Follow-up to 6119f26 (awsacmpca: replace stub client with AWS SDK v2
implementation). CI's golangci-lint contextcheck rule flagged six
violations in awsacmpca_test.go where mustNew/awsacmpca.New were
called from test functions that had ctx in scope but didn't thread it
through New(). The previous commit used context.Background() inside
New() with the rationale that "the audit allows either threading or
documenting the limitation"; CI made that choice for us.
Threading ctx is the right shape per the audit's stated preference.
The fix cascades from awsacmpca.New through issuerfactory.NewFromConfig
and IssuerRegistry.Rebuild because the contextcheck rule propagates
upward through every caller that has ctx in scope.
This commit:
- Changes awsacmpca.New(config, logger) to
awsacmpca.New(ctx, config, logger). The ctx is passed to
buildSDKClient → awsconfig.LoadDefaultConfig so SDK credential chain
resolution honors caller deadlines (LoadDefaultConfig may probe IMDS
or remote credential sources). The doc-comment on New explains that
callers without a useful deadline should pass context.Background()
and that the SDK has internal credential-resolution timeouts.
- Adds ctx as the first parameter of issuerfactory.NewFromConfig.
Currently only the AWSACMPCA branch uses ctx (it's threaded into
awsacmpca.New); the other 11 branches accept ctx without using it.
This is a contractual change that lets callers thread ctx through
without contextcheck warnings, even though most issuer constructors
do no ctx-aware work today.
- Adds ctx as the first parameter of IssuerRegistry.Rebuild. Rebuild
iterates over configs and calls NewFromConfig per issuer; the same
ctx flows through every connector instantiation.
- Updates the two production call sites in internal/service:
- issuer.go:279 (TestIssuer connection test) now passes its
method-scoped ctx
- issuer.go:303 (BuildRegistry) now passes its method-scoped ctx
to Rebuild
- Updates 13 test sites in internal/connector/issuerfactory/factory_test.go
via a new testCtx() helper that returns context.Background(). Helper
is dedicated to this file so contextcheck's "you have a ctx in scope,
pass it" rule doesn't fire on test functions that don't otherwise
need ctx.
- Updates 6 test sites in internal/service/issuer_registry_test.go
to pass context.Background() to Rebuild.
- Removes the now-stale "// NewFromConfig has no ctx parameter
(preserved across all 12 connectors); pass context.Background() ..."
comment from the awsacmpca branch in factory.go — that workaround
is no longer the design.
Verified locally:
- gofmt -l . clean
- go vet ./... clean
- staticcheck ./... clean
- golangci-lint run --timeout 5m ./... clean (was failing with 6
contextcheck issues before the cascade; now 0 issues)
- go test -short -count=1 across all changed packages green
Sandbox couldn't run the existing CI's full make verify due to
disk pressure on /sessions and a virtiofs concurrent-open-file
ceiling on go mod tidy; operator should run `make verify` on
the workstation to confirm.
Audit reference: cowork/issuer-coverage-audit-2026-05-01/RESULTS.md
Top-10 fix#1 (CI follow-up; behavior unchanged from 6119f26).
Activates the CRL/OCSP responder pipeline that landed dormant in
phases 1-4 (commits dc44826, 6d1da84, ff20fba, c76bfcf):
* IssuerRegistry gains SetLocalIssuerDeps + LocalIssuerDeps struct.
Rebuild type-asserts each constructed connector to *local.Connector
and injects ocspResponderRepo + signerDriver + IssuerID + key dir
+ (optional) rotation-grace + validity overrides. Non-local
connectors are unaffected (the type-assert fails silently). Adapter
pattern preserved: callers still see service.IssuerConnector.
* cmd/server/main.go:
- constructs CRLCacheRepository + OCSPResponderRepository from db
- constructs signer.FileDriver (default; PKCS#11 driver plugs in
later via the same Driver interface, no main.go changes needed)
- calls issuerRegistry.SetLocalIssuerDeps(...) BEFORE BuildRegistry
so the deps are in place when local connectors are constructed
- wires CRLCacheService into CertificateService via SetCRLCacheSvc
(Phase 4 cache-aware GenerateDERCRL path now active)
- calls scheduler.SetCRLCacheService + SetCRLGenerationInterval
after sched is constructed; logs the interval at startup
* config: new OCSPResponderConfig struct + Scheduler.CRLGenerationInterval
field. Three new env vars:
CERTCTL_OCSP_RESPONDER_KEY_DIR (no default; operator MUST set in prod)
CERTCTL_OCSP_RESPONDER_ROTATION_GRACE (default 7d)
CERTCTL_OCSP_RESPONDER_VALIDITY (default 30d)
CERTCTL_CRL_GENERATION_INTERVAL (default 1h)
Backward compat: when env vars are unset, the responder bootstrap path
still activates (with default rotation grace + validity, key dir = cwd
which is fine for tests), and the CRL cache pre-populates on the
1h interval. Operators not running the local issuer see no behavior
change.
go vet clean across the full module. Targeted tests for config +
service + scheduler packages all green. Full module build deferred
to CI (sandbox /sessions disk pressure prevented unzipping a
transitive dep — same disk-full pattern the prior commits hit; not
a code issue).
Replace static env-var-based issuer wiring with GUI-driven dynamic
configuration stored encrypted in PostgreSQL. Operators can now
configure, test, enable/disable, and manage issuers from the dashboard
without restarting the server.
Key changes:
- AES-256-GCM encryption for sensitive issuer config at rest (PBKDF2
key derivation with 100k iterations)
- Dynamic IssuerRegistry with sync.RWMutex replacing static map
- Connector factory pattern (issuerfactory.NewFromConfig) replacing
140 lines of static wiring in main.go
- Migration 000009: encrypted_config, last_tested_at, test_status,
source columns on issuers table
- Env var seeding on first boot with ON CONFLICT DO NOTHING
- Registry Rebuild() for atomic map swap after CRUD operations
- Issuer type validation against domain constants on Create
- Audit trail for test connection results
- Conditional seeding for step-ca/OpenSSL (only when env vars set)
- GUI: source badge, connection test status on issuer detail page
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
shankar0123