Generate client certs dynamically #1725
Conversation
test/conftest.py
Outdated
|
|
||
|
|
||
| @pytest.fixture(scope="session") | ||
| def generated_certs(tmp_path_factory): |
There was a problem hiding this comment.
Hate to be nit-picky about names but can we call this certs_dir or something shorter? :)
There was a problem hiding this comment.
Don't worry, I love nitpicks! You're right, certs_dir would be better.
| # OpenSSL looks up certificates by the hash for their name, see c_rehash | ||
| # TODO infer the bytes using `cryptography.x509.Name.public_bytes`. | ||
| # https://github.com/pyca/cryptography/pull/3236 | ||
| shutil.copyfile(DEFAULT_CA, str(tmpdir / "b6b9ccf9.0")) |
There was a problem hiding this comment.
This will be changed once we move to generating server certs as well?
There was a problem hiding this comment.
Yes, it will change. I'm not sure yet how that will look. Ideally I'll be able to get the hash programmatically, maybe via trustme. It's also possible that it will stay static because it depends only on the name which could stay static. Not sure, really. I've spend quite some time trying to figure this out but don't have a satisfying answer here yet. :(
Codecov Report
@@ Coverage Diff @@
## master #1725 +/- ##
=======================================
Coverage 99.65% 99.65%
=======================================
Files 22 22
Lines 2006 2006
=======================================
Hits 1999 1999
Misses 7 7Continue to review full report at Codecov.
|
This was not possibly until now because of functool.wraps for older Pythons.
Instead of storing it in git.
In order to support older Python versions.
We keep the existing client_intermediate.pem because it's used in the password tests. And we still rely on the existing root CA to generate the client certificate because it's still used for the server certificate. Since the CA uses a 1024-bit key, those client_intermediate tests still don't work on macOS 10.15, but this commit still is a step forward.
Opening this pull request to get a review of the last commit: pquentin@22da6fd
I'll rebase it if/when the other pull requests get merged.