From 4801f673dae46c1683cb97ca81429604fb25ad18 Mon Sep 17 00:00:00 2001 From: Andre Dietisheim Date: Wed, 12 Aug 2026 07:01:56 +0200 Subject: [PATCH] test: extract PEM fixtures to resources and allowlist for gitleaks (crw-12394) Move PEM certificates and private keys from inline Kotlin test strings into src/test/resources/tls/ and load them through TlsTestCertificates (readTlsResource, singleLine). Add .gitleaks.toml allowlist for that directory so secret scanners skip known test fixtures. Signed-off-by: Andre Dietisheim Co-authored-by: Cursor --- .gitleaks.toml | 4 ++ .../devtools/gateway/auth/tls/PemUtils.kt | 10 ++-- .../gateway/auth/tls/CertificateSourceTest.kt | 24 +--------- .../devtools/gateway/auth/tls/PemUtilsTest.kt | 47 ++++--------------- .../tls/TlsConnectionProbeTestFixtures.kt | 12 ++--- .../gateway/auth/tls/TlsTestCertificates.kt | 40 ++++++---------- .../kubeconfig/BlockStyleFilePersisterTest.kt | 2 - .../kubeconfig/KubeConfigNamedUserTest.kt | 2 - .../gateway/kubeconfig/KubeConfigUtilsTest.kt | 3 +- .../gateway/openshift/ApiClientUtilsTest.kt | 29 ++---------- .../devtools/gateway/openshift/ClusterTest.kt | 6 +-- .../openshift/OpenShiftClientBuilderTest.kt | 35 ++------------ src/test/resources/tls/ca-cert.pem | 22 +++++++++ src/test/resources/tls/client-key.pem | 28 +++++++++++ src/test/resources/tls/ec-cert.pem | 14 ++++++ src/test/resources/tls/normalization-cert.pem | 16 +++++++ 16 files changed, 129 insertions(+), 165 deletions(-) create mode 100644 .gitleaks.toml create mode 100644 src/test/resources/tls/ca-cert.pem create mode 100644 src/test/resources/tls/client-key.pem create mode 100644 src/test/resources/tls/ec-cert.pem create mode 100644 src/test/resources/tls/normalization-cert.pem diff --git a/.gitleaks.toml b/.gitleaks.toml new file mode 100644 index 00000000..126083fa --- /dev/null +++ b/.gitleaks.toml @@ -0,0 +1,4 @@ +[allowlist] +paths = [ + 'src/test/resources/tls/.*', +] diff --git a/src/main/kotlin/com/redhat/devtools/gateway/auth/tls/PemUtils.kt b/src/main/kotlin/com/redhat/devtools/gateway/auth/tls/PemUtils.kt index f28ef3f2..b9cc849c 100644 --- a/src/main/kotlin/com/redhat/devtools/gateway/auth/tls/PemUtils.kt +++ b/src/main/kotlin/com/redhat/devtools/gateway/auth/tls/PemUtils.kt @@ -46,8 +46,7 @@ object PemUtils { .encodeToString(certificate.encoded) return buildString { - // notsecret - append("-----BEGIN CERTIFICATE-----\n") + append("-----BEGIN CERTIFICATE-----\n") // notsecret append(base64) append("\n-----END CERTIFICATE-----\n") } @@ -69,13 +68,12 @@ object PemUtils { // JBTextField can strip or mangle newlines from pasted PEM → reformat if needed val reformatted = clean(normalized) - // notsecret val cleaned = reformatted - .replace("-----BEGIN PRIVATE KEY-----", "") + .replace("-----BEGIN PRIVATE KEY-----", "") // notsecret .replace("-----END PRIVATE KEY-----", "") - .replace("-----BEGIN RSA PRIVATE KEY-----", "") + .replace("-----BEGIN RSA PRIVATE KEY-----", "") // notsecret .replace("-----END RSA PRIVATE KEY-----", "") - .replace("-----BEGIN EC PRIVATE KEY-----", "") + .replace("-----BEGIN EC PRIVATE KEY-----", "") // notsecret .replace("-----END EC PRIVATE KEY-----", "") .replace("\\s".toRegex(), "") diff --git a/src/test/kotlin/com/redhat/devtools/gateway/auth/tls/CertificateSourceTest.kt b/src/test/kotlin/com/redhat/devtools/gateway/auth/tls/CertificateSourceTest.kt index abacc5a7..ff53079a 100644 --- a/src/test/kotlin/com/redhat/devtools/gateway/auth/tls/CertificateSourceTest.kt +++ b/src/test/kotlin/com/redhat/devtools/gateway/auth/tls/CertificateSourceTest.kt @@ -214,9 +214,7 @@ class CertificateSourceTest { @Test fun `#fromUserInput normalizes and base64-encodes single-line PEM`() { // given — self-signed fixture for this suite only (openssl req … *.invalid), not from any cluster - val singleLinePem = - // notsecret - "-----BEGIN CERTIFICATE-----MIICmDCCAgGgAwIBAgIUV5nqmQtJt7MtAFJDk8/mI/LvDgIwDQYJKoZIhvcNAQELBQAwXjEwMC4GA1UEAwwnZmFrZS1ub3JtYWxpemF0aW9uLXRlc3QuZXhhbXBsZS5pbnZhbGlkMR0wGwYDVQQKDBRFeGFtcGxlIFRlc3QgRml4dHVyZTELMAkGA1UEBhMCWFgwHhcNMjYwNTEzMTMyMDE0WhcNMzYwNTEwMTMyMDE0WjBeMTAwLgYDVQQDDCdmYWtlLW5vcm1hbGl6YXRpb24tdGVzdC5leGFtcGxlLmludmFsaWQxHTAbBgNVBAoMFEV4YW1wbGUgVGVzdCBGaXh0dXJlMQswCQYDVQQGEwJYWDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAziSew4ot/f/avtFRNfMG9YlviyDbGf1UqViaGI2G4r7gUGSF1a//hNe8+mNMdDfyg/s1VelBR0ajAUU+R45N6DRJFAdy8dYaHVxzrxKe7apk2PIqXBo7CI59I2D2KMkEWrYtSDtyXhg8GNb753/Tkw+6ifXp/5Px5GLkU93AlzUCAwEAAaNTMFEwHQYDVR0OBBYEFG3l/ZZpH4IpTASMXlFoaQbQdOlIMB8GA1UdIwQYMBaAFG3l/ZZpH4IpTASMXlFoaQbQdOlIMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADgYEAvEWA5kcQYgD+U2lwKueYgL/habm8KcUb+e+DK0b4y0WcuoTCqH+2XWaxh5JdG6BLIC+EdFYn9SNm6lo1nv2pOppoyvE5w/xcoPB0rrXr8Eu5PGqKDOWF7YdPcEkjGqL+/TUGiGQmCY0zpTia8+MBDlZLwI9im0W4TJAL2/Lhryg=-----END