ca-pruning-test.yml

name: CA database pruning

on: workflow_call

env:
  DS_IMAGE: ${{ vars.DS_IMAGE || 'quay.io/389ds/dirsrv' }}

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    env:
      SHARED: /tmp/workdir/pki
    steps:
      - name: Clone repository
        uses: actions/checkout@v4

      - name: Retrieve PKI images
        uses: actions/cache@v4
        with:
          key: pki-images-${{ github.sha }}
          path: pki-images.tar

      - name: Load PKI images
        run: docker load --input pki-images.tar

      - name: Create network
        run: docker network create example

      - name: Set up DS container
        run: |
          tests/bin/ds-create.sh \
              --image=${{ env.DS_IMAGE }} \
              --hostname=ds.example.com \
              --password=Secret.123 \
              ds

      - name: Connect DS container to network
        run: docker network connect example ds --alias ds.example.com

      - name: Set up PKI container
        run: |
          tests/bin/runner-init.sh pki
        env:
          HOSTNAME: pki.example.com

      - name: Connect PKI container to network
        run: docker network connect example pki --alias pki.example.com

      - name: Install CA
        run: |
          docker exec pki pkispawn \
              -f /usr/share/pki/server/examples/installation/ca.cfg \
              -s CA \
              -D pki_ds_url=ldap://ds.example.com:3389 \
              -v

      - name: Configure server cert profile
        run: |
          # set cert validity to 1 minute
          VALIDITY_DEFAULT="policyset.serverCertSet.2.default.params"
          docker exec pki sed -i \
              -e "s/^$VALIDITY_DEFAULT.range=.*$/$VALIDITY_DEFAULT.range=1/" \
              -e "/^$VALIDITY_DEFAULT.range=.*$/a $VALIDITY_DEFAULT.rangeUnit=minute" \
              /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caServerCert.cfg

          # check updated profile
          docker exec pki cat /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caServerCert.cfg

      - name: Configure user cert profile
        run: |
          # set cert validity to 4 minute
          VALIDITY_DEFAULT="policyset.userCertSet.2.default.params"
          docker exec pki sed -i \
              -e "s/^$VALIDITY_DEFAULT.range=.*$/$VALIDITY_DEFAULT.range=4/" \
              -e "/^$VALIDITY_DEFAULT.range=.*$/a $VALIDITY_DEFAULT.rangeUnit=minute" \
              /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caUserCert.cfg

          # check updated profile
          docker exec pki cat /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caUserCert.cfg

      - name: Configure cert status update task
        run: |
          # configure task to run every minute
          docker exec pki pki-server ca-config-set ca.certStatusUpdateInterval 60

      - name: Configure pruning job
        run: |
          # configure pruning to run manually without retention time
          docker exec pki pki-server ca-config-set jobsScheduler.enabled true
          docker exec pki pki-server ca-config-set jobsScheduler.job.pruning.enabled true
          docker exec pki pki-server ca-config-set jobsScheduler.job.pruning.certRetentionTime 0
          docker exec pki pki-server ca-config-set jobsScheduler.job.pruning.certRetentionUnit minute
          docker exec pki pki-server ca-config-set jobsScheduler.job.pruning.requestRetentionTime 0
          docker exec pki pki-server ca-config-set jobsScheduler.job.pruning.requestRetentionUnit minute

      - name: Restart CA subsystem
        run: |
          docker exec pki pki-server ca-redeploy --wait

      - name: Install CA admin cert
        run: |
          docker exec pki pki-server cert-export ca_signing --cert-file ca_signing.crt

          docker exec pki pki nss-cert-import \
              --cert ca_signing.crt \
              --trust CT,C,C \
              ca_signing

          docker exec pki pki pkcs12-import \
              --pkcs12 /root/.dogtag/pki-tomcat/ca_admin_cert.p12 \
              --pkcs12-password Secret.123
          docker exec pki pki -n caadmin ca-user-show caadmin

