From 8b0b7f36f23e5e41f4852af38ef2a8e9307bbc8f Mon Sep 17 00:00:00 2001 From: Paul Flynn Date: Tue, 10 Mar 2026 16:21:48 -0400 Subject: [PATCH 1/5] fix(sdk): remove testcontainers from consumer dependency graph Move keycloak integration tests from sdk/auth/oauth/ to a separate test/integration module with its own go.mod. This removes testcontainers-go and 60+ transitive container dependencies (docker, containerd, moby, etc.) from the SDK's published module graph. Downstream consumers will no longer inherit these test-only dependencies, eliminating false CVE alerts from vulnerability scanners. Resolves: DSPX-2582 Co-Authored-By: Claude Opus 4.6 Signed-off-by: Paul Flynn --- go.work | 1 + sdk/auth/oauth/oauth_test.go | 574 ----------------- sdk/go.mod | 53 +- sdk/go.sum | 118 ---- test/integration/go.mod | 92 +++ test/integration/go.sum | 241 ++++++++ test/integration/oauth/oauth_test.go | 575 ++++++++++++++++++ test/integration/oauth/testdata/localhost.crt | 26 + test/integration/oauth/testdata/localhost.key | 28 + test/integration/oauth/testdata/new-ca.crt | 33 + test/integration/oauth/testdata/new-ca.jks | Bin 0 -> 1514 bytes test/integration/oauth/testdata/new-ca.key | 52 ++ .../integration/oauth/testdata/sampleuser.crt | 26 + .../integration/oauth/testdata/sampleuser.key | 28 + test/integration/oauth/testdata/sanX509.conf | 1 + .../integration/oauth/testdata/sanX509su.conf | 1 + 16 files changed, 1105 insertions(+), 744 deletions(-) create mode 100644 test/integration/go.mod create mode 100644 test/integration/go.sum create mode 100644 test/integration/oauth/oauth_test.go create mode 100644 test/integration/oauth/testdata/localhost.crt create mode 100644 test/integration/oauth/testdata/localhost.key create mode 100644 test/integration/oauth/testdata/new-ca.crt create mode 100644 test/integration/oauth/testdata/new-ca.jks create mode 100644 test/integration/oauth/testdata/new-ca.key create mode 100644 test/integration/oauth/testdata/sampleuser.crt create mode 100644 test/integration/oauth/testdata/sampleuser.key create mode 100644 test/integration/oauth/testdata/sanX509.conf create mode 100644 test/integration/oauth/testdata/sanX509su.conf diff --git a/go.work b/go.work index f897f17ac1..c8ab1243da 100644 --- a/go.work +++ b/go.work @@ -11,5 +11,6 @@ use ( ./protocol/go ./sdk ./service + ./test/integration ./tests-bdd ) diff --git a/sdk/auth/oauth/oauth_test.go b/sdk/auth/oauth/oauth_test.go index 91bd644b3e..11d5a8aa65 100644 --- a/sdk/auth/oauth/oauth_test.go +++ b/sdk/auth/oauth/oauth_test.go @@ -1,348 +1,10 @@ package oauth import ( - "context" - "crypto" - "crypto/rand" - "crypto/rsa" - "crypto/tls" - "crypto/x509" - _ "embed" - "encoding/base64" - "encoding/json" - "net/http" - "net/http/httptest" - "os" - "slices" "testing" "time" - - "github.com/lestrrat-go/jwx/v2/jwa" - "github.com/lestrrat-go/jwx/v2/jwk" - "github.com/lestrrat-go/jwx/v2/jws" - "github.com/lestrrat-go/jwx/v2/jwt" - "github.com/opentdf/platform/lib/fixtures" - "github.com/opentdf/platform/sdk/httputil" - "github.com/stretchr/testify/require" - "github.com/stretchr/testify/suite" - tc "github.com/testcontainers/testcontainers-go" - "github.com/testcontainers/testcontainers-go/wait" ) -type OAuthSuite struct { - suite.Suite - dpopJWK jwk.Key - keycloakContainer tc.Container - keycloakEndpoint string - keycloakHTTPSEndpoint string -} - -func TestOAuthTestSuite(t *testing.T) { - suite.Run(t, new(OAuthSuite)) -} - -func (s *OAuthSuite) SetupSuite() { - // Generate RSA Key to use for DPoP - dpopKey, err := rsa.GenerateKey(rand.Reader, 4096) - if err != nil { - panic(err) - } - - dpopJWK, err := jwk.FromRaw(dpopKey) - s.Require().NoError(err) - s.Require().NoError(dpopJWK.Set("use", "sig")) - s.Require().NoError(dpopJWK.Set("alg", jwa.RS256.String())) - - s.dpopJWK = dpopJWK - ctx := context.Background() - - keycloak, idpEndpoint, idpHTTPSEndpoint := setupKeycloak(ctx, s.T()) - s.keycloakContainer = keycloak - s.keycloakEndpoint = idpEndpoint - s.keycloakHTTPSEndpoint = idpHTTPSEndpoint -} - -func (s *OAuthSuite) TearDownSuite() { - _ = s.keycloakContainer.Terminate(context.Background()) -} - -//go:embed testdata/new-ca.crt -var ca []byte - -func (s *OAuthSuite) TestCertExchangeFromKeycloak() { - clientCredentials := ClientCredentials{ - ClientID: "opentdf-sdk", - ClientAuth: "secret", - } - cert, err := tls.LoadX509KeyPair("testdata/sampleuser.crt", "testdata/sampleuser.key") - rootCAs, _ := x509.SystemCertPool() - rootCAs.AppendCertsFromPEM(ca) - s.Require().NoError(err) - tlsConfig := &tls.Config{ - MinVersion: tls.VersionTLS12, - Certificates: []tls.Certificate{cert}, - RootCAs: rootCAs, - } - exhcangeInfo := CertExchangeInfo{ - HTTPClient: httputil.SafeHTTPClientWithTLSConfig(tlsConfig), - Audience: []string{"opentdf-sdk"}, - } - - tok, err := DoCertExchange( - context.Background(), - s.keycloakHTTPSEndpoint, - exhcangeInfo, - clientCredentials, - s.dpopJWK) - s.Require().NoError(err) - - tokenDetails, err := jwt.ParseString(tok.AccessToken, jwt.WithVerify(false)) - s.Require().NoError(err) - - cnfClaim, ok := tokenDetails.Get("cnf") - s.Require().True(ok) - cnfClaimsMap, ok := cnfClaim.(map[string]interface{}) - s.Require().True(ok) - idpKeyFingerprint, ok := cnfClaimsMap["jkt"].(string) - s.Require().True(ok) - s.Require().NotEmpty(idpKeyFingerprint) - pk, err := s.dpopJWK.PublicKey() - s.Require().NoError(err) - hash, err := pk.Thumbprint(crypto.SHA256) - s.Require().NoError(err) - - expectedThumbprint := base64.URLEncoding.WithPadding(base64.NoPadding).EncodeToString(hash) - s.Equal(expectedThumbprint, idpKeyFingerprint, "didn't get expected fingerprint") - s.Positivef(tok.ExpiresIn, "invalid expiration is before current time: %v", tok) - s.Falsef(tok.Expired(), "got a token that is currently expired: %v", tok) - - name, ok := tokenDetails.Get("name") - s.Require().True(ok) - s.Equal("sample user", name, "got unexpected name") -} - -func (s *OAuthSuite) TestGettingAccessTokenFromKeycloak() { - clientCredentials := ClientCredentials{ - ClientID: "opentdf-sdk", - ClientAuth: "secret", - } - - tok, err := GetAccessToken( - http.DefaultClient, - s.keycloakEndpoint, - []string{"testscope"}, - clientCredentials, - s.dpopJWK) - - s.Require().NoError(err) - - tokenDetails, err := jwt.ParseString(tok.AccessToken, jwt.WithVerify(false)) - s.Require().NoError(err) - - cnfClaim, ok := tokenDetails.Get("cnf") - s.Require().True(ok) - cnfClaimsMap, ok := cnfClaim.(map[string]interface{}) - s.Require().True(ok) - idpKeyFingerprint, ok := cnfClaimsMap["jkt"].(string) - s.Require().True(ok) - s.Require().NotEmpty(idpKeyFingerprint) - pk, err := s.dpopJWK.PublicKey() - s.Require().NoError(err) - hash, err := pk.Thumbprint(crypto.SHA256) - s.Require().NoError(err) - - scope, ok := tokenDetails.Get("scope") - s.Require().True(ok) - scopeString, ok := scope.(string) - s.Require().True(ok) - s.Require().Contains(scopeString, "testscope") - - expectedThumbprint := base64.URLEncoding.WithPadding(base64.NoPadding).EncodeToString(hash) - s.Equal(expectedThumbprint, idpKeyFingerprint, "didn't get expected fingerprint") - s.Positivef(tok.ExpiresIn, "invalid expiration is before current time: %v", tok) - s.Falsef(tok.Expired(), "got a token that is currently expired: %v", tok) - - // verify that we got a token that has the opentdf-standard role, which only the sdk client has - ra, ok := tokenDetails.Get("realm_access") - s.Require().True(ok) - raMap, ok := ra.(map[string]interface{}) - s.Require().True(ok) - roles, ok := raMap["roles"] - s.Require().True(ok) - rolesList, ok := roles.([]interface{}) - s.Require().True(ok) - s.Require().True(slices.Contains(rolesList, "opentdf-standard"), "missing the `opentdf-standard` role") -} - -func (s *OAuthSuite) TestDoingTokenExchangeWithKeycloak() { - ctx := context.Background() - - clientCredentials := ClientCredentials{ - ClientID: "opentdf-sdk", - ClientAuth: "secret", - } - - subjectToken, err := GetAccessToken( - http.DefaultClient, - s.keycloakEndpoint, - []string{"testscope"}, - clientCredentials, - s.dpopJWK) - s.Require().NoError(err) - - exchangeCredentials := ClientCredentials{ - ClientID: "opentdf", - ClientAuth: "secret", - } - - tokenExchange := TokenExchangeInfo{ - SubjectToken: subjectToken.AccessToken, - Audience: []string{"opentdf-sdk"}, - } - - exchangedTok, err := DoTokenExchange(ctx, http.DefaultClient, s.keycloakEndpoint, []string{}, exchangeCredentials, tokenExchange, s.dpopJWK) - s.Require().NoError(err) - - tokenDetails, err := jwt.ParseString(exchangedTok.AccessToken, jwt.WithVerify(false)) - s.Require().NoError(err) - - cnfClaim, ok := tokenDetails.Get("cnf") - s.Require().True(ok) - cnfClaimsMap, ok := cnfClaim.(map[string]interface{}) - s.Require().True(ok) - idpKeyFingerprint, ok := cnfClaimsMap["jkt"].(string) - s.Require().True(ok) - s.Require().NotEmpty(idpKeyFingerprint) - pk, err := s.dpopJWK.PublicKey() - s.Require().NoError(err) - hash, err := pk.Thumbprint(crypto.SHA256) - s.Require().NoError(err) - - expectedThumbprint := base64.URLEncoding.WithPadding(base64.NoPadding).EncodeToString(hash) - s.Equal(expectedThumbprint, idpKeyFingerprint, "didn't get expected fingerprint") - s.Positivef(subjectToken.ExpiresIn, "invalid expiration is before current time: %v", subjectToken) - s.Falsef(subjectToken.Expired(), "got a token that is currently expired: %v", subjectToken) - - // verify that we got a token that has the opentdf-standard role, which only the sdk client has - ra, ok := tokenDetails.Get("realm_access") - s.Require().True(ok) - raMap, ok := ra.(map[string]interface{}) - s.Require().True(ok) - roles, ok := raMap["roles"] - s.Require().True(ok) - rolesList, ok := roles.([]interface{}) - s.Require().True(ok) - s.Require().True(slices.Contains(rolesList, "opentdf-standard"), "missing the `opentdf-standard` role") - - // verify that the calling client is the authorized party - azpClaim, ok := tokenDetails.Get("azp") - s.Require().True(ok) - s.Require().Equal(exchangeCredentials.ClientID, azpClaim) - - // verify that the exchanged token has a scope that is only allowed for the client that got the original token - scope, ok := tokenDetails.Get("scope") - s.Require().True(ok) - scopeString, ok := scope.(string) - s.Require().True(ok) - s.Require().Contains(scopeString, "testscope") -} - -func (s *OAuthSuite) TestClientSecretNoNonce() { - server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - s.Equal("/token", r.URL.Path) - s.NoError(r.ParseForm()) - - validateBasicAuth(r, s.T()) - extractDPoPToken(r, s.T()) - - tok, err := jwt.NewBuilder(). - Issuer("example.org/fake"). - IssuedAt(time.Now()). - Build() - s.NoError(err) - - responseBytes, err := json.Marshal(tok) - s.NoError(err, "error writing response") - - w.Header().Add("Content-Type", "application/json") - _, err = w.Write(responseBytes) - s.NoError(err) - })) - defer server.Close() - - clientCredentials := ClientCredentials{ - ClientID: "theclient", - ClientAuth: "thesecret", - } - _, err := GetAccessToken(http.DefaultClient, server.URL+"/token", []string{"scope1", "scope2"}, clientCredentials, s.dpopJWK) - s.Require().NoError(err, "didn't get a token back from the IdP") -} - -func (s *OAuthSuite) TestClientSecretWithNonce() { - timesCalled := 0 - - server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - timesCalled++ - s.Equal("/token", r.URL.Path, "surprise http request to mock oauth service") - err := r.ParseForm() - s.NoError(err, "error parsing oauth request") - - validateBasicAuth(r, s.T()) - - if timesCalled == 1 { - w.Header().Add("DPoP-Nonce", "dfdffdfddf") - w.WriteHeader(http.StatusBadRequest) - _, err := w.Write([]byte{}) - s.NoError(err, "error writing response") - return - } else if timesCalled > 2 { - s.T().Logf("made more than two calls to the server: %d", timesCalled) - return - } - - // get the key we used to sign the DPoP token from the header - clientTok := extractDPoPToken(r, s.T()) - - nonce, exists := clientTok.Get("nonce") - if !exists { - s.T().Logf("didn't get nonce assertion") - } - - if nonceStr, ok := nonce.