.sh |
| 4 | +source install/dc-detect-version.sh |
| 5 | + |
| 6 | +CERT_DIR="./certificates" |
| 7 | +GENERATED_DIR="${CERT_DIR}/.generated" |
| 8 | + |
| 9 | +# ----------------------------------------------------------------------- |
| 10 | +# Test 1: Feature flag is NOT set → script is a no-op, no generated dir. |
| 11 | +# ----------------------------------------------------------------------- |
| 12 | +unset SETUP_CUSTOM_CA_CERTIFICATE |
| 13 | +source install/setup-custom-ca-certificate.sh |
| 14 | +test ! -d "$GENERATED_DIR" |
| 15 | +echo "Pass: no-op when SETUP_CUSTOM_CA_CERTIFICATE is unset" |
| 16 | + |
| 17 | +# ----------------------------------------------------------------------- |
| 18 | +# Test 2: Feature flag set but no .crt files → prints a message, no-op. |
| 19 | +# ----------------------------------------------------------------------- |
| 20 | +export SETUP_CUSTOM_CA_CERTIFICATE=1 |
| 21 | +source install/setup-custom-ca-certificate.sh |
| 22 | +test ! -d "$GENERATED_DIR" |
| 23 | +echo "Pass: no-op when certificates/ has no .crt files" |
| 24 | + |
| 25 | +# ----------------------------------------------------------------------- |
| 26 | +# Shared setup: generate a self-signed test CA certificate. |
| 27 | +# ----------------------------------------------------------------------- |
| 28 | +openssl req -x509 -newkey rsa:2048 \ |
| 29 | + -keyout /tmp/self-hosted-test-ca.key \ |
| 30 | + -out "${CERT_DIR}/self-hosted-test-ca.crt" \ |
| 31 | + -days 1 -nodes -subj "/CN=Self-Hosted Test CA DO NOT TRUST" 2>/dev/null |
| 32 | +echo "Test certificate generated." |
| 33 | + |
| 34 | +# ----------------------------------------------------------------------- |
| 35 | +# Test 3: Invalid .crt file → script exits non-zero (subshell to isolate). |
| 36 | +# ----------------------------------------------------------------------- |
| 37 | +echo "not a certificate" >"${CERT_DIR}/bad.crt" |
| 38 | +if ( |
| 39 | + export SETUP_CUSTOM_CA_CERTIFICATE=1 |
| 40 | + source install/setup-custom-ca-certificate.sh |
| 41 | +) 2>/dev/null; then |
| 42 | + echo "Expected setup-custom-ca-certificate.sh to fail for invalid certificate input" |
| 43 | + exit 1 |
| 44 | +fi |
| 45 | +rm "${CERT_DIR}/bad.crt" |
| 46 | +echo "Pass: invalid certificate causes a non-zero exit" |
| 47 | + |
| 48 | +# ----------------------------------------------------------------------- |
| 49 | +# Test 4: Happy path — valid cert, flag set. |
| 50 | +# |
| 51 | +# We override all image vars to sentry-self-hosted-jq-local (guaranteed |
| 52 | +# present after _test_setup.sh) so the test runs without pulling large |
| 53 | +# upstream images. The jq image has no /etc/ssl/certs, so the script uses |
| 54 | +# an empty baseline and overlays our custom cert on top. |
| 55 | +# ----------------------------------------------------------------------- |
| 56 | +export RELAY_IMAGE=sentry-self-hosted-jq-local |
| 57 | +export SYMBOLICATOR_IMAGE=sentry-self-hosted-jq-local |
| 58 | +export SNUBA_IMAGE=sentry-self-hosted-jq-local |
| 59 | +export VROOM_IMAGE=sentry-self-hosted-jq-local |
| 60 | +export TASKBROKER_IMAGE=sentry-self-hosted-jq-local |
| 61 | +export UPTIME_CHECKER_IMAGE=sentry-self-hosted-jq-local |
| 62 | + |
| 63 | +export SETUP_CUSTOM_CA_CERTIFICATE=1 |
| 64 | +source install/setup-custom-ca-certificate.sh |
| 65 | + |
| 66 | +# The generated directory must exist. |
| 67 | +test -d "$GENERATED_DIR" |
| 68 | +echo "Pass: generated directory was created" |
| 69 | + |
| 70 | +# Each service's trust store directory must exist. |
| 71 | +for nickname in relay symbolicator snuba vroom taskbroker uptime-checker; do |
| 72 | + test -d "${GENERATED_DIR}/${nickname}/etc/ssl/certs" |
| 73 | + echo " Pass: ${nickname} trust store directory exists" |
| 74 | +done |
| 75 | + |
| 76 | +# Each service's bundle must contain the custom cert's PEM block. |
| 77 | +for nickname in relay symbolicator snuba vroom taskbroker uptime-checker; do |
| 78 | + bundle="${GENERATED_DIR}/${nickname}/etc/ssl/certs/ca-certificates.crt" |
| 79 | + test -f "$bundle" |
| 80 | + grep -q "BEGIN CERTIFICATE" "$bundle" |
| 81 | + echo " Pass: ${nickname} ca-certificates.crt contains at least one certificate" |
| 82 | +done |
| 83 | + |
| 84 | +# The individual .crt file must be present in each service's cert dir. |
| 85 | +for nickname in relay symbolicator snuba vroom taskbroker uptime-checker; do |
| 86 | + test -f "${GENERATED_DIR}/${nickname}/etc/ssl/certs/self-hosted-test-ca.crt" |
| 87 | + echo " Pass: ${nickname} has the individual self-hosted-test-ca.crt file" |
| 88 | +done |
| 89 | + |
| 90 | +# openssl rehash must have created at least one hash symlink per service dir. |
| 91 | +for nickname in relay symbolicator snuba vroom taskbroker uptime-checker; do |
| 92 | + cert_dir="${GENERATED_DIR}/${nickname}/etc/ssl/certs" |
| 93 | + hash_links=$(find "$cert_dir" -maxdepth 1 -type l | wc -l) |
| 94 | + test "$hash_links" -gt 0 |
| 95 | + echo " Pass: ${nickname} has ${hash_links} OpenSSL hash symlink(s)" |
| 96 | +done |
| 97 | + |
| 98 | +# ----------------------------------------------------------------------- |
| 99 | +# Test 5: Idempotency — running again produces the same result. |
| 100 | +# ----------------------------------------------------------------------- |
| 101 | +source install/setup-custom-ca-certificate.sh |
| 102 | + |
| 103 | +for nickname in relay symbolicator snuba vroom taskbroker uptime-checker; do |
| 104 | + bundle="${GENERATED_DIR}/${nickname}/etc/ssl/certs/ca-certificates.crt" |
| 105 | + count=$(grep -c "BEGIN CERTIFICATE" "$bundle") |
| 106 | + # Each run wipes and rebuilds .generated/, so exactly one copy of our cert. |
| 107 | + test "$count" -eq 1 |
| 108 | + echo " Pass: ${nickname} bundle has exactly 1 certificate after second run (no duplication)" |
| 109 | +done |
| 110 | +echo "Pass: script is idempotent" |
| 111 | + |
| 112 | +report_success |
0 commit comments