CERTIFICATE-----" + val singleLinePem = TlsTestCertificates.singleLine(TlsTestCertificates.NORMALIZATION_PEM) // when val source = CertificateSource.fromPathOrPem(singleLinePem)!! @@ -233,25 +231,7 @@ class CertificateSourceTest { @Test fun `#fromUserInput handles properly formatted multi-line PEM`() { // given - proper synthetic PEM with newlines - // notsecret - val multiLinePem = """ - -----BEGIN CERTIFICATE----- - MIICmDCCAgGgAwIBAgIUV5nqmQtJt7MtAFJDk8/mI/LvDgIwDQYJKoZIhvcNAQEL - BQAwXjEwMC4GA1UEAwwnZmFrZS1ub3JtYWxpemF0aW9uLXRlc3QuZXhhbXBsZS5p - bnZhbGlkMR0wGwYDVQQKDBRFeGFtcGxlIFRlc3QgRml4dHVyZTELMAkGA1UEBhMC - WFgwHhcNMjYwNTEzMTMyMDE0WhcNMzYwNTEwMTMyMDE0WjBeMTAwLgYDVQQDDCdm - YWtlLW5vcm1hbGl6YXRpb24tdGVzdC5leGFtcGxlLmludmFsaWQxHTAbBgNVBAoM - FEV4YW1wbGUgVGVzdCBGaXh0dXJlMQswCQYDVQQGEwJYWDCBnzANBgkqhkiG9w0B - AQEFAAOBjQAwgYkCgYEAziSew4ot/f/avtFRNfMG9YlviyDbGf1UqViaGI2G4r7g - UGSF1a//hNe8+mNMdDfyg/s1VelBR0ajAUU+R45N6DRJFAdy8dYaHVxzrxKe7apk - 2PIqXBo7CI59I2D2KMkEWrYtSDtyXhg8GNb753/Tkw+6ifXp/5Px5GLkU93AlzUC - AwEAAaNTMFEwHQYDVR0OBBYEFG3l/ZZpH4IpTASMXlFoaQbQdOlIMB8GA1UdIwQY - MBaAFG3l/ZZpH4IpTASMXlFoaQbQdOlIMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZI - hvcNAQELBQADgYEAvEWA5kcQYgD+U2lwKueYgL/habm8KcUb+e+DK0b4y0WcuoTC - qH+2XWaxh5JdG6BLIC+EdFYn9SNm6lo1nv2pOppoyvE5w/xcoPB0rrXr8Eu5PGqK - DOWF7YdPcEkjGqL+/TUGiGQmCY0zpTia8+MBDlZLwI9im0W4TJAL2/Lhryg= - -----END CERTIFICATE----- - """.trimIndent() + val multiLinePem = TlsTestCertificates.NORMALIZATION_PEM // when val source = CertificateSource.fromPathOrPem(multiLinePem)!! diff --git a/src/test/kotlin/com/redhat/devtools/gateway/auth/tls/PemUtilsTest.kt b/src/test/kotlin/com/redhat/devtools/gateway/auth/tls/PemUtilsTest.kt index f3dc305b..ede510db 100644 --- a/src/test/kotlin/com/redhat/devtools/gateway/auth/tls/PemUtilsTest.kt +++ b/src/test/kotlin/com/redhat/devtools/gateway/auth/tls/PemUtilsTest.kt @@ -63,8 +63,7 @@ class PemUtilsTest { @Test fun `#isPem returns false for base64 content`() { - // notsecret - assertThat(PemUtils.isPem("LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0t")).isFalse() + assertThat(PemUtils.isPem("LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0t")).isFalse() // notsecret } @Test @@ -80,9 +79,7 @@ class PemUtilsTest { @Test fun `#parseCertificate handles single-line PEM from JBTextField paste`() { // given - simulates pasting multi-line PEM into single-line JBTextField (newlines stripped) - val singleLinePem = - // notsecret - "-----BEGIN CERTIFICATE-----MIIDlTCCAn2gAwIBAgIUJ/MyNwdZC5vGYJMyYa5m4letZrYwDQYJKoZIhvcNAQELBQAwWjEnMCUGA1UEAwweZmFrZS11bml0LXRlc3QuZXhhbXBsZS5pbnZhbGlkMSIwIAYDVQQKDBlFeGFtcGxlIFRlc3QgRml4dHVyZSBPbmx5MQswCQYDVQQGEwJYWDAeFw0yNjA1MTMxMzE4MDJaFw0zNjA1MTAxMzE4MDJaMFoxJzAlBgNVBAMMHmZha2UtdW5pdC10ZXN0LmV4YW1wbGUuaW52YWxpZDEiMCAGA1UECgwZRXhhbXBsZSBUZXN0IEZpeHR1cmUgT25seTELMAkGA1UEBhMCWFgwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCG4CRbIkDOtpWzjWVW3V62FKzSfdAhdOJ/avqaPU2FiSjwEcBuVceoT5ilVjNWuDSqWeTrmwPjBfzywpB9OHrziqE5rRBnlyuxTMgxxbpNU8WEBFtn2RWvKen0uZOOLTro1oQsI6ALqKd07s8t9XjIZMEiOzhvKzYK6xQiqXjnYJqWAw3ZjhuvPcuvAALTXJMB6dASZNJ+q7gUd0gIMIjXVzAcj/QPxISwr3JMbpk+GvDnz0kFt7TFQRMqW56dbK36ukjDvLdFd+bbigE6m55vsGVdyZC55wBIB87ycn0zc3hgrfej4JVEqEhhlsifUkjGqNR2h9cdY3u58gzJwZP5AgMBAAGjUzBRMB0GA1UdDgQWBBSn488Oxr0rTEaI1Q3xHhxERrAZ5jAfBgNVHSMEGDAWgBSn488Oxr0rTEaI1Q3xHhxERrAZ5jAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAu0fWReMMgSMM2ctyslZ/b00FDUnDq713HQ+HH3sB28NVxvwKUHR637Z/VzX2HNlR5wuR2ulxKi6m54EBVCuE+T4kwPD/wx32RtGMAyuBlpamLC6WOdmVIVdYr66BRE7KdfTNnK+MJAa0duD5KniqxkdMU7ZxveHM6RRv/hDg0qybOxLSwetmfI9CRiw0qOGiX5PhCqsJVIf1FxRl2mPPO0HiI94AyenmZfatuz9Y8Pb/q7cgdXpX2x29dnqXXO91qbVHk+zIIsYowqsdnMTfqNHFSJGrNovvI63/GQ/8148oKAALaH4VgNOyVIdaKkPDR5I/WBnNmgJHFa/ozYnVi-----END CERTIFICATE-----" + val singleLinePem = TlsTestCertificates.singleLine(TlsTestCertificates.CA_PEM) // when val certificate = PemUtils.parseCertificate(singleLinePem) // then — self-signed RSA fixture generated for this test suite only (openssl req -x509 … *.invalid) @@ -94,31 +91,7 @@ class PemUtilsTest { @Test fun `#parseCertificate handles properly formatted