Skip to content

Conversation

@aramprice
Copy link
Member

Newer versons of the OpenSSL gem have changed the exception class returned when there are Pub or Pivate key portions missing. This change relaxes the expectation to check for the message, and not the class name.

Fixes the following error when running with openssl-4.0.0.gem:

  1) Bosh::Director::NatsClientCertGenerator when CA or Private Key are misconfigured throws an invalid Private Key error if an error occurs while loading the certificate private key
     Failure/Error:
       expect { subject }.to raise_error(DeploymentNATSClientCertificateGenerationError) do |error|
         expect(error.message).to include('Error occurred while loading private key to generate NATS Client certificates')
         expect(error.message).to include('OpenSSL::PKey::RSAError: Neither PUB key nor PRIV key')
       end
     
       expected "Error occurred while loading private key to generate NATS Client certificates: #<OpenSSL::PKey::PKeyError: Neither PUB key nor PRIV key>" to include "OpenSSL::PKey::RSAError: Neither PUB key nor PRIV key"
     # ./spec/unit/bosh/director/nats_client_cert_generator_spec.rb:103:in `block (3 levels) in <module:Director>'
     # ./spec/spec_helper.rb:67:in `block in reset_database'
     # /usr/local/bundle/ruby/3.3.0/gems/sequel-5.99.0/lib/sequel/database/transactions.rb:257:in `_transaction'
     # /usr/local/bundle/ruby/3.3.0/gems/sequel-5.99.0/lib/sequel/database/transactions.rb:239:in `block in transaction'
     # /usr/local/bundle/ruby/3.3.0/gems/sequel-5.99.0/lib/sequel/connection_pool/timed_queue.rb:90:in `hold'
     # /usr/local/bundle/ruby/3.3.0/gems/sequel-5.99.0/lib/sequel/database/connecting.rb:283:in `synchronize'
     # /usr/local/bundle/ruby/3.3.0/gems/sequel-5.99.0/lib/sequel/database/transactions.rb:197:in `transaction'
     # /usr/local/bundle/ruby/3.3.0/gems/sequel-5.99.0/lib/sequel/core.rb:395:in `block (2 levels) in transaction'
     # /usr/local/bundle/ruby/3.3.0/gems/sequel-5.99.0/lib/sequel/core.rb:403:in `transaction'
     # ./spec/spec_helper.rb:66:in `reset_database'
     # ./spec/spec_helper.rb:156:in `block (2 levels) in <top (required)>'
     # /usr/local/bundle/ruby/3.3.0/gems/webmock-3.26.1/lib/webmock/rspec.rb:39:in `block (2 levels) in <top (required)>'

Context: https://bosh.ci.cloudfoundry.org/teams/main/pipelines/bosh-director/jobs/bump-deps/builds/184#L69448740:529:548

Newer versons of the OpenSSL gem have changed the exception class
returned when there are Pub or Pivate key portions missing. This change
relaxes the expectation to check for the message, and not the class
name.
@github-project-automation github-project-automation bot moved this from Inbox to Pending Merge | Prioritized in Foundational Infrastructure Working Group Dec 19, 2025
@ystros ystros merged commit fba4394 into main Dec 19, 2025
19 checks passed
@github-project-automation github-project-automation bot moved this from Pending Merge | Prioritized to Done in Foundational Infrastructure Working Group Dec 19, 2025
@ystros ystros deleted the allow-openssl-upgrade branch December 19, 2025 16:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Development

Successfully merging this pull request may close these issues.

3 participants