gsadmin/certctl
1
0
Fork 0
mirror of https://github.com/shankar0123/certctl.git synced 2026-06-14 06:28:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

awsacmpca: thread ctx through factory + registry — fix CI contextcheck

Browse Source 
Follow-up to 6119f26 (awsacmpca: replace stub client with AWS SDK v2
implementation). CI's golangci-lint contextcheck rule flagged six
violations in awsacmpca_test.go where mustNew/awsacmpca.New were
called from test functions that had ctx in scope but didn't thread it
through New(). The previous commit used context.Background() inside
New() with the rationale that "the audit allows either threading or
documenting the limitation"; CI made that choice for us.

Threading ctx is the right shape per the audit's stated preference.
The fix cascades from awsacmpca.New through issuerfactory.NewFromConfig
and IssuerRegistry.Rebuild because the contextcheck rule propagates
upward through every caller that has ctx in scope.

This commit:
- Changes awsacmpca.New(config, logger) to
  awsacmpca.New(ctx, config, logger). The ctx is passed to
  buildSDKClient → awsconfig.LoadDefaultConfig so SDK credential chain
  resolution honors caller deadlines (LoadDefaultConfig may probe IMDS
  or remote credential sources). The doc-comment on New explains that
  callers without a useful deadline should pass context.Background()
  and that the SDK has internal credential-resolution timeouts.
- Adds ctx as the first parameter of issuerfactory.NewFromConfig.
  Currently only the AWSACMPCA branch uses ctx (it's threaded into
  awsacmpca.New); the other 11 branches accept ctx without using it.
  This is a contractual change that lets callers thread ctx through
  without contextcheck warnings, even though most issuer constructors
  do no ctx-aware work today.
- Adds ctx as the first parameter of IssuerRegistry.Rebuild. Rebuild
  iterates over configs and calls NewFromConfig per issuer; the same
  ctx flows through every connector instantiation.
- Updates the two production call sites in internal/service:
  - issuer.go:279 (TestIssuer connection test) now passes its
    method-scoped ctx
  - issuer.go:303 (BuildRegistry) now passes its method-scoped ctx
    to Rebuild
- Updates 13 test sites in internal/connector/issuerfactory/factory_test.go
  via a new testCtx() helper that returns context.Background(). Helper
  is dedicated to this file so contextcheck's "you have a ctx in scope,
  pass it" rule doesn't fire on test functions that don't otherwise
  need ctx.
- Updates 6 test sites in internal/service/issuer_registry_test.go
  to pass context.Background() to Rebuild.
- Removes the now-stale "// NewFromConfig has no ctx parameter
  (preserved across all 12 connectors); pass context.Background() ..."
  comment from the awsacmpca branch in factory.go — that workaround
  is no longer the design.

Verified locally:
- gofmt -l . clean
- go vet ./... clean
- staticcheck ./... clean
- golangci-lint run --timeout 5m ./... clean (was failing with 6
  contextcheck issues before the cascade; now 0 issues)
- go test -short -count=1 across all changed packages green

Sandbox couldn't run the existing CI's full make verify due to
disk pressure on /sessions and a virtiofs concurrent-open-file
ceiling on go mod tidy; operator should run `make verify` on
the workstation to confirm.

