certctl

mirror of https://github.com/shankar0123/certctl.git synced 2026-06-07 19:21:29 +00:00

Files

T

shankar0123 29d853d641 Bundle J (Coverage Audit Closure): ACME failure-mode test batch — C-001 partial-closed

internal/connector/issuer/acme line coverage 41.8% -> 55.6% (+13.8pp) via

internal/connector/issuer/acme/acme_failure_test.go (~700 LoC, 23 tests).

Failure modes pinned (all hermetic via httptest.Server, no live ACME):

  EAB auto-fetch:  network-error, malformed-JSON, 5xx, 401, success=false

  ARI:             dir-unreachable, 5xx, 404 (nil/nil), malformed-JSON,

                   empty-suggestedWindow, dir-malformed-falls-to-fallback,

                   invalid-PEM, happy-path with explanationURL

  Profile-order:   directory-discovery-failure on JWS-POST branch

                   empty-profile fast-path delegation

  fetchNonce:      no-URL, no-Replay-Nonce, network-error, happy-path

  Always-error V1: RevokeCertificate, GenerateCRL, SignOCSPResponse,

                   GetCACertPEM

  ensureClient propagation: IssueCertificate / RenewCertificate /

                            GetOrderStatus surface 'ACME client init' wrap

  Challenge handler (HTTP-01): known-token serves, unknown-token 404

  presentPersistRecord: no-solver + DNSSolver-fallback

  Defense-in-depth: error messages do not leak HMAC key bytes

Per-function deltas:

  GetRenewalInfo            11.4% -> 91.4%

  getARIEndpoint             0.0% -> 82.4%

  computeARICertID          50.0% -> 100.0%

  RenewCertificate           0.0% -> 100.0%

  RevokeCertificate          0.0% -> 80.0%

  presentPersistRecord       0.0% -> 80.0%

  fetchNonce                78.6% -> 92.9%

  ensureClient              79.3% -> 86.2%

  fetchZeroSSLEAB           80.8% -> 88.5%

Engineering: preWiredConnector fixture pre-sets c.client + c.accountKey

so ensureClient short-circuits, letting tests exercise post-init paths

(ARI/profile/revoke/getOrderStatus) without a full registration mock.

Why partial-closed: residual ~30pp gap to >=85% target lives in

IssueCertificate (~115 LoC) + solveAuthorizations[HTTP01|DNS01|DNSPersist01]

(~280 LoC) + authorizeOrderWithProfile JWS-POST branch — all require a

Pebble-style ACME mock (~300-500 LoC infra + ~500 LoC tests). Tracked as

follow-on 'Bundle J-extended'. C-001 status open -> partial_closed.

Verification:

  go vet ./internal/connector/issuer/acme/...        clean

  staticcheck ./internal/connector/issuer/acme/...   clean

  go test -short ./internal/connector/issuer/acme/   PASS, 55.6% coverage

  go test -race  ./internal/connector/issuer/acme/   PASS, 0 races

Audit deliverables:

  findings.yaml: C-001 status open -> partial_closed with closure_note

  gap-backlog.md: closure log + C-001 row updated

  coverage-matrix.md: ACME 41.8 -> 55.6

  closure-plan.md: Bundle J [~] partial-closed

  CHANGELOG.md: [unreleased] Bundle J entry with per-function table

2026-04-27 16:26:24 +00:00

api

Bundle G: Final audit closure — L-004 + D-003/4/5/7 closed; 54/55 + 7/7

2026-04-27 02:27:44 +00:00

cli

D-1: correct certctl-cli status endpoint path (/api/v1/health -> /health)

2026-04-20 19:40:58 +00:00

config

Bundle G: Final audit closure — L-004 + D-003/4/5/7 closed; 54/55 + 7/7

2026-04-27 02:27:44 +00:00

connector

Bundle J (Coverage Audit Closure): ACME failure-mode test batch — C-001 partial-closed