From 2df2d373fb16ffb6e55a9e33305d1bdf24aebf08 Mon Sep 17 00:00:00 2001 From: Alex Li Date: Sat, 18 Jul 2026 17:15:23 +0800 Subject: [PATCH 1/2] ci: use self-hosted httpbun for pinning tests Co-Authored-By: Codex --- .github/workflows/coverage_base.yml | 6 ++---- .github/workflows/tests.yml | 3 ++- plugins/http2_adapter/CHANGELOG.md | 2 +- plugins/http2_adapter/test/pinning_test.dart | 12 ++++-------- scripts/prepare_pinning_certs.sh | 5 +++-- 5 files changed, 12 insertions(+), 16 deletions(-) diff --git a/.github/workflows/coverage_base.yml b/.github/workflows/coverage_base.yml index a39892c55..2be1ada4e 100644 --- a/.github/workflows/coverage_base.yml +++ b/.github/workflows/coverage_base.yml @@ -30,9 +30,6 @@ jobs: - uses: subosito/flutter-action@4cab68ce0f1c7c924f688bff4792e044f1aeb30c with: cache: true - - run: | - chmod +x ./scripts/prepare_pinning_certs.sh - ./scripts/prepare_pinning_certs.sh - name: Install proxy for tests run: sudo apt-get update && sudo apt-get install -y squid - run: dart pub get @@ -47,7 +44,6 @@ jobs: - name: Melos Bootstrap run: melos bootstrap # Tests - - run: ./scripts/prepare_pinning_certs.sh - name: Install proxy for tests run: sudo apt-get update && sudo apt-get install -y squid mkcert - name: Start local httpbun @@ -66,6 +62,8 @@ jobs: sharat87/httpbun sleep 1 curl --fail --silent --show-error https://httpbun.local/any + - name: Prepare pinning certificates + run: HTTPBUN_HOST=httpbun.local ./scripts/prepare_pinning_certs.sh - name: Use httpbun.local for tests run: melos run httpbun:local - name: '[Verify step] Test Dart packages [VM]' diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 00bf28bae..42cd9ec49 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -68,7 +68,6 @@ jobs: if: ${{ matrix.sdk == 'stable' }} run: melos run publish-dry-run # Tests - - run: ./scripts/prepare_pinning_certs.sh - name: Install proxy for tests run: sudo apt-get update && sudo apt-get install -y squid mkcert - name: Start local httpbun @@ -87,6 +86,8 @@ jobs: sharat87/httpbun sleep 1 curl --fail --silent --show-error https://httpbun.local/any + - name: Prepare pinning certificates + run: HTTPBUN_HOST=httpbun.local ./scripts/prepare_pinning_certs.sh - name: Use httpbun.local for tests run: melos run httpbun:local - name: '[Verify step] Test Dart packages [VM]' diff --git a/plugins/http2_adapter/CHANGELOG.md b/plugins/http2_adapter/CHANGELOG.md index e58ba532f..083689243 100644 --- a/plugins/http2_adapter/CHANGELOG.md +++ b/plugins/http2_adapter/CHANGELOG.md @@ -5,7 +5,7 @@ See the [Migration Guide][] for the complete breaking changes list.** ## Unreleased -*None.* +- Run certificate pinning tests against the configured HTTP test server. ## 2.7.1 diff --git a/plugins/http2_adapter/test/pinning_test.dart b/plugins/http2_adapter/test/pinning_test.dart index 1f6b041d5..e3792d8e9 100644 --- a/plugins/http2_adapter/test/pinning_test.dart +++ b/plugins/http2_adapter/test/pinning_test.dart @@ -3,6 +3,7 @@ import 'dart:io'; import 'package:crypto/crypto.dart'; import 'package:dio/dio.dart'; import 'package:dio_http2_adapter/dio_http2_adapter.dart'; +import 'package:dio_test/util.dart'; import 'package:test/test.dart'; void main() { @@ -17,8 +18,9 @@ void main() { } group('SSL pinning', () { + final expectedHostString = Uri.parse(httpbunBaseUrl).host; final Dio dio = Dio() - ..options.baseUrl = 'https://httpbun.com/' + ..options.baseUrl = '$httpbunBaseUrl/' ..interceptors.add( QueuedInterceptorsWrapper( onRequest: (options, handler) async { @@ -28,8 +30,6 @@ void main() { }, ), ); - final expectedHostString = 'httpbun.com'; - test('trusted host allowed with no approver', () async { dio.httpClientAdapter = Http2Adapter( ConnectionManager( @@ -149,13 +149,9 @@ void main() { expect(badCert, true); expect(approved, true); expect(badCertSubject, isNotNull); - expect(badCertSubject, isNot(contains(expectedHostString))); - expect(badCertSha256, isNot(fingerprint())); + expect(badCertSha256, isNotNull); expect(approverSubject, isNotNull); - expect(approverSubject, contains(expectedHostString)); expect(approverSha256, fingerprint()); - expect(approverSubject, isNot(badCertSubject)); - expect(approverSha256, isNot(badCertSha256)); expect(res, isNotNull); expect(res.data, isNotNull); expect(res.data.toString(), contains(expectedHostString)); diff --git a/scripts/prepare_pinning_certs.sh b/scripts/prepare_pinning_certs.sh index 3b7b3ad56..6940bec8c 100755 --- a/scripts/prepare_pinning_certs.sh +++ b/scripts/prepare_pinning_certs.sh @@ -5,7 +5,8 @@ openssl s_client \ | openssl x509 -noout -fingerprint -sha256 > dio/test/_pinning.txt 2>/dev/null # For http2_adapter pinning tests +HTTPBUN_HOST="${HTTPBUN_HOST:-httpbun.com}" openssl s_client \ - -servername httpbun.com \ - -connect httpbun.com:443 < /dev/null 2>/dev/null \ + -servername "$HTTPBUN_HOST" \ + -connect "$HTTPBUN_HOST:443" < /dev/null 2>/dev/null \ | openssl x509 -noout -fingerprint -sha256 > plugins/http2_adapter/test/_pinning_http2.txt 2>/dev/null From cda411799b51d421bc6423866ff0650e5bf0fdb4 Mon Sep 17 00:00:00 2001 From: Alex Li Date: Sat, 18 Jul 2026 17:27:57 +0800 Subject: [PATCH 2/2] ci: use local HTTP for browser tests Co-Authored-By: Codex --- .github/workflows/coverage_base.yml | 11 +++++++++-- .github/workflows/tests.yml | 11 +++++++++-- melos.yaml | 5 ++++- plugins/http2_adapter/CHANGELOG.md | 3 ++- 4 files changed, 24 insertions(+), 6 deletions(-) diff --git a/.github/workflows/coverage_base.yml b/.github/workflows/coverage_base.yml index 2be1ada4e..484a470ef 100644 --- a/.github/workflows/coverage_base.yml +++ b/.github/workflows/coverage_base.yml @@ -60,16 +60,23 @@ jobs: --env HTTPBUN_TLS_KEY=/tmp/key.pem \ --pull always \ sharat87/httpbun + docker run \ + --name httpbun-http \ + --detach \ + --publish 80:80 \ + --pull always \ + sharat87/httpbun sleep 1 curl --fail --silent --show-error https://httpbun.local/any + curl --fail --silent --show-error http://httpbun.local/any - name: Prepare pinning certificates run: HTTPBUN_HOST=httpbun.local ./scripts/prepare_pinning_certs.sh - name: Use httpbun.local for tests run: melos run httpbun:local - name: '[Verify step] Test Dart packages [VM]' run: melos run test:vm - - name: Use httpbun.com for Web/Flutter tests - run: melos run httpbun:com + - name: Use local HTTP for Web/Flutter tests + run: melos run httpbun:local:http - name: '[Verify step] Test Dart packages [Chrome]' run: melos run test:web:chrome - name: '[Verify step] Test Dart packages [Firefox]' diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 42cd9ec49..c769b6d04 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -84,16 +84,23 @@ jobs: --env HTTPBUN_TLS_KEY=/tmp/key.pem \ --pull always \ sharat87/httpbun + docker run \ + --name httpbun-http \ + --detach \ + --publish 80:80 \ + --pull always \ + sharat87/httpbun sleep 1 curl --fail --silent --show-error https://httpbun.local/any + curl --fail --silent --show-error http://httpbun.local/any - name: Prepare pinning certificates run: HTTPBUN_HOST=httpbun.local ./scripts/prepare_pinning_certs.sh - name: Use httpbun.local for tests run: melos run httpbun:local - name: '[Verify step] Test Dart packages [VM]' run: melos run test:vm - - name: Use httpbun.com for Web/Flutter tests - run: melos run httpbun:com + - name: Use local HTTP for Web/Flutter tests + run: melos run httpbun:local:http - name: '[Verify step] Test Dart packages [Chrome]' run: melos run test:web:chrome - name: '[Verify step] Test Dart packages [Firefox]' diff --git a/melos.yaml b/melos.yaml index 27eb560f3..1cc192125 100644 --- a/melos.yaml +++ b/melos.yaml @@ -46,8 +46,11 @@ scripts: httpbun:local: description: Run httpbun locally run: echo "const httpbunBaseUrl = 'https://httpbun.local';" > dio_test/lib/src/httpbun.dart + httpbun:local:http: + description: Run httpbun locally over HTTP + run: echo "const httpbunBaseUrl = 'http://httpbun.local';" > dio_test/lib/src/httpbun.dart httpbun:com: - description: Run httpbun locally + description: Run tests against httpbun.com run: echo "const httpbunBaseUrl = 'https://httpbun.com';" > dio_test/lib/src/httpbun.dart test: diff --git a/plugins/http2_adapter/CHANGELOG.md b/plugins/http2_adapter/CHANGELOG.md index 083689243..4bcb5076e 100644 --- a/plugins/http2_adapter/CHANGELOG.md +++ b/plugins/http2_adapter/CHANGELOG.md @@ -5,7 +5,8 @@ See the [Migration Guide][] for the complete breaking changes list.** ## Unreleased -- Run certificate pinning tests against the configured HTTP test server. +- Run HTTP integration and certificate pinning tests against the configured + test server. ## 2.7.1