(string); ok { - if nonceStr != "dfdffdfddf" { - s.T().Errorf("Got incorrect nonce: %v", nonce) - } - } else { - s.T().Errorf("Nonce is not a string") - } - - tok, _ := jwt.NewBuilder(). - Issuer("example.org/fake"). - IssuedAt(time.Now()). - Build() - - responseBytes, err := json.Marshal(tok) - if err != nil { - s.T().Errorf("error writing response: %v", err) - } - - w.Header().Add("Content-Type", "application/json") - l, err := w.Write(responseBytes) - s.Len(responseBytes, l) - s.NoError(err) - })) - defer server.Close() - - clientCredentials := ClientCredentials{ - ClientID: "theclient", - ClientAuth: "thesecret", - } - _, err := GetAccessToken(http.DefaultClient, server.URL+"/token", []string{"scope1", "scope2"}, clientCredentials, s.dpopJWK) - if err != nil { - s.T().Errorf("didn't get a token back from the IdP: %v", err) - } -} - func TestTokenExpiration_RespectsLeeway(t *testing.T) { expiredToken := Token{ received: time.Now().Add(-tokenExpirationBuffer - 10*time.Second), @@ -370,239 +32,3 @@ func TestTokenExpiration_RespectsLeeway(t *testing.T) { t.Fatalf("token should not be expired") } } - -func (s *OAuthSuite) TestSignedJWTWithNonce() { - // Generate RSA Key to use for DPoP - dpopKey, err := rsa.GenerateKey(rand.Reader, 4096) - s.Require().NoError(err, "error generating dpop key") - dpopJWK, err := jwk.FromRaw(dpopKey) - s.Require().NoError(err) - s.Require().NoError(dpopJWK.Set("use", "sig")) - s.Require().NoError(dpopJWK.Set("alg", jwa.RS256.String())) - - clientAuthKey, err := rsa.GenerateKey(rand.Reader, 4096) - s.Require().NoError(err, "error generating clientAuth key") - clientAuthJWK, err := jwk.FromRaw(clientAuthKey) - s.Require().NoError(err, "error constructing raw JWK") - s.Require().NoError(clientAuthJWK.Set("use", "sig")) - s.Require().NoError(clientAuthJWK.Set("alg", jwa.RS256.String())) - clientPublicKey, err := clientAuthJWK.PublicKey() - s.Require().NoError(err, "error getting public JWK from client auth JWK [%v]", clientAuthJWK) - - timesCalled := 0 - - var url string - getURL := func() string { - return url - } - - server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - timesCalled++ - - if r.URL.Path != "/token" { - s.T().Errorf("Expected to request '/token', got: %s", r.URL.Path) - } - s.NoError(r.ParseForm()) - - validateClientAssertionAuth(r, s.T(), getURL, "theclient", clientPublicKey) - - if timesCalled == 1 { - w.Header().Add("DPoP-Nonce", "dfdffdfddf") - w.WriteHeader(http.StatusBadRequest) - if _, err := w.Write([]byte{}); err != nil { - s.T().Errorf("error writing response: %v", err) - } - return - } else if timesCalled > 2 { - s.T().Logf("made more than two calls to the server: %d", timesCalled) - return - } - - // get the key we used to sign the DPoP token from the header - clientTok := extractDPoPToken(r, s.T()) - - nonce, exists := clientTok.Get("nonce") - if exists { - value, ok := nonce.(string) - if !ok { - s.T().Errorf("Nonce is not a string") - } else if value != "dfdffdfddf" { - s.T().Errorf("Got incorrect nonce: %v", value) - } - } else { - s.T().Logf("didn't get nonce assertion") - } - - tok, _ := jwt.NewBuilder(). - Issuer("example.org/fake"). - IssuedAt(time.Now()). - Build() - - responseBytes, err := json.Marshal(tok) - if err != nil { - s.T().Errorf("error writing response: %v", err) - } - - w.Header().Add("Content-Type", "application/json") - l, err := w.Write(responseBytes) - s.Len(responseBytes, l) - s.NoError(err) - })) - defer server.Close() - - clientCredentials := ClientCredentials{ - ClientID: "theclient", - ClientAuth: clientAuthJWK, - } - - url = server.URL + "/token" - - _, err = GetAccessToken(http.DefaultClient, url, []string{"scope1", "scope2"}, clientCredentials, dpopJWK) - if err != nil { - s.T().Errorf("didn't get a token back from the IdP: %v", err) - } -} - -/* -* -the token endpoint is a string _but_ we only have the value after we create the server -so we need a way get the value of the url after the server has started -* -*/ -func validateClientAssertionAuth(r *http.Request, t *testing.T, tokenEndpoint func() string, clientID string, key jwk.Key) { - if grant := r.Form.Get("grant_type"); grant != "client_credentials" { - t.Logf("got the wrong grant type: %s, expected client_credentials", grant) - } - if assertionType := r.Form.Get("client_assertion_type"); assertionType != "urn:ietf:params:oauth:client-assertion-type:jwt-bearer" { - t.Errorf("incorrect client assertion type: %s", assertionType) - } - - clientAssertion := r.Form.Get("client_assertion") - if clientAssertion == "" { - t.Errorf("missing client assertion") - } - - alg := key.Algorithm() - if alg == nil { - t.Logf("no key algorithm specified, using RS256 to verify client signature") - alg = jwa.RS256 - } - - tok, err := jwt.ParseString(clientAssertion, jwt.WithVerify(true), jwt.WithKey(alg, key)) - if err != nil { - t.Fatalf("error verifying client signature on token [%s]: %v", clientAssertion, err) - } - - if tok.Subject() != clientID { - t.Fatalf("incorrect subject: %s", tok.Subject()) - } - - if tok.Issuer() != clientID { - t.Fatalf("incorrect issuer: %s", tok.Issuer()) - } - - expectedAudience := tokenEndpoint() - if len(tok.Audience()) != 1 || tok.Audience()[0] != expectedAudience { - t.Fatalf("incorrect audience: %v", tok.Audience()) - } -} - -func validateBasicAuth(r *http.Request, t *testing.T) { - if grant := r.Form.Get("grant_type"); grant != "client_credentials" { - t.Logf("got the wrong grant type: %s, expected client_credentials", grant) - } - - username, password, ok := r.BasicAuth() - if !ok { - t.Errorf("missing basic auth") - } - if username != "theclient" || password != "thesecret" { - t.Errorf("failed to pass correct username and password. got %s:%s", username, password) - } -} - -func extractDPoPToken(r *http.Request, t *testing.T) jwt.Token { - dpop := r.Header.Get("dpop") - jwsMessage, err := jws.ParseString(dpop) - if err != nil { - t.Errorf("error parsing dpop payload as JWS: %v", err) - } - - sig := jwsMessage.Signatures()[0] - signingKey := sig.ProtectedHeaders().JWK() - - clientTok, err := jwt.ParseString(dpop, jwt.WithVerify(true), jwt.WithKey(signingKey.Algorithm(), signingKey)) - if err != nil { - t.Errorf("failed to parse/verify the dpop token: %v", err) - } - - return clientTok -} - -func setupKeycloak(ctx context.Context, t *testing.T) (tc.Container, string, string) { - containerReq := tc.ContainerRequest{ - Image: "ghcr.io/opentdf/keycloak:sha-8a6d35a", - ExposedPorts: []string{"8082/tcp", "8083/tcp"}, - Cmd: []string{ - "start-dev", "--http-port=8082", "--https-port=8083", "--features=preview", "--verbose", - "-Djavax.net.ssl.trustStorePassword=password", "-Djavax.net.ssl.HostnameVerifier=AllowAll", - "-Djavax.net.debug=ssl", - "-Djavax.net.ssl.trustStore=/truststore/truststore.jks", - "--spi-truststore-file-hostname-verification-policy=ANY", - }, - Files: []tc.ContainerFile{ - {HostFilePath: "testdata/new-ca.jks", ContainerFilePath: "/truststore/truststore.jks", FileMode: int64(0o777)}, - {HostFilePath: "testdata/localhost.crt", ContainerFilePath: "/etc/x509/tls/localhost.crt", FileMode: int64(0o777)}, - {HostFilePath: "testdata/localhost.key", ContainerFilePath: "/etc/x509/tls/localhost.key", FileMode: int64(0o777)}, - }, - Env: map[string]string{ - "KEYCLOAK_ADMIN": "admin", - "KEYCLOAK_ADMIN_PASSWORD": "admin", - "KC_HTTPS_KEY_STORE_PASSWORD": "password", - "KC_HTTPS_KEY_STORE_FILE": "/truststore/truststore.jks", - "KC_HTTPS_CERTIFICATE_FILE": "/etc/x509/tls/localhost.crt", - "KC_HTTPS_CERTIFICATE_KEY_FILE": "/etc/x509/tls/localhost.key", - "KC_HTTPS_CLIENT_AUTH": "request", - }, - - WaitingFor: wait.ForLog("Running the server"), - } - - var providerType tc.ProviderType - - if os.Getenv("TESTCONTAINERS_PODMAN") == "true" { - providerType = tc.ProviderPodman - } else { - providerType = tc.ProviderDocker - } - - keycloak, err := tc.GenericContainer(ctx, tc.GenericContainerRequest{ - ProviderType: providerType, - ContainerRequest: containerReq, - Started: true, - }) - if err != nil { - t.Fatalf("error starting keycloak container: %v", err) - } - port, _ := keycloak.MappedPort(ctx, "8082") - keycloakBase := "http://localhost:" + port.Port() - - httpPort, _ := keycloak.MappedPort(ctx, "8083") - keycloakHTTPSBase := "https://localhost:" + httpPort.Port() - - realm := "test" - - connectParams := fixtures.KeycloakConnectParams{ - BasePath: keycloakBase, - Username: "admin", - Password: "admin", - Realm: realm, - Audience: "https://test.example.org", - AllowInsecureTLS: true, - } - - err = fixtures.SetupKeycloak(ctx, connectParams) - require.NoError(t, err) - - return keycloak, keycloakBase + "/realms/" + realm + "/protocol/openid-connect/token", keycloakHTTPSBase + "/realms/" + realm + "/protocol/openid-connect/token" -} diff --git a/sdk/go.mod b/sdk/go.mod index e4fe03dfe5..57e9d161cd 100644 --- a/sdk/go.mod +++ b/sdk/go.mod @@ -11,11 +11,9 @@ require ( github.com/gowebpki/jcs v1.0.1 github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3 github.com/lestrrat-go/jwx/v2 v2.1.6 - github.com/opentdf/platform/lib/fixtures v0.4.0 github.com/opentdf/platform/lib/ocrypto v0.10.0 github.com/opentdf/platform/protocol/go v0.16.0 github.com/stretchr/testify v1.11.1 - github.com/testcontainers/testcontainers-go v0.40.0 github.com/xeipuuv/gojsonschema v1.2.0 golang.org/x/oauth2 v0.34.0 golang.org/x/text v0.32.0 @@ -26,71 +24,22 @@ require ( require ( buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.6-20250603165357-b52ab10f4468.1 // indirect - dario.cat/mergo v1.0.2 // indirect - github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect - github.com/Microsoft/go-winio v0.6.2 // indirect - github.com/Nerzal/gocloak/v13 v13.9.0 // indirect - github.com/cenkalti/backoff/v4 v4.3.0 // indirect - github.com/cespare/xxhash/v2 v2.3.0 // indirect - github.com/containerd/errdefs v1.0.0 // indirect - github.com/containerd/errdefs/pkg v0.3.0 // indirect - github.com/containerd/log v0.1.0 // indirect - github.com/containerd/platforms v0.2.1 // indirect - github.com/cpuguy83/dockercfg v0.3.2 // indirect github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect - github.com/distribution/reference v0.6.0 // indirect - github.com/docker/docker v28.5.1+incompatible // indirect - github.com/docker/go-connections v0.6.0 // indirect - github.com/docker/go-units v0.5.0 // indirect - github.com/ebitengine/purego v0.8.4 // indirect - github.com/felixge/httpsnoop v1.0.4 // indirect - github.com/go-logr/logr v1.4.3 // indirect - github.com/go-logr/stdr v1.2.2 // indirect - github.com/go-ole/go-ole v1.3.0 // indirect - github.com/go-resty/resty/v2 v2.16.5 // indirect