ca-ecc-test.yml

name: CA with ECC

on: workflow_call

env:
  DB_IMAGE: ${{ vars.DB_IMAGE || 'quay.io/389ds/dirsrv' }}

jobs:
  # docs/installation/ca/Installing_CA_with_ECC.md
  test:
    name: Test
    runs-on: ubuntu-latest
    env:
      SHARED: /tmp/workdir/pki
    steps:
      - name: Clone repository
        uses: actions/checkout@v4

      - name: Retrieve PKI images
        uses: actions/cache@v4
        with:
          key: pki-images-${{ github.sha }}
          path: pki-images.tar

      - name: Load PKI images
        run: docker load --input pki-images.tar

      - name: Create network
        run: docker network create example

      - name: Set up DS container
        run: |
          tests/bin/ds-container-create.sh ds
        env:
          IMAGE: ${{ env.DB_IMAGE }}
          HOSTNAME: ds.example.com
          PASSWORD: Secret.123

      - name: Connect DS container to network
        run: docker network connect example ds --alias ds.example.com

      - name: Set up PKI container
        run: |
          tests/bin/runner-init.sh pki
        env:
          HOSTNAME: pki.example.com

      - name: Connect PKI container to network
        run: docker network connect example pki --alias pki.example.com

      - name: Install CA
        run: |
          docker exec pki pkispawn \
              -f /usr/share/pki/server/examples/installation/ca-ecc.cfg \
              -s CA \
              -D pki_ds_url=ldap://ds.example.com:3389 \
              -D pki_enable_access_log=False \
              -v

      - name: Check system cert keys
        run: |
          # all keys should be "ec"
          echo Secret.123 > password.txt
          docker exec pki certutil -K -d /var/lib/pki/pki-tomcat/conf/alias -f ${SHARED}/password.txt | tee output
          echo "ec" > expected

          grep ca_signing output | sed -n 's/<.*>\s\(\S\+\)\s.*/\1/p' > actual
          diff expected actual

          grep ca_ocsp_signing output | sed -n 's/<.*>\s\(\S\+\)\s.*/\1/p' > actual
          diff expected actual

          grep ca_audit_signing output | sed -n 's/<.*>\s\(\S\+\)\s.*/\1/p' > actual
          diff expected actual

          grep subsystem output | sed -n 's/<.*>\s\(\S\+\)\s.*/\1/p' > actual
          diff expected actual

          grep sslserver output | sed -n 's/<.*>\s\(\S\+\)\s.*/\1/p' > actual
          diff expected actual

      - name: Check CA signing cert
        run: |
          # inspect cert with certutil
          docker exec pki certutil -L -d /var/lib/pki/pki-tomcat/conf/alias -f ${SHARED}/password.txt -n ca_signing | tee output

          # signing algorithm should be "X9.62 ECDSA signature with SHA384"
          echo "X9.62 ECDSA signature with SHA384" > expected
          sed -n -e "s/\s*$//" -e "s/^\s*Signature Algorithm:\s*\(.*\)$/\1/p" output | uniq > actual
          diff expected actual

          # inspect cert with openssl
          docker exec pki pki-server cert-export ca_signing --cert-file ca_signing.crt
          docker exec pki openssl x509 -text -noout -in ca_signing.crt | tee output

          # signing algorithm should be "ecdsa-with-SHA384"
          echo "ecdsa-with-SHA384" > expected
          sed -n -e "s/\s*$//" -e "s/^\s*Signature Algorithm:\s*\(.*\)$/\1/p" output | uniq > actual
          diff expected actual

          # default signing algorithm should be "SHA512withEC"
          echo "SHA512withEC" > expected
          docker exec pki pki-server ca-config-show ca.signing.defaultSigningAlgorithm | tee actual
          diff expected actual

      - name: Check CA OCSP signing cert
        run: |
          # inspect cert with certutil
          docker exec pki certutil -L -d /var/lib/pki/pki-tomcat/conf/alias -f ${SHARED}/password.txt -n ca_ocsp_signing | tee output

