gsadmin/pulse
1
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-09-10 02:25:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

test(relay): serve revocation fixture over trusted TLS

Browse Source 
The workspace-scoped managed relay proof still supplied an HTTP revocation origin after the canonical relay began enforcing HTTPS-only credential transport. Use a local TLS server and pass its certificate to the child process so the combined canonical repositories exercise the production boundary rather than failing during startup.

Change-source: pulse-maintainer
This commit is contained in:
pulse-triage[bot]
2026-09-06 00:53:30 +01:00
parent aed8b8923a
commit bde794de79
1 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/relay/client_managed_runtime_test.go
+13 -1
View File
@@ -4,8 +4,10 @@ import (
"bytes"
"context"
"crypto/ed25519"
"crypto/x509"
"encoding/base64"
"encoding/json"
"encoding/pem"
"errors"
"io"
"net"
@@ -52,7 +54,7 @@ func TestManagedRuntimeRelayRegistrationReconnectDrain(t *testing.T) {
pulseRoot, pulseProRelayDir := managedRelayWorkspaceRoots(t)
relayBinary := buildManagedRelayBinary(t, pulseProRelayDir)
const revocationFeedToken = "managed-runtime-revocation-feed-token"
revocationFeed := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
revocationFeed := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
if r.URL.Path != "/v1/revocations" {
http.NotFound(w, r)
return
@@ -69,6 +71,16 @@ func TestManagedRuntimeRelayRegistrationReconnectDrain(t *testing.T) {
})
}))
defer revocationFeed.Close()
revocationCertificate, err := x509.ParseCertificate(revocationFeed.TLS.Certificates[0].Certificate[0])
if err != nil {
t.Fatalf("parse revocation feed certificate: %v", err)
}
revocationCAPath := filepath.Join(t.TempDir(), "revocation-feed-ca.pem")
revocationCAPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: revocationCertificate.Raw})
if err := os.WriteFile(revocationCAPath, revocationCAPEM, 0o600); err != nil {
t.Fatalf("write revocation feed CA: %v", err)
}
t.Setenv("SSL_CERT_FILE", revocationCAPath)
t.Setenv("PULSE_RELAY_LICENSE_SERVER_URL", revocationFeed.URL)
t.Setenv("PULSE_RELAY_REVOCATION_FEED_TOKEN", revocationFeedToken)