github.com/goccy/go-json v0.10.5 // indirect - github.com/golang-jwt/jwt/v5 v5.2.2 // indirect github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 // indirect - github.com/klauspost/compress v1.18.0 // indirect github.com/lestrrat-go/blackmagic v1.0.4 // indirect github.com/lestrrat-go/httpcc v1.0.1 // indirect github.com/lestrrat-go/httprc v1.0.6 // indirect github.com/lestrrat-go/iter v1.0.2 // indirect github.com/lestrrat-go/option v1.0.1 // indirect - github.com/lufia/plan9stats v0.0.0-20250317134145-8bc96cf8fc35 // indirect - github.com/magiconair/properties v1.8.10 // indirect - github.com/moby/docker-image-spec v1.3.1 // indirect - github.com/moby/go-archive v0.1.0 // indirect - github.com/moby/patternmatcher v0.6.0 // indirect - github.com/moby/sys/sequential v0.6.0 // indirect - github.com/moby/sys/user v0.4.0 // indirect - github.com/moby/sys/userns v0.1.0 // indirect - github.com/moby/term v0.5.2 // indirect - github.com/morikuni/aec v1.0.0 // indirect - github.com/opencontainers/go-digest v1.0.0 // indirect - github.com/opencontainers/image-spec v1.1.1 // indirect - github.com/opentracing/opentracing-go v1.2.0 // indirect - github.com/pkg/errors v0.9.1 // indirect github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect - github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect + github.com/rogpeppe/go-internal v1.14.1 // indirect github.com/segmentio/asm v1.2.0 // indirect - github.com/segmentio/ksuid v1.0.4 // indirect - github.com/shirou/gopsutil/v4 v4.25.6 // indirect - github.com/sirupsen/logrus v1.9.3 // indirect - github.com/tklauser/go-sysconf v0.3.15 // indirect - github.com/tklauser/numcpus v0.10.0 // indirect github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect - github.com/yusufpapurcu/wmi v1.2.4 // indirect - go.opentelemetry.io/auto/sdk v1.2.1 // indirect - go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect go.opentelemetry.io/otel v1.40.0 // indirect - go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.36.0 // indirect - go.opentelemetry.io/otel/metric v1.40.0 // indirect - go.opentelemetry.io/otel/sdk v1.40.0 // indirect go.opentelemetry.io/otel/sdk/metric v1.40.0 // indirect - go.opentelemetry.io/otel/trace v1.40.0 // indirect golang.org/x/crypto v0.45.0 // indirect golang.org/x/mod v0.30.0 // indirect golang.org/x/net v0.47.0 // indirect diff --git a/sdk/go.sum b/sdk/go.sum index a511d79ef1..220178c2fb 100644 --- a/sdk/go.sum +++ b/sdk/go.sum @@ -2,68 +2,21 @@ buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.6-2025060316535 buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.6-20250603165357-b52ab10f4468.1/go.mod h1:avRlCjnFzl98VPaeCtJ24RrV/wwHFzB8sWXhj26+n/U= connectrpc.com/connect v1.19.1 h1:R5M57z05+90EfEvCY1b7hBxDVOUl45PrtXtAV2fOC14= connectrpc.com/connect v1.19.1/go.mod h1:tN20fjdGlewnSFeZxLKb0xwIZ6ozc3OQs2hTXy4du9w= -dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8= -dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA= -github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk= -github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8= -github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg= -github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E= github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0= github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM= -github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY= -github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU= -github.com/Nerzal/gocloak/v13 v13.9.0 h1:YWsJsdM5b0yhM2Ba3MLydiOlujkBry4TtdzfIzSVZhw= -github.com/Nerzal/gocloak/v13 v13.9.0/go.mod h1:YYuDcXZ7K2zKECyVP7pPqjKxx2AzYSpKDj8d6GuyM10= -github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8= -github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE= -github.com/cenkalti/backoff/v5 v5.0.2 h1:rIfFVxEf1QsI7E1ZHfp/B4DF/6QBAUhmgkxc0H7Zss8= -github.com/cenkalti/backoff/v5 v5.0.2/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw= github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= -github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI= -github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M= -github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE= -github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk= -github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I= -github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo= -github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpSBQv6A= -github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw= -github.com/cpuguy83/dockercfg v0.3.2 h1:DlJTyZGBDlXqUZ2Dk2Q3xHs/FtnooJJVaad2S9GKorA= -github.com/cpuguy83/dockercfg v0.3.2/go.mod h1:sugsbF4//dDlL/i+S+rtpIWp+5h0BHJHfjj5/jFyUJc= -github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY= -github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 h1:NMZiJj8QnKe1LgsbDayM4UoHwbvwDRwnI3hwNaAHRnc= github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0/go.mod h1:ZXNYxsqcloTdSy/rNShjYzMhyjf0LaoftYK0p+A3h40= -github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk= -github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E= -github.com/docker/docker v28.5.1+incompatible h1:Bm8DchhSD2J6PsFzxC35TZo4TLGR2PdW/E69rU45NhM= -github.com/docker/docker v28.5.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk= -github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94= -github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE= -github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4= -github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk= -github.com/ebitengine/purego v0.8.4 h1:CF7LEKg5FFOsASUj0+QwaXf8Ht6TlFxg09+S9wz0omw= -github.com/ebitengine/purego v0.8.4/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ= -github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg= -github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= -github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= -github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0= -github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE= -github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78= -github.com/go-resty/resty/v2 v2.16.5 h1:hBKqmWrr7uRc3euHVqmh1HTHcKn99Smr7o5spptdhTM= -github.com/go-resty/resty/v2 v2.16.5/go.mod h1:hkJtXbA2iKHzJheXYvQ8snQES5ZLGKMwQ07xAwp/fiA= github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4= github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M= -github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8= -github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk= github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek= github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= @@ -76,8 +29,6 @@ github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3 h1:B+8ClL/kCQkRiU82d9xajR github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3/go.mod h1:NbCUVmiS4foBGBHOYlCT25+YmGpJ32dZPi75pGEUpj4= github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 h1:5ZPtiqj0JL5oKWmcsq4VMaAW5ukBEgSGXEN89zeH1Jo= github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3/go.mod h1:ndYquD05frm2vACXE1nsccT4oJzjhw2arTS2cpUD1PI= -github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo= -github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= @@ -94,72 +45,24 @@ github.com/lestrrat-go/jwx/v2 v2.1.6 h1:hxM1gfDILk/l5ylers6BX/Eq1m/pnxe9NBwW6lVf github.com/lestrrat-go/jwx/v2 v2.1.6/go.mod h1:Y722kU5r/8mV7fYDifjug0r8FK8mZdw0K0GpJw/l8pU= github.com/lestrrat-go/option v1.0.1 h1:oAzP2fvZGQKWkvHa1/SAcFolBEca1oN+mQ7eooNBEYU= github.com/lestrrat-go/option v1.0.1/go.mod h1:5ZHFbivi4xwXxhxY9XHDe2FHo6/Z7WWmtT7T5nBBp3I= -github.com/lufia/plan9stats v0.0.0-20250317134145-8bc96cf8fc35 h1:PpXWgLPs+Fqr325bN2FD2ISlRRztXibcX6e8f5FR5Dc= -github.com/lufia/plan9stats v0.0.0-20250317134145-8bc96cf8fc35/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg= -github.com/magiconair/properties v1.8.10 h1:s31yESBquKXCV9a/ScB3ESkOjUYYv+X0rg8SYxI99mE= -github.com/magiconair/properties v1.8.10/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0= -github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0= -github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo= -github.com/moby/go-archive v0.1.0 h1:Kk/5rdW/g+H8NHdJW2gsXyZ7UnzvJNOy6VKJqueWdcQ= -github.com/moby/go-archive v0.1.0/go.mod h1:G9B+YoujNohJmrIYFBpSd54GTUB4lt9S+xVQvsJyFuo= -github.com/moby/patternmatcher v0.6.0 h1:GmP9lR19aU5GqSSFko+5pRqHi+Ohk1O69aFiKkVGiPk= -github.com/moby/patternmatcher v0.6.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc= -github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw= -github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs= -github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU= -github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko= -github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs= -github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs= -github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g= -github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28= -github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ= -github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc= -github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A= -github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc= -github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U= -github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM= -github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040= -github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M= -github.com/opentdf/platform/lib/fixtures v0.4.0 h1:p3Y5MLJEBaWiSmo+QyRNTirvI8LqYDj+HtaE9vYrEJ8= -github.com/opentdf/platform/lib/fixtures v0.4.0/go.mod h1:ctyrVn+eTObHAPy3vrdPO0O1mc3vgQ6lc9pBTdhBAfo= github.com/opentdf/platform/lib/ocrypto v0.10.0 h1:7dn/z/1qH3p+gWCrfOoU7hj9XF/p5N+b2JBJuWF9aK0= github.com/opentdf/platform/lib/ocrypto v0.10.0/go.mod h1:WASkoHreqgTFImB/gJW42VTdpi9AkgkmaW19y/fU+Ew= github.com/opentdf/platform/protocol/go v0.16.0 h1:/EumdEZY7ujYyQF+EzCBCtIMiJPvGIZpgFgg8bORiFk= github.com/opentdf/platform/protocol/go v0.16.0/go.mod h1:4lsBu86yrOWdhqIko8/x5ndamOtM8iDNZYBguF9ZiQQ= -github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs= -github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc= -github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= -github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU= -github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= github.com/segmentio/asm v1.2.0 h1:9BQrFxC+YOHJlTlHGkTrFWf59nbL3XnCoFLTwDCI7ys= github.com/segmentio/asm v1.2.0/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs= -github.com/segmentio/ksuid v1.0.4 h1:sBo2BdShXjmcugAMwjugoGUdUV0pcxY5mW4xKRn3v4c= -github.com/segmentio/ksuid v1.0.4/go.mod h1:/XUiZBD3kVx5SmUOl55voK5yeAbBNNIed+2O73XgrPE= -github.com/shirou/gopsutil/v4 v4.25.6 h1:kLysI2JsKorfaFPcYmcJqbzROzsBWEOAtw6A7dIfqXs= -github.com/shirou/gopsutil/v4 v4.25.6/go.mod h1:PfybzyydfZcN+JMMjkF6Zb8Mq1A/VcogFFg7hj50W9c= -github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ= -github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= -github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY= -github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= -github.com/testcontainers/testcontainers-go v0.40.0 h1:pSdJYLOVgLE8YdUY2FHQ1Fxu+aMnb6JfVz1mxk7OeMU= -github.com/testcontainers/testcontainers-go