t/05_ca_hashes_up_to_date.t was relying on time stamps but those do
not work in GHA. This PR now uses git diff which is reliable.
Also it check the wording of the generator utils/create_ca_hashes.sh
also it cleans up the generated crtl files which can cause a problem
when ones run it locally.
The test t/05_ca_hashes_up_to_date.t compared the regenerated etc/ca_hashes.txt
byte-for-byte against the committed file, but two aspects are not stable across
platforms:
- The name column comes from 'openssl x509 -subject', which formats
differently between LibreSSL (macOS) and OpenSSL (Linux).
- The line order comes from 'sort', whose collation differs between
BSD libc and glibc even under an identically-named locale.
Only the SPKI hash (field 1) is deterministic, and it is the sole
column testssl.sh consumes. So:
- The test now compares the set of SPKI hashes (field 1) between the
committed and regenerated files, order-independently, using
'LC_ALL=C sort -u' for a stable, platform-independent collation.
- create_ca_hashes.sh pins the name format ('-nameopt compat') and
sort collation ('LC_ALL=C') so the generated file is stable.
Verified on macOS (LibreSSL) and Ubuntu 24.04 (OpenSSL).
Starting with a few simple patterns, like for checking for non-variables at left hand side like [[ LHS == $value ]]. The file is supposed be amended in the future.
This fixes#3074 for 3.2
... to avoid repeated failures because of heise.de . Looks like there are
server side measures which made some tests fail. Often the MacOS CI runner
is slower and seems to run into that.
See also 56c1e585
... so that we have a comparison between OpenSSL and LibreSSL. Otherwise this test would be completely futile for MacOS.
Also change the displayed text.
This fixes a problem which was introduced @ 8d8f83ace5.
It caused for some hosts not to parse / display the issuer CN correctly.
Also it adds some code in testssl.sh and in a unit test to detect
this earlier. In general an output string FIXME will now cause a
unit test to fail. This can + should be used at other places too!
Fixes#2789
As suggested in #2780 this PR redirects all stderr on a perl level
to stdout so that we should see all errors which we miss because
we can't redirect (>/dev/null in check) or we haven't redirected yet.
Also old checks are imporved, so that $prg is used as in newer
checks.
Not sure why this has been triggered though.
# Failed test 'Check whether CSV output matches baseline file from testssl.sh'
# at t/61_diff_testsslsh.t line 57.
#
# %s
# @@ -1,5 +1,4 @@
# "id","fqdn/ip","port","severity","finding","cve","cwe"
# -"engine_problem","/","443","WARN","No engine or GOST support via engine with your ./bin/openssl.Linux.x86_64","",""
# "service","testssl.sh/81.169.166.184","443","INFO","HTTP","",""
# "pre_128cipher","testssl.sh/81.169.166.184","443","INFO","No 128 cipher limit bug","",""
# "SSLv2","testssl.sh/81.169.166.184","443","OK","not offered","",""
# Looks like you failed 1 test of 1.
t/61_diff_testsslsh.t ..............
Dirk Wetter