          # signing algorithm should be "X9.62 ECDSA signature with SHA512"
          echo "X9.62 ECDSA signature with SHA512" > expected
          sed -n -e "s/\s*$//" -e "s/^\s*Signature Algorithm:\s*\(.*\)$/\1/p" output | uniq > actual
          diff expected actual

          # inspect cert with openssl
          docker exec pki pki-server cert-export ca_ocsp_signing --cert-file ca_ocsp_signing.crt
          docker exec pki openssl x509 -text -noout -in ca_ocsp_signing.crt | tee output

          # signing algorithm should be "ecdsa-with-SHA512"
          echo "ecdsa-with-SHA512" > expected
          sed -n -e "s/\s*$//" -e "s/^\s*Signature Algorithm:\s*\(.*\)$/\1/p" output | uniq > actual
          diff expected actual

          # default signing algorithm should be "SHA384withEC"
          echo "SHA384withEC" > expected
          docker exec pki pki-server ca-config-show ca.ocsp_signing.defaultSigningAlgorithm | tee actual
          diff expected actual

      - name: Check CA audit signing cert
        run: |
          # inspect cert with certutil
          docker exec pki certutil -L -d /var/lib/pki/pki-tomcat/conf/alias -f ${SHARED}/password.txt -n ca_audit_signing | tee output

          # signing algorithm should be "X9.62 ECDSA signature with SHA512"
          echo "X9.62 ECDSA signature with SHA512" > expected
          sed -n -e "s/\s*$//" -e "s/^\s*Signature Algorithm:\s*\(.*\)$/\1/p" output | uniq > actual
          diff expected actual

          # inspect cert with openssl
          docker exec pki pki-server cert-export ca_audit_signing --cert-file ca_audit_signing.crt
          docker exec pki openssl x509 -text -noout -in ca_audit_signing.crt | tee output

          # signing algorithm should be "ecdsa-with-SHA512"
          echo "ecdsa-with-SHA512" > expected
          sed -n -e "s/\s*$//" -e "s/^\s*Signature Algorithm:\s*\(.*\)$/\1/p" output | uniq > actual
          diff expected actual

          # default signing algorithm should be "SHA384withEC"
          echo "SHA384withEC" > expected
          docker exec pki pki-server ca-config-show ca.audit_signing.defaultSigningAlgorithm | tee actual
          diff expected actual

      - name: Check subsystem cert
        run: |
          # inspect cert with certutil
          docker exec pki certutil -L -d /var/lib/pki/pki-tomcat/conf/alias -f ${SHARED}/password.txt -n subsystem | tee output

          # signing algorithm should be "X9.62 ECDSA signature with SHA512"
          echo "X9.62 ECDSA signature with SHA512" > expected
          sed -n -e "s/\s*$//" -e "s/^\s*Signature Algorithm:\s*\(.*\)$/\1/p" output | uniq > actual
          diff expected actual

          # inspect cert with openssl
          docker exec pki pki-server cert-export subsystem --cert-file subsystem.crt
          docker exec pki openssl x509 -text -noout -in subsystem.crt | tee output

          # signing algorithm should be "ecdsa-with-SHA512"
          echo "ecdsa-with-SHA512" > expected
          sed -n -e "s/\s*$//" -e "s/^\s*Signature Algorithm:\s*\(.*\)$/\1/p" output | uniq > actual
          diff expected actual

          # default signing algorithm should not exist
          echo "ERROR: No such parameter: ca.subsystem.defaultSigningAlgorithm" > expected
          docker exec pki pki-server ca-config-show ca.subsystem.defaultSigningAlgorithm \
              > >(tee stdout) 2> >(tee stderr >&2) || true
          diff expected stderr

      - name: Check SSL server cert
        run: |
          # inspect cert with certutil
          docker exec pki certutil -L -d /var/lib/pki/pki-tomcat/conf/alias -f ${SHARED}/password.txt -n sslserver | tee output

          # signing algorithm should be "X9.62 ECDSA signature with SHA512"
          echo "X9.62 ECDSA signature with SHA512" > expected
          sed -n -e "s/\s*$//" -e "s/^\s*Signature Algorithm:\s*\(.*\)$/\1/p" output | uniq > actual
          diff expected actual