v0.40.0/go.mod h1:FSXV5KQtX2HAMlm7U3APNyLkkap35zNLxukw9oBi/MY= -github.com/tklauser/go-sysconf v0.3.15 h1:VE89k0criAymJ/Os65CSn1IXaol+1wrsFHEB8Ol49K4= -github.com/tklauser/go-sysconf v0.3.15/go.mod h1:Dmjwr6tYFIseJw7a3dRLJfsHAMXZ3nEnL/aZY+0IuI4= -github.com/tklauser/numcpus v0.10.0 h1:18njr6LDBk1zuna922MgdjQuJFjrdppsZG60sHGfjso= -github.com/tklauser/numcpus v0.10.0/go.mod h1:BiTKazU708GQTYF4mB+cmlpT2Is1gLk7XVuEeem8LsQ= github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU= github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo= github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU= @@ -167,18 +70,10 @@ github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHo github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ= github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74= github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y= -github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0= -github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q= go.opentelemetry.io/otel v1.40.0 h1:oA5YeOcpRTXq6NN7frwmwFR0Cn3RhTVZvXsP4duvCms= go.opentelemetry.io/otel v1.40.0/go.mod h1:IMb+uXZUKkMXdPddhwAHm6UfOwJyh4ct1ybIlV14J0g= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.36.0 h1:dNzwXjZKpMpE2JhmO+9HsPl42NIXFIFSUSSs0fiqra0= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.36.0/go.mod h1:90PoxvaEB5n6AOdZvi+yWJQoE95U8Dhhw2bSyRqnTD0= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.36.0 h1:nRVXXvf78e00EwY6Wp0YII8ww2JVWshZ20HfTlE11AM= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.36.0/go.mod h1:r49hO7CgrxY9Voaj3Xe8pANWtr0Oq916d0XAmOoCZAQ= go.opentelemetry.io/otel/metric v1.40.0 h1:rcZe317KPftE2rstWIBitCdVp89A2HqjkxR3c11+p9g= go.opentelemetry.io/otel/metric v1.40.0/go.mod h1:ib/crwQH7N3r5kfiBZQbwrTge743UDc7DTFVZrrXnqc= go.opentelemetry.io/otel/sdk v1.40.0 h1:KHW/jUzgo6wsPh9At46+h4upjtccTmuZCFAc9OJ71f8= @@ -187,8 +82,6 @@ go.opentelemetry.io/otel/sdk/metric v1.40.0 h1:mtmdVqgQkeRxHgRv4qhyJduP3fYJRMX4A go.opentelemetry.io/otel/sdk/metric v1.40.0/go.mod h1:4Z2bGMf0KSK3uRjlczMOeMhKU2rhUqdWNoKcYrtcBPg= go.opentelemetry.io/otel/trace v1.40.0 h1:WA4etStDttCSYuhwvEa8OP8I5EWu24lkOzp+ZYblVjw= go.opentelemetry.io/otel/trace v1.40.0/go.mod h1:zeAhriXecNGP/s2SEG3+Y8X9ujcJOTqQ5RgdEJcawiA= -go.opentelemetry.io/proto/otlp v1.6.0 h1:jQjP+AQyTf+Fe7OKj/MfkDrmK4MNVtw2NpXsf9fefDI= -go.opentelemetry.io/proto/otlp v1.6.0/go.mod h1:cicgGehlFuNdgZkcALOCh3VE6K/u2tAjzlRhDwmVpZc= golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q= golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4= golang.org/x/mod v0.30.0 h1:fDEXFVZ/fmCKProc/yAXXUijritrDzahmwwefnjoPFk= @@ -199,19 +92,10 @@ golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw= golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA= golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4= golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= -golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ= golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= -golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU= -golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254= golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU= golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY= -golang.org/x/time v0.6.0 h1:eTDhh4ZXt5Qf0augr54TN6suAUudPcawVZeIAPU7D4U= -golang.org/x/time v0.6.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM= golang.org/x/tools v0.39.0 h1:ik4ho21kwuQln40uelmciQPp9SipgNDdrafrYA4TmQQ= golang.org/x/tools v0.39.0/go.mod h1:JnefbkDPyD8UU2kI5fuf8ZX4/yUeh9W877ZeBONxUqQ= gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk= @@ -230,5 +114,3 @@ gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EV gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q= -gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA= diff --git a/test/integration/go.mod b/test/integration/go.mod new file mode 100644 index 0000000000..ce75fddc3a --- /dev/null +++ b/test/integration/go.mod @@ -0,0 +1,92 @@ +module github.com/opentdf/platform/test/integration + +go 1.25.0 + +toolchain go1.25.8 + +replace ( + github.com/opentdf/platform/lib/fixtures => ../../lib/fixtures + github.com/opentdf/platform/lib/ocrypto => ../../lib/ocrypto + github.com/opentdf/platform/protocol/go => ../../protocol/go + github.com/opentdf/platform/sdk => ../../sdk +) + +require ( + github.com/lestrrat-go/jwx/v2 v2.1.6 + github.com/opentdf/platform/lib/fixtures v0.0.0-00010101000000-000000000000 + github.com/opentdf/platform/sdk v0.0.0-00010101000000-000000000000 + github.com/stretchr/testify v1.11.1 + github.com/testcontainers/testcontainers-go v0.41.0 +) + +require ( + dario.cat/mergo v1.0.2 // indirect + github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect + github.com/Microsoft/go-winio v0.6.2 // indirect + github.com/Nerzal/gocloak/v13 v13.9.0 // indirect + github.com/cenkalti/backoff/v4 v4.3.0 // indirect + github.com/cenkalti/backoff/v5 v5.0.3 // indirect + github.com/cespare/xxhash/v2 v2.3.0 // indirect + github.com/containerd/errdefs v1.0.0 // indirect + github.com/containerd/errdefs/pkg v0.3.0 // indirect + github.com/containerd/log v0.1.0 // indirect + github.com/containerd/platforms v0.2.1 // indirect + github.com/cpuguy83/dockercfg v0.3.2 // indirect + github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect + github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect + github.com/distribution/reference v0.6.0 // indirect + github.com/docker/docker v28.5.2+incompatible // indirect + github.com/docker/go-connections v0.6.0 // indirect + github.com/docker/go-units v0.5.0 // indirect + github.com/ebitengine/purego v0.10.0 // indirect + github.com/felixge/httpsnoop v1.0.4 // indirect + github.com/go-logr/logr v1.4.3 // indirect + github.com/go-logr/stdr v1.2.2 // indirect + github.com/go-ole/go-ole v1.2.6 // indirect + github.com/go-resty/resty/v2 v2.12.0 // indirect + github.com/goccy/go-json v0.10.5 // indirect + github.com/golang-jwt/jwt/v5 v5.2.2 // indirect + github.com/google/uuid v1.6.0 // indirect + github.com/klauspost/compress v1.18.2 // indirect + github.com/lestrrat-go/blackmagic v1.0.4 // indirect + github.com/lestrrat-go/httpcc v1.0.1 // indirect + github.com/lestrrat-go/httprc v1.0.6 // indirect + github.com/lestrrat-go/iter v1.0.2 // indirect + github.com/lestrrat-go/option v1.0.1 // indirect + github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect + github.com/magiconair/properties v1.8.10 // indirect + github.com/moby/docker-image-spec v1.3.1 // indirect + github.com/moby/go-archive v0.2.0 // indirect + github.com/moby/patternmatcher v0.6.0 // indirect + github.com/moby/sys/sequential v0.6.0 // indirect + github.com/moby/sys/user v0.4.0 // indirect + github.com/moby/sys/userns v0.1.0 // indirect + github.com/moby/term v0.5.2 // indirect + github.com/morikuni/aec v1.0.0 // indirect + github.com/opencontainers/go-digest v1.0.0 // indirect + github.com/opencontainers/image-spec v1.1.1 // indirect + github.com/opentracing/opentracing-go v1.2.0 // indirect + github.com/pkg/errors v0.9.1 // indirect + github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect + github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect + github.com/segmentio/asm v1.2.0 // indirect + github.com/segmentio/ksuid v1.0.4 // indirect + github.com/shirou/gopsutil/v4 v4.26.2 // indirect + github.com/sirupsen/logrus v1.9.3 // indirect + github.com/tklauser/go-sysconf v0.3.16 // indirect + github.com/tklauser/numcpus v0.11.0 // indirect + github.com/yusufpapurcu/wmi v1.2.4 // indirect + go.opentelemetry.io/auto/sdk v1.2.1 // indirect + go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 // indirect + go.opentelemetry.io/otel v1.42.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0 // indirect + go.opentelemetry.io/otel/metric v1.42.0 // indirect + go.opentelemetry.io/otel/sdk v1.42.0 // indirect + go.opentelemetry.io/otel/trace v1.42.0 // indirect + go.opentelemetry.io/proto/otlp v1.10.0 // indirect + golang.org/x/crypto v0.48.0 // indirect + golang.org/x/net v0.50.0 // indirect + golang.org/x/sys v0.41.0 // indirect + google.golang.org/protobuf v1.36.11 // indirect + gopkg.in/yaml.v3 v3.0.1 // indirect +) diff --git a/test/integration/go.sum b/test/integration/go.sum new file mode 100644 index 0000000000..c1ed9b3541 --- /dev/null +++ b/test/integration/go.sum @@ -0,0 +1,241 @@ +dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8= +dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA= +github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk= +github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8= +github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg= +github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E= +github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY= +github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU= +github.com/Nerzal/gocloak/v13 v13.9.0 h1:YWsJsdM5b0yhM2Ba3MLydiOlujkBry4TtdzfIzSVZhw= +github.com/Nerzal/gocloak/v13 v13.9.0/go.mod h1:YYuDcXZ7K2zKECyVP7pPqjKxx2AzYSpKDj8d6GuyM10= +github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8= +github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE= +github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM= +github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw= +github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= +github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= +github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI= +github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M= +github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE= +github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk= +github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I= +github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo= +github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpSBQv6A= +github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw= +github.com/cpuguy83/dockercfg v0.3.2 h1:DlJTyZGBDlXqUZ2Dk2Q3xHs/FtnooJJVaad2S9GKorA= +github.com/cpuguy83/dockercfg v0.3.2/go.mod h1:sugsbF4//dDlL/i+S+rtpIWp+5h0BHJHfjj5/jFyUJc= +github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY= +github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4= +github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= +github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 h1:NMZiJj8QnKe1LgsbDayM4UoHwbvwDRwnI3hwNaAHRnc= +github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0/go.mod h1:ZXNYxsqcloTdSy/rNShjYzMhyjf0LaoftYK0p+A3h40= +github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk= +github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E= +github.com/docker/docker v28.5.2+incompatible h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM= +github.com/docker/docker v28.5.