certctl

mirror of https://github.com/shankar0123/certctl.git synced 2026-06-07 23:11:32 +00:00

Files

T

cowork 0ffcdedc8e Bundle J-extended (Coverage Audit Extension): ACME 55.6% -> 85.4% via Pebble-style mock — C-001 fully closed

Closes the deferred >=85% gate on internal/connector/issuer/acme that
Bundle J left at 55.6% (failure-mode batch only). The remaining gap
was IssueCertificate + solveAuthorizations* + authorizeOrderWithProfile's
JWS-POST branch — all uncoverable without a Pebble-style ACME server
that handles the full RFC 8555 flow.

What shipped
============
internal/connector/issuer/acme/pebble_mock_test.go (~900 LoC):
  - RFC 8555 state machine: newAccount (with onlyReturnExisting=true
    short-circuit returning HTTP 200 for stdlib's GetReg(ctx, '') vs
    201 for fresh registration) + newOrder + authz + challenge +
    finalize + cert + order-poll + account-self
  - JWS envelope parsing (no signature verification — stdlib client
    signs correctly; test exercises connector code, not stdlib JWS)
  - Nonce ring with badNonce errors on replays
  - In-process self-signed ECDSA P-256 CA fixture
  - Mock DNSSolver with Present / CleanUp / PresentPersist

13 new tests
============
  - IssueCertificate_HappyPath / MultiSAN / WithProfile
  - RenewCertificate_DelegatesToIssue
  - GetOrderStatus_HappyPath
  - NewAccountFailure_ReturnsError
  - FinalizeProcessingStuck_RecoversToValid
  - FinalizeReturnsInvalid_FailsClean
  - ContextCancel_DuringIssuance
  - BadCSR_RejectedByMock
  - IssueCertificate_HTTP01ChallengeFlow (exercises
    solveAuthorizationsHTTP01 + startChallengeServer)
  - IssueCertificate_DNS01ChallengeFlow + DNS01_PresentFails +
    DNS01_NoSolver
  - IssueCertificate_DNSPersist01ChallengeFlow +
    DNSPersist01_FallbackToDNS01 + DNSPersist01_NoSolver

Coverage trajectory
============
  Pre-Bundle-J:           41.8%
  Post-Bundle-J:          55.6%   (+13.8pp; failure-mode batch)
  Post-Bundle-J-extended: 85.4%   (+29.8pp; Pebble-mock issuance)
  Total delta:                    +43.6pp; +0.4 above 85% gate

Per-function deltas (vs Pre-Bundle-J baseline):
  IssueCertificate:                0.0% -> 100.0%
  solveAuthorizations:             0.0% -> 100.0%
  solveAuthorizationsHTTP01:       0.0% -> 88.4%
  solveAuthorizationsDNS01:        0.0% -> 91.4%
  solveAuthorizationsDNSPersist01: 0.0% -> 87.0%
  authorizeOrderWithProfile:       0.0% -> 92.5%
  GetOrderStatus:                  0.0% -> 100.0%
  startChallengeServer:            0.0% -> 100.0%

Verification
============
  - go test -count=1 -timeout=20s ./internal/connector/issuer/acme/...:
    PASS in 1.4s
  - go test -short -count=1 -cover ./internal/connector/issuer/acme/...:
    85.4%
  - go vet ./internal/connector/issuer/acme/...: clean

Audit deliverables
============
  - findings.yaml C-001: partial_closed -> closed with full closure
    note enumerating all 13 tests + per-function deltas
  - gap-backlog.md C-001: full strikethrough with closure note
  - coverage-audit-2026-04-27/extension-progress.md: J-extended DONE

Closes: C-001 (ACME Existential coverage)
Bundle: J-extended (Coverage Audit Extension)

2026-04-27 21:12:31 +00:00

api

Bundle G: Final audit closure — L-004 + D-003/4/5/7 closed; 54/55 + 7/7

2026-04-27 02:27:44 +00:00

cli

D-1: correct certctl-cli status endpoint path (/api/v1/health -> /health)

2026-04-20 19:40:58 +00:00

config

Bundle O (Coverage Audit Closure): test hygiene + FSM coverage tables — M-004 + M-005 + M-006 closed

2026-04-27 18:06:06 +00:00

connector

Bundle J-extended (Coverage Audit Extension): ACME 55.6% -> 85.4% via Pebble-style mock — C-001 fully closed