mirror of
https://github.com/drone-plugins/drone-docker.git
synced 2026-07-16 16:21:18 +08:00
Raghav
d10b5ea8b8
The plugin now reads a HARNESS_CA_PATH environment variable pointing to a PEM CA file and installs it into the host system trust store before starting the Docker daemon. This solves x509 errors when builds run behind TLS-intercepting egress proxies that re-sign upstream TLS with their own CA. - Linux: installs into distro anchor directory (/usr/local/share/ca-certificates or /etc/pki/ca-trust/source/anchors) and refreshes system bundle via update-ca-certificates/update-ca-trust, with direct bundle append fallback - Windows: imports via certutil -addstore Root - macOS: logged no-op (not currently supported) - Best-effort, idempotent, documented in README.md with usage examples - New platform-specific source files: ca_linux.go, ca_windows.go, ca_other.go - Comprehensive tests added: ca_test.go, ca_linux_test.go Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> AI-Session-Id: fe2aa5fe-1bf5-4257-ab76-2c862c5637fe AI-Tool: claude-code AI-Model: unknown
88 lines
2.2 KiB
Go
88 lines
2.2 KiB
Go
package docker
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
)
|
|
|
|
const testCAPEM = `-----BEGIN CERTIFICATE-----
|
|
MIIBAg==
|
|
-----END CERTIFICATE-----
|
|
`
|
|
|
|
// withStubbedInstall replaces the platform installer with a capturing stub for
|
|
// the duration of a test, returning a pointer to the captured CA bytes and a
|
|
// pointer to a call counter.
|
|
func withStubbedInstall(t *testing.T) (captured *[]byte, calls *int) {
|
|
t.Helper()
|
|
captured = new([]byte)
|
|
calls = new(int)
|
|
orig := installHarnessCAFn
|
|
installHarnessCAFn = func(caPEM []byte) {
|
|
*calls++
|
|
*captured = append([]byte(nil), caPEM...)
|
|
}
|
|
t.Cleanup(func() { installHarnessCAFn = orig })
|
|
return captured, calls
|
|
}
|
|
|
|
func TestTrustHarnessCA_Unset(t *testing.T) {
|
|
os.Unsetenv("HARNESS_CA_PATH")
|
|
_, calls := withStubbedInstall(t)
|
|
|
|
trustHarnessCA()
|
|
|
|
if *calls != 0 {
|
|
t.Fatalf("expected installer not to be called when HARNESS_CA_PATH is unset, got %d calls", *calls)
|
|
}
|
|
}
|
|
|
|
func TestTrustHarnessCA_MissingFile(t *testing.T) {
|
|
missing := filepath.Join(t.TempDir(), "does-not-exist.crt")
|
|
os.Setenv("HARNESS_CA_PATH", missing)
|
|
defer os.Unsetenv("HARNESS_CA_PATH")
|
|
_, calls := withStubbedInstall(t)
|
|
|
|
trustHarnessCA()
|
|
|
|
if *calls != 0 {
|
|
t.Fatalf("expected installer not to be called when CA file is missing, got %d calls", *calls)
|
|
}
|
|
}
|
|
|
|
func TestTrustHarnessCA_EmptyFile(t *testing.T) {
|
|
empty := filepath.Join(t.TempDir(), "empty.crt")
|
|
if err := os.WriteFile(empty, []byte(" \n\t"), 0644); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
os.Setenv("HARNESS_CA_PATH", empty)
|
|
defer os.Unsetenv("HARNESS_CA_PATH")
|
|
_, calls := withStubbedInstall(t)
|
|
|
|
trustHarnessCA()
|
|
|
|
if *calls != 0 {
|
|
t.Fatalf("expected installer not to be called for whitespace-only CA, got %d calls", *calls)
|
|
}
|
|
}
|
|
|
|
func TestTrustHarnessCA_ValidFile(t *testing.T) {
|
|
valid := filepath.Join(t.TempDir(), "ca.crt")
|
|
if err := os.WriteFile(valid, []byte(testCAPEM), 0644); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
os.Setenv("HARNESS_CA_PATH", valid)
|
|
defer os.Unsetenv("HARNESS_CA_PATH")
|
|
captured, calls := withStubbedInstall(t)
|
|
|
|
trustHarnessCA()
|
|
|
|
if *calls != 1 {
|
|
t.Fatalf("expected installer to be called once for a valid CA, got %d calls", *calls)
|
|
}
|
|
if string(*captured) != testCAPEM {
|
|
t.Fatalf("installer received %q, want %q", string(*captured), testCAPEM)
|
|
}
|
|
}
|