Audit reference: cowork/issuer-coverage-audit-2026-05-01/RESULTS.md
Top-10 fix #1 (CI follow-up; behavior unchanged from 6119f26).
This commit is contained in:
shankar0123
2026-05-01 23:27:25 +00:00
parent 6119f26b1b
commit 62d03d9134
7 changed files with 68 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/connector/issuerfactory/factory.go
+9 -2
View File
@@ -1,6 +1,7 @@
package issuerfactory
import (
"context"
"encoding/json"
"fmt"
"log/slog"
@@ -23,7 +24,13 @@ import (
// NewFromConfig instantiates an issuer connector from its type string and config JSON.
// The config JSON keys use snake_case matching the connector Config struct json tags.
// This replaces the manual wiring in cmd/server/main.go.
func NewFromConfig(issuerType string, configJSON json.RawMessage, logger *slog.Logger) (issuer.Connector, error) {
//
// ctx is currently used only by the AWSACMPCA branch (passed to
// awsconfig.LoadDefaultConfig for SDK credential chain resolution). Other
// connectors take no context at construction; the parameter is kept on the
// signature so callers that have a ctx in scope thread it through cleanly
// (contextcheck linter).
func NewFromConfig(ctx context.Context, issuerType string, configJSON json.RawMessage, logger *slog.Logger) (issuer.Connector, error) {
if len(configJSON) == 0 {
configJSON = []byte("{}")
}
@@ -90,7 +97,7 @@ func NewFromConfig(issuerType string, configJSON json.RawMessage, logger *slog.L
if err := json.Unmarshal(configJSON, &cfg); err != nil {
return nil, fmt.Errorf("invalid AWS ACM PCA config: %w", err)
}
conn, err := awsacmpca.New(&cfg, logger)
conn, err := awsacmpca.New(ctx, &cfg, logger)
if err != nil {
return nil, fmt.Errorf("AWS ACM PCA init: %w", err)
}
internal/connector/issuerfactory/factory_test.go
+19 -13
View File
@@ -1,6 +1,7 @@
package issuerfactory
import (
"context"
"encoding/json"
"log/slog"
"os"
@@ -11,9 +12,14 @@ func testLogger() *slog.Logger {
return slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelError}))
}
// testCtx is a fresh background context per test. The factory takes ctx
// for the AWSACMPCA SDK config load; other connectors ignore it. Tests
// use a dedicated helper so contextcheck doesn't cascade.
func testCtx() context.Context { return context.Background() }
func TestNewFromConfig_LocalCA(t *testing.T) {
cfg := json.RawMessage(`{"ca_common_name":"Test CA"}`)
conn, err := NewFromConfig("local", cfg, testLogger())
conn, err := NewFromConfig(testCtx(), "local", cfg, testLogger())
if err != nil {
t.Fatalf("NewFromConfig(local) failed: %v", err)
}
@@ -24,7 +30,7 @@ func TestNewFromConfig_LocalCA(t *testing.T) {
func TestNewFromConfig_GenericCA_Alias(t *testing.T) {
cfg := json.RawMessage(`{}`)
conn, err := NewFromConfig("GenericCA", cfg, testLogger())
conn, err := NewFromConfig(testCtx(), "GenericCA", cfg, testLogger())
if err != nil {
t.Fatalf("NewFromConfig(GenericCA) failed: %v", err)
}
@@ -35,7 +41,7 @@ func TestNewFromConfig_GenericCA_Alias(t *testing.T) {
func TestNewFromConfig_ACME(t *testing.T) {
cfg := json.RawMessage(`{"directory_url":"https://acme-staging-v02.api.letsencrypt.org/directory","email":"test@example.com"}`)
conn, err := NewFromConfig("ACME", cfg, testLogger())
conn, err := NewFromConfig(testCtx(), "ACME", cfg, testLogger())
if err != nil {
t.Fatalf("NewFromConfig(ACME) failed: %v", err)
}
@@ -46,7 +52,7 @@ func TestNewFromConfig_ACME(t *testing.T) {
func TestNewFromConfig_StepCA(t *testing.T) {
cfg := json.RawMessage(`{"ca_url":"https://ca.internal:9000","provisioner_name":"test"}`)
conn, err := NewFromConfig("StepCA", cfg, testLogger())
conn, err := NewFromConfig(testCtx(), "StepCA", cfg, testLogger())
