mirror of
https://github.com/hanzoai/deploy.git
synced 2026-10-07 08:44:50 +00:00
zeekayandHanzo Dev
1ab6e799c1
go.mod still declared `module github.com/hanzoai/deploy` after the repo was renamed. A Go module path is not cosmetic — it is the resolvable location. So `go get github.com/hanzoai/cd` could not work, and anything importing this module had to spell a name that no longer exists at that address. The build log of v3.6.0 is where it surfaced: the compiler was still emitting github.com/hanzoai/deploy/cmd/cd/commands. 3541 import paths across 690 .go, 19 .proto, 4 .yaml, 3 .sh, 2 .mod, Procfile and Makefile. Plus the 62 ghcr.io/hanzoai/deploy image references, moved to ghcr.io/hanzoai/cd to match hanzo.yml's build target — a distinct string from the module path, replaced separately so neither could clobber the other. go mod tidy clean, CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build ./... clean. Co-authored-by: Hanzo Dev <[email protected]>
100 lines
3.7 KiB
Go
100 lines
3.7 KiB
Go
package commands
|
|
|
|
import (
|
|
ctls "crypto/tls"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
|
|
utilstls "github.com/hanzoai/cd/util/tls"
|
|
)
|
|
|
|
func TestNewCommand_DisableTLSFlag(t *testing.T) {
|
|
cmd := NewCommand()
|
|
|
|
flag := cmd.Flags().Lookup("disable-tls")
|
|
require.NotNil(t, flag)
|
|
assert.Equal(t, "false", flag.DefValue)
|
|
|
|
require.NoError(t, cmd.Flags().Set("disable-tls", "true"))
|
|
value, err := cmd.Flags().GetBool("disable-tls")
|
|
require.NoError(t, err)
|
|
assert.True(t, value)
|
|
}
|
|
|
|
func TestNewCommand_DisableTLSAndClientCAPathAreMutuallyExclusive(t *testing.T) {
|
|
t.Setenv("CD_EXEC_TIMEOUT", "1ms")
|
|
|
|
cmd := NewCommand()
|
|
cmd.SetArgs([]string{"--disable-tls", "--client-ca-path", "/tmp/client-ca.crt"})
|
|
|
|
err := cmd.Execute()
|
|
require.Error(t, err)
|
|
assert.Contains(t, err.Error(), "--client-ca-path cannot be used when --disable-tls is enabled")
|
|
}
|
|
|
|
func TestBuildHealthCheckTLSConfig_NilCert(t *testing.T) {
|
|
cfg := buildHealthCheckTLSConfig(nil, false)
|
|
|
|
assert.False(t, cfg.StrictValidation, "strict validation must be off: the probe verifies itself over localhost")
|
|
assert.Empty(t, cfg.ClientCertificates, "no client cert must be present when mTLS is not active")
|
|
assert.Nil(t, cfg.Certificates, "no CA pool must be set: server-cert verification is skipped for localhost probes")
|
|
assert.False(t, cfg.DisableTLS, "TLS itself must not be disabled: it is still a TLS connection")
|
|
}
|
|
|
|
func TestBuildHealthCheckTLSConfig_WithCert(t *testing.T) {
|
|
hcCert, err := utilstls.GenerateHealthCheckClientCert()
|
|
require.NoError(t, err)
|
|
require.NotNil(t, hcCert)
|
|
|
|
cfg := buildHealthCheckTLSConfig(hcCert, false)
|
|
|
|
assert.False(t, cfg.StrictValidation, "server-cert verification is always skipped for localhost self-connections")
|
|
require.Len(t, cfg.ClientCertificates, 1, "the ephemeral health-check cert must appear as the client identity")
|
|
assert.Equal(t, hcCert.Certificate[0], cfg.ClientCertificates[0].Certificate[0], "the propagated cert bytes must match the ephemeral cert exactly")
|
|
assert.Nil(t, cfg.Certificates, "no CA pool must be set: server-cert verification is skipped")
|
|
}
|
|
|
|
func TestBuildHealthCheckTLSConfig_IsIdempotent(t *testing.T) {
|
|
hcCert, err := utilstls.GenerateHealthCheckClientCert()
|
|
require.NoError(t, err)
|
|
|
|
cfg1 := buildHealthCheckTLSConfig(hcCert, false)
|
|
cfg2 := buildHealthCheckTLSConfig(hcCert, false)
|
|
|
|
assert.Equal(t, cfg1.StrictValidation, cfg2.StrictValidation)
|
|
assert.Equal(t, cfg1.DisableTLS, cfg2.DisableTLS)
|
|
require.Len(t, cfg1.ClientCertificates, 1)
|
|
require.Len(t, cfg2.ClientCertificates, 1)
|
|
assert.Equal(t, cfg1.ClientCertificates[0].Certificate[0], cfg2.ClientCertificates[0].Certificate[0],
|
|
"repeated calls must return equivalent configs with no shared mutable state")
|
|
}
|
|
|
|
func TestBuildHealthCheckTLSConfig_MutatingReturnedCertDoesNotAffectSource(t *testing.T) {
|
|
hcCert, err := utilstls.GenerateHealthCheckClientCert()
|
|
require.NoError(t, err)
|
|
|
|
originalDER := make([]byte, len(hcCert.Certificate[0]))
|
|
copy(originalDER, hcCert.Certificate[0])
|
|
|
|
cfg := buildHealthCheckTLSConfig(hcCert, false)
|
|
require.Len(t, cfg.ClientCertificates, 1)
|
|
|
|
cfg.ClientCertificates[0] = ctls.Certificate{}
|
|
|
|
assert.Equal(t, originalDER, hcCert.Certificate[0], "mutating the returned config must not affect the source certificate")
|
|
}
|
|
|
|
// TestNewCommand_OTLPHeadersFlagUsesEnv proves the otlp-headers flag default is wired to the
|
|
// canonical CD_REPO_SERVER_OTLP_HEADERS environment variable.
|
|
func TestNewCommand_OTLPHeadersFlagUsesEnv(t *testing.T) {
|
|
t.Setenv("CD_REPO_SERVER_OTLP_HEADERS", "traceparent=abc123")
|
|
|
|
cmd := NewCommand()
|
|
|
|
got, err := cmd.Flags().GetStringToString("otlp-headers")
|
|
require.NoError(t, err)
|
|
assert.Equal(t, map[string]string{"traceparent": "abc123"}, got)
|
|
}
|