diff --git a/certbot-ci/certbot_integration_tests/utils/acme_server.py b/certbot-ci/certbot_integration_tests/utils/acme_server.py index f8f4b2c69..718a8fcb1 100755 --- a/certbot-ci/certbot_integration_tests/utils/acme_server.py +++ b/certbot-ci/certbot_integration_tests/utils/acme_server.py @@ -132,16 +132,33 @@ def _prepare_acme_server(workspace, acme_type, acme_xdist): os.rename(join(instance_path, 'test/rate-limit-policies-b.yml'), join(instance_path, 'test/rate-limit-policies.yml')) if acme_type == 'pebble': - # Configure Pebble at full speed (PEBBLE_VA_NOSLEEP=1) and not randomly refusing valid - # nonce (PEBBLE_WFE_NONCEREJECT=0) to have a stable test environment. with open(os.path.join(instance_path, 'docker-compose.yml'), 'r') as file_handler: config = yaml.load(file_handler.read()) + # Configure Pebble at full speed (PEBBLE_VA_NOSLEEP=1) and not randomly refusing valid + # nonce (PEBBLE_WFE_NONCEREJECT=0) to have a stable test environment. config['services']['pebble'].setdefault('environment', [])\ .extend(['PEBBLE_VA_NOSLEEP=1', 'PEBBLE_WFE_NONCEREJECT=0']) + + # Also disable strict mode for now, since Pebble v2.1.0 added specs in + # strict mode for which Certbot is not compliant for now. + # See https://github.com/certbot/certbot/pull/7175 + # TODO: Add back -strict mode once Certbot is compliant with Pebble v2.1.0+ + config['services']['pebble']['command'] = config['services']['pebble']['command']\ + .replace('-strict', '') + with open(os.path.join(instance_path, 'docker-compose.yml'), 'w') as file_handler: file_handler.write(yaml.dump(config)) + with open(os.path.join(instance_path, 'test', 'pebble-config.json'), 'r') as file_handler: + config = yaml.load(file_handler.read()) + + # Setup the OCSP Responder URL for Pebble to local mock + config['ocspResponderURL'] = 'http://127.0.0.1:{0}'.format(MOCK_OCSP_SERVER_PORT) + + with open(os.path.join(instance_path, 'test', 'pebble-config.json'), 'w') as file_handler: + file_handler.write(yaml.dump(config)) + # Launch the ACME CA server. _launch_command(['docker-compose', 'up', '--force-recreate', '-d'], cwd=instance_path) diff --git a/certbot-ci/certbot_integration_tests/utils/constants.py b/certbot-ci/certbot_integration_tests/utils/constants.py index 9266e25ea..53725fdb2 100644 --- a/certbot-ci/certbot_integration_tests/utils/constants.py +++ b/certbot-ci/certbot_integration_tests/utils/constants.py @@ -5,3 +5,4 @@ CHALLTESTSRV_PORT = 8055 BOULDER_V1_DIRECTORY_URL = 'http://localhost:4000/directory' BOULDER_V2_DIRECTORY_URL = 'http://localhost:4001/directory' PEBBLE_DIRECTORY_URL = 'https://localhost:14000/dir' +MOCK_OCSP_SERVER_PORT = 4002 diff --git a/certbot-ci/certbot_integration_tests/utils/misc.py b/certbot-ci/certbot_integration_tests/utils/misc.py index 518b64404..0475ee7dc 100644 --- a/certbot-ci/certbot_integration_tests/utils/misc.py +++ b/certbot-ci/certbot_integration_tests/utils/misc.py @@ -25,6 +25,7 @@ from six.moves import socketserver, SimpleHTTPServer from certbot_integration_tests.utils import ocsp_server +from certbot_integration_tests.utils.constants import MOCK_OCSP_SERVER_PORT try: import urllib3 @@ -306,11 +307,10 @@ def mock_ocsp_server(directory_url, workspace): environ = os.environ.copy() environ['ISSUER_KEY_PATH'] = key_path environ['ISSUER_CERT_PATH'] = cert_path - environ['OCSP_PORT'] = '4002' process = subprocess.Popen([sys.executable, ocsp_server.__file__], env=environ) try: - yield 'http://127.0.0.1:4002' + yield 'http://127.0.0.1:{0}'.format(MOCK_OCSP_SERVER_PORT) finally: process.terminate() process.wait() diff --git a/certbot-ci/certbot_integration_tests/utils/ocsp_server.py b/certbot-ci/certbot_integration_tests/utils/ocsp_server.py index db8ed162e..916a86773 100644 --- a/certbot-ci/certbot_integration_tests/utils/ocsp_server.py +++ b/certbot-ci/certbot_integration_tests/utils/ocsp_server.py @@ -8,6 +8,8 @@ from cryptography import x509 from cryptography.x509 import ocsp from flask import Flask, request +from certbot_integration_tests.utils.constants import MOCK_OCSP_SERVER_PORT + app = Flask(__name__) app.debug = False @@ -69,4 +71,4 @@ def status_certificate(): if __name__ == '__main__': - app.run(host='0.0.0.0', port=int(os.environ.get('OCSP_PORT', 4002))) + app.run(host='0.0.0.0', port=int(os.environ.get('OCSP_PORT', MOCK_OCSP_SERVER_PORT)))