mirror of
https://github.com/drwetter/testssl.sh.git
synced 2026-10-25 10:35:12 +01:00
Dirk Wetter
0779e0a423
t/05_ca_hashes_up_to_date.t was relying on time stamps but those do
not work in GHA. This PR now uses git diff which is reliable.
Also it check the wording of the generator utils/create_ca_hashes.sh
also it cleans up the generated crtl files which can cause a problem
when ones run it locally.
The test t/05_ca_hashes_up_to_date.t compared the regenerated etc/ca_hashes.txt
byte-for-byte against the committed file, but two aspects are not stable across
platforms:
- The name column comes from 'openssl x509 -subject', which formats
differently between LibreSSL (macOS) and OpenSSL (Linux).
- The line order comes from 'sort', whose collation differs between
BSD libc and glibc even under an identically-named locale.
Only the SPKI hash (field 1) is deterministic, and it is the sole
column testssl.sh consumes. So:
- The test now compares the set of SPKI hashes (field 1) between the
committed and regenerated files, order-independently, using
'LC_ALL=C sort -u' for a stable, platform-independent collation.
- create_ca_hashes.sh pins the name format ('-nameopt compat') and
sort collation ('LC_ALL=C') so the generated file is stable.
Verified on macOS (LibreSSL) and Ubuntu 24.04 (OpenSSL).
Naming scheme
- 00-05: Does the bare testssl.sh work at all?
- 10-29: Do scans work fine (client side)?
- 30-39: Does reporting work?
- 50-69: Are the results what I expect (server side)?
Please help to write CI tests! Documentation can be found here.
You can consult the existing code here. Feel free to use 10_baseline_ipv4_http.t or 12_diff_opensslversions.t as a
template. The latter is newer and code is cleaner.