mirror of
https://github.com/drwetter/testssl.sh.git
synced 2026-10-25 10:35:12 +01:00
Dirk Wetter
06f364f25b
The test compared the regenerated etc/ca_hashes.txt byte-for-byte
against the committed file, but two aspects are not stable across
platforms:
- The name column comes from 'openssl x509 -subject', which formats
differently between LibreSSL (macOS) and OpenSSL (Linux).
- The line order comes from 'sort', whose collation differs between
BSD libc and glibc even under an identically-named locale.
Only the SPKI hash (field 1) is deterministic, and it is the sole
column testssl.sh consumes. So:
- The test now compares the set of SPKI hashes (field 1) between the
committed and regenerated files, order-independently, using
'LC_ALL=C sort -u' for a stable, platform-independent collation.
- create_ca_hashes.sh pins the name format ('-nameopt compat') and
sort collation ('LC_ALL=C') so the generated file is stable.
Verified on macOS (LibreSSL) and Ubuntu 24.04 (OpenSSL).
Naming scheme
- 00-05: Does the bare testssl.sh work at all?
- 10-29: Do scans work fine (client side)?
- 30-39: Does reporting work?
- 50-69: Are the results what I expect (server side)?
Please help to write CI tests! Documentation can be found here.
You can consult the existing code here. Feel free to use 10_baseline_ipv4_http.t or 12_diff_opensslversions.t as a
template. The latter is newer and code is cleaner.
03_debug.t.DISABLEDis a handy tool when the runner is not in line with checks outside github. It provides debugging means- IPv6 was (status 2025) not allowed, thus the file
11_baseline_ipv6_http.t.DISABLEDwhich can be renamed if that will change.