Fix TestConnect on macOS #265
Conversation
|
I was a bit late to chime in with a review before this got merged. Go alters the default ciphersuite to prefer ChaPoly over AES-GCM suites if the underlying hardware doesn't have AES extensions. (https://cs.opensource.google/go/go/+/master:src/crypto/tls/handshake_server_tls13.go;l=158?q=defaultCipherSuitesTLS13NoAES%20&ss=go%2Fgo). So CI/CD systems running under virtualization may not always reflect the underlying CPUs extensions. One good example—and how I ended up debugging this issue—was NixOS CI system for Darwin x86-64 wasn't picking AES. Temporarily I ended up disabling tests on darwin-x86_64. So the lines 110 and 138 for |
* master: (21 commits) Update README.md Unconditionally add forward slash in OCSP GET requests (square#282) Use Go generate instead of a makefile (square#279) Bump github.com/stretchr/testify from 1.7.5 to 1.8.0 Add support for printing SCTs (square#277) Update Go version to 1.18 (square#276) Update to 1.16 (square#275) Fix OCSP checking (square#274) Bump github.com/stretchr/testify from 1.7.2 to 1.7.5 Update go command to install certigo (square#270) Bump github.com/stretchr/testify from 1.7.1 to 1.7.2 Upgrade yaml.v3 version (square#266) Allow any ciphersuite in TestConnect (square#268) Fix TestConnect on macOS (square#265) Bump github.com/stretchr/testify from 1.7.0 to 1.7.1 (square#262) Bump version string to 1.15.1 (square#263) Remove use of the format list in the connect command (square#260) Add --leaf flag to view the first cert only, including for json and pem Set certs explicitly (square#259) Upgrade /x/crypto dependency (square#257) ...
@bdd did an excellent writeup of the issue in #264. To fix this, stop relying on stable error messages between platforms and Go versions by performing a successful
certigo connectin the test rather than a failed one.I generated new ECDSA certificates for
localhostusing https://github.com/square/certstrap.