Skip to content

Commit f78cc8a

Browse files
committed
t: configure TLS client certificates in tests
In commit b9602f3 of PR git-lfs#5616 we resolved a problem which caused flaky test results in our CI jobs by ensuring that the t/t-credential.sh test script used a unique directory for the credential record files we provide to our git-credential-lfstest helper program. This change ensured that when the "clone (HTTP server/proxy require cookies)" test in our t/t-clone.sh script creates a record file named "localhost" in the common directory specified by the CREDSDIR environment variable, specifically a copy of the "127.0.0.1" file created by the setup_creds() shell library function, this does not conflict with the "credentials from netrc" test and other related tests in the t/t-credential.sh test script, which depend on there being no credential records associated with the "localhost" hostname. However, we already made a previous attempt to resolve this problem in commits bb87944 and bcb9eb3 of PR git-lfs#3825, but that change assumes that our test scripts always run sequentially rather than in parallel. In PR git-lfs#3825 the "clone (HTTP server/proxy require cookies)" test was added, and at the end of the test, it removes the "localhost" credential record file it creates at the beginning of the test. Of course, if the test ever fails, then it leaves the "localhost" record file in place, so even if our test scripts always ran sequentially there would still be a potential conflict with the tests in the t/t-credential.sh script. We can more comprehensively ensure that these two test scripts do not conflict again in the future by using the same technique applied in commit b9602f3 to the t/t-credential.sh script in the t/t-clone.sh script as well. First, we add a call to setup_creds() at the start of the t/t-clone.sh script after setting the CREDSDIR environment variable to a path unique to the t/t-clone.sh script. This ensures that a separate copy of the default credential record file for the 127.0.0.1 hostname is available for the exclusive use of the tests in the script. Next, we move the creation of the credential record files associated with the TLS/SSL client certificate used in the "clone ClientCert" test from the generic setup_creds() function into the test itself. We would otherwise need to define the "certpath" and "keypath" variables, as their values are interpolated by the function into the names of these credential record files. The TLS/SSL client certificate and key files are generated by our lfstest-gitserver utility when it is first executed. Their locations are defined by the LFSTEST_CLIENT_* environment variables passed by the setup() function in our t/testhelpers.sh shell library to the lfstest-count-tests utility, which then runs the lfstest-gitserver program. The values of these environment variables are set from the LFS_CLIENT_CERT_FILE and LFS_CLIENT_KEY_FILE* variables defined by our t/testenv.sh script. We now use these variables in the "clone ClientCert" test when we call the write_creds_file() function directly, instead of allowing the setup_creds() function to perform those calls. We could define the "certpath" and "keypath" variables (using the LFS_CLIENT_CERT_FILE and LFS_CLIENT_KEY_FILE_ENCRYPTED variables) prior to calling setup_creds() at the start of the t/t-clone.sh script. However, the "clone ClientCert" test is the only one which actually makes use of these credential record files, as this is the only test which actively checks the use of an encrypted TLS/SSL client certificate, and so is the only place where we need to create these record files. Further, we can also move into the test the "git config" commands that set the "http.<url>.sslCert" and "http.<url>.sslKey" Git configuration options with the locations of the TLS/SSL client certificate files, and we do the same for the "create lock with server using client cert" test in the t/t-lock.sh test script. Previously, we set these configuration options in the setup() function in our t/testhelpers.sh shell library, so they were configured for all tests in all test scripts, although only the "clone ClientCert" test and the "create lock with server using client cert" test make use of them. Finally, the "clone (HTTP server/proxy require cookies)" test no longer needs to attempt to delete the credential record file for the "localhost" hostname after the test is complete, so we can simply remove that code. Note that the "clone ClientCert" test was first introduced in commit daba49a of PR git-lfs#1893, at which time the "git config" commands to set the "http.<url>.sslCert" and "http.<url>.sslKey" options were added to the setup() function, and the LFS_CLIENT_CERT_FILE and LFS_CLIENT_KEY_FILE variables were defined in what was then the test/testenv.sh script. Later, in commit 52f94c2 of PR git-lfs#3270, the LFS_CLIENT_KEY_FILE_ENCRYPTED variable was added along with support in the lfstest-gitserver program to generate an encrypted certificate key file. In another commit in PR git-lfs#3270, commit 706beca, the "clone ClientCert" test was then expanded to validate use of the encrypted key file with the "git lfs clone" command. (Note too that the following test, the "clone ClientCert with homedir certs" test, appears to also depend on credential record files for the TLS/SSL client certificate files it creates in the dedicated home directory used by our tests. However, because this test does not set the "http.sslCertPasswordProtected" Git configuration option or the GIT_SSL_CERT_PASSWORD_PROTECTED environment variable, Git does not attempt to retrieve a passphrase for the certificate files, and so the associated credential record files are never actually used. We will address this issue in a subsequent commit in this PR.)
1 parent 8dde1bb commit f78cc8a

