From 21046cd6ffb731c1fa29495477e18bbcdb3fba1c Mon Sep 17 00:00:00 2001 From: ScottW514 Date: Wed, 14 Oct 2026 11:25:28 -0400 Subject: [PATCH] Catalog: setup.cert-page leaves setup.cert-page leaves for forgectrl's tests/host_guard.sh (4d2d109): GET /settings reports a 95-character tls_fingerprint, and over HTTP and over HTTPS, with no token, GET /cert is 200 with no redirect, that fingerprint and the host's name, and GET /cert.pem is a PEM certificate. The catalog test reached the board by its LAN address; the page is what it proved. The catalog goes from 96 to 95. It called no helper of its own. src/tls.* stays on the login, HTTPS, first-run and TLS-record tests, src/ui/wizard.html on image.license-bundle and setup.mirror, and src/ui/wizard.js on forgectrl.auth, exthost.wizard and setup.mirror. No unit test names it. No HOST_TESTED row: the pinned workflow does not run host_guard.sh. test_setup_suite.py passes (31 tests). The coverage lint on the tree manifest finds no uncovered path and no host-tested row problem across the 95 tests; its one finding is setup.check-lens's empty src/lensfind.* entry. pyflakes is clean on setup.py. The full forgetest suite was not run. Fingerprints: the deletion moves suite/setup.py's shared text, so 32 tests move: the 7 left in setup.py and the 25 in the modules that read it. The pending pin bump from c274f19 already owes 30 of them; setup.machine-name and exthost.platform are the two it adds, as before. releases/ is unchanged. --- forgetest/forgetest/suite/setup.py | 32 ------------------------------ 1 file changed, 32 deletions(-) diff --git a/forgetest/forgetest/suite/setup.py b/forgetest/forgetest/suite/setup.py index 991f246..7fc7527 100644 --- a/forgetest/forgetest/suite/setup.py +++ b/forgetest/forgetest/suite/setup.py @@ -1141,38 +1141,6 @@ def first_run_page(ctx): ctx.confirm("Did the control panel open after Start using the machine?") -@test("setup.cert-page", title="The certificate is checkable before the warning", - subsystem="setup", kind="auto", est_min=1, - covers=[("forgectrl", "src/tls.*"), ("forgectrl", "src/main.c"), - ("forgectrl", "src/ui/wizard.html"), ("forgectrl", "src/ui/wizard.js")], - requires=["forgectrl.auth"], - description="From the board's LAN address, GET /cert over plain HTTP answers 200 with the " - "certificate's SHA-256 fingerprint (the one /settings reports), the names on " - "it, and no redirect and no login; /cert.pem serves the certificate in PEM form; " - "both answer over HTTPS too.") -def cert_page(ctx): - fc = ctx.forgectrl - ev = ctx.evidence - ip = lan_ip() - ctx.check(ip, "cannot determine the board's LAN address") - fp = fc.settings().get("tls_fingerprint", "") - ctx.check(len(fp) == 95, "no fingerprint in /settings (%r): no HTTPS listener?", fp) - ev["fingerprint"] = fp - for base in ("http://%s" % ip, "https://%s" % ip): - st, body, hdrs = request(base, "GET", "/cert") - text = body.decode("utf-8", "replace") - ctx.log("GET %s/cert -> %s", base, st) - ctx.check(st == 200, "GET %s/cert -> %s, expected 200", base, st) - ctx.check("location" not in hdrs, "GET %s/cert redirected", base) - ctx.check(fp in text, "the fingerprint is not on the page from %s", base) - ctx.check(socket.gethostname() in text, - "the machine's hostname is not among the names on the page") - st, body, hdrs = request(base, "GET", "/cert.pem") - ctx.check(st == 200 and body.startswith(b"-----BEGIN CERTIFICATE-----"), - "GET %s/cert.pem -> %s, not a PEM certificate", base, st) - ev["pem_bytes"] = len(body) - - # ------------------------------------------------------- the lifecycle @test("setup.mirror", title="One browser drives a check; a second one follows",