From e022ef0358725ab9292b4a8f5bb863f4cba7b1e5 Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk Date: Feb 13 2019 22:03:22 +0000 Subject: [PATCH 1/6] Pass no-name-constraint to repospanner ca init As explained in the documentation and error messages when run with Go1.9 compiled binaries, there's a Go bug in Go1.9 and earlier that breaks the name constraint. This should make the tests work on EL7 compiled binaries of repoSpanner. Signed-off-by: Patrick Uiterwijk --- diff --git a/tests/test_pagure_repospanner.py b/tests/test_pagure_repospanner.py index 9fe1abf..d7f3be4 100644 --- a/tests/test_pagure_repospanner.py +++ b/tests/test_pagure_repospanner.py @@ -188,7 +188,8 @@ class PagureRepoSpannerTests(tests.Modeltests): with open(os.path.join(self.path, 'repospanner', 'keylog'), 'w') as keylog: # Create the CA - self.run_cacmd(keylog, 'init', 'repospanner.local') + self.run_cacmd(keylog, 'init', 'repospanner.local', + '--no-name-constraint') # Create the node cert self.run_cacmd(keylog, 'node', 'regiona', 'nodea') # Create the admin cert From 9b2de721acd0419a7d927f264a29717703f0a1f3 Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk Date: Feb 13 2019 22:03:22 +0000 Subject: [PATCH 2/6] Use localhost.localdomain for repoSpanner tests Signed-off-by: Patrick Uiterwijk --- diff --git a/tests/__init__.py b/tests/__init__.py index 565790c..446b047 100644 --- a/tests/__init__.py +++ b/tests/__init__.py @@ -103,7 +103,7 @@ REPOSPANNER_NEW_REPO_ADMIN_OVERRIDE = %(repospanner_admin_override)s REPOSPANNER_NEW_FORK = %(repospanner_new_fork)s REPOSPANNER_ADMIN_MIGRATION = %(repospanner_admin_migration)s REPOSPANNER_REGIONS = { - 'default': {'url': 'https://nodea.regiona.repospanner.local:%(repospanner_gitport)s', + 'default': {'url': 'https://repospanner.localhost.localdomain:%(repospanner_gitport)s', 'repo_prefix': 'pagure/', 'hook': None, 'ca': '%(path)s/repospanner/pki/ca.crt', diff --git a/tests/test_pagure_repospanner.py b/tests/test_pagure_repospanner.py index d7f3be4..f170569 100644 --- a/tests/test_pagure_repospanner.py +++ b/tests/test_pagure_repospanner.py @@ -41,7 +41,7 @@ REPOSPANNER_CONFIG_TEMPLATE = """ ca: path: %(path)s/repospanner/pki admin: - url: https://nodea.regiona.repospanner.local:%(gitport)s/ + url: https://localhost.localdomain:%(gitport)s/ ca: %(path)s/repospanner/pki/ca.crt cert: %(path)s/repospanner/pki/admin.crt key: %(path)s/repospanner/pki/admin.key @@ -57,12 +57,12 @@ listen: certificates: ca: %(path)s/repospanner/pki/ca.crt client: - cert: %(path)s/repospanner/pki/nodea.regiona.crt - key: %(path)s/repospanner/pki/nodea.regiona.key + cert: %(path)s/repospanner/pki/repospanner.localhost.crt + key: %(path)s/repospanner/pki/repospanner.localhost.key server: default: - cert: %(path)s/repospanner/pki/nodea.regiona.crt - key: %(path)s/repospanner/pki/nodea.regiona.key + cert: %(path)s/repospanner/pki/repospanner.localhost.crt + key: %(path)s/repospanner/pki/repospanner.localhost.key hooks: bubblewrap: enabled: true @@ -188,10 +188,10 @@ class PagureRepoSpannerTests(tests.Modeltests): with open(os.path.join(self.path, 'repospanner', 'keylog'), 'w') as keylog: # Create the CA - self.run_cacmd(keylog, 'init', 'repospanner.local', + self.run_cacmd(keylog, 'init', 'localdomain', '--no-name-constraint') # Create the node cert - self.run_cacmd(keylog, 'node', 'regiona', 'nodea') + self.run_cacmd(keylog, 'node', 'localhost', 'repospanner') # Create