multi-line PEM`() { // given - proper synthetic PEM with newlines - // notsecret - val multiLinePem = """ - -----BEGIN CERTIFICATE----- - MIIDlTCCAn2gAwIBAgIUJ/MyNwdZC5vGYJMyYa5m4letZrYwDQYJKoZIhvcNAQEL - BQAwWjEnMCUGA1UEAwweZmFrZS11bml0LXRlc3QuZXhhbXBsZS5pbnZhbGlkMSIw - IAYDVQQKDBlFeGFtcGxlIFRlc3QgRml4dHVyZSBPbmx5MQswCQYDVQQGEwJYWDAe - Fw0yNjA1MTMxMzE4MDJaFw0zNjA1MTAxMzE4MDJaMFoxJzAlBgNVBAMMHmZha2Ut - dW5pdC10ZXN0LmV4YW1wbGUuaW52YWxpZDEiMCAGA1UECgwZRXhhbXBsZSBUZXN0 - IEZpeHR1cmUgT25seTELMAkGA1UEBhMCWFgwggEiMA0GCSqGSIb3DQEBAQUAA4IB - DwAwggEKAoIBAQCG4CRbIkDOtpWzjWVW3V62FKzSfdAhdOJ/avqaPU2FiSjwEcBu - VceoT5ilVjNWuDSqWeTrmwPjBfzywpB9OHrziqE5rRBnlyuxTMgxxbpNU8WEBFtn - 2RWvKen0uZOOLTro1oQsI6ALqKd07s8t9XjIZMEiOzhvKzYK6xQiqXjnYJqWAw3Z - jhuvPcuvAALTXJMB6dASZNJ+q7gUd0gIMIjXVzAcj/QPxISwr3JMbpk+GvDnz0kF - t7TFQRMqW56dbK36ukjDvLdFd+bbigE6m55vsGVdyZC55wBIB87ycn0zc3hgrfej - 4JVEqEhhlsifUkjGqNR2h9cdY3u58gzJwZP5AgMBAAGjUzBRMB0GA1UdDgQWBBSn - 488Oxr0rTEaI1Q3xHhxERrAZ5jAfBgNVHSMEGDAWgBSn488Oxr0rTEaI1Q3xHhxE - RrAZ5jAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAu0fWReMMg - SMM2ctyslZ/b00FDUnDq713HQ+HH3sB28NVxvwKUHR637Z/VzX2HNlR5wuR2ulxK - i6m54EBVCuE+T4kwPD/wx32RtGMAyuBlpamLC6WOdmVIVdYr66BRE7KdfTNnK+MJ - Aa0duD5KniqxkdMU7ZxveHM6RRv/hDg0qybOxLSwetmfI9CRiw0qOGiX5PhCqsJV - If1FxRl2mPPO0HiI94AyenmZfatuz9Y8Pb/q7cgdXpX2x29dnqXXO91qbVHk+zII - sYowqsdnMTfqNHFSJGrNovvI63/GQ/8148oKAALaH4VgNOyVIdaKkPDR5I/WBnNm - gJHFa/ozYnVi - -----END CERTIFICATE----- - """.trimIndent() + val multiLinePem = TlsTestCertificates.CA_PEM // when val certificate = PemUtils.parseCertificate(multiLinePem) //then @@ -129,9 +102,7 @@ class PemUtilsTest { @Test fun `#parseCertificate handles single-line EC certificate`() { // given - // notsecret - val singleLineEcPem = - "-----BEGIN CERTIFICATE-----MIICDzCCAbWgAwIBAgIUJM+lFwR1WyaM0pOqgloNGsvTLjEwCgYIKoZIzj0EAwIwXTEqMCgGA1UEAwwhZmFrZS1lYy11bml0LXRlc3QuZXhhbXBsZS5pbnZhbGlkMSIwIAYDVQQKDBlFeGFtcGxlIFRlc3QgRml4dHVyZSBPbmx5MQswCQYDVQQGEwJYWDAeFw0yNjA1MTMxMzE5MjdaFw0zNjA1MTAxMzE5MjdaMF0xKjAoBgNVBAMMIWZha2UtZWMtdW5pdC10ZXN0LmV4YW1wbGUuaW52YWxpZDEiMCAGA1UECgwZRXhhbXBsZSBUZXN0IEZpeHR1cmUgT25seTELMAkGA1UEBhMCWFgwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASjD1l8BUS3K/y60I9tUn6njNT378eh6rtqWA9JUM4Rij4iIOnnRRjBuN0L+fF/ojNgakEG6Dc17z6C1t3oJjCSo1MwUTAdBgNVHQ4EFgQUIsiKjviTVSQMf52xWPlEu6+/cU0wHwYDVR0jBBgwFoAUIsiKjviTVSQMf52xWPlEu6+/cU0wDwYDVR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAgNIADBFAiAWbprqeHYk2Ov262fzisXbyLmSlNa9uOMQXCaxmqm6tQIhAIgIr5jIokOT+ThCgant0Jr/XUEryzF7tpvAD/lJkwv9-----END CERTIFICATE-----" + val singleLineEcPem = TlsTestCertificates.singleLine(TlsTestCertificates.EC_PEM) // when val certificate = PemUtils.parseCertificate(singleLineEcPem) // then @@ -144,9 +115,7 @@ class PemUtilsTest { // PKCS#8 PEM is a throwaway RSA key generated only for this test (openssl genrsa / // pkcs8 -nocrypt). It is not paired with any certificate in this file, never belonged to // a cluster or host - // notsecret - val singleLineKey = - "-----BEGIN PRIVATE KEY-----MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCcxRFWa06rNo5xsdpGTLsETLviFAR4wdB0bylr6lHCuNpdW1gM1TyRvVvFyQWbJK+Dk+emSV7ocbUibUaxdhWQ1W1Jv7L/s3H4zzYdWpOF4LZ+W0wHVhav4AZjiU7GbvO15uK2gbfuEZHJ06uLTpKMh5uWRGpEBr0eNDE1Y6au1lpZtJSfgXuJRXHd+kbngjtmjb4XcW/3xCBbcAcpmXSCGgE9uV5uuYVmCwYBrLtHK5MUKz0i1F85XN2DEQwAEHEkg5d9Z0ypxoKHMRGmBkoN2t9SihAU04efHHKWk2GTDFZGY4Ga4w/YmmhoPM54gU7ONRN3LYRfThr0Y5ivJfPTAgMBAAECggEACqQ97GCAXeg9fG5BjirAjybToiG7DqS+t7NMBoKeENpncurea+Xq+fb2odMRdFnl0sgEHio2LQ/QPIlaa8rDj/9M2d1kvdgP0SnlAdJs19ZMd6tO2o33dZzUEjGh4p++ygbli39RXZxdCcGP5Xbsmml3dZh99ibW85PrZd+2fYD9hsO0CTRdlCLB0/Gy/yKW4iujlJyp1HfPFeiw/lKL5GwNSFpMJElwGcQUPVdXPqU+GzPJH1m54jFlYzIZCXuHW4U99+NPFj6foA5PjMS3ZXcEyWZfhuHbDYrqj3aKxRURWaNdGVxML6xSmdXvN/4yo7CkLUr1PN0apKACVS0FYQKBgQDUTP0aTp+ja3TNVtrv4K1v8Me3stlbxR9zeB/zL4QBjSkALBhz8xeYGYm4i1elH3Ch9jn2rHy9E8C7zxwZbW2mYHtV/Micyc6X03yqBuEVzsqlIxSUoUKM4yVTlje5jj6ggo/OJP86wUExbvsxkjocjrRitqk5eAlt6KHr5SxbqQKBgQC9CewRCFBJQpYaHDEpyVHlsgM6qwP4W4VvStScTQ1hXnHE7g0mQhKxiS+WgF6RJkhiJhTvRfSVm0/3PSLa9woEtgiNx+cPscHLFvR0y4RCbjA1QDIGLbQV9/e6ntnlup4nFrCEgA17oQtb/EGXMAIRL2SdsGpd3YEWrSchOxuhGwKBgQDJeyt17Qo6OMAIJJbxswRGyXdxUm5QVtsLZgTEceLQ6hvwSukGGb3ZntsCZlPOpPDq9Nh7z6UueHGgi+U6CI1YqhZDO/1UN342vwKABrlVTgUqBgoBKK4VMXl6Q4UtN98dy+sYlCoZo9DwTkhc+k7mTVTKnlop7U7dnTsWuk+HyQKBgHOAm39wr/WDPMlpTlS00FhjIvv2v+9ApE/yzeNOZQ2IMkVcGia1GkzlgHEZsC5J0NI/aG0mNiIvCnYLIb/eT32/Z4yRhsmdF8aqGOU/8GjSgJwYxDfoNu9xWijppENsefNyNppOz24pYRJsF/tzdt/fMD/1KZh+ncAoPg9c2S3fAoGAWzYz9FFDIXv8yx8e5eGJstq+F2GkOrTliPfjX5PP1NkIJ8vFxGVE6RKzn8FSoE+Xxz5GjcULoE0hno7p2oYqLQpd7pI3LyLTSZhTN0FKDHQQpPtzoo6hSda53i3AaI0VO6mRi3VJaSoWhUkz/4ULR1NuuWpW2oFD2hIEQZqkiDI=-----END