ca-sequential-test.yml

name: CA with Sequential Serial Numbers

on: workflow_call

env:
  DB_IMAGE: ${{ vars.DB_IMAGE || 'quay.io/389ds/dirsrv' }}

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    env:
      SHARED: /tmp/workdir/pki
    steps:
      - name: Clone repository
        uses: actions/checkout@v4

      - name: Retrieve PKI images
        uses: actions/cache@v4
        with:
          key: pki-images-${{ github.sha }}
          path: pki-images.tar

      - name: Load PKI images
        run: docker load --input pki-images.tar

      - name: Create network
        run: docker network create example

      - name: Set up DS container
        run: |
          tests/bin/ds-container-create.sh ds
        env:
          IMAGE: ${{ env.DB_IMAGE }}
          HOSTNAME: ds.example.com
          PASSWORD: Secret.123

      - name: Connect DS container to network
        run: docker network connect example ds --alias ds.example.com

      - name: Set up PKI container
        run: |
          tests/bin/runner-init.sh pki
        env:
          HOSTNAME: pki.example.com

      - name: Connect PKI container to network
        run: docker network connect example pki --alias pki.example.com

      - name: Install CA
        run: |
          docker exec pki pkispawn \
              -f /usr/share/pki/server/examples/installation/ca.cfg \
              -s CA \
              -D pki_ds_url=ldap://ds.example.com:3389 \
              -D pki_cert_id_generator=legacy \
              -D pki_request_id_generator=legacy \
              -v

      - name: Check CA certs and keys
        run: |
          # check certs
          docker exec pki pki-server cert-find

          # check keys
          echo "Secret.123" > password.txt
          docker cp password.txt pki:password.txt
          docker exec pki certutil -K \
              -d /etc/pki/pki-tomcat/alias \
              -f password.txt | tee output

          # there should be no orphaned keys
          echo "0" > expected
          grep "(orphan)" output | wc -l > actual
          diff expected actual

      # https://github.com/dogtagpki/pki/wiki/Configuring-CA-with-Random-Serial-Numbers-v3
      - name: Switch to RSNv3
        run: |
          # switch cert request ID generator to RSNv3
          docker exec pki pki-server ca-config-unset dbs.beginRequestNumber
          docker exec pki pki-server ca-config-unset dbs.endRequestNumber
          docker exec pki pki-server ca-config-unset dbs.requestIncrement
          docker exec pki pki-server ca-config-unset dbs.requestLowWaterMark
          docker exec pki pki-server ca-config-unset dbs.requestCloneTransferNumber
          docker exec pki pki-server ca-config-unset dbs.requestRangeDN

          docker exec pki pki-server ca-config-set dbs.request.id.generator random

          # switch cert ID generator to RSNv3
          docker exec pki pki-server ca-config-unset dbs.beginSerialNumber
          docker exec pki pki-server ca-config-unset dbs.endSerialNumber
          docker exec pki pki-server ca-config-unset dbs.serialIncrement
          docker exec pki pki-server ca-config-unset dbs.serialLowWaterMark
          docker exec pki pki-server ca-config-unset dbs.serialCloneTransferNumber
          docker exec pki pki-server ca-config-unset dbs.serialRangeDN

          docker exec pki pki-server ca-config-set dbs.cert.id.generator random

          # restart CA subsystem
          docker exec pki pki-server ca-redeploy --wait

      - name: Run PKI healthcheck
        run: docker exec pki pki-healthcheck --failures-only

      - name: Initialize PKI client
        run: |
          docker exec pki pki-server cert-export ca_signing --cert-file ca_signing.crt
          docker exec pki pki client-cert-import ca_signing --ca-cert ca_signing.crt
          docker exec pki pki pkcs12-import \
              --pkcs12 /root/.dogtag/pki-tomcat/ca_admin_cert.p12 \
              --pkcs12-password Secret.123

      - name: Check cert requests in CA
        run: |
          docker exec pki pki -n caadmin ca-cert-request-find

      - name: Check certs in CA
        run: |
          docker exec pki pki ca-cert-find

      - name: Remove CA
        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v

      - name: Check PKI server systemd journal
        if: always()
        run: |
          docker exec pki journalctl -x --no-pager -u pki-tomcatd@pki-tomcat.service

      - name: Check CA debug log
        if: always()
        run: |
          docker exec pki find /var/log/pki/pki-tomcat/ca -name "debug.*" -exec cat {} \;

      - name: Gather artifacts
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh ds
          tests/bin/pki-artifacts-save.sh pki
        continue-on-error: true

      - name: Upload artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: ca-sequential
          path: /tmp/artifacts