Add Python regression tests; eliminate shell portability workarounds

[ecrist]

Summary

Adds unit-tests-pr1436.py — a Python 3 rewrite of the PR #1436 regression suite that requires no external binaries other than easyrsa and openssl.

Updates op-test.sh to prefer the Python version and fall back to the shell version only when Python 3 is unavailable.

---

Motivation

The original shell test script (unit-tests-pr1436.sh) had to work around the absence of standard POSIX utilities on Windows, where the EasyRSA distribution ships outdated GNU-for-Windows binaries. PR #1437 rewrote the shell script to avoid those tools using shell built-ins.

Python removes the problem entirely:

Problem	Shell workaround	Python solution
cat not reliable	while IFS= read -r loop	path.read_text()
ls not reliable	glob for loop	path.glob() / path.iterdir()
sleep absent on Windows	$SECONDS busy-wait or SKIP	subprocess.run(timeout=N) — kills automatically
/tmp absent on Windows	TMPDIR/TEMP/TMP/CWD chain	tempfile.mkdtemp()
mkdir -p flag issues	single-level mkdir + CWD fallback	tempfile.mkdtemp()
rm -rf may be absent	best-effort with advisory message	shutil.rmtree(ignore_errors=True)
POSIX shebang ignored on Windows	N/A (shell already handles it)	_easyrsa_cmd() prepends sh on win32

---

Design

unit-tests-pr1436.py — stdlib only, Python ≥ 3.6:

_find_easyrsa()       resolves ERSA_BIN env → easyrsa3/easyrsa → PATH
_easyrsa_cmd()        prepends 'sh' on Windows; bare path on Unix/macOS
Runner.run()          subprocess.run() with timeout; as_posix() paths
Runner.t_pass/fail/skip  result accounting + formatted output

The seven tests map 1-to-1 with the shell version:

Test	How Python improves it
FIX-1-passphrase-eof-exits	subprocess.run(stdin=DEVNULL, timeout=10) raises TimeoutExpired if the process hangs — no background jobs, no signals
FIX-2a/b/c/d set_var validation	path.write_text() writes vars files; subprocess.run() checks exit code
FIX-3 passphrase comparison	Same subprocess call as before, simpler capture
FIX-4 mktemp naming	Path.glob("temp.*") replaces the ls + for-loop in shell

op-test.sh — run_local_regression_tests() updated:

1. Probe for python3 then python, verify version starts with Python 3
2. If found and .py file present: run Python version
3. Otherwise: fall back to .sh version
4. Map -v/-vv op-test verb flags to Python's -v

---

Compatibility

Runner	Python available?	Test file used	Expected
GitHub Actions Ubuntu	yes (python3)	.py	7 PASS
GitHub Actions macOS	yes (python3)	.py	7 PASS
GitHub Actions Windows	yes (python3 via setup-python)	.py	7 PASS
Minimal embedded Linux	no	.sh fallback	6 PASS, 1 SKIP
mksh/Win32 without Python	no	.sh fallback	7 PASS (SECONDS mode)

---

Test plan

• python3 unit-tests-pr1436.py -v — 7 PASS on macOS/Linux
• python3 unit-tests-pr1436.py version — prints version string, exits 0
• sh op-test.sh -v — confirm Python path is taken, 7 PASS in log
• Remove python3 from PATH temporarily, run sh op-test.sh -v — confirm fallback to .sh is logged
• On Windows CI: wop-test.bat → op-test.sh → Python tests pass

🤖 Generated with Claude Code