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk= +github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94= +github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE= +github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4= +github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk= +github.com/ebitengine/purego v0.10.0 h1:QIw4xfpWT6GWTzaW5XEKy3HXoqrJGx1ijYHzTF0/ISU= +github.com/ebitengine/purego v0.10.0/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ= +github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg= +github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= +github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= +github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= +github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= +github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= +github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY= +github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0= +github.com/go-resty/resty/v2 v2.12.0 h1:rsVL8P90LFvkUYq/V5BTVe203WfRIU4gvcf+yfzJzGA= +github.com/go-resty/resty/v2 v2.12.0/go.mod h1:o0yGPrkS3lOe1+eFajk6kBW8ScXzwU3hD69/gt2yB/0= +github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4= +github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M= +github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8= +github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk= +github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= +github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= +github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= +github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= +github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 h1:HWRh5R2+9EifMyIHV7ZV+MIZqgz+PMpZ14Jynv3O2Zs= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0/go.mod h1:JfhWUomR1baixubs02l85lZYYOm7LV6om4ceouMv45c= +github.com/klauspost/compress v1.18.2 h1:iiPHWW0YrcFgpBYhsA6D1+fqHssJscY/Tm/y2Uqnapk= +github.com/klauspost/compress v1.18.2/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4= +github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= +github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= +github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= +github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= +github.com/lestrrat-go/blackmagic v1.0.4 h1:IwQibdnf8l2KoO+qC3uT4OaTWsW7tuRQXy9TRN9QanA= +github.com/lestrrat-go/blackmagic v1.0.4/go.mod h1:6AWFyKNNj0zEXQYfTMPfZrAXUWUfTIZ5ECEUEJaijtw= +github.com/lestrrat-go/httpcc v1.0.1 h1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZrIE= +github.com/lestrrat-go/httpcc v1.0.1/go.mod h1:qiltp3Mt56+55GPVCbTdM9MlqhvzyuL6W/NMDA8vA5E= +github.com/lestrrat-go/httprc v1.0.6 h1:qgmgIRhpvBqexMJjA/PmwSvhNk679oqD1RbovdCGW8k= +github.com/lestrrat-go/httprc v1.0.6/go.mod h1:mwwz3JMTPBjHUkkDv/IGJ39aALInZLrhBp0X7KGUZlo= +github.com/lestrrat-go/iter v1.0.2 h1:gMXo1q4c2pHmC3dn8LzRhJfP1ceCbgSiT9lUydIzltI= +github.com/lestrrat-go/iter v1.0.2/go.mod h1:Momfcq3AnRlRjI5b5O8/G5/BvpzrhoFTZcn06fEOPt4= +github.com/lestrrat-go/jwx/v2 v2.1.6 h1:hxM1gfDILk/l5ylers6BX/Eq1m/pnxe9NBwW6lVfecA= +github.com/lestrrat-go/jwx/v2 v2.1.6/go.mod h1:Y722kU5r/8mV7fYDifjug0r8FK8mZdw0K0GpJw/l8pU= +github.com/lestrrat-go/option v1.0.1 h1:oAzP2fvZGQKWkvHa1/SAcFolBEca1oN+mQ7eooNBEYU= +github.com/lestrrat-go/option v1.0.1/go.mod h1:5ZHFbivi4xwXxhxY9XHDe2FHo6/Z7WWmtT7T5nBBp3I= +github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 h1:6E+4a0GO5zZEnZ81pIr0yLvtUWk2if982qA3F3QD6H4= +github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0/go.mod h1:zJYVVT2jmtg6P3p1VtQj7WsuWi/y4VnjVBn7F8KPB3I= +github.com/magiconair/properties v1.8.10 h1:s31yESBquKXCV9a/ScB3ESkOjUYYv+X0rg8SYxI99mE= +github.com/magiconair/properties v1.8.10/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0= +github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0= +github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo= +github.com/moby/go-archive v0.2.0 h1:zg5QDUM2mi0JIM9fdQZWC7U8+2ZfixfTYoHL7rWUcP8= +github.com/moby/go-archive v0.2.0/go.mod h1:mNeivT14o8xU+5q1YnNrkQVpK+dnNe/K6fHqnTg4qPU= +github.com/moby/patternmatcher v0.6.0 h1:GmP9lR19aU5GqSSFko+5pRqHi+Ohk1O69aFiKkVGiPk= +github.com/moby/patternmatcher v0.6.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc= +github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw= +github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs= +github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU= +github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko= +github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs= +github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs= +github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g= +github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28= +github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ= +github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc= +github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A= +github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc= +github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U= +github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM= +github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040= +github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M= +github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs= +github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc= +github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= +github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= +github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= +github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU= +github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE= +github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= +github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= +github.com/segmentio/asm v1.2.0 h1:9BQrFxC+YOHJlTlHGkTrFWf59nbL3XnCoFLTwDCI7ys= +github.com/segmentio/asm v1.2.0/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs= +github.com/segmentio/ksuid v1.0.4 h1:sBo2BdShXjmcugAMwjugoGUdUV0pcxY5mW4xKRn3v4c= +github.com/segmentio/ksuid v1.0.4/go.mod h1:/XUiZBD3kVx5SmUOl55voK5yeAbBNNIed+2O73XgrPE= +github.com/shirou/gopsutil/v4 v4.26.2 h1:X8i6sicvUFih4BmYIGT1m2wwgw2VG9YgrDTi7cIRGUI= +github.com/shirou/gopsutil/v4 v4.26.2/go.mod h1:LZ6ewCSkBqUpvSOf+LsTGnRinC6iaNUNMGBtDkJBaLQ= +github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ= +github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ= +github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= +github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY= +github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA= +github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= +github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= +github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= +github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= +github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= +github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= +github.com/testcontainers/testcontainers-go v0.41.0 h1:mfpsD0D36YgkxGj2LrIyxuwQ9i2wCKAD+ESsYM1wais= +github.com/testcontainers/testcontainers-go v0.41.0/go.mod h1:pdFrEIfaPl24zmBjerWTTYaY0M6UHsqA1YSvsoU40MI= +github.com/tklauser/go-sysconf v0.3.16 h1:frioLaCQSsF5Cy1jgRBrzr6t502KIIwQ0MArYICU0nA= +github.com/tklauser/go-sysconf v0.3.16/go.mod h1:/qNL9xxDhc7tx3HSRsLWNnuzbVfh3e7gh/BmM179nYI= +github.com/tklauser/numcpus v0.11.0 h1:nSTwhKH5e1dMNsCdVBukSZrURJRoHbSEQjdEbY+9RXw= +github.com/tklauser/numcpus v0.11.0/go.mod h1:z+LwcLq54uWZTX0u/bGobaV34u6V7KNlTZejzM6/3MQ= +github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= +github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0= +github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0= +go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= +go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 h1:jq9TW8u3so/bN+JPT166wjOI6/vQPF6Xe7nMNIltagk= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0/go.mod h1:p8pYQP+m5XfbZm9fxtSKAbM6oIllS7s2AfxrChvc7iw= +go.opentelemetry.io/otel v1.42.0 h1:lSQGzTgVR3+sgJDAU/7/ZMjN9Z+vUip7leaqBKy4sho= +go.opentelemetry.io/otel v1.42.0/go.mod h1:lJNsdRMxCUIWuMlVJWzecSMuNjE7dOYyWlqOXWkdqCc= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0 h1:THuZiwpQZuHPul65w4WcwEnkX2QIuMT+UFoOrygtoJw= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0/go.mod h1:J2pvYM5NGHofZ2/Ru6zw/TNWnEQp5crgyDeSrYpXkAw= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.41.0 h1:inYW9ZhgqiDqh6BioM7DVHHzEGVq76Db5897WLGZ5Go= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.41.0/go.mod h1:Izur+Wt8gClgMJqO/cZ8wdeeMryJ/xxiOVgFSSfpDTY= +go.opentelemetry.io/otel/metric v1.42.0 h1:2jXG+3oZLNXEPfNmnpxKDeZsFI5o4J+nz6xUlaFdF/4= +go.opentelemetry.io/otel/metric v1.42.0/go.mod h1:RlUN/7vTU7Ao/diDkEpQpnz3/92J9ko05BIwxYa2SSI= +go.opentelemetry.io/otel/sdk v1.42.0 h1:LyC8+jqk6UJwdrI/8VydAq/hvkFKNHZVIWuslJXYsDo= +go.opentelemetry.io/otel/sdk v1.42.0/go.mod h1:rGHCAxd9DAph0joO4W6OPwxjNTYWghRWmkHuGbayMts= +go.opentelemetry.io/otel/trace v1.42.0 h1:OUCgIPt+mzOnaUTpOQcBiM/PLQ/Op7oq6g4LenLmOYY= +go.opentelemetry.io/otel/trace v1.42.0/go.mod h1:f3K9S+IFqnumBkKhRJMeaZeNk9epyhnCmQh/EysQCdc= +go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g= +go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk= +golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= +golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= +golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU= +golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs= +golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts= +golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos= +golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= +golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= +golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= +golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= +golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= +golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg= +golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44= +golang.org/x/net v0.22.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg= +golang.org/x/net v0.50.0 h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60= +golang.org/x/net v0.50.0/go.mod h1:UgoSli3F/pBgdJBHCTc+tp3gmrU4XswgGRgtnwWTfyM= +golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= +golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= +golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= +golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k= +golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= +golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= +golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= +golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= +golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo= +golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk= +golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58= +golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg= +golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM= +golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= +golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= +golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= +golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= +golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= +golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= +golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk= +golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA= +golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM= +golang.org/x/time v0.6.0 h1:eTDhh4ZXt5Qf0augr54TN6suAUudPcawVZeIAPU7D4U= +golang.org/x/time v0.6.