the admin cert self.run_cacmd(keylog, 'leaf', 'admin', '--admin', '--region', '*', '--repo', '*') @@ -232,7 +232,7 @@ class PagureRepoSpannerTests(tests.Modeltests): try: # Wait for the instance to become available resp = requests.get( - 'https://nodea.regiona.repospanner.local:%d/' + 'https://repospanner.localhost.localdomain:%d/' % configvals['gitport'], verify=os.path.join(self.path, 'repospanner', 'pki', 'ca.crt'), cert=( From 3df2fc3769a6fc0da954cb60882e411232815e0c Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk Date: Feb 13 2019 22:03:23 +0000 Subject: [PATCH 3/6] Add --random-cn to repoSpanner ca init This works around an annoyance in NSS. This will need a newer repoSpanner build, which is inbound. Signed-off-by: Patrick Uiterwijk --- diff --git a/tests/test_pagure_repospanner.py b/tests/test_pagure_repospanner.py index f170569..67f2db8 100644 --- a/tests/test_pagure_repospanner.py +++ b/tests/test_pagure_repospanner.py @@ -189,7 +189,7 @@ class PagureRepoSpannerTests(tests.Modeltests): 'w') as keylog: # Create the CA self.run_cacmd(keylog, 'init', 'localdomain', - '--no-name-constraint') + '--no-name-constraint', '--random-cn') # Create the node cert self.run_cacmd(keylog, 'node', 'localhost', 'repospanner') # Create the admin cert From cf13969d4e171d5c94804aa84eb51ca3f6b91875 Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk Date: Feb 13 2019 22:03:23 +0000 Subject: [PATCH 4/6] Disable bubblewrap in the test environment This doesn't get allowed by default inside podman, there aren't enough capabilities provided for bubblewrap to work. While it's still strongly suggested to enable this in any real deployments, for test we can bypass this. Signed-off-by: Patrick Uiterwijk --- diff --git a/tests/test_pagure_repospanner.py b/tests/test_pagure_repospanner.py index 67f2db8..91955a7 100644 --- a/tests/test_pagure_repospanner.py +++ b/tests/test_pagure_repospanner.py @@ -65,7 +65,7 @@ certificates: key: %(path)s/repospanner/pki/repospanner.localhost.key hooks: bubblewrap: - enabled: true + enabled: false unshare: - net - ipc From 6e6ebb055d490ba3cf45613ebf811db9d0087963 Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk Date: Feb 13 2019 22:03:23 +0000 Subject: [PATCH 5/6] Make sure that if pypath is set, that gets used as first Signed-off-by: Patrick Uiterwijk --- diff --git a/pagure/hooks/files/repospannerhook b/pagure/hooks/files/repospannerhook index bf7f00c..24270b6 100755 --- a/pagure/hooks/files/repospannerhook +++ b/pagure/hooks/files/repospannerhook @@ -19,7 +19,7 @@ PYPATH = "${pypath}" # Prepare code imports if PYPATH: - sys.path.append(PYPATH) + sys.path.insert(0, PYPATH) import pagure import pagure.lib.model_base From 7262c5f5a5aa6bcbf966db881754dc1fd6c74294 Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk Date: Feb 13 2019 22:03:23 +0000 Subject: [PATCH 6/6] Update the needle due to strange control chars in CI Signed-off-by: Patrick Uiterwijk --- diff --git a/tests/test_pagure_repospanner.py b/tests/test_pagure_repospanner.py index 91955a7..b86ae7b 100644 --- a/tests/test_pagure_repospanner.py +++ b/tests/test_pagure_repospanner.py @@ -465,8 +465,7 @@ class PagureRepoSpannerTestsNewRepoDefault(PagureRepoSpannerTests): output_text ) self.assertIn( - "Denied push for ref 'refs/heads/master' for user 'foo'\n" - "All changes have been rejected", + "Denied push for ref 'refs/heads/master' for user 'foo'", output_text )