File tree

3 files changed

+13
-9
lines changed

3 files changed

+13
-9
lines changed

t/t-clone.sh

+9-3
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,9 @@ if [ "$IS_WINDOWS" -eq 0 -a "$IS_MAC" -eq 0 ]; then
1111
fi
1212
export GIT_LIBNSS
1313

14+
export CREDSDIR="$REMOTEDIR/creds-clone"
15+
setup_creds
16+
1417
begin_test "clone"
1518
(
1619
set -e
@@ -175,6 +178,12 @@ begin_test "clone ClientCert"
175178
git config --global "http.sslBackend" "openssl"
176179
fi
177180

181+
write_creds_file "::pass" "$CREDSDIR/--$(echo "$LFS_CLIENT_CERT_FILE" | tr / -)"
182+
write_creds_file "::pass" "$CREDSDIR/--$(echo "$LFS_CLIENT_KEY_FILE_ENCRYPTED" | tr / -)"
183+
184+
git config --global "http.$LFS_CLIENT_CERT_URL/.sslCert" "$LFS_CLIENT_CERT_FILE"
185+
git config --global "http.$LFS_CLIENT_CERT_URL/.sslKey" "$LFS_CLIENT_KEY_FILE"
186+
178187
reponame="test-cloneClientCert"
179188
setup_remote_repo "$reponame"
180189
clone_repo_clientcert "$reponame" "$reponame"
@@ -844,8 +853,5 @@ begin_test "clone (HTTP server/proxy require cookies)"
844853
[ ! -e "lfs" ]
845854
assert_clean_status
846855
popd
847-
848-
# to avoid breaking t-credentials.sh
849-
rm "$CREDSDIR/localhost"
850856
)
851857
end_test

t/t-lock.sh

+4
Original file line numberDiff line numberDiff line change
@@ -141,6 +141,10 @@ end_test
141141
begin_test "create lock with server using client cert"
142142
(
143143
set -e
144+
145+
git config --global "http.$LFS_CLIENT_CERT_URL/.sslCert" "$LFS_CLIENT_CERT_FILE"
146+
git config --global "http.$LFS_CLIENT_CERT_URL/.sslKey" "$LFS_CLIENT_KEY_FILE"
147+
144148
reponame="lock_create_client_cert"
145149
setup_remote_repo_with_file "$reponame" "cc.dat"
146150

t/testhelpers.sh

-6
Original file line numberDiff line numberDiff line change
@@ -576,8 +576,6 @@ write_creds_file() {
576576
setup_creds() {
577577
mkdir -p "$CREDSDIR"
578578
write_creds_file ":user:pass" "$CREDSDIR/127.0.0.1"
579-
write_creds_file "::pass" "$CREDSDIR/--$certpath"
580-
write_creds_file "::pass" "$CREDSDIR/--$keypath"
581579
write_creds_file "::pass" "$CREDSDIR/--$homecertpath"
582580
write_creds_file "::pass" "$CREDSDIR/--$homekeypath"
583581
}
@@ -631,14 +629,10 @@ setup() {
631629
git config --global user.name "Git LFS Tests"
632630
git config --global user.email "[email protected]"
633631
git config --global http.sslcainfo "$LFS_CERT_FILE"
634-
git config --global http.$LFS_CLIENT_CERT_URL/.sslKey "$LFS_CLIENT_KEY_FILE"
635-
git config --global http.$LFS_CLIENT_CERT_URL/.sslCert "$LFS_CLIENT_CERT_FILE"
636632
git config --global init.defaultBranch main
637633
fi | sed -e 's/^/# /g'
638634

639635
# setup the git credential password storage
640-
local certpath="$(echo "$LFS_CLIENT_CERT_FILE" | tr / -)"
641-
local keypath="$(echo "$LFS_CLIENT_KEY_FILE_ENCRYPTED" | tr / -)"
642636
local homecertpath="$(echo "$TRASHDIR/home/lfs-client-cert-file" | tr / -)"
643637
local homekeypath="$(echo "$TRASHDIR/home/lfs-client-key-file" | tr / -)"
644638
setup_creds

0 commit comments

Comments
 (0)