PRIVATE KEY-----" + val singleLineKey = TlsTestCertificates.singleLine(TlsTestCertificates.CLIENT_KEY_PEM) // when val privateKey = PemUtils.parsePrivateKey(singleLineKey) // then @@ -157,9 +126,9 @@ class PemUtilsTest { @Test fun `#parseCertificate handles malformed PEM with only header newline`() { // given - // notsecret - val malformedPem = - "-----BEGIN CERTIFICATE-----\nMIIDlTCCAn2gAwIBAgIUJ/MyNwdZC5vGYJMyYa5m4letZrYwDQYJKoZIhvcNAQELBQAwWjEnMCUGA1UEAwweZmFrZS11bml0LXRlc3QuZXhhbXBsZS5pbnZhbGlkMSIwIAYDVQQKDBlFeGFtcGxlIFRlc3QgRml4dHVyZSBPbmx5MQswCQYDVQQGEwJYWDAeFw0yNjA1MTMxMzE4MDJaFw0zNjA1MTAxMzE4MDJaMFoxJzAlBgNVBAMMHmZha2UtdW5pdC10ZXN0LmV4YW1wbGUuaW52YWxpZDEiMCAGA1UECgwZRXhhbXBsZSBUZXN0IEZpeHR1cmUgT25seTELMAkGA1UEBhMCWFgwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCG4CRbIkDOtpWzjWVW3V62FKzSfdAhdOJ/avqaPU2FiSjwEcBuVceoT5ilVjNWuDSqWeTrmwPjBfzywpB9OHrziqE5rRBnlyuxTMgxxbpNU8WEBFtn2RWvKen0uZOOLTro1oQsI6ALqKd07s8t9XjIZMEiOzhvKzYK6xQiqXjnYJqWAw3ZjhuvPcuvAALTXJMB6dASZNJ+q7gUd0gIMIjXVzAcj/QPxISwr3JMbpk+GvDnz0kFt7TFQRMqW56dbK36ukjDvLdFd+bbigE6m55vsGVdyZC55wBIB87ycn0zc3hgrfej4JVEqEhhlsifUkjGqNR2h9cdY3u58gzJwZP5AgMBAAGjUzBRMB0GA1UdDgQWBBSn488Oxr0rTEaI1Q3xHhxERrAZ5jAfBgNVHSMEGDAWgBSn488Oxr0rTEaI1Q3xHhxERrAZ5jAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAu0fWReMMgSMM2ctyslZ/b00FDUnDq713HQ+HH3sB28NVxvwKUHR637Z/VzX2HNlR5wuR2ulxKi6m54EBVCuE+T4kwPD/wx32RtGMAyuBlpamLC6WOdmVIVdYr66BRE7KdfTNnK+MJAa0duD5KniqxkdMU7ZxveHM6RRv/hDg0qybOxLSwetmfI9CRiw0qOGiX5PhCqsJVIf1FxRl2mPPO0HiI94AyenmZfatuz9Y8Pb/q7cgdXpX2x29dnqXXO91qbVHk+zIIsYowqsdnMTfqNHFSJGrNovvI63/GQ/8148oKAALaH4VgNOyVIdaKkPDR5I/WBnNmgJHFa/ozYnVi-----END CERTIFICATE-----" + // header newline only; body and footer on one line + val malformedPem = TlsTestCertificates.singleLine(TlsTestCertificates.CA_PEM) + .replace("-----BEGIN CERTIFICATE-----", "-----BEGIN CERTIFICATE-----\n") // notsecret // when val certificate = PemUtils.parseCertificate(malformedPem) // then diff --git a/src/test/kotlin/com/redhat/devtools/gateway/auth/tls/TlsConnectionProbeTestFixtures.kt b/src/test/kotlin/com/redhat/devtools/gateway/auth/tls/TlsConnectionProbeTestFixtures.kt index 8bec4f0e..f5c6ca98 100644 --- a/src/test/kotlin/com/redhat/devtools/gateway/auth/tls/TlsConnectionProbeTestFixtures.kt +++ b/src/test/kotlin/com/redhat/devtools/gateway/auth/tls/TlsConnectionProbeTestFixtures.kt @@ -57,17 +57,13 @@ object TlsConnectionProbeTestFixtures { private val CHAR_ARRAY_EMPTY = CharArray(0) - val SERVER_KEY_PEM = TlsConnectionProbeTestFixtures::class.java.classLoader - .getResourceAsStream("tls/server-key.pem")!!.readBytes().toString(Charsets.UTF_8) + val SERVER_KEY_PEM = TlsTestCertificates.readTlsResource("server-key.pem") - val SERVER_CERT_PEM = TlsConnectionProbeTestFixtures::class.java.classLoader - .getResourceAsStream("tls/server-cert.pem")!!.readBytes().toString(Charsets.UTF_8) + val SERVER_CERT_PEM = TlsTestCertificates.readTlsResource("server-cert.pem") - val MISMATCH_KEY_PEM = TlsConnectionProbeTestFixtures::class.java.classLoader - .getResourceAsStream("tls/mismatch-key.pem")!!.readBytes().toString(Charsets.UTF_8) + val MISMATCH_KEY_PEM = TlsTestCertificates.readTlsResource("mismatch-key.pem") - val MISMATCH_CERT_PEM = TlsConnectionProbeTestFixtures::class.java.classLoader - .getResourceAsStream("tls/mismatch-cert.pem")!!.readBytes().toString(Charsets.UTF_8) + val MISMATCH_CERT_PEM = TlsTestCertificates.readTlsResource("mismatch-cert.pem") fun createServerSslContext(keyPem: String, certPem: String): SSLContext { val key = PemUtils.parsePrivateKey(keyPem) diff --git a/src/test/kotlin/com/redhat/devtools/gateway/auth/tls/TlsTestCertificates.kt b/src/test/kotlin/com/redhat/devtools/gateway/auth/tls/TlsTestCertificates.kt index 557a43a4..f4659bee 100644 --- a/src/test/kotlin/com/redhat/devtools/gateway/auth/tls/TlsTestCertificates.kt +++ b/src/test/kotlin/com/redhat/devtools/gateway/auth/tls/TlsTestCertificates.kt @@ -15,31 +15,21 @@ import java.security.cert.X509Certificate object TlsTestCertificates { - // notsecret — synthetic self-signed fixture (see PemUtilsTest) - val CA_PEM: String = """ - -----BEGIN CERTIFICATE----- - MIIDlTCCAn2gAwIBAgIUJ/MyNwdZC5vGYJMyYa5m4letZrYwDQYJKoZIhvcNAQEL - BQAwWjEnMCUGA1UEAwweZmFrZS11bml0LXRlc3QuZXhhbXBsZS5pbnZhbGlkMSIw - IAYDVQQKDBlFeGFtcGxlIFRlc3QgRml4dHVyZSBPbmx5MQswCQYDVQQGEwJYWDAe - Fw0yNjA1MTMxMzE4MDJaFw0zNjA1MTAxMzE4MDJaMFoxJzAlBgNVBAMMHmZha2Ut - dW5pdC10ZXN0LmV4YW1wbGUuaW52YWxpZDEiMCAGA1UECgwZRXhhbXBsZSBUZXN0 - IEZpeHR1cmUgT25seTELMAkGA1UEBhMCWFgwggEiMA0GCSqGSIb3DQEBAQUAA4IB - DwAwggEKAoIBAQCG4CRbIkDOtpWzjWVW3V62FKzSfdAhdOJ/avqaPU2FiSjwEcBu - VceoT5ilVjNWuDSqWeTrmwPjBfzywpB9OHrziqE5rRBnlyuxTMgxxbpNU8WEBFtn - 2RWvKen0uZOOLTro1oQsI6ALqKd07s8t9XjIZMEiOzhvKzYK6xQiqXjnYJqWAw3Z - jhuvPcuvAALTXJMB6dASZNJ+q7gUd0gIMIjXVzAcj/QPxISwr3JMbpk+GvDnz0kF - t7TFQRMqW56dbK36ukjDvLdFd+bbigE6m55vsGVdyZC55wBIB87ycn0zc3hgrfej - 4JVEqEhhlsifUkjGqNR2h9cdY3u58gzJwZP5AgMBAAGjUzBRMB0GA1UdDgQWBBSn - 488Oxr0rTEaI1Q3xHhxERrAZ5jAfBgNVHSMEGDAWgBSn488Oxr0rTEaI1Q3xHhxE - RrAZ5jAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAu0fWReMMg - SMM2ctyslZ/b00FDUnDq713HQ+HH3sB28NVxvwKUHR637Z/VzX2HNlR5wuR2ulxK - i6m54EBVCuE+T4kwPD/wx32RtGMAyuBlpamLC6WOdmVIVdYr66BRE7KdfTNnK+MJ - Aa0duD5KniqxkdMU7ZxveHM6RRv/hDg0qybOxLSwetmfI9CRiw0qOGiX5PhCqsJV - If1FxRl2mPPO0HiI94AyenmZfatuz9Y8Pb/q7cgdXpX2x29dnqXXO91qbVHk+zII - sYowqsdnMTfqNHFSJGrNovvI63/GQ/8148oKAALaH4VgNOyVIdaKkPDR5I/WBnNm - gJHFa/ozYnVi - -----END CERTIFICATE----- - """.trimIndent() + // synthetic fixtures loaded from src/test/resources/tls/ + val CA_PEM: String = readTlsResource("ca-cert.pem") + val EC_PEM: String = readTlsResource("ec-cert.pem") + val NORMALIZATION_PEM: String = readTlsResource("normalization-cert.pem") + // PKCS#8 RSA key; not paired with a live cluster + val CLIENT_KEY_PEM: String = readTlsResource("client-key.pem") + + fun readTlsResource(name: String): String = + TlsTestCertificates::class.java.classLoader + .getResourceAsStream("tls/$name") + ?.use { it.readBytes() } + ?.toString(Charsets.UTF_8) + ?: error("Missing TLS test resource: tls/$name") + + fun singleLine(pem: String): String = pem.replace("\n", "").replace("\r", "") fun caCertificate(): X509Certificate = PemUtils.parseCertificate(CA_PEM) diff --git a/src/test/kotlin/com/redhat/devtools/gateway/kubeconfig/BlockStyleFilePersisterTest.kt b/src/test/kotlin/com/redhat/devtools/gateway/kubeconfig/BlockStyleFilePersisterTest.kt index 85c28641..ce12dcc0 100644 --- a/src/test/kotlin/com/redhat/devtools/gateway/kubeconfig/BlockStyleFilePersisterTest.kt +++ b/src/test/kotlin/com/redhat/devtools/gateway/kubeconfig/BlockStyleFilePersisterTest.kt @@ -21,8 +21,6 @@ import java.nio.file.Path class BlockStyleFilePersisterTest { - // notsecret — kubeconfig user token strings embedded in YAML snippets are invented test fixtures only. - @TempDir lateinit var tempDir: Path diff --git a/src/test/kotlin/com/redhat/devtools/gateway/kubeconfig/KubeConfigNamedUserTest.kt b/src/test/kotlin/com/redhat/devtools/gateway/kubeconfig/KubeConfigNamedUserTest.kt index 3e7c6e47..8b544eca 100644 --- a/src/test/kotlin/com/redhat/devtools/gateway/kubeconfig/KubeConfigNamedUserTest.kt +++ b/src/test/kotlin/com/redhat/devtools/gateway/kubeconfig/KubeConfigNamedUserTest.kt @@ -18,8 +18,6 @@ import org.junit.jupiter.api.Test class KubeConfigNamedUserTest { - // notsecret — token and credential-like strings are invented test fixtures only. - @Test fun `#fromMap is parsing named user`() { // given diff --git a/src/test/kotlin/com/redhat/devtools/gateway/kubeconfig/KubeConfigUtilsTest.kt b/src/test/kotlin/com/redhat/devtools/gateway/kubeconfig/KubeConfigUtilsTest.kt index 88ca16c9..ad430774 100644 --- a/src/test/kotlin/com/redhat/devtools/gateway/kubeconfig/KubeConfigUtilsTest.kt +++ b/src/test/kotlin/com/redhat/devtools/gateway/kubeconfig/KubeConfigUtilsTest.kt @@ -26,7 +26,6 @@ import kotlin.io.path.writeText class KubeConfigUtilsTest { - // notsecret — tokens and URLs embedded in kubeconfig YAML snippets below are invented test fixtures only. @TempDir lateinit var tempDir: Path @@ -436,7 +435,7 @@ class KubeConfigUtilsTest { current-context: dagobah-context """.trimIndent() ) - // notsecret + val kubeConfigFile2 = createTempKubeConfigFile( "config2", """ apiVersion: v1 diff --git a/src/test/kotlin/com/redhat/devtools/gateway/openshift/ApiClientUtilsTest.kt b/src/test/kotlin/com/redhat/devtools/gateway/openshift/ApiClientUtilsTest.kt index 3679e380..c7b54960 100644 --- a/src/test/kotlin/com/redhat/devtools/gateway/openshift/ApiClientUtilsTest.kt +++ b/src/test/kotlin/com/redhat/devtools/gateway/openshift/ApiClientUtilsTest.kt @@ -8,6 +8,7 @@ */ package com.redhat.devtools.gateway.openshift +import