      - name: Check initial certs and requests
        run: |
          # there should be 6 requests initially
          docker exec pki pki -n caadmin ca-cert-request-find | tee output

          echo "6" > expected
          grep "Request ID:" output | wc -l > actual
          diff expected actual

          # there should be 6 certs initially
          docker exec pki pki ca-cert-find | tee output

          echo "6" > expected
          grep "Serial Number:" output | wc -l > actual
          diff expected actual

      - name: Enroll server cert
        run: |
          docker exec pki pki client-cert-request \
              --profile caServerCert \
              cn=server.example.com | tee output

          REQUEST_ID=$(sed -n -e 's/^ *Request ID: *\(.*\)$/\1/p' output)
          echo "REQUEST_ID: $REQUEST_ID"
          echo $REQUEST_ID > server-request-id

          docker exec pki pki -n caadmin ca-cert-request-approve $REQUEST_ID --force | tee output
          CERT_ID=$(sed -n -e 's/^ *Certificate ID: *\(.*\)$/\1/p' output)
          echo "CERT_ID: $CERT_ID"
          echo $CERT_ID > server-cert-id

      - name: Create incomplete server cert request
        run: |
          docker exec pki pki client-cert-request \
              --profile caServerCert \
              cn=server.example.com | tee output

          REQUEST_ID=$(sed -n -e 's/^ *Request ID: *\(.*\)$/\1/p' output)
          echo "REQUEST_ID: $REQUEST_ID"
          echo $REQUEST_ID > incomplete-server-request-id

      - name: Enroll user cert
        run: |
          docker exec pki pki client-cert-request \
              --profile caUserCert \
              uid=testuser | tee output

          REQUEST_ID=$(sed -n -e 's/^ *Request ID: *\(.*\)$/\1/p' output)
          echo "REQUEST_ID: $REQUEST_ID"
          echo $REQUEST_ID > user-request-id

          docker exec pki pki -n caadmin ca-cert-request-approve $REQUEST_ID --force | tee output
          CERT_ID=$(sed -n -e 's/^ *Certificate ID: *\(.*\)$/\1/p' output)
          echo "CERT_ID: $CERT_ID"
          echo $CERT_ID > user-cert-id

      - name: Create incomplete user cert request
        run: |
          docker exec pki pki client-cert-request \
              --profile caUserCert \
              uid=testuser | tee output

          REQUEST_ID=$(sed -n -e 's/^ *Request ID: *\(.*\)$/\1/p' output)
          echo "REQUEST_ID: $REQUEST_ID"
          echo $REQUEST_ID > incomplete-user-request-id

      - name: Check certs after enrollments
        run: |
          # there should be 8 certs now
          docker exec pki pki ca-cert-find | tee output

          echo "8" > expected
          grep "Serial Number:" output | wc -l > actual
          diff expected actual

          # the server cert should exist
          CERT_ID=$(cat server-cert-id)
          docker exec pki pki ca-cert-show $CERT_ID | tee output

          # the server cert should be valid
          sed -n "s/^ *Status: \(.*\)$/\1/p" output > actual
          echo "VALID" > expected
          diff expected actual

          # the user cert should exist
          CERT_ID=$(cat user-cert-id)
          docker exec pki pki ca-cert-show $CERT_ID | tee output

          # the user cert should be valid
          sed -n "s/^ *Status: \(.*\)$/\1/p" output > actual
          echo "VALID" > expected
          diff expected actual

      - name: Check requests after enrollments
        run: |
          # there should be 10 requests now
          docker exec pki pki -n caadmin ca-cert-request-find | tee output

          echo "10" > expected
          grep "Request ID:" output | wc -l > actual
          diff expected actual

          # the completed server request should exist
          REQUEST_ID=$(cat server-request-id)
          docker exec pki pki ca-cert-request-show $REQUEST_ID

