security/securitytest: generate test certs at runtime#168842
security/securitytest: generate test certs at runtime#168842pritesh-lahoti wants to merge 1 commit intocockroachdb:release-26.2.0-rcfrom
Conversation
Replace static embedded test certificates with runtime-generated ones using Go's crypto/x509 libraries. Certificates are generated lazily via sync.Once on first access and cached in an in-memory map for the process lifetime. This eliminates the need for periodic manual regeneration of test certificates (the CN/SAN variant certs expired annually, and other certs had 5-10 year lifetimes). All not-found errors are wrapped with os.ErrNotExist so callers like CertificateLoader.Load() can detect them via oserror.IsNotExist(). Epic: none Fixes: CRDB-61176 Co-Authored-By: roachdev-claude <roachdev-claude-bot@cockroachlabs.com>
|
Thanks for opening a backport. Before merging, please confirm that the change does not break backwards compatibility and otherwise complies with the backport policy. Include a brief release justification in the PR description explaining why the backport is appropriate. All backports must be reviewed by the TL for the owning area. While the stricter LTS policy does not yet apply, please exercise judgment and consider gating non-critical changes behind a disabled-by-default feature flag when appropriate. |
blathers-crl
Bot
added
backport
|
Your pull request contains more than 1000 changes. It is strongly encouraged to split big PRs into smaller chunks. It looks like your PR touches production code but doesn't add or edit any test code. Did you consider adding tests to your PR? 🦉 Hoot! I am a Blathers, a bot for CockroachDB. My owner is dev-inf. |
|
This change is |
|
/trunk merge |
|
This PR's base branch doesn't have a Merge Queue configured, and it's not part of a stack that targets a branch with a Merge Queue. You can still merge it directly without using the Merge Queue. |
|
All CI checks have passed and the PR has been approved. Could someone with admin access merge this? The branch is locked and cannot be merged via the regular merge button or command line. |
3 participants
Backport 1/1 commits from #167398.
/cc @cockroachdb/security
Summary
Backport of #167398 to release-26.2.0-rc. This replaces static, expiring test
certificates with runtime-generated ones, fixing test failures caused by
expired certs. Cherry-picked cleanly with no conflicts.
Epic: none
Release note: None
Release justification: Test fix