          # inspect cert with openssl
          docker exec pki pki-server cert-export sslserver --cert-file sslserver.crt
          docker exec pki openssl x509 -text -noout -in sslserver.crt | tee output

          # signing algorithm should be "ecdsa-with-SHA512"
          echo "ecdsa-with-SHA512" > expected
          sed -n -e "s/\s*$//" -e "s/^\s*Signature Algorithm:\s*\(.*\)$/\1/p" output | uniq > actual
          diff expected actual

          # default signing algorithm should not exist
          echo "ERROR: No such parameter: ca.sslserver.defaultSigningAlgorithm" > expected
          docker exec pki pki-server ca-config-show ca.sslserver.defaultSigningAlgorithm \
              > >(tee stdout) 2> >(tee stderr >&2) || true
          diff expected stderr

      - name: Run PKI healthcheck
        run: docker exec pki pki-healthcheck --failures-only

      - name: Check authenticating as CA admin user
        run: |
          docker exec pki pki-server cert-export ca_signing --cert-file ca_signing.crt
          docker exec pki pki client-cert-import ca_signing --ca-cert ca_signing.crt
          docker exec pki pki pkcs12-import \
              --pkcs12 /root/.dogtag/pki-tomcat/ca_admin_cert.p12 \
              --pkcs12-password Secret.123
          docker exec pki pki -n caadmin ca-user-show caadmin

      - name: Check CA admin cert
        run: |
          # inspect cert with certutil
          docker exec pki certutil -L -d /root/.dogtag/nssdb -n caadmin | tee output

          # signing algorithm should be "X9.62 ECDSA signature with SHA512"
          echo "X9.62 ECDSA signature with SHA512" > expected
          sed -n -e "s/\s*$//" -e "s/^\s*Signature Algorithm:\s*\(.*\)$/\1/p" output | uniq > actual
          diff expected actual

          # inspect cert with openssl
          docker exec pki openssl x509 -text -noout -in /root/.dogtag/pki-tomcat/ca_admin.cert | tee output

          # signing algorithm should be "ecdsa-with-SHA512"
          echo "ecdsa-with-SHA512" > expected
          sed -n -e "s/\s*$//" -e "s/^\s*Signature Algorithm:\s*\(.*\)$/\1/p" output | uniq > actual
          diff expected actual

      - name: Check issuing SSL server cert
        run: |
          # issue cert
          docker exec pki /usr/share/pki/tests/ca/bin/sslserver-create.sh

          # inspect cert with certutil
          docker exec pki certutil -L -d /root/.dogtag/nssdb -n sslserver | tee output

          # signing algorithm should be "X9.62 ECDSA signature with SHA512"
          echo "X9.62 ECDSA signature with SHA512" > expected
          sed -n -e "s/\s*$//" -e "s/^\s*Signature Algorithm:\s*\(.*\)$/\1/p" output | uniq > actual
          diff expected actual

          # inspect cert with openssl
          docker exec pki openssl x509 -text -noout -in sslserver.crt | tee output

          # signing algorithm should be "ecdsa-with-SHA512"
          echo "ecdsa-with-SHA512" > expected
          sed -n -e "s/\s*$//" -e "s/^\s*Signature Algorithm:\s*\(.*\)$/\1/p" output | uniq > actual
          diff expected actual

      - name: Remove CA
        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v

      - name: Check DS server systemd journal
        if: always()
        run: |
          docker exec ds journalctl -x --no-pager -u dirsrv@localhost.service

      - name: Check DS container logs
        if: always()
        run: |
          docker logs ds

      - name: Check PKI server systemd journal
        if: always()
        run: |
          docker exec pki journalctl -x --no-pager -u pki-tomcatd@pki-tomcat.service

      - name: Check CA debug log
        if: always()
        run: |
          docker exec pki find /var/lib/pki/pki-tomcat/logs/ca -name "debug.*" -exec cat {} \;

      - name: Gather artifacts
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh ds
          tests/bin/pki-artifacts-save.sh pki
        continue-on-error: true

      - name: Upload artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: ca-ecc
          path: /tmp/artifacts