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM= +golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= +golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= +golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= +golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= +golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57 h1:JLQynH/LBHfCTSbDWl+py8C+Rg/k1OVH3xfcaiANuF0= +google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57/go.mod h1:kSJwQxqmFXeo79zOmbrALdflXQeAYcUbgS7PbpMknCY= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260209200024-4cfbd4190f57 h1:mWPCjDEyshlQYzBpMNHaEof6UX1PmHcaUODUywQ0uac= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260209200024-4cfbd4190f57/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ= +google.golang.org/grpc v1.79.2 h1:fRMD94s2tITpyJGtBBn7MkMseNpOZU8ZxgC3MMBaXRU= +google.golang.org/grpc v1.79.2/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ= +google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= +google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= +gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= +gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q= +gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= +gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= +gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= +gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q= +gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA= diff --git a/test/integration/oauth/oauth_test.go b/test/integration/oauth/oauth_test.go new file mode 100644 index 0000000000..db3abd0742 --- /dev/null +++ b/test/integration/oauth/oauth_test.go @@ -0,0 +1,575 @@ +package oauth_test + +import ( + "context" + "crypto" + "crypto/rand" + "crypto/rsa" + "crypto/tls" + "crypto/x509" + _ "embed" + "encoding/base64" + "encoding/json" + "net/http" + "net/http/httptest" + "os" + "slices" + "testing" + "time" + + "github.com/lestrrat-go/jwx/v2/jwa" + "github.com/lestrrat-go/jwx/v2/jwk" + "github.com/lestrrat-go/jwx/v2/jws" + "github.com/lestrrat-go/jwx/v2/jwt" + "github.com/opentdf/platform/lib/fixtures" + "github.com/opentdf/platform/sdk/auth/oauth" + "github.com/opentdf/platform/sdk/httputil" + "github.com/stretchr/testify/require" + "github.com/stretchr/testify/suite" + tc "github.com/testcontainers/testcontainers-go" + "github.com/testcontainers/testcontainers-go/wait" +) + +type OAuthSuite struct { + suite.Suite + dpopJWK jwk.Key + keycloakContainer tc.Container + keycloakEndpoint string + keycloakHTTPSEndpoint string +} + +func TestOAuthTestSuite(t *testing.T) { + suite.Run(t, new(OAuthSuite)) +} + +func (s *OAuthSuite) SetupSuite() { + // Generate RSA Key to use for DPoP + dpopKey, err := rsa.GenerateKey(rand.Reader, 4096) + if err != nil { + panic(err) + } + + dpopJWK, err := jwk.FromRaw(dpopKey) + s.Require().NoError(err) + s.Require().NoError(dpopJWK.Set("use", "sig")) + s.Require().NoError(dpopJWK.Set("alg", jwa.RS256.String())) + + s.dpopJWK = dpopJWK + ctx := context.Background() + + keycloak, idpEndpoint, idpHTTPSEndpoint := setupKeycloak(ctx, s.T()) + s.keycloakContainer = keycloak + s.keycloakEndpoint = idpEndpoint + s.keycloakHTTPSEndpoint = idpHTTPSEndpoint +} + +func (s *OAuthSuite) TearDownSuite() { + _ = s.keycloakContainer.Terminate(context.Background()) +} + +//go:embed testdata/new-ca.crt +var ca []byte + +func (s *OAuthSuite) TestCertExchangeFromKeycloak() { + clientCredentials := oauth.ClientCredentials{ + ClientID: "opentdf-sdk", + ClientAuth: "secret", + } + cert, err := tls.LoadX509KeyPair("testdata/sampleuser.crt", "testdata/sampleuser.key") + rootCAs, _ := x509.SystemCertPool() + rootCAs.AppendCertsFromPEM(ca) + s.Require().NoError(err) + tlsConfig := &tls.Config{ + MinVersion: tls.VersionTLS12, + Certificates: []tls.Certificate{cert}, + RootCAs: rootCAs, + } + exhcangeInfo := oauth.CertExchangeInfo{ + HTTPClient: httputil.SafeHTTPClientWithTLSConfig(tlsConfig), + Audience: []string{"opentdf-sdk"}, + } + + tok, err := oauth.DoCertExchange( + context.Background(), + s.keycloakHTTPSEndpoint, + exhcangeInfo, + clientCredentials, + s.dpopJWK) + s.Require().NoError(err) + + tokenDetails, err := jwt.ParseString(tok.AccessToken, jwt.WithVerify(false)) + s.Require().NoError(err) + + cnfClaim, ok := tokenDetails.Get("cnf") + s.Require().True(ok) + cnfClaimsMap, ok := cnfClaim.(map[string]interface{}) + s.Require().True(ok) + idpKeyFingerprint, ok := cnfClaimsMap["jkt"].(string) + s.Require().True(ok) + s.Require().NotEmpty(idpKeyFingerprint) + pk, err := s.dpopJWK.PublicKey() + s.Require().NoError(err) + hash, err := pk.Thumbprint(crypto.SHA256) + s.Require().NoError(err) + + expectedThumbprint := base64.URLEncoding.WithPadding(base64.NoPadding).EncodeToString(hash) + s.Equal(expectedThumbprint, idpKeyFingerprint, "didn't get expected fingerprint") + s.Positivef(tok.ExpiresIn, "invalid expiration is before current time: %v", tok) + s.Falsef(tok.Expired(), "got a token that is currently expired: %v", tok) + + name, ok := tokenDetails.Get("name") + s.Require().True(ok) + s.Equal("sample user", name, "got unexpected name") +} + +func (s *OAuthSuite) TestGettingAccessTokenFromKeycloak() { + clientCredentials := oauth.ClientCredentials{ + ClientID: "opentdf-sdk", + ClientAuth: "secret", + } + + tok, err := oauth.GetAccessToken( + http.DefaultClient, + s.keycloakEndpoint, + []string{"testscope"}, + clientCredentials, + s.dpopJWK) + + s.Require().NoError(err) + + tokenDetails, err := jwt.ParseString(tok.AccessToken, jwt.WithVerify(false)) + s.Require().NoError(err) + + cnfClaim, ok := tokenDetails.Get("cnf") + s.Require().True(ok) + cnfClaimsMap, ok := cnfClaim.(map[string]interface{}) + s.Require().True(ok) + idpKeyFingerprint, ok := cnfClaimsMap["jkt"].(string) + s.Require().True(ok) + s.Require().NotEmpty(idpKeyFingerprint) + pk, err := s.dpopJWK.PublicKey() + s.Require().NoError(err) + hash, err := pk.Thumbprint(crypto.SHA256) + s.Require().NoError(err) + + scope, ok := tokenDetails.Get("scope") + s.Require().True(ok) + scopeString, ok := scope.(string) + s.Require().True(ok) + s.Require().Contains(scopeString, "testscope") + + expectedThumbprint := base64.URLEncoding.WithPadding(base64.NoPadding).EncodeToString(hash) + s.Equal(expectedThumbprint, idpKeyFingerprint, "didn't get expected fingerprint") + s.Positivef(tok.ExpiresIn, "invalid expiration is before current time: %v", tok) + s.Falsef(tok.Expired(), "got a token that is currently expired: %v", tok) + + // verify that we got a token that has the opentdf-standard role, which only the sdk client has + ra, ok := tokenDetails.Get("realm_access") + s.Require().True(ok) + raMap, ok := ra.(map[string]interface{}) + s.Require().True(ok) + roles, ok := raMap["roles"] + s.Require().True(ok) + rolesList, ok := roles.([]interface{}) + s.Require().True(ok) + s.Require().True(slices.Contains(rolesList, "opentdf-standard"), "missing the `opentdf-standard` role") +} + +func (s *OAuthSuite) TestDoingTokenExchangeWithKeycloak() { + ctx := context.Background() + + clientCredentials := oauth.ClientCredentials{ + ClientID: "opentdf-sdk", + ClientAuth: "secret", + } + + subjectToken, err := oauth.GetAccessToken( + http.DefaultClient, + s.keycloakEndpoint, + []string{"testscope"}, + clientCredentials, + s.dpopJWK) + s.Require().NoError(err) + + exchangeCredentials := oauth.ClientCredentials{ + ClientID: "opentdf", + ClientAuth: "secret", + } + + tokenExchange := oauth.TokenExchangeInfo{ + SubjectToken: subjectToken.AccessToken, + Audience: []string{"opentdf-sdk"}, + } + + exchangedTok, err := oauth.DoTokenExchange(ctx, http.DefaultClient, s.keycloakEndpoint, []string{}, exchangeCredentials, tokenExchange, s.dpopJWK) + s.Require().NoError(err) + + tokenDetails, err := jwt.ParseString(exchangedTok.AccessToken, jwt.WithVerify(false)) + s.Require().NoError(err) + + cnfClaim, ok := tokenDetails.Get("cnf") + s.Require().True(ok) + cnfClaimsMap, ok := cnfClaim.(map[string]interface{}) + s.Require().True(ok) + idpKeyFingerprint, ok := cnfClaimsMap["jkt"].(string) + s.Require().True(ok) + s.Require().NotEmpty(idpKeyFingerprint) + pk, err := s.dpopJWK.PublicKey() + s.Require().NoError(err) + hash, err := pk.Thumbprint(crypto.SHA256) + s.Require().NoError(err) + + expectedThumbprint := base64.URLEncoding.WithPadding(base64.NoPadding).EncodeToString(hash) + s.Equal(expectedThumbprint, idpKeyFingerprint, "didn't get expected fingerprint") + s.Positivef(subjectToken.ExpiresIn, "invalid expiration is before current time: %v", subjectToken) + s.Falsef(subjectToken.Expired(), "got a token that is currently expired: %v", subjectToken) + + // verify that we got a token that has the opentdf-standard role, which only the sdk client has + ra, ok := tokenDetails.Get("realm_access") + s.Require().True(ok) + raMap, ok := ra.(map[string]interface{}) + s.Require().True(ok) + roles, ok := raMap["roles"] + s.Require().True(ok) + rolesList, ok := roles.([]interface{}) + s.Require().True(ok) + s.Require().True(slices.Contains(rolesList, "opentdf-standard"), "missing the `opentdf-standard` role") + + // verify that the calling client is the authorized party + azpClaim, ok := tokenDetails.Get("azp") + s.Require().True(ok) + s.Require().Equal(exchangeCredentials.ClientID, azpClaim) + + // verify that the exchanged token has a scope that is only allowed for the client that got the original token + scope, ok := tokenDetails.Get("scope") + s.Require().True(ok) + scopeString, ok := scope.(string) + s.Require().True(ok) + s.Require().Contains(scopeString, "testscope") +} + +func (s *OAuthSuite) TestClientSecretNoNonce() { + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + s.Equal("/token", r.URL.Path) + s.NoError(r.ParseForm()) + + validateBasicAuth(r, s.T()) + extractDPoPToken(r, s.T()) + + tok, err := jwt.NewBuilder(). + Issuer("example.org/fake"). + IssuedAt(time.Now()). + Build() + s.NoError(err) + + responseBytes, err := json.Marshal(tok) + s.NoError(err, "error writing response") + + w.Header().Add("Content-Type", "application/json") + _, err = w.Write(responseBytes) + s.NoError(err) + })) + defer server.Close() + + clientCredentials := oauth.ClientCredentials{ + ClientID: "theclient", + ClientAuth: "thesecret", + } + _, err := oauth.GetAccessToken(http.DefaultClient, server.URL+"/token", []string{"scope1", "scope2"}, clientCredentials, s.dpopJWK) + s.Require().NoError(err, "didn't get a token back from the IdP") +} + +func (s *OAuthSuite) TestClientSecretWithNonce() { + timesCalled := 0 + + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + timesCalled++ + s.Equal("/token", r.URL.Path, "surprise http request to mock oauth service") + err := r.ParseForm() + s.NoError(err, "error parsing oauth request") + + validateBasicAuth(r, s.T()) + + if timesCalled == 1 { + w.Header().Add("DPoP-Nonce", "dfdffdfddf") + w.WriteHeader(http.StatusBadRequest) + _, err := w.Write([]byte{}) + s.NoError(err, "error writing response") + return + } else if timesCalled > 2 { + s.T().Logf("made more than two calls to the server: %d", timesCalled) + return + } + + // get the key we used to sign the DPoP token from the header + clientTok := extractDPoPToken(r, s.T()) + + nonce, exists := clientTok.Get("nonce") + if !exists { + s.T().Logf("didn't get nonce assertion") + } + + if nonceStr, ok := nonce.