rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix step-ca root CA access on Linux CI

Browse Source 
Host chmod cannot open 0700 dirs owned by UID 1000, so
`-f` never sees root_ca.crt. Chmod from inside the
container as root while waiting for the cert.

Signed-off-by: Bryan Frimin <bryan@probo.com>
This commit is contained in:
Bryan Frimin
2026-07-19 16:43:44 +02:00
parent cb1d7c274b
commit b03acbd029
17 changed files with 28 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/server/api/complianceportal/session.go
View File

@@ -39,6 +39,7 @@ func NewSessionHostMiddleware(cookieConfig securecookie.Config) func(next http.H
return http.HandlerFunc(
func(w http.ResponseWriter, r *http.Request) {
ctx := r.Context()
session := authn.SessionFromContext(ctx)
if session == nil {
next.ServeHTTP(w, r)
@@ -52,6 +53,7 @@ func NewSessionHostMiddleware(cookieConfig securecookie.Config) func(next http.H
}
securecookie.Clear(w, cookieConfig)
ctx = authn.ContextWithSession(ctx, nil)
ctx = authn.ContextWithIdentity(ctx, nil)
next.ServeHTTP(w, r.WithContext(ctx))

3
pkg/server/api/complianceportal/session_test.go
View File

@@ -49,6 +49,7 @@ func TestSessionHostMiddleware_RejectsMismatchedHost(t *testing.T) {
handler := NewSessionHostMiddleware(securecookie.Config{Name: "ssid"})(
http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
authenticated = authn.IdentityFromContext(r.Context()) != nil
w.WriteHeader(http.StatusOK)
}),
)
@@ -80,6 +81,7 @@ func TestSessionHostMiddleware_AllowsMatchingTLSHost(t *testing.T) {
handler := NewSessionHostMiddleware(securecookie.Config{Name: "ssid"})(
http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
authenticated = authn.IdentityFromContext(r.Context()) != nil
w.WriteHeader(http.StatusOK)
}),
)
@@ -111,6 +113,7 @@ func TestSessionHostMiddleware_RejectsSpoofedHostHeader(t *testing.T) {
handler := NewSessionHostMiddleware(securecookie.Config{Name: "ssid"})(
http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
authenticated = authn.IdentityFromContext(r.Context()) != nil
w.WriteHeader(http.StatusOK)
}),
)

1
pkg/server/api/complianceportal/v1/brand_logo_handler.go
View File

@@ -63,6 +63,7 @@ func (h *brandLogoHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
}
var fileID *gid.GID
switch h.variant {
case brandLogoVariantLogo:
fileID = compliancePage.LogoFileID

2
pkg/server/api/complianceportal/v1/oauth_callback_handler.go
View File

@@ -77,6 +77,7 @@ func (h *OAuthCallbackHandler) ServeHTTP(w http.ResponseWriter, r *http.Request)
}
code := r.URL.Query().Get("code")
stateToken := r.URL.Query().Get("state")
if code == "" || stateToken == "" {
httpserver.RenderError(w, http.StatusBadRequest, errInvalidOAuthRequest)
@@ -92,6 +93,7 @@ func (h *OAuthCallbackHandler) ServeHTTP(w http.ResponseWriter, r *http.Request)
}
portal := complianceportal.CompliancePageFromContext(ctx)
portalBaseURL := complianceportal.CompliancePageBaseURLFromContext(ctx)
if portal == nil || portalBaseURL == nil {
httpserver.RenderError(w, http.StatusNotFound, errNotFound)