          # the incomplete server request should exist
          REQUEST_ID=$(cat incomplete-server-request-id)
          docker exec pki pki ca-cert-request-show $REQUEST_ID

          # the completed user request should exist
          REQUEST_ID=$(cat user-request-id)
          docker exec pki pki ca-cert-request-show $REQUEST_ID

          # the incomplete user request should exist
          REQUEST_ID=$(cat incomplete-user-request-id)
          docker exec pki pki ca-cert-request-show $REQUEST_ID

      - name: Wait for server cert expiration
        run: |
          sleep 120

      - name: Check certs after server cert expiration
        run: |
          # there should still be 8 certs
          docker exec pki pki ca-cert-find | tee output

          echo "8" > expected
          grep "Serial Number:" output | wc -l > actual
          diff expected actual

          # the server cert should still exist
          CERT_ID=$(cat server-cert-id)
          docker exec pki pki ca-cert-show $CERT_ID | tee output

          # the server cert should be expired now
          sed -n "s/^ *Status: \(.*\)$/\1/p" output > actual
          echo "EXPIRED" > expected
          diff expected actual

          # the user cert should still exist
          CERT_ID=$(cat user-cert-id)
          docker exec pki pki ca-cert-show $CERT_ID | tee output

          # the user cert should still be valid
          sed -n "s/^ *Status: \(.*\)$/\1/p" output > actual
          echo "VALID" > expected
          diff expected actual

      - name: Check requests after server cert expiration
        run: |
          # there should still be 10 requests
          docker exec pki pki -n caadmin ca-cert-request-find | tee output

          echo "10" > expected
          grep "Request ID:" output | wc -l > actual
          diff expected actual

          # the completed server request should still exist
          REQUEST_ID=$(cat server-request-id)
          docker exec pki pki ca-cert-request-show $REQUEST_ID

          # the incomplete server request should still exist
          REQUEST_ID=$(cat incomplete-server-request-id)
          docker exec pki pki ca-cert-request-show $REQUEST_ID

          # the completed user request should still exist
          REQUEST_ID=$(cat user-request-id)
          docker exec pki pki ca-cert-request-show $REQUEST_ID

          # the incomplete user request should still exist
          REQUEST_ID=$(cat incomplete-user-request-id)
          docker exec pki pki ca-cert-request-show $REQUEST_ID

      - name: Start the first pruning
        run: |
          docker exec pki pki -n caadmin ca-job-start pruning

          sleep 30

      - name: Check certs after the first pruning
        run: |
          # there should be 7 certs now
          docker exec pki pki ca-cert-find | tee output

          echo "7" > expected
          grep "Serial Number:" output | wc -l > actual
          diff expected actual

          # the expired server cert should be removed
          CERT_ID=$(cat server-cert-id)
          docker exec pki pki ca-cert-show $CERT_ID \
              > >(tee stdout) 2> >(tee stderr >&2) || true

          echo "CertNotFoundException: Certificate ID $CERT_ID not found" > expected
          diff expected stderr

          # the user cert should still exist
          CERT_ID=$(cat user-cert-id)
          docker exec pki pki ca-cert-show $CERT_ID | tee output

          # the user cert should still be valid
          sed -n "s/^ *Status: \(.*\)$/\1/p" output > actual
          echo "VALID" > expected
          diff expected actual

      - name: Check requests after the first pruning
        run: |
          # there should be 7 requests now
          docker exec pki pki -n caadmin ca-cert-request-find | tee output

          echo "7" > expected
          grep "Request ID:" output | wc -l > actual
          diff expected actual

          # the completed server request should be removed
          REQUEST_ID=$(cat server-request-id)
          docker exec pki pki ca-cert-request-show $REQUEST_ID \
              > >(tee stdout) 2> >(tee stderr >&2) || true

          echo "RequestNotFoundException: Request ID $REQUEST_ID not found" > expected
          diff expected stderr