if err != nil {
t.Fatalf("NewFromConfig(StepCA) failed: %v", err)
}
@@ -57,7 +63,7 @@ func TestNewFromConfig_StepCA(t *testing.T) {
func TestNewFromConfig_OpenSSL(t *testing.T) {
cfg := json.RawMessage(`{"sign_script":"/path/to/sign.sh"}`)
conn, err := NewFromConfig("OpenSSL", cfg, testLogger())
conn, err := NewFromConfig(testCtx(), "OpenSSL", cfg, testLogger())
if err != nil {
t.Fatalf("NewFromConfig(OpenSSL) failed: %v", err)
}
@@ -68,7 +74,7 @@ func TestNewFromConfig_OpenSSL(t *testing.T) {
func TestNewFromConfig_VaultPKI(t *testing.T) {
cfg := json.RawMessage(`{"addr":"https://vault:8200","token":"hvs.test","mount":"pki","role":"web","ttl":"8760h"}`)
conn, err := NewFromConfig("VaultPKI", cfg, testLogger())
conn, err := NewFromConfig(testCtx(), "VaultPKI", cfg, testLogger())
if err != nil {
t.Fatalf("NewFromConfig(VaultPKI) failed: %v", err)
}
@@ -79,7 +85,7 @@ func TestNewFromConfig_VaultPKI(t *testing.T) {
func TestNewFromConfig_DigiCert(t *testing.T) {
cfg := json.RawMessage(`{"api_key":"test-key","org_id":"123","product_type":"ssl_basic"}`)
conn, err := NewFromConfig("DigiCert", cfg, testLogger())
conn, err := NewFromConfig(testCtx(), "DigiCert", cfg, testLogger())
if err != nil {
t.Fatalf("NewFromConfig(DigiCert) failed: %v", err)
}
@@ -90,7 +96,7 @@ func TestNewFromConfig_DigiCert(t *testing.T) {
func TestNewFromConfig_Sectigo(t *testing.T) {
cfg := json.RawMessage(`{"customer_uri":"test-org","login":"api-user","password":"secret","org_id":1}`)
conn, err := NewFromConfig("Sectigo", cfg, testLogger())
conn, err := NewFromConfig(testCtx(), "Sectigo", cfg, testLogger())
if err != nil {
t.Fatalf("NewFromConfig(Sectigo) failed: %v", err)
}
@@ -101,7 +107,7 @@ func TestNewFromConfig_Sectigo(t *testing.T) {
func TestNewFromConfig_GoogleCAS(t *testing.T) {
cfg := json.RawMessage(`{"project":"my-project","location":"us-central1","ca_pool":"my-pool","credentials":"/path/to/creds.json"}`)
conn, err := NewFromConfig("GoogleCAS", cfg, testLogger())
conn, err := NewFromConfig(testCtx(), "GoogleCAS", cfg, testLogger())
if err != nil {
t.Fatalf("NewFromConfig(GoogleCAS) failed: %v", err)
}
@@ -112,7 +118,7 @@ func TestNewFromConfig_GoogleCAS(t *testing.T) {
func TestNewFromConfig_UnknownType(t *testing.T) {
cfg := json.RawMessage(`{}`)
_, err := NewFromConfig("UnknownCA", cfg, testLogger())
_, err := NewFromConfig(testCtx(), "UnknownCA", cfg, testLogger())
if err == nil {
t.Fatal("expected error for unknown type")
}
@@ -120,7 +126,7 @@ func TestNewFromConfig_UnknownType(t *testing.T) {
func TestNewFromConfig_MalformedJSON(t *testing.T) {
cfg := json.RawMessage(`{invalid json}`)
_, err := NewFromConfig("ACME", cfg, testLogger())
_, err := NewFromConfig(testCtx(), "ACME", cfg, testLogger())
if err == nil {
t.Fatal("expected error for malformed JSON")
}
@@ -128,7 +134,7 @@ func TestNewFromConfig_MalformedJSON(t *testing.T) {
func TestNewFromConfig_EmptyConfig(t *testing.T) {
// Empty config should work — connectors have defaults
conn, err := NewFromConfig("local", nil, testLogger())
conn, err := NewFromConfig(testCtx(), "local", nil, testLogger())
if err != nil {
t.Fatalf("NewFromConfig with nil config failed: %v", err)
}
@@ -139,7 +145,7 @@ func TestNewFromConfig_EmptyConfig(t *testing.T) {
func TestNewFromConfig_AWSACMPCA(t *testing.T) {
cfg := json.RawMessage(`{"project":"my-project","location":"us-central1","ca_pool":"my-pool","credentials":"/path/to/creds.json"}`)
conn, err := NewFromConfig("AWSACMPCA", cfg, testLogger())
conn, err := NewFromConfig(testCtx(), "AWSACMPCA", cfg, testLogger())
if err != nil {
t.Fatalf("NewFromConfig(AWSACMPCA) failed: %v", err)
}