com.redhat.devtools.gateway.auth.tls.TlsTestCertificates import com.redhat.devtools.gateway.openshift.apiclient.ApiClientUtils import io.kubernetes.client.openapi.ApiClient import org.assertj.core.api.Assertions.assertThat @@ -22,32 +23,8 @@ import java.nio.charset.StandardCharsets */ class ApiClientUtilsTest { - /** Self-signed RSA fixture for this test only (*.invalid); not from any cluster or public CA. */ - // notsecret - private val testCaPem = """ - -----BEGIN CERTIFICATE----- - MIIDlTCCAn2gAwIBAgIUJ/MyNwdZC5vGYJMyYa5m4letZrYwDQYJKoZIhvcNAQEL - BQAwWjEnMCUGA1UEAwweZmFrZS11bml0LXRlc3QuZXhhbXBsZS5pbnZhbGlkMSIw - IAYDVQQKDBlFeGFtcGxlIFRlc3QgRml4dHVyZSBPbmx5MQswCQYDVQQGEwJYWDAe - Fw0yNjA1MTMxMzE4MDJaFw0zNjA1MTAxMzE4MDJaMFoxJzAlBgNVBAMMHmZha2Ut - dW5pdC10ZXN0LmV4YW1wbGUuaW52YWxpZDEiMCAGA1UECgwZRXhhbXBsZSBUZXN0 - IEZpeHR1cmUgT25seTELMAkGA1UEBhMCWFgwggEiMA0GCSqGSIb3DQEBAQUAA4IB - DwAwggEKAoIBAQCG4CRbIkDOtpWzjWVW3V62FKzSfdAhdOJ/avqaPU2FiSjwEcBu - VceoT5ilVjNWuDSqWeTrmwPjBfzywpB9OHrziqE5rRBnlyuxTMgxxbpNU8WEBFtn - 2RWvKen0uZOOLTro1oQsI6ALqKd07s8t9XjIZMEiOzhvKzYK6xQiqXjnYJqWAw3Z - jhuvPcuvAALTXJMB6dASZNJ+q7gUd0gIMIjXVzAcj/QPxISwr3JMbpk+GvDnz0kF - t7TFQRMqW56dbK36ukjDvLdFd+bbigE6m55vsGVdyZC55wBIB87ycn0zc3hgrfej - 4JVEqEhhlsifUkjGqNR2h9cdY3u58gzJwZP5AgMBAAGjUzBRMB0GA1UdDgQWBBSn - 488Oxr0rTEaI1Q3xHhxERrAZ5jAfBgNVHSMEGDAWgBSn488Oxr0rTEaI1Q3xHhxE - RrAZ5jAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAu0fWReMMg - SMM2ctyslZ/b00FDUnDq713HQ+HH3sB28NVxvwKUHR637Z/VzX2HNlR5wuR2ulxK - i6m54EBVCuE+T4kwPD/wx32RtGMAyuBlpamLC6WOdmVIVdYr66BRE7KdfTNnK+MJ - Aa0duD5KniqxkdMU7ZxveHM6RRv/hDg0qybOxLSwetmfI9CRiw0qOGiX5PhCqsJV - If1FxRl2mPPO0HiI94AyenmZfatuz9Y8Pb/q7cgdXpX2x29dnqXXO91qbVHk+zII - sYowqsdnMTfqNHFSJGrNovvI63/GQ/8148oKAALaH4VgNOyVIdaKkPDR5I/WBnNm - gJHFa/ozYnVi - -----END CERTIFICATE----- - """.trimIndent() + /** Self-signed RSA fixture from [TlsTestCertificates]; not from any cluster or public CA. */ + private val testCaPem = TlsTestCertificates.CA_PEM @Test fun `cloneForExec succeeds when sslCaCert stream is already consumed`() { diff --git a/src/test/kotlin/com/redhat/devtools/gateway/openshift/ClusterTest.kt b/src/test/kotlin/com/redhat/devtools/gateway/openshift/ClusterTest.kt index 39857c90..026784eb 100644 --- a/src/test/kotlin/com/redhat/devtools/gateway/openshift/ClusterTest.kt +++ b/src/test/kotlin/com/redhat/devtools/gateway/openshift/ClusterTest.kt @@ -74,9 +74,9 @@ class ClusterTest { fun `#equals returns true for clusters with same properties`() { // given // when - val cluster1 = Cluster(name = "r2d2", url = "https://api.robots.galaxy", token = "droid-token-1") // notsecret - val cluster2 = Cluster(name = "r2d2", url = "https://api.robots.galaxy", token = "droid-token-1") // notsecret - val cluster3 = Cluster(name = "c3po", url = "https://api.robots.galaxy", token = "droid-token-1") // notsecret + val cluster1 = Cluster(name = "r2d2", url = "https://api.robots.galaxy", token = "droid-token-1") + val cluster2 = Cluster(name = "r2d2", url = "https://api.robots.galaxy", token = "droid-token-1") + val cluster3 = Cluster(name = "c3po", url = "https://api.robots.galaxy", token = "droid-token-1") // then assertThat(cluster1).isEqualTo(cluster2) diff --git a/src/test/kotlin/com/redhat/devtools/gateway/openshift/OpenShiftClientBuilderTest.kt b/src/test/kotlin/com/redhat/devtools/gateway/openshift/OpenShiftClientBuilderTest.kt index 85147824..5c94badc 100644 --- a/src/test/kotlin/com/redhat/devtools/gateway/openshift/OpenShiftClientBuilderTest.kt +++ b/src/test/kotlin/com/redhat/devtools/gateway/openshift/OpenShiftClientBuilderTest.kt @@ -9,6 +9,7 @@ package com.redhat.devtools.gateway.openshift import com.redhat.devtools.gateway.auth.tls.CertificateSource +import com.redhat.devtools.gateway.auth.tls.TlsTestCertificates import com.redhat.devtools.gateway.openshift.apiclient.ClientCertClientBuilder import com.redhat.devtools.gateway.openshift.apiclient.LinkClientBuilder import com.redhat.devtools.gateway.openshift.apiclient.TokenClientBuilder @@ -31,36 +32,10 @@ class OpenShiftClientBuilderTest { private val tlsContext = SslContextFactory.insecure() - /** Self-signed RSA fixture for this suite only (*.invalid); not from any cluster or public CA. */ - // notsecret - private val testClientCertPem = """ - -----BEGIN CERTIFICATE----- - MIIDlTCCAn2gAwIBAgIUJ/MyNwdZC5vGYJMyYa5m4letZrYwDQYJKoZIhvcNAQEL - BQAwWjEnMCUGA1UEAwweZmFrZS11bml0LXRlc3QuZXhhbXBsZS5pbnZhbGlkMSIw - IAYDVQQKDBlFeGFtcGxlIFRlc3QgRml4dHVyZSBPbmx5MQswCQYDVQQGEwJYWDAe - Fw0yNjA1MTMxMzE4MDJaFw0zNjA1MTAxMzE4MDJaMFoxJzAlBgNVBAMMHmZha2Ut - dW5pdC10ZXN0LmV4YW1wbGUuaW52YWxpZDEiMCAGA1UECgwZRXhhbXBsZSBUZXN0 - IEZpeHR1cmUgT25seTELMAkGA1UEBhMCWFgwggEiMA0GCSqGSIb3DQEBAQUAA4IB - DwAwggEKAoIBAQCG4CRbIkDOtpWzjWVW3V62FKzSfdAhdOJ/avqaPU2FiSjwEcBu - VceoT5ilVjNWuDSqWeTrmwPjBfzywpB9OHrziqE5rRBnlyuxTMgxxbpNU8WEBFtn - 2RWvKen0uZOOLTro1oQsI6ALqKd07s8t9XjIZMEiOzhvKzYK6xQiqXjnYJqWAw3Z - jhuvPcuvAALTXJMB6dASZNJ+q7gUd0gIMIjXVzAcj/QPxISwr3JMbpk+GvDnz0kF - t7TFQRMqW56dbK36ukjDvLdFd+bbigE6m55vsGVdyZC55wBIB87ycn0zc3hgrfej - 4JVEqEhhlsifUkjGqNR2h9cdY3u58gzJwZP5AgMBAAGjUzBRMB0GA1UdDgQWBBSn - 488Oxr0rTEaI1Q3xHhxERrAZ5jAfBgNVHSMEGDAWgBSn488Oxr0rTEaI1Q3xHhxE - RrAZ5jAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAu0fWReMMg - SMM2ctyslZ/b00FDUnDq713HQ+HH3sB28NVxvwKUHR637Z/VzX2HNlR5wuR2ulxK - i6m54EBVCuE+T4kwPD/wx32RtGMAyuBlpamLC6WOdmVIVdYr66BRE7KdfTNnK+MJ - Aa0duD5KniqxkdMU7ZxveHM6RRv/hDg0qybOxLSwetmfI9CRiw0qOGiX5PhCqsJV - If1FxRl2mPPO0HiI94AyenmZfatuz9Y8Pb/q7cgdXpX2x29dnqXXO91qbVHk+zII - sYowqsdnMTfqNHFSJGrNovvI63/GQ/8148oKAALaH4VgNOyVIdaKkPDR5I/WBnNm - gJHFa/ozYnVi - -----END CERTIFICATE----- - """.trimIndent() - - // notsecret — PKCS#8 RSA key generated only for this test suite; not paired with a live cluster - private val testClientKeyPem = - "-----BEGIN PRIVATE KEY-----MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCcxRFWa06rNo5xsdpGTLsETLviFAR4wdB0bylr6lHCuNpdW1gM1TyRvVvFyQWbJK+Dk+emSV7ocbUibUaxdhWQ1W1Jv7L/s3H4zzYdWpOF4LZ+W0wHVhav4AZjiU7GbvO15uK2gbfuEZHJ06uLTpKMh5uWRGpEBr0eNDE1Y6au1lpZtJSfgXuJRXHd+kbngjtmjb4XcW/3xCBbcAcpmXSCGgE9uV5uuYVmCwYBrLtHK5MUKz0i1F85XN2DEQwAEHEkg5d9Z0ypxoKHMRGmBkoN2t9SihAU04efHHKWk2GTDFZGY4Ga4w/YmmhoPM54gU7ONRN3LYRfThr0Y5ivJfPTAgMBAAECggEACqQ97GCAXeg9fG5BjirAjybToiG7DqS+t7NMBoKeENpncurea+Xq+fb2odMRdFnl0sgEHio2LQ/QPIlaa8rDj/9M2d1kvdgP0SnlAdJs19ZMd6tO2o33dZzUEjGh4p++ygbli39RXZxdCcGP5Xbsmml3dZh99ibW85PrZd+2fYD9hsO0CTRdlCLB0/Gy/yKW4iujlJyp1HfPFeiw/lKL5GwNSFpMJElwGcQUPVdXPqU+GzPJH1m54jFlYzIZCXuHW4U99+NPFj6foA5PjMS3ZXcEyWZfhuHbDYrqj3aKxRURWaNdGVxML6xSmdXvN/4yo7CkLUr1PN0apKACVS0FYQKBgQDUTP0aTp+ja3TNVtrv4K1v8Me3stlbxR9zeB/zL4QBjSkALBhz8xeYGYm4i1elH3Ch9jn2rHy9E8C7zxwZbW2mYHtV/Micyc6X03yqBuEVzsqlIxSUoUKM4yVTlje5jj6ggo/OJP86wUExbvsxkjocjrRitqk5eAlt6KHr5SxbqQKBgQC9CewRCFBJQpYaHDEpyVHlsgM6qwP4W4VvStScTQ1hXnHE7g0mQhKxiS+WgF6RJkhiJhTvRfSVm0/3PSLa9woEtgiNx+cPscHLFvR0y4RCbjA1QDIGLbQV9/e6ntnlup4nFrCEgA17oQtb/EGXMAIRL2SdsGpd3YEWrSchOxuhGwKBgQDJeyt17Qo6OMAIJJbxswRGyXdxUm5QVtsLZgTEceLQ6hvwSukGGb3ZntsCZlPOpPDq9Nh7z6UueHGgi+U6CI1YqhZDO/1UN342vwKABrlVTgUqBgoBKK4VMXl6Q4UtN98dy+sYlCoZo9DwTkhc+k7mTVTKnlop7U7dnTsWuk+HyQKBgHOAm39wr/WDPMlpTlS00FhjIvv2v+9ApE/yzeNOZQ2IMkVcGia1GkzlgHEZsC5J0NI/aG0mNiIvCnYLIb/eT32/Z4yRhsmdF8aqGOU/8GjSgJwYxDfoNu9xWijppENsefNyNppOz24pYRJsF/tzdt/fMD/1KZh+ncAoPg9c2S3fAoGAWzYz9FFDIXv8yx8e5eGJstq+F2GkOrTliPfjX5PP1NkIJ8vFxGVE6RKzn8FSoE+Xxz5GjcULoE0hno7p2oYqLQpd7pI3LyLTSZhTN0FKDHQQpPtzoo6hSda53i3AaI0VO6mRi3VJaSoWhUkz/4ULR1NuuWpW2oFD2hIEQZqkiDI=-----END PRIVATE KEY-----" + /** Self-signed RSA fixture from [TlsTestCertificates]; not from any cluster or public CA. */ + private val testClientCertPem = TlsTestCertificates.CA_PEM + + private val testClientKeyPem = TlsTestCertificates.CLIENT_KEY_PEM @AfterEach fun tearDown() { diff --git a/src/test/resources/tls/ca-cert.pem b/src/test/resources/tls/ca-cert.pem new file mode 100644 index 00000000..fcbd90e8 --- /dev/null +++ b/src/test/resources/tls/ca-cert.pem @@ -0,0 +1,22 @@ +-----BEGIN CERTIFICATE----- +MIIDlTCCAn2gAwIBAgIUJ/MyNwdZC5vGYJMyYa5m4letZrYwDQYJKoZIhvcNAQEL +BQAwWjEnMCUGA1UEAwweZmFrZS11bml0LXRlc3QuZXhhbXBsZS5pbnZhbGlkMSIw +IAYDVQQKDBlFeGFtcGxlIFRlc3QgRml4dHVyZSBPbmx5MQswCQYDVQQGEwJYWDAe +Fw0yNjA1MTMxMzE4MDJaFw0zNjA1MTAxMzE4MDJaMFoxJzAlBgNVBAMMHmZha2Ut +dW5pdC10ZXN0LmV4YW1wbGUuaW52YWxpZDEiMCAGA1UECgwZRXhhbXBsZSBUZXN0 +IEZpeHR1cmUgT25seTELMAkGA1UEBhMCWFgwggEiMA0GCSqGSIb3DQEBAQUAA4IB +DwAwggEKAoIBAQCG4CRbIkDOtpWzjWVW3V62FKzSfdAhdOJ/avqaPU2FiSjwEcBu +VceoT5ilVjNWuDSqWeTrmwPjBfzywpB9OHrziqE5rRBnlyuxTMgxxbpNU8WEBFtn +2RWvKen0uZOOLTro1oQsI6ALqKd07s8t9XjIZMEiOzhvKzYK6xQiqXjnYJqWAw3Z +jhuvPcuvAALTXJMB6dASZNJ+q7gUd0gIMIjXVzAcj/QPxISwr3JMbpk+GvDnz0kF +t7TFQRMqW56dbK36ukjDvLdFd+bbigE6m55vsGVdyZC55wBIB87ycn0zc3hgrfej +4JVEqEhhlsifUkjGqNR2h9cdY3u58gzJwZP5AgMBAAGjUzBRMB0GA1UdDgQWBBSn +488Oxr0rTEaI1Q3xHhxERrAZ5jAfBgNVHSMEGDAWgBSn488Oxr0rTEaI1Q3xHhxE +RrAZ5jAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAu0fWReMMg +SMM2ctyslZ/b00FDUnDq713HQ+HH3sB28NVxvwKUHR637Z/VzX2HNlR5wuR2ulxK +i6m54EBVCuE+T4kwPD/wx32RtGMAyuBlpamLC6WOdmVIVdYr66BRE7KdfTNnK+MJ +Aa0duD5KniqxkdMU7ZxveHM6RRv/hDg0qybOxLSwetmfI9CRiw0qOGiX5PhCqsJV +If1FxRl2mPPO0HiI94AyenmZfatuz9Y8Pb/q7cgdXpX2x29dnqXXO91qbVHk+zII +sYowqsdnMTfqNHFSJGrNovvI63/GQ/8148oKAALaH4VgNOyVIdaKkPDR5I/WBnNm +gJHFa/ozYnVi +-----END CERTIFICATE----- diff --git a/src/test/resources/tls/client-key.pem b/src/test/resources/tls/client-key.pem new file mode 100644 index 00000000..1692084e --- /dev/null +++ b/src/test/resources/tls/client-key.pem @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCcxRFWa06rNo5x +sdpGTLsETLviFAR4wdB0bylr6lHCuNpdW1gM1TyRvVvFyQWbJK+Dk+emSV7ocbUi +bUaxdhWQ1W1Jv7L/s3H4zzYdWpOF4LZ+W0wHVhav4AZjiU7GbvO15uK2gbfuEZHJ +06uLTpKMh5uWRGpEBr0eNDE1Y6au1lpZtJSfgXuJRXHd+kbngjtmjb4XcW/3xCBb +cAcpmXSCGgE9uV5uuYVmCwYBrLtHK5MUKz0i1F85XN2DEQwAEHEkg5d9Z0ypxoKH +MRGmBkoN2t9SihAU04efHHKWk2GTDFZGY4Ga4w/YmmhoPM54gU7ONRN3LYRfThr0 +Y5ivJfPTAgMBAAECggEACqQ97GCAXeg9fG5BjirAjybToiG7DqS+t7NMBoKeENpn +curea+Xq+fb2odMRdFnl0sgEHio2LQ/QPIlaa8rDj/9M2d1kvdgP0SnlAdJs19ZM +d6tO2o33dZzUEjGh4p++ygbli39RXZxdCcGP5Xbsmml3dZh99ibW85PrZd+2fYD9 +hsO0CTRdlCLB0/Gy/yKW4iujlJyp1HfPFeiw/lKL5GwNSFpMJElwGcQUPVdXPqU+ +GzPJH1m54jFlYzIZCXuHW4U99+NPFj6foA5PjMS3ZXcEyWZfhuHbDYrqj3aKxRU +RWaNdGVxML6xSmdXvN/4yo7CkLUr1PN0apKACVS0FYQKBgQDUTP0aTp+ja3TNVtr +v4K1v8Me3stlbxR9zeB/zL4QBjSkALBhz8xeYGYm4i1elH3Ch9jn2rHy9E8C7zx +wZbW2mYHtV/Micyc6X03yqBuEVzsqlIxSUoUKM4yVTlje5jj6ggo/OJP86wUExbv +sxkjocjrRitqk5eAlt6KHr5SxbqQKBgQC9CewRCFBJQpYaHDEpyVHlsgM6qwP4W4 +VvStScTQ1hXnHE7g0mQhKxiS+WgF6RJkhiJhTvRfSVm0/3PSLa9woEtgiNx+cPsc +HLFvR0y4RCbjA1QDIGLbQV9/e6ntnlup4nFrCEgA17oQtb/EGXMAIRL2SdsGpd3Y +EWrSchOxuhGwKBgQDJeyt17Qo6OMAIJJbxswRGyXdxUm5QVtsLZgTEceLQ6hvwSu +kGGb3ZntsCZlPOpPDq9Nh7z6UueHGgi+U6CI1YqhZDO/1UN342vwKABrlVTgUqBg +oBKK4VMXl6Q4UtN98dy+sYlCoZo9DwTkhc+k7mTVTKnlop7U7dnTsWuk+HyQKBgH +OAm39wr/WDPMlpTlS00FhjIvv2v+9ApE/yzeNOZQ2IMkVcGia1GkzlgHEZsC5J0N +I/aG0mNiIvCnYLIb/eT32/Z4yRhsmdF8aqGOU/8GjSgJwYxDfoNu9xWijppENsef +NyNppOz24pYRJsF/tzdt/fMD/1KZh+ncAoPg9c2S3fAoGAWzYz9FFDIXv8yx8e5e +GJstq+F2GkOrTliPfjX5PP1NkIJ8vFxGVE6RKzn8FSoE+Xxz5GjcULoE0hno7p2o +YqLQpd7pI3LyLTSZhTN0FKDHQQpPtzoo6hSda53i3AaI0VO6mRi3VJaSoWhUkz/4 +ULR1NuuWpW2oFD2hIEQZqkiDI= +-----END PRIVATE KEY----- diff --git a/src/test/resources/tls/ec-cert.pem b/src/test/resources/tls/ec-cert.pem new file mode 100644 index 00000000..aee45dea --- /dev/null +++ b/src/test/resources/tls/ec-cert.pem @@ -0,0 +1,14 @@ +-----BEGIN CERTIFICATE----- +MIICDzCCAbWgAwIBAgIUJM+lFwR1WyaM0pOqgloNGsvTLjEwCgYIKoZIzj0EAwIw +XTEqMCgGA1UEAwwhZmFrZS1lYy11bml0LXRlc3QuZXhhbXBsZS5pbnZhbGlkMSIw +IAYDVQQKDBlFeGFtcGxlIFRlc3QgRml4dHVyZSBPbmx5MQswCQYDVQQGEwJYWDAe +Fw0yNjA1MTMxMzE5MjdaFw0zNjA1MTAxMzE5MjdaMF0xKjAoBgNVBAMMIWZha2Ut +ZWMtdW5pdC10ZXN0LmV4YW1wbGUuaW52YWxpZDEiMCAGA1UECgwZRXhhbXBsZSBU +ZXN0IEZpeHR1cmUgT25seTELMAkGA1UEBhMCWFgwWTATBgcqhkjOPQIBBggqhkjO +PQMBBwNCAASjD1l8BUS3K/y60I9tUn6njNT378eh6rtqWA9JUM4Rij4iIOnnRRjB +uN0L+fF/ojNgakEG6Dc17z6C1t3oJjCSo1MwUTAdBgNVHQ4EFgQUIsiKjviTVSQM +f52xWPlEu6+/cU0wHwYDVR0jBBgwFoAUIsiKjviTVSQMf52xWPlEu6+/cU0wDwYD +VR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAgNIADBFAiAWbprqeHYk2Ov262fzisXb +yLmSlNa9uOMQXCaxmqm6tQIhAIgIr5jIokOT+ThCgant0Jr/XUEryzF7tpvAD/lJ +kwv9 +-----END CERTIFICATE----- diff --git a/src/test/resources/tls/normalization-cert.pem b/src/test/resources/tls/normalization-cert.pem new file mode 100644 index 00000000..e07f9b7a --- /dev/null +++ b/src/test/resources/tls/normalization-cert.pem @@ -0,0 +1,16 @@ +-----BEGIN CERTIFICATE----- +MIICmDCCAgGgAwIBAgIUV5nqmQtJt7MtAFJDk8/mI/LvDgIwDQYJKoZIhvcNAQEL +BQAwXjEwMC4GA1UEAwwnZmFrZS1ub3JtYWxpemF0aW9uLXRlc3QuZXhhbXBsZS5p +bnZhbGlkMR0wGwYDVQQKDBRFeGFtcGxlIFRlc3QgRml4dHVyZTELMAkGA1UEBhMC +WFgwHhcNMjYwNTEzMTMyMDE0WhcNMzYwNTEwMTMyMDE0WjBeMTAwLgYDVQQDDCdm +YWtlLW5vcm1hbGl6YXRpb24tdGVzdC5leGFtcGxlLmludmFsaWQxHTAbBgNVBAoM +FEV4YW1wbGUgVGVzdCBGaXh0dXJlMQswCQYDVQQGEwJYWDCBnzANBgkqhkiG9w0B +AQEFAAOBjQAwgYkCgYEAziSew4ot/f/avtFRNfMG9YlviyDbGf1UqViaGI2G4r7g +UGSF1a//hNe8+mNMdDfyg/s1VelBR0ajAUU+R45N6DRJFAdy8dYaHVxzrxKe7apk +2PIqXBo7CI59I2D2KMkEWrYtSDtyXhg8GNb753/Tkw+6ifXp/5Px5GLkU93AlzUC +AwEAAaNTMFEwHQYDVR0OBBYEFG3l/ZZpH4IpTASMXlFoaQbQdOlIMB8GA1UdIwQY +MBaAFG3l/ZZpH4IpTASMXlFoaQbQdOlIMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZI +hvcNAQELBQADgYEAvEWA5kcQYgD+U2lwKueYgL/habm8KcUb+e+DK0b4y0WcuoTC +qH+2XWaxh5JdG6BLIC+EdFYn9SNm6lo1nv2pOppoyvE5w/xcoPB0rrXr8Eu5PGqK +DOWF7YdPcEkjGqL+/TUGiGQmCY0zpTia8+MBDlZLwI9im0W4TJAL2/Lhryg= +-----END CERTIFICATE-----