Migrate Azure Key Vault acceptance tests off live Azure to a Testcontainers emulator - #1
Closed
usmansaleem wants to merge 2 commits into
Closed
Migrate Azure Key Vault acceptance tests off live Azure to a Testcontainers emulator#1usmansaleem wants to merge 2 commits into
usmansaleem wants to merge 2 commits into
Conversation
- Wire the custom acceptanceTest task to the test source set explicitly for Gradle 9. - Update Besu from 26.5.0 to 26.8.0. - Replace removed PoW miner CLI options with a single-validator QBFT test network. - Verify insufficient-funds transactions are not mined and leave balances unchanged under Besu 26.8 transaction-pool behavior.
…ainers emulator Adds an AzureKeyVaultEmulator Testcontainers DSL class (ghcr.io/usmansaleem/azure-keyvault-emulator:v2.3.4) that starts a shared emulator container, generates a self-signed TLS cert, and seeds the exact BLS/SECP fixtures previously documented for manual import into real Azure. AzureKeyVaultAcceptanceTest, BlsSigningAcceptanceTest.ableToSignUsingAzure, SecpSigningAcceptanceTest.signDataWithKeyInAzure, and KeyIdentifiersAcceptanceTest.azureKeysReturnAppropriatePublicKey now run against the emulator with zero external Azure credentials. CI no longer needs any AZURE_* secrets. Threads a new AzureKeyVaultParameters.getEndpointOverride() through the config chain (CLI option, YAML metadata, DefaultAzureKeyVaultParameters, AzureConfig), mirroring the existing AWS endpoint-override pattern, so AzureKeyVault can target the emulator instead of *.vault.azure.net, use a fixed emulator bearer token, and disable Azure SDK challenge-resource verification. Fixes found only by actually running the emulator end-to-end (see individual commits/diffs for detail): - pin linux/amd64 platform for Testcontainers (fixed upstream in v2.3.4, which now ships native arm64 too, so this pin has since been removed again) - pin 127.0.0.1 instead of localhost for the container URL (Docker Desktop for Mac IPv6 quirk) - make the generated PKCS12 cert world-readable (container runs as non-root) - always set explicit enabled=true on seeded secrets (Secrets SDK NPEs on the emulator's default omission) - pin the resolved key version for the raw-REST sign call instead of the empty "latest" placeholder Also fixes the actual root-cause blocker upstream in usmansaleem/azure-keyvault-emulator: its ES256K Sign/Verify operations were re-hashing an already-computed digest before signing (via ECDsa.SignData instead of SignHash), producing signatures that don't verify against real Azure Key Vault's documented Sign semantics. Fixed and released as v2.3.4; SecpSigningAcceptanceTest.signDataWithKeyInAzure is verified working end-to-end against the real published image.
Owner
Author
|
Opened against upstream instead: Consensys-Incorporated#1222 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR Description
Migrates all Azure Key Vault acceptance tests off live Azure onto a local Testcontainers-managed emulator (
ghcr.io/usmansaleem/azure-keyvault-emulator:v2.3.4), so they run with zero external Azure credentials.AzureKeyVaultEmulator, a Testcontainers DSL class that starts a shared emulator container, generates a self-signed TLS cert, and seeds the exact BLS/SECP fixtures previously documented for manual import into real Azure.AzureKeyVaultAcceptanceTest,BlsSigningAcceptanceTest.ableToSignUsingAzure,SecpSigningAcceptanceTest.signDataWithKeyInAzure, andKeyIdentifiersAcceptanceTest.azureKeysReturnAppropriatePublicKeynow all run against the emulator.AzureKeyVaultParameters.getEndpointOverride()through the config chain (CLI option, YAML metadata,DefaultAzureKeyVaultParameters,AzureConfig), mirroring the existing AWS endpoint-override pattern, soAzureKeyVaultcan target the emulator instead of*.vault.azure.net, use a fixed emulator bearer token, and disable Azure SDK challenge-resource verification.AZURE_*secrets; removed fromci_main.ymland the README's manual-setup instructions.Fixes discovered only by actually running the emulator end-to-end:
127.0.0.1instead oflocalhostfor the container URL (Docker Desktop for Mac IPv6 quirk).enabled=trueon seeded secrets (the Azure Secrets SDK NPEs on the emulator's default omission of that attribute).Also fixed the root-cause blocker upstream in
usmansaleem/azure-keyvault-emulator: its ES256K Sign/Verify operations were re-hashing an already-computed digest before signing (ECDsa.SignDatainstead ofSignHash), producing signatures that don't verify against real Azure Key Vault's documented Sign semantics. Fixed, tested, and released asv2.3.4(which also now builds natively for both amd64 and arm64).SecpSigningAcceptanceTest.signDataWithKeyInAzureis verified working end-to-end against the real published image.Fixed Issue(s)
Documentation
doc-change-requiredlabel to this PR if updates are required.Changelog
Testing