Test certificates expired

[ellert]

$ for x in $(find . -name *.cert.pem) ; do echo $x ; openssl x509 -in $x -noout -dates ; done
./src/test/resources/vomsdir-expired-aa-cert/expired.cert.pem
notBefore=Dec 1 00:00:00 2011 GMT
notAfter=Dec 2 00:00:00 2011 GMT
./src/test/resources/homes/pem-creds/.globus/test0.cert.pem
notBefore=Sep 26 15:39:34 2012 GMT
notAfter=Sep 24 15:39:34 2022 GMT
./src/test/resources/vomsdir-fake-aa-cert/test_host_2_cnaf_infn_it.cert.pem
notBefore=Dec 14 18:44:17 2012 GMT
notAfter=Dec 12 18:44:17 2022 GMT
./src/test/resources/certs/expired_cert_host_cnaf_infn_it.cert.pem
notBefore=Dec 14 19:06:15 2012 GMT
notAfter=Dec 12 19:06:15 2022 GMT
./src/test/resources/certs/test1.cert.pem
notBefore=Sep 26 15:39:36 2012 GMT
notAfter=Sep 24 15:39:36 2022 GMT
./src/test/resources/certs/test4.cert.pem
notBefore=Sep 26 15:39:44 2012 GMT
notAfter=Sep 24 15:39:44 2022 GMT
./src/test/resources/certs/test_host_cnaf_infn_it.cert.pem
notBefore=Oct 10 16:03:07 2012 GMT
notAfter=Oct 8 16:03:07 2022 GMT
./src/test/resources/certs/test0.cert.pem
notBefore=Sep 26 15:39:34 2012 GMT
notAfter=Sep 24 15:39:34 2022 GMT
./src/test/resources/certs/test5.cert.pem
notBefore=Sep 26 15:39:47 2012 GMT
notAfter=Sep 24 15:39:47 2022 GMT
./src/test/resources/certs/revoked.cert.pem
notBefore=Sep 26 15:20:43 2012 GMT
notAfter=Sep 24 15:20:43 2022 GMT
./src/test/resources/certs/expired.cert.pem
notBefore=Dec 1 00:00:00 2011 GMT
notAfter=Dec 2 00:00:00 2011 GMT
./src/test/resources/certs/wilco_cnaf_infn_it.cert.pem
notBefore=Sep 26 15:08:56 2012 GMT
notAfter=Sep 24 15:08:56 2022 GMT
./src/test/resources/certs/test2.cert.pem
notBefore=Sep 26 15:39:38 2012 GMT
notAfter=Sep 24 15:39:38 2022 GMT
./src/test/resources/certs/test_host_2_cnaf_infn_it.cert.pem
notBefore=Dec 14 18:44:17 2012 GMT
notAfter=Dec 12 18:44:17 2022 GMT
./src/test/resources/certs/test3.cert.pem
notBefore=Sep 26 15:39:41 2012 GMT
notAfter=Sep 24 15:39:41 2022 GMT
./src/test/resources/perm-test/test1.cert.pem
notBefore=Sep 26 15:39:36 2012 GMT
notAfter=Sep 24 15:39:36 2022 GMT
./src/test/resources/perm-test/test0.cert.pem
notBefore=Sep 26 15:39:34 2012 GMT
notAfter=Sep 24 15:39:34 2022 GMT

[ellert]

Since I filed this issue one more of the certificates in the above list has expired and 11 more tests are failing...

[ellert]

This week one more certificate expired, and now there is one more failing test.

[giacomini]

We are going to generate the test certificates on the fly. I hope that's ok with you.

[federicaagostini]

Hello, we have added a setup script to be run when the CA and test certificates expire, or if you run the tests for the first time. The certificates are now gitignored, so not present on this repo.

Few steps are required before to run the script, as you can see from the github workflow, which basically are:

• install the faketime command (to produce expired certificates)
• clone the helper scripts (to create CA and server certificates)
  • add them to the PATH environment variable.

Is this enough to close the issue?

[ellert]

Thank you for the description. I have updated the packages in Fedora and Debian and re-enabled the tests.

[giacomini]

@ellert are there any requirements on the mentioned helper scripts so that they can be used in the package production in Fedora and Debian?

[ellert]

I used the tarball available from
https://baltig.infn.it/mw-devel/helper-scripts/-/archive/master/helper-scripts-master.tar.gz

Adding a second source tarball to the Fedora source RPM and the Debian source package is not a problem.

https://src.fedoraproject.org/rpms/voms-api-java/blob/rawhide/f/voms-api-java.spec

https://deb.debian.org/debian/pool/main/v/voms-api-java/voms-api-java_3.3.6-2.dsc
https://salsa.debian.org/ellert/voms-api-java/-/tree/master/debian

[giacomini]

Ok. Do you prefer if we prepare actual releases, so that you don't rely on what we put on master?

Also, please let us know if the scripts don't run correctly on some platform. I noticed some inconsistencies between the openssl commands on different platforms.