          # the incomplete server request should be removed
          REQUEST_ID=$(cat incomplete-server-request-id)
          docker exec pki pki ca-cert-request-show $REQUEST_ID \
              > >(tee stdout) 2> >(tee stderr >&2) || true

          echo "RequestNotFoundException: Request ID $REQUEST_ID not found" > expected
          diff expected stderr

          # the completed user request should still exist
          REQUEST_ID=$(cat user-request-id)
          docker exec pki pki ca-cert-request-show $REQUEST_ID

          # the incomplete user request should be removed
          REQUEST_ID=$(cat incomplete-user-request-id)
          docker exec pki pki ca-cert-request-show $REQUEST_ID \
              > >(tee stdout) 2> >(tee stderr >&2) || true

          echo "RequestNotFoundException: Request ID $REQUEST_ID not found" > expected
          diff expected stderr

      - name: Wait for user cert expiration
        run: |
          sleep 120

      - name: Check certs after user cert expiration
        run: |
          # there should still be 7 certs
          docker exec pki pki ca-cert-find | tee output

          echo "7" > expected
          grep "Serial Number:" output | wc -l > actual
          diff expected actual

          # the user cert should still exist
          CERT_ID=$(cat user-cert-id)
          docker exec pki pki ca-cert-show $CERT_ID | tee output

          # the user cert should be expired now
          sed -n "s/^ *Status: \(.*\)$/\1/p" output > actual
          echo "EXPIRED" > expected
          diff expected actual

      - name: Check requests after user cert expiration
        run: |
          # there should still be 7 requests
          docker exec pki pki -n caadmin ca-cert-request-find | tee output

          echo "7" > expected
          grep "Request ID:" output | wc -l > actual
          diff expected actual

          # the completed user request should still exist
          REQUEST_ID=$(cat user-request-id)
          docker exec pki pki ca-cert-request-show $REQUEST_ID

      - name: Start the second pruning
        run: |
          docker exec pki pki -n caadmin ca-job-start pruning

          sleep 30

      - name: Check certs after the second pruning
        run: |
          # there should be 6 certs again
          docker exec pki pki ca-cert-find | tee output

          echo "6" > expected
          grep "Serial Number:" output | wc -l > actual
          diff expected actual

          # the expired user cert should be removed
          CERT_ID=$(cat user-cert-id)
          docker exec pki pki ca-cert-show $CERT_ID \
              > >(tee stdout) 2> >(tee stderr >&2) || true

          echo "CertNotFoundException: Certificate ID $CERT_ID not found" > expected
          diff expected stderr

      - name: Check requests after the second pruning
        run: |
          # there should be 6 requests again
          docker exec pki pki -n caadmin ca-cert-request-find | tee output

          echo "6" > expected
          grep "Request ID:" output | wc -l > actual
          diff expected actual

          # the completed user request should be removed
          REQUEST_ID=$(cat user-request-id)
          docker exec pki pki ca-cert-request-show $REQUEST_ID \
              > >(tee stdout) 2> >(tee stderr >&2) || true

          echo "RequestNotFoundException: Request ID $REQUEST_ID not found" > expected
          diff expected stderr

      - name: Remove CA
        run: docker exec pki pkidestroy -s CA -v

      - name: Check DS server systemd journal
        if: always()
        run: |
          docker exec ds journalctl -x --no-pager -u dirsrv@localhost.service

      - name: Check DS container logs
        if: always()
        run: |
          docker logs ds

      - name: Check PKI server systemd journal
        if: always()
        run: |
          docker exec pki journalctl -x --no-pager -u pki-tomcatd@pki-tomcat.service

      - name: Check CA debug log
        if: always()
        run: |
          docker exec pki find /var/lib/pki/pki-tomcat/logs/ca -name "debug.*" -exec cat {} \;

      - name: Gather artifacts
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh ds
          tests/bin/pki-artifacts-save.sh pki
        continue-on-error: true

      - name: Upload artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: ca-pruning
          path: /tmp/artifacts