(string); ok { + if nonceStr != "dfdffdfddf" { + s.T().Errorf("Got incorrect nonce: %v", nonce) + } + } else { + s.T().Errorf("Nonce is not a string") + } + + tok, _ := jwt.NewBuilder(). + Issuer("example.org/fake"). + IssuedAt(time.Now()). + Build() + + responseBytes, err := json.Marshal(tok) + if err != nil { + s.T().Errorf("error writing response: %v", err) + } + + w.Header().Add("Content-Type", "application/json") + l, err := w.Write(responseBytes) + s.Len(responseBytes, l) + s.NoError(err) + })) + defer server.Close() + + clientCredentials := oauth.ClientCredentials{ + ClientID: "theclient", + ClientAuth: "thesecret", + } + _, err := oauth.GetAccessToken(http.DefaultClient, server.URL+"/token", []string{"scope1", "scope2"}, clientCredentials, s.dpopJWK) + if err != nil { + s.T().Errorf("didn't get a token back from the IdP: %v", err) + } +} + +func (s *OAuthSuite) TestSignedJWTWithNonce() { + // Generate RSA Key to use for DPoP + dpopKey, err := rsa.GenerateKey(rand.Reader, 4096) + s.Require().NoError(err, "error generating dpop key") + dpopJWK, err := jwk.FromRaw(dpopKey) + s.Require().NoError(err) + s.Require().NoError(dpopJWK.Set("use", "sig")) + s.Require().NoError(dpopJWK.Set("alg", jwa.RS256.String())) + + clientAuthKey, err := rsa.GenerateKey(rand.Reader, 4096) + s.Require().NoError(err, "error generating clientAuth key") + clientAuthJWK, err := jwk.FromRaw(clientAuthKey) + s.Require().NoError(err, "error constructing raw JWK") + s.Require().NoError(clientAuthJWK.Set("use", "sig")) + s.Require().NoError(clientAuthJWK.Set("alg", jwa.RS256.String())) + clientPublicKey, err := clientAuthJWK.PublicKey() + s.Require().NoError(err, "error getting public JWK from client auth JWK [%v]", clientAuthJWK) + + timesCalled := 0 + + var url string + getURL := func() string { + return url + } + + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + timesCalled++ + + if r.URL.Path != "/token" { + s.T().Errorf("Expected to request '/token', got: %s", r.URL.Path) + } + s.NoError(r.ParseForm()) + + validateClientAssertionAuth(r, s.T(), getURL, "theclient", clientPublicKey) + + if timesCalled == 1 { + w.Header().Add("DPoP-Nonce", "dfdffdfddf") + w.WriteHeader(http.StatusBadRequest) + if _, err := w.Write([]byte{}); err != nil { + s.T().Errorf("error writing response: %v", err) + } + return + } else if timesCalled > 2 { + s.T().Logf("made more than two calls to the server: %d", timesCalled) + return + } + + // get the key we used to sign the DPoP token from the header + clientTok := extractDPoPToken(r, s.T()) + + nonce, exists := clientTok.Get("nonce") + if exists { + value, ok := nonce.(string) + if !ok { + s.T().Errorf("Nonce is not a string") + } else if value != "dfdffdfddf" { + s.T().Errorf("Got incorrect nonce: %v", value) + } + } else { + s.T().Logf("didn't get nonce assertion") + } + + tok, _ := jwt.NewBuilder(). + Issuer("example.org/fake"). + IssuedAt(time.Now()). + Build() + + responseBytes, err := json.Marshal(tok) + if err != nil { + s.T().Errorf("error writing response: %v", err) + } + + w.Header().Add("Content-Type", "application/json") + l, err := w.Write(responseBytes) + s.Len(responseBytes, l) + s.NoError(err) + })) + defer server.Close() + + clientCredentials := oauth.ClientCredentials{ + ClientID: "theclient", + ClientAuth: clientAuthJWK, + } + + url = server.URL + "/token" + + _, err = oauth.GetAccessToken(http.DefaultClient, url, []string{"scope1", "scope2"}, clientCredentials, dpopJWK) + if err != nil { + s.T().Errorf("didn't get a token back from the IdP: %v", err) + } +} + +func validateClientAssertionAuth(r *http.Request, t *testing.T, tokenEndpoint func() string, clientID string, key jwk.Key) { + if grant := r.Form.Get("grant_type"); grant != "client_credentials" { + t.Logf("got the wrong grant type: %s, expected client_credentials", grant) + } + if assertionType := r.Form.Get("client_assertion_type"); assertionType != "urn:ietf:params:oauth:client-assertion-type:jwt-bearer" { + t.Errorf("incorrect client assertion type: %s", assertionType) + } + + clientAssertion := r.Form.Get("client_assertion") + if clientAssertion == "" { + t.Errorf("missing client assertion") + } + + alg := key.Algorithm() + if alg == nil { + t.Logf("no key algorithm specified, using RS256 to verify client signature") + alg = jwa.RS256 + } + + tok, err := jwt.ParseString(clientAssertion, jwt.WithVerify(true), jwt.WithKey(alg, key)) + if err != nil { + t.Fatalf("error verifying client signature on token [%s]: %v", clientAssertion, err) + } + + if tok.Subject() != clientID { + t.Fatalf("incorrect subject: %s", tok.Subject()) + } + + if tok.Issuer() != clientID { + t.Fatalf("incorrect issuer: %s", tok.Issuer()) + } + + expectedAudience := tokenEndpoint() + if len(tok.Audience()) != 1 || tok.Audience()[0] != expectedAudience { + t.Fatalf("incorrect audience: %v", tok.Audience()) + } +} + +func validateBasicAuth(r *http.Request, t *testing.T) { + if grant := r.Form.Get("grant_type"); grant != "client_credentials" { + t.Logf("got the wrong grant type: %s, expected client_credentials", grant) + } + + username, password, ok := r.BasicAuth() + if !ok { + t.Errorf("missing basic auth") + } + if username != "theclient" || password != "thesecret" { + t.Errorf("failed to pass correct username and password. got %s:%s", username, password) + } +} + +func extractDPoPToken(r *http.Request, t *testing.T) jwt.Token { + dpop := r.Header.Get("dpop") + jwsMessage, err := jws.ParseString(dpop) + if err != nil { + t.Errorf("error parsing dpop payload as JWS: %v", err) + } + + sig := jwsMessage.Signatures()[0] + signingKey := sig.ProtectedHeaders().JWK() + + clientTok, err := jwt.ParseString(dpop, jwt.WithVerify(true), jwt.WithKey(signingKey.Algorithm(), signingKey)) + if err != nil { + t.Errorf("failed to parse/verify the dpop token: %v", err) + } + + return clientTok +} + +func setupKeycloak(ctx context.Context, t *testing.T) (tc.Container, string, string) { + containerReq := tc.ContainerRequest{ + Image: "ghcr.io/opentdf/keycloak:sha-8a6d35a", + ExposedPorts: []string{"8082/tcp", "8083/tcp"}, + Cmd: []string{ + "start-dev", "--http-port=8082", "--https-port=8083", "--features=preview", "--verbose", + "-Djavax.net.ssl.trustStorePassword=password", "-Djavax.net.ssl.HostnameVerifier=AllowAll", + "-Djavax.net.debug=ssl", + "-Djavax.net.ssl.trustStore=/truststore/truststore.jks", + "--spi-truststore-file-hostname-verification-policy=ANY", + }, + Files: []tc.ContainerFile{ + {HostFilePath: "testdata/new-ca.jks", ContainerFilePath: "/truststore/truststore.jks", FileMode: int64(0o777)}, + {HostFilePath: "testdata/localhost.crt", ContainerFilePath: "/etc/x509/tls/localhost.crt", FileMode: int64(0o777)}, + {HostFilePath: "testdata/localhost.key", ContainerFilePath: "/etc/x509/tls/localhost.key", FileMode: int64(0o777)}, + }, + Env: map[string]string{ + "KEYCLOAK_ADMIN": "admin", + "KEYCLOAK_ADMIN_PASSWORD": "admin", + "KC_HTTPS_KEY_STORE_PASSWORD": "password", + "KC_HTTPS_KEY_STORE_FILE": "/truststore/truststore.jks", + "KC_HTTPS_CERTIFICATE_FILE": "/etc/x509/tls/localhost.crt", + "KC_HTTPS_CERTIFICATE_KEY_FILE": "/etc/x509/tls/localhost.key", + "KC_HTTPS_CLIENT_AUTH": "request", + }, + + WaitingFor: wait.ForLog("Running the server"), + } + + var providerType tc.ProviderType + + if os.Getenv("TESTCONTAINERS_PODMAN") == "true" { + providerType = tc.ProviderPodman + } else { + providerType = tc.ProviderDocker + } + + keycloak, err := tc.GenericContainer(ctx, tc.GenericContainerRequest{ + ProviderType: providerType, + ContainerRequest: containerReq, + Started: true, + }) + if err != nil { + t.Fatalf("error starting keycloak container: %v", err) + } + port, _ := keycloak.MappedPort(ctx, "8082") + keycloakBase := "http://localhost:" + port.Port() + + httpPort, _ := keycloak.MappedPort(ctx, "8083") + keycloakHTTPSBase := "https://localhost:" + httpPort.Port() + + realm := "test" + + connectParams := fixtures.KeycloakConnectParams{ + BasePath: keycloakBase, + Username: "admin", + Password: "admin", + Realm: realm, + Audience: "https://test.example.org", + AllowInsecureTLS: true, + } + + err = fixtures.SetupKeycloak(ctx, connectParams) + require.NoError(t, err) + + return keycloak, keycloakBase + "/realms/" + realm + "/protocol/openid-connect/token", keycloakHTTPSBase + "/realms/" + realm + "/protocol/openid-connect/token" +} diff --git a/test/integration/oauth/testdata/localhost.crt b/test/integration/oauth/testdata/localhost.crt new file mode 100644 index 0000000000..2bfe20210f --- /dev/null +++ b/test/integration/oauth/testdata/localhost.crt @@ -0,0 +1,26 @@ +-----BEGIN CERTIFICATE----- +MIIEYzCCAkugAwIBAgIUBcYOn2rG6y98ADDpKoj20huHt9IwDQYJKoZIhvcNAQEL +BQAwYzELMAkGA1UEBhMCVVMxDDAKBgNVBAgMA0RldjEMMAoGA1UEBwwDRGV2MRQw +EgYDVQQKDAtLZXljbG9hayBDQTEMMAoGA1UECwwDRGV2MRQwEgYDVQQDDAtLZXlj +bG9hayBDQTAeFw0yNTA0MjUxNzM3NDRaFw0zNTA0MjMxNzM3NDRaMBQxEjAQBgNV +BAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALKr +vtDsVS4BRBmkgGn9rz4Z3H4K2R9oMgoMFSj8AIzTSgJEGPHWE3BHgh3V3OPc4BJ4 +OjAn0fSpdNulqLBUBNJnMKZCDOTfs/JB7gBNg1uB4Hba3Umc2rPMHyzk4YX7uqIL +jYqKbMtEoDQ548AuHUNYHu+Iee7ukjVlV7jNF9W++Vo6y9p2yoo6C9ClF+9sSaHT +XhcU8a8aEDUet2cTdgiEMGJm3Cd3wAGAzFMN+mJdHecuZ2m6Ze582N/+ZLLwsWGy +fJzJ21FJsn002Zw+E1utleR0yL2W0kjRw5Fd0YysXKhSdKQQ9kyBBubjuYVhLfWB +xkXVV5gTlqNfuS1+6McCAwEAAaNeMFwwGgYDVR0RBBMwEYIJbG9jYWxob3N0hwR/ +AAABMB0GA1UdDgQWBBQ2FSk/BRC2TbNtGYDVVbWtdlHOijAfBgNVHSMEGDAWgBTO +xVPaQyhUx7eUgwjg20dWE23uJzANBgkqhkiG9w0BAQsFAAOCAgEAXCriDq5LLPrc +qLy6IDxWkz9ulkFXf77ZyprKrIrgOASbq7Nwz/wsAYydq0PBTUGHY0/akDt/O5Tt +37e3i7kN5aVzMUAb05j7JBPeQqzs1CVySSPkCWb2DzqHajIpWp8SkzRVCBLRu3l8 +T3yS8q1BDVteu5SZV88Z6eTTdq0/0Fw6iWKIELiKRx7fMcUyKhwTE07Y6QujvxVc +P7pgn9EU1mF2leOQy9RrAbzJPDkeLa/zLE9Pjh48Ea8sjEXlORE58WVAxqVstxKj +QjbIMv5H/DUqYRoi/bXfTQU+xs9ucblbmBibIgTYWiAwaNxgmHbYfG6IrPdb1VLD +X1J29A01ADQOb4rnU85tPC5fBAcP3tZhlMzjxi/LYHR0iPOhGKAQcKc1DpZqgbHs +FmPdNcPsVc8rOElXSkdrXvEgMDGXH9oFV//gwv5Sb2tI12O8MmmGNg8zZp+wJiPC +hyoqy5SAll0uaEY6YBHBgRB/40QsObkyVlFavuqipJ2eWmNdkRjVHnPTK5kOML86 +fQE0ChJu8bmRj1Dy4GQfKgEiuB3r9sHke11IdQo4zoZRNdSm0NKuQ1kqMgjoFubl +kmwEfUhKyGH7zSV7CFSejA59rE675da3mJcva2vYvY1XG5/T3vdkUtuOTUtqD8l0 +xSJN7KHHieas/nabhc4wP2/YheNaFuM= +-----END CERTIFICATE----- diff --git a/test/integration/oauth/testdata/localhost.key b/test/integration/oauth/testdata/localhost.key new file mode 100644 index 0000000000..0d1791bcfc --- /dev/null +++ b/test/integration/oauth/testdata/localhost.key @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCyq77Q7FUuAUQZ +pIBp/a8+Gdx+CtkfaDIKDBUo/ACM00oCRBjx1hNwR4Id1dzj3OASeDowJ9H0qXTb +paiwVATSZzCmQgzk37PyQe4ATYNbgeB22t1JnNqzzB8s5OGF+7qiC42KimzLRKA0 +OePALh1DWB7viHnu7pI1ZVe4zRfVvvlaOsvadsqKOgvQpRfvbEmh014XFPGvGhA1 +HrdnE3YIhDBiZtwnd8ABgMxTDfpiXR3nLmdpumXufNjf/mSy8LFhsnycydtRSbJ9 +NNmcPhNbrZXkdMi9ltJI0cORXdGMrFyoUnSkEPZMgQbm47mFYS31gcZF1VeYE5aj +X7ktfujHAgMBAAECggEBAKcd8y3RT97m+j6N2jrJOMd6Qv11wh4ZRGyXXpdmFlGi +M2ApN7fDx4zGpdKoPaK37rH32F1AcaZJde8YZM8A1z3BnQR1VUAiaVqYBjgsSEgo +E763+jEnUHzJ2QMR1kuO58M30R0bWqVJvBr9ZqRTvbVG0DC1028DoKfm8YT9+GRI +Ws18LiLRoWO67Wrw1hu/uX/xA482qqLBn6JGQVcgGkvtQvBqdBzKRXaOkznZc0Sk +nHVHOanKGRtAYUQCu7jga2BuayCn4rofbpCT4SUmyHSjA0mSHIgpRdBCyslSKkeO +az3Qv6K19o3u4HrKQJxsuqW/ka4j0bN11WOBvB+UbxkCgYEA39PsFidZvu4l6Wzs +GYbAD1N5SgLAtqvwCwCIiF8ZCUBe9ORYoPN+yvlHyQ2SMyqDUYdJ8j+RWey9Geg+ +juSIwkrtl9bNgVRiCPLrddYdod/F71QeCHqlTYkkomLaYODDRkoFS6jNXDRZxaZK +IXBr3y28PwfPpwT4LGtp71PgQ0sCgYEAzFo00Y83Iz/7jnV8wm97En7JL3y4yXMx +9kE+zj2kJWBL5HtH6mVOEFy6npSKkeqR25oF4WV2zyLyu022m1YSJxbC+XMe2qZZ ++dUuhEggGBkTfTMl+eWUedizuDPq7vd5AHeVn9+Oaxl0W/pBnqLAyGDVnyxkZkC+ +uUHD811oRvUCgYEA1qXEFWa9UTXPE7DKJpysGMaDXW+QYl43AEYNqUIRn2ak6ZMG +T6vTX1F5/xxNpVXSw1/LkU5W1PcMTgkD3ULayADVIzTytWE39r8HAWVJ24/eoOp5 +NsZvOhEYGcZVCGzjt8eKlokWD6OAp+QV2UWXnVqd2ZBjGhfQ68BCwiocuksCgYAn ++9Jv2lzIeeFni1dg1901zjbhIr8pM2/oJfX69paidYgD6Zc1pqKykuI02w2N5V6q +oCVcZ7TqbIUf3uHG3P1qRorZsgusbnYWav7SBSa6cFWe3p4kmiYF/T+U4BusrCEx +1TQiduRv0igxQvMJ7gBYdJH3tgDi/PIUX2jOuk0H7QKBgDxOWfRezUgS0IoXA4fk +l5wAmPuc3h/PmiluaR4tM/rusXK7sz+LyqeuVv20qEW1+fiSJYEpavr9WHzZYbYh +AgJE6n5UCWMogSmq4LzqI1dXU45lXytL3aDYwoo+UK8L0FsYi5FSI8pgXLRIpUY/ +JXfGmyC6web7ytelgOEG8vBo +-----END PRIVATE KEY----- diff --git a/test/integration/oauth/testdata/new-ca.crt b/test/integration/oauth/testdata/new-ca.crt new file mode 100644 index 0000000000..c5c90e00fd --- /dev/null +++ b/test/integration/oauth/testdata/new-ca.crt @@ -0,0 +1,33 @@ +-----BEGIN CERTIFICATE----- +MIIFpzCCA4+gAwIBAgIURqqRmFi5XM46wV4AnUYwX8jD/pMwDQYJKoZIhvcNAQEL +BQAwYzELMAkGA1UEBhMCVVMxDDAKBgNVBAgMA0RldjEMMAoGA1UEBwwDRGV2MRQw +EgYDVQQKDAtLZXljbG9hayBDQTEMMAoGA1UECwwDRGV2MRQwEgYDVQQDDAtLZXlj +bG9hayBDQTAeFw0yNTA0MjUxNzE4MzZaFw0zNTA0MjMxNzE4MzZaMGMxCzAJBgNV +BAYTAlVTMQwwCgYDVQQIDANEZXYxDDAKBgNVBAcMA0RldjEUMBIGA1UECgwLS2V5 +Y2xvYWsgQ0ExDDAKBgNVBAsMA0RldjEUMBIGA1UEAwwLS2V5Y2xvYWsgQ0EwggIi +MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCXW/6kmmZ95KWjuMj/PUEoBD1s +Zp4LEnF+e4+rIKov/wT+kRCtaH2PO4Xg96WtvWBpm0vHLS4jIPiwjnxuuDHFQBF9 +LFI0JW+MAVvFJc12qeT6E6nGM+lX54gtitL6zvcIM+vaXoUlPz8JmDPk8jbmKlTG +GwAdtPOguF1xAMQSAqXGd9m2TXsenj9y3B8F8wQ5yeHyiw8Xc619rh7d72CjBBFH +TkvfE/NDIA0iWS729+0ZyUTCwrFqLXEjPAXvInmHT6FizI+wGgJXLnAhUZu1k/4M +/EtL0NmB+TL/oiQSAdryei5z41u9wzsObdHhhzY/r614UeZbR3BY8l2FcpE9jHYO +8AX6xhFxJYLZYxFx1kZ3DAurzCbsYzyxrMRjOmTrRYYPWggEfBrnu7UROJIHp01X +8Q+KWfgSH7ElTm74Jh47wB0apghpVhB2BzZrmWkExNF0kTozfNxXjoccWakFoXwy +atMZtXpZIh3J+EigvyaLcG6eP5gWpA1NUbg7f885114+xysEqlbErC4pyO0oPjUo +n3Ur2EG4WZEksTVUKqgtnuq3HnOz9PmNSXJLq5ICFs+s/Rj4jyCVvaLVcJHNz63a +J7iNEYUznC1Vy3TW826YuHO+ZsCwYiLNZKDv+OpfbIHwUDoELcN02mEqCPW1CdVR +XpvT8f/pJNnJG5N+ywIDAQABo1MwUTAdBgNVHQ4EFgQUzsVT2kMoVMe3lIMI4NtH +VhNt7icwHwYDVR0jBBgwFoAUzsVT2kMoVMe3lIMI4NtHVhNt7icwDwYDVR0TAQH/ +BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAgEAhjGrCNBy6Qk7oDI5bdCjN7avz/cL +CYXQhX19NLrneGOCd+7ZTsCjdR3khiFZwRdSxS2M6x61OYPgObBmwZhAIsAPvPu9 +g2wNhYTCQfRTL2fhHqFdDQbr9Bz+QIZiBPv0mDJo7I6iDdcfGcr5JR37ziiUzcpS +CR2rULzkT2TpT+XtOB1dFeDnwVvoMklIGCEBsIuUpF8CWGxDbW5cdKhqkKR9MZXK +BKr9IEtuNCfU3GkBBUbIyqgs2UT7eCQ/bcDSoXHvoJ87Q4AGeekGLXjBiesvegNF +dSDnsNdQ06G2IZpXUQwJmbke/UJ4xubkJnu9HxtnhswOOjaiNj1I0qqo+c2j88SH +lhUktwjtTtStg5a1s8JTHLVnreBmcbixZnKHySLrDczt1LCvDsyFMDq81prHjjFl +TRYAmDCF4TbVUbX8BWha4J7k784fMHUqq+rXW2HC4CPYuL8zKneoufrCjYOO+Jwp +0E/S8Ln3lugjpo6FiZMpqqz3doJe9X3A49gbRY9yardTwEhbYM0Nch0No9P1xgMu +ffCu7xm10Y+PG/z9YtZBOOMvK7qzZIhdRIqz7KZxmpQFu7HcbcrT833idbATbqOr +1mwb9hW711Vtwp20Z+ZAAbSdKj/OX9rEMoBywGuhRAeIY+9sJR4zcYlZnVk3uBIv +wi+lNvGtM5PexTk= +-----END CERTIFICATE----- diff --git a/test/integration/oauth/testdata/new-ca.jks b/test/integration/oauth/testdata/new-ca.jks new file mode 100644 index 0000000000000000000000000000000000000000..4bb5e7dbdaa708cd4b42e2eca83922b3983873a0 GIT binary patch literal 1514 zcmezO_TO6u1_mY|W(3o0d8y^P$%#PjwA`N&{}@;!^h^yb85mes8#J*lH)vw+U%<@7 z$iyV#wrb*xh@CO#tPaL8%ylz}KXLfqWCLC{POUbNw(q=*jNGgY2FZrp2Apinp)72| zOrgPsJO*4K4hIjjOKKU6#}46%7zlynxOlj|Q!A5m@)NTaoE>3mxKY$Fqo^^E6X!KD zH83$UH8eN0FgA-4=QRd#jiFrnIHHM33EA_EtPIReO#BQ6O-x)&O-zgo)1&__nUz-i zWa;7^C;r(Z}t-#Lt5-->HhwYTS- zVf^Hi*)y$>W6}(=TRtz?5nIS`M2KnWvGSYSe5>W=*%#fBXZ_4#dGg_>ZhrCNwYBTy z?!Hf0%p&OS=Y3!Jv$F!PQl#Fu?{6hfx*R&RF-x~l*@pGKQf0gU!lX0(8>E=R^$HXN zXK$VSkLQoK_l28{KaKt`QW0Xj^{Gm)_;K{!!`6Jc7az8p*{@$)5%?_Hy&&RKY-`a( z+nzGM53IkA2^Ok0-AooNyyjNU!@c^9+M8sXjcbl1Tcx~qZR3yPV5yOMzI&^n#U%FS zzTqGFyCQ!G$!}Ek%ln}wXMI3cY8gjnm_Ql3S@z6KmLnHSCR!QS+zIb%mx)}-y0FG5 z>$2q5sz@c-lRrEb>{sh9$eU+BLu?7JZ{QB=`tz38jI- z6>K%0qZ@j<u7QSCF-`cr>t@0(CZpFdQ*ZNh=uB8gk zH(U?6yl|W1tnfe{&Y3&q{yJ40d-g=Fdat~6dfOR3E3-vrwjP&Ot@wF%@#iD$(?nIa zbG-GtvbK5J*3E~4WwxfTeUMhTV`ExT`$?tOyl38C*|47POsj#_o@=v?_Zg=8iZRSE zXnkmQHE`=6){LkJ^PapvCvQ-ywffcd=)^-0lyB_VZ>&|mV&|_zz0G|;=4f8^=dz?doQ{5 zVt>E%pT9}h94#K}Ywy~e(h=*@wfW7m!dX*TcW=Ctd+PG%+DD}ug!2}!zLq2XO?3D5 z(A-0Fx1>LFVB9iS%l=&ats_PaMF+AMy0CX7zt2&XGcN3moEvGrLrDLS{!+7#YmF!0 cJ8C(X*)~&7!*t3#nMlt|H>>=AUlmse06Ro%WdHyG literal 0 HcmV?d00001 diff --git a/test/integration/oauth/testdata/new-ca.key b/test/integration/oauth/testdata/new-ca.key new file mode 100644 index 0000000000..2c16768045 --- /dev/null +++ b/test/integration/oauth/testdata/new-ca.key @@ -0,0 +1,52 @@ +-----BEGIN PRIVATE KEY----- +MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQCXW/6kmmZ95KWj +uMj/PUEoBD1sZp4LEnF+e4+rIKov/wT+kRCtaH2PO4Xg96WtvWBpm0vHLS4jIPiw +jnxuuDHFQBF9LFI0JW+MAVvFJc12qeT6E6nGM+lX54gtitL6zvcIM+vaXoUlPz8J +mDPk8jbmKlTGGwAdtPOguF1xAMQSAqXGd9m2TXsenj9y3B8F8wQ5yeHyiw8Xc619 +rh7d72CjBBFHTkvfE/NDIA0iWS729+0ZyUTCwrFqLXEjPAXvInmHT6FizI+wGgJX +LnAhUZu1k/4M/EtL0NmB+TL/oiQSAdryei5z41u9wzsObdHhhzY/r614UeZbR3BY +8l2FcpE9jHYO8AX6xhFxJYLZYxFx1kZ3DAurzCbsYzyxrMRjOmTrRYYPWggEfBrn +u7UROJIHp01X8Q+KWfgSH7ElTm74Jh47wB0apghpVhB2BzZrmWkExNF0kTozfNxX +joccWakFoXwyatMZtXpZIh3J+EigvyaLcG6eP5gWpA1NUbg7f885114+xysEqlbE +rC4pyO0oPjUon3Ur2EG4WZEksTVUKqgtnuq3HnOz9PmNSXJLq5ICFs+s/Rj4jyCV +vaLVcJHNz63aJ7iNEYUznC1Vy3TW826YuHO+ZsCwYiLNZKDv+OpfbIHwUDoELcN0 +2mEqCPW1CdVRXpvT8f/pJNnJG5N+ywIDAQABAoICABg+VCAHBRdGxMs1C/4Upczk +OkxpzAhc+LsizRptaHpjQBMK/EoHkbjxS+/X6tHUd/liYPWzBGVRtikIIYvVyqRc +BJEb72zKeZP0xxS3Cd0RuGCKlBJwT9X/JV5EvVIOosh4ZzTPwpwlMGfNLl649yx6 +/PTK8AP8xFsVZ2N0FR5cuIh8u5f00B18M7smNn029WcmMXUuazPn7j19DWpMmcTH +9YE03CKL6QEdmfegTk1Lh87Yteqg0axT6/+8m6didRHEd5vsxQUWyBIxGM/AE7nh +TaYZ0RurL55Jt9lJ82TDpvoDXPu99SdaJSmZ/diVq42cNM5asT7PR1elNm/rWlzr +V5ZJgjY7zvT6DQDLCMmD91iq6lTCeuAPmh4idH2E2Xer+vCaJWEH9svAMdvxP/53 +GzlwXa58VaqPagFODZ5DFmJNdXmWyEnujD02N29AD23PUw6GqzZaZlf8WGZbBiCb +ct2Zl27cgl9P6hUCjmq+uVF+MDL0dcIME73cD1f/utuK+LMpk5aR8o5yRRDUqlGr +qWsrCfbIje2kjHaZk1heI6a1u3pusDM7jDaeEYsyoiyThJgZs9PgTnS70IXia51o +I2pxPOiVS0KntnD4X5A8GaK1qkzwAo8rMXX7VxQRBfhZZVdtZpngMPVbLVOJ+RAI +Od/eHKnkBPCC4MuKyfQtAoIBAQDUPSajw+eVUVUwWVtgs9rxA4f/0mGwwKPZ7RIy +pfjVzkN3uEUZlh6dfU4hNtf12bcPnGTIU4cOPZogn7YPnFCiGVgZtDtlZ/11KuXS +mW98/pQz1HWQM/21UF7JmsMjcALTUi3uCbPE/RXg1XVunJDQaNlKui29o/7oqvJ7 +d8jzrGmUxdEv9dNqu2SpDSBzx1a2Fh+jMxgXaxUyVniCN5ZnbauNpTaWk48qPQ4+ +bCmim51HxuwfPu4ehTtH5qGWY9+DcTaKavwrWVYZGU+EI1iKaEqnNfMDPbqP1CCm +GSB8cQR8W1bTGHSF485wyaMMx/j6NDrvqkGB9veZuXhzTrTPAoIBAQC2kV66wxl0 +Fn/Ipa5xJNzhsCAtnUpUxJbEoBJYN5N3JtzNqbb92u9Nos46Ws9EA5odTDlih6oi +dPiMmXy9CMdjpjL/q10Pu40msZlt3QslYtJf4AHNlcuStumxcL1LySeCwi+5OOc5 +I1zIIcV08cqBhywZ3j6N1D8Y874ejUAf17OOXZoiyKG7JJkgxIpL32x+oNRnIAhN +iYHGgGe15nkOIFLYBnoC29Edx//ECkStX8iQuEq+D21fbQUnYksFlMPdjeeQANOt +7vZ1AiG+VCQqDRGqDrdGDCTVoxquE1mgflh4V6WvTb6fgjls401dxWFXLB9rposw +qPIAzguw/c1FAoIBAQCPaJ6CS65gs6tHVymqZv0Km6M6lfJSl2hfqZQBSyqfdZca +/xUZ29jl+7ReNwun4KuUTc2/mskIM1HAt4oydCH71fo0rBbyR1j44bqXGfw+Tlrf +xrCFdsv4xsy1lvBCMr6GAeJtFHs3IPe2iyWlTv9/A0nH95NOr9BfcJsWGHNdS2Ow +FhZqPMXVObgjjm4eLVSHBt3rzWt6721MLSeSfXMQggdIV5lSF3TGSqkkPrvHVzTo +Oh50YnZNgyLyS4Fl+CggTdBXqUCpHd1SakrTc3qxUxUWdRq2VvCHnQNOmG3eCBPK +34EEdGLP0YU9qtGUok626bHlHXrUEYduhOdBqq37AoIBAHayYuWIDRd1vVTFq3my +Xs15BiLB/d7JBcEG1YZ3c6/nG223Ztr7KdTPAcfc3J66vMtJkJGn5IyMgkBfVkNM +3t3B46xoTJP6+1Vp6HgOW73N1zswV9vDBVz5AU01IE2SldakzARfo615eUxA8LEM +tv2p1Zln7kGl+fQOHNCeQ0+wnPP1lU4CJWyX6drtDYEw3MgjZpU5tUw8F5zoRQV1 +t8TgbRw4ccFEC1ySeI6LooUaHjtBJo8VVqXRKqWleWNCimmUZjYw429VSvVeEnQ9 +HlocrxxifvPS12vypFkDCaWYH4r2aSlloYbxUsahrd5Ggvf7Ht6NpDdZ0CWH0QAc +swUCggEBAL5z899JEyRLharBIl1tUix3XDjqmpX+F2TRPQJrF6x8tAyoRyzFAOEf +F77uB03L/kF44SIGC92z/ZMGL7XIo7dJ/bDnyVOfirWvOUwF6JafJxGmJgutyge0 +RmfP05JElx9ztfX3SnIc48x6vVCSPeeNZifV/qYvsV+80fwru7TETF13p4xLL91B +F+MkUHRaclE/1rqXuEdAEV1rA0+v5YUCBdp+31N2wzh7vPw7BAo7STbNUxy7+n8g +lyvgh49iT2gZ25k8lkw5T7OzTV0rRWuXWG/QbcG+dSWS1zDNOSSqF/MrU44A6lGm +edwJUrNCzm6zmzfHkSsov6NIS3te55k= +-----END PRIVATE KEY----- diff --git a/test/integration/oauth/testdata/sampleuser.crt b/test/integration/oauth/testdata/sampleuser.crt new file mode 100644 index 0000000000..eb1d3b071f --- /dev/null +++ b/test/integration/oauth/testdata/sampleuser.crt @@ -0,0 +1,26 @@ +-----BEGIN CERTIFICATE----- +MIIEazCCAlOgAwIBAgIUBcYOn2rG6y98ADDpKoj20huHt9MwDQYJKoZIhvcNAQEL +BQAwYzELMAkGA1UEBhMCVVMxDDAKBgNVBAgMA0RldjEMMAoGA1UEBwwDRGV2MRQw +EgYDVQQKDAtLZXljbG9hayBDQTEMMAoGA1UECwwDRGV2MRQwEgYDVQQDDAtLZXlj +bG9hayBDQTAeFw0yNTA0MjUxNzM5NDBaFw0zNTA0MjMxNzM5NDBaMBUxEzARBgNV +BAMMCnNhbXBsZXVzZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCa +Xs9WCGdFwtRcs8+NGyf8lebUQ55fBTKUn7Y6tIfox/f6Mtrtc9xUW+1fiO7PhiVx +RphAPdfttekLGB6LKYRmnBk58EBUQpbbC2mfxL8LhdEYz9XCq8pzGLI59IciRqHa +S1YMH9pHW7e5PDCuS5BrcA05gip5y6vyiLh80GWKwo/9Wf8A70KtLnk3ggrFKMXw +5DOCVzTM6ms6bVjqdXHK1c64q/kNcr4nrEiamV8KwH87UZ8qCMWkET5B4/+lTbgi +oEdPZ65FQVwMMUkCcFl+smwmiIZtjiTsnfsq8Tc/KcLz4VKRNB2E0mlOG3DHueNH +yVRuNoxfZYny50R+2m+DAgMBAAGjZTBjMCEGA1UdEQQaMBiBFnNhbXBsZXVzZXJA +ZXhhbXBsZS5jb20wHQYDVR0OBBYEFIRqJa0ogdeHeQARsqOEjheW9QJOMB8GA1Ud +IwQYMBaAFM7FU9pDKFTHt5SDCODbR1YTbe4nMA0GCSqGSIb3DQEBCwUAA4ICAQBj +KWqxC6Vtsc4J+ZTEwHD9qXVwLXkP9VUAaWkb40Er4Uflt09DIzrk1yN+3x33qRhf +TzcuhuDTQnZqO0QDEIm0dI3ju0rGSxFouqlqgrfmJeQ/ultPM2yzn2YRkhBId4Za +Bjbyh/yyowDQDns0S+nBGTBzEEqK7jiAY/jlI3JhFiw30iUoWG3iq70eqOU+yFgF +saCo+dldBeiKD2kBnP5GvRK8fcuPFI/m6fS08oA4J73+x110xNWRL2PvnUiJVujc +GA+O6GxoZa6GB0aVe/9Al8Xw/v+K16q7Oh09UpBBgx5g6f0LORQjl7SLdzbKglwY +qTumgMFFdqI6NyAqU2GxrYG1X9UwXdauVVMYqWk5UhaGYRE90mULfsukNGL3wn8f +2R0EnT1n5GYFteR4jueWMAMXsYs4VvwSWGjAndEQ0fhEztBqcPA5ATAg6IIbSciC +TZbIMsU0WwgysZ/SxJwa1/6ZFBQVdHKpPX0r8iibYU33ugCjz9jXmUPurjuXuc/Q +Ai2D8RwyOWp7Dg662ufLKcIn0aO9Hrs61pbTqhqKdbscuYRkhUn7zvtpIN/Q8AnN +8Xh4eq7c+Ox6LTkkv9iUo85d7UPSeRxdK+4xR2VmyuZdKlOAduURTAZeqIS+OJw7 +MzMup6L4gugLvIGdAXIKyVgHQH8Pjnqz8n2TcpZK3Q== +-----END CERTIFICATE----- diff --git a/test/integration/oauth/testdata/sampleuser.key b/test/integration/oauth/testdata/sampleuser.key new file mode 100644 index 0000000000..baa7ed0dcf --- /dev/null +++ b/test/integration/oauth/testdata/sampleuser.key @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCaXs9WCGdFwtRc +s8+NGyf8lebUQ55fBTKUn7Y6tIfox/f6Mtrtc9xUW+1fiO7PhiVxRphAPdfttekL +GB6LKYRmnBk58EBUQpbbC2mfxL8LhdEYz9XCq8pzGLI59IciRqHaS1YMH9pHW7e5 +PDCuS5BrcA05gip5y6vyiLh80GWKwo/9Wf8A70KtLnk3ggrFKMXw5DOCVzTM6ms6 +bVjqdXHK1c64q/kNcr4nrEiamV8KwH87UZ8qCMWkET5B4/+lTbgioEdPZ65FQVwM +MUkCcFl+smwmiIZtjiTsnfsq8Tc/KcLz4VKRNB2E0mlOG3DHueNHyVRuNoxfZYny +50R+2m+DAgMBAAECggEAbhP/i1zQr6k/n59E+F0OBYqrIF/bdeyR5fOBkZkcdTzr +MonDHaIJ0kn/GaneiTMiTgVGGkE/Ua3vMU8QsLF5TWYwguU0KiGVyzr3Jcu5Y7EX +qrbBumCgK7THmpYpKqLtVWl1QY4RK+NWPouSNyeBI2uysniEa3d19KvTyoUcc3Yw +be5aK+b3MXC5Ig7tuXXroM7ubBG4/MqHi9t7IPyTbgJw6iiqLPS9Lckjb6mSQVxr +zcwfc48MFgdkv/ZAKtSTYCrz8miUuTPvn7DfHdRlyN27AvDgw0VjNgD2JbQOkJNf +E08auB8oJHN65wo3i1Ko8iNp2JjySTU9udq2opwluQKBgQDMvWbuxq5nhQzdVcpo +zFVdAWhaWpjHzcSl2oy/r5fyIx5FlOk0spv/AOXNe0i76OYfsxKSdp8ewK9U8Y7g +LPg8Wf1Yh/xThgytcmltpylbWq9YliGIjakDQgXvGY/MzOi5jQoWkVtBU9KL74Fn +Cmv2V8I2/RcGnrQPFUtk5+pzhQKBgQDBBQZLu56MzyjD8s7gchODGuNH/uIZBGi0 +NcYaFa1coEXshFguXwp38kzuE+YhXbCw0s6IF8gz8F+coyXXnDMGt2J5K97mUfjo +Z+VeFV18uomEMpJNQ/AHqn6QIEpTKsisEKfROO7rFSKkZAkAUIGTUHhgcT6qRfDk +jmgWfjuxZwKBgQCpvcVe5P2m+Znmzr+XDwEesJIRhtbvn9sPHhheu3ef2hm42nJV +rFbEnbvoFfQBRl+znEUjhJD7cAhsxjAMD3xmnLz77xH1NUfBbP+XV2VkRdTl/uIi +Uj/zYYOF7Y1Y3/F6FEJu32fmy1Xdil2gTfWgMLXl3QKADId/kcoGCHhJ+QKBgQCT +7PfgPo/KNlF1qrYliQevKIIbARniNmDQC44hG4/bNvGfy+WQ1EG/nzCaHSH3XEg3 +m7ew0RkbxRJhhