Closes Top-10 fix#3 of the 2026-05-03 issuer-coverage audit (see
cowork/issuer-coverage-audit-2026-05-03/RESULTS.md). Pre-fix, the
OpenSSL adapter (497 LOC, certctl's highest-risk issuer surface)
had openssl_test.go (8 happy-path funcs + 20 subtests) but no
dedicated _failure_test.go. Compare to ACME, Vault, DigiCert,
Sectigo, Entrust, GlobalSign, EJBCA — all peers have one. An
acquirer's diligence team flags this as an immediate blocker on
the highest-risk issuer surface.
This commit adds 6 failure-mode tests:
1. TestOpenSSL_Issue_ScriptNotFound_OperatorActionableError —
SignScript path doesn't exist; error wraps os.ErrNotExist
(errors.Is); message contains 'no such file' / 'not found'
so the operator's grep finds it in journalctl.
2. TestOpenSSL_Issue_PermissionDenied_OperatorActionableError —
SignScript exists with mode 0o600 (non-executable); error
wraps os.ErrPermission; message contains 'permission'.
Skipped under root (uid 0 bypasses chmod gating).
3. TestOpenSSL_Issue_MalformedStdout_DistinguishedFromCSRReject
— script exits 0 + writes garbage (no PEM markers) to the
cert output file; error mentions PEM/certificate/parse so
operators distinguish output-parsing failure from a script-
side fault.
4. TestOpenSSL_Issue_NonZeroExit_DistinguishesCAReject_From_
ScriptError — script writes 'policy violation: …' to stderr
and exits 2 (CA-side rejection convention); the script's
stderr surfaces in the error message; errors.Unwrap returns
non-nil (proving the underlying *exec.ExitError chain
survives).
5. TestOpenSSL_Issue_TimeoutEnforced_ContextCancellationPropagates
— script does 'exec sleep 30' (not 'sleep 30 ' as a child;
exec replaces bash so SIGKILL goes directly to the sleeper,
avoiding the orphan-pipes corner case where a killed bash
leaves sleep holding stdout/stderr open and CombinedOutput
blocks); ctx with 100ms deadline; call returns within ~5s
wall-clock; either errors.Is(err, context.DeadlineExceeded)
or the error message names 'killed' / 'signal'.
6. TestOpenSSL_Issue_SignalKilled_PartialOutputDiscarded —
script writes a half-PEM ('-----BEGIN CERTIFICATE-----\nMII…')
then 'kill -KILL $$'; assertion: result is nil OR
CertPEM is empty (no half-cert leaks to caller); error
names 'signal' / 'killed' OR 'PEM' / 'parse' (both are
operator-actionable).
Each test pins the operator-actionable error message contract:
the message names the failure mode (so journalctl + grep find
it) and proves no half-state was created (no partial cert
returned). errors.Is / errors.Unwrap checks confirm the wrapping
chain survives.
The OpenSSL adapter has no commandRunner abstraction (production
code uses exec.CommandContext directly); these tests use real
operator-supplied scripts written to t.TempDir (matches the
adapter's actual production code path; no os/exec mocking). The
'exec sleep 30' technique in Test 5 is the load-bearing fix for
the bash-orphans-sleep-and-pipes-stay-open corner case that
otherwise makes the test take 30s instead of 100ms.
Coverage delta:
- Before this commit: openssl_test.go + openssl_stubs_test.go
covered 8 happy-path funcs.
- After: 79.8% statement coverage of openssl.go (up from
operator-pre-existing baseline; the 6 new tests exercise
every error path through callSignScript + parseCertificate).
Tests pass clean under '-race -count=10' (Test 5's deadline
tolerance is the only timing-sensitive case; the 5s wall-clock
budget vs the 100ms ctx deadline gives ample slack on slow CI
without masking deadline-not-enforced bugs).
Test-only commit; no production code changes. Hardening fixes
(per-call concurrency semaphore, threat-model docs) are separate
Top-10 entries.
Verified locally:
- gofmt clean across the repo.
- go vet ./... clean across the repo.
- go test -race -count=10 -short
./internal/connector/issuer/openssl/... green.
Audit reference: cowork/issuer-coverage-audit-2026-05-03/
RESULTS.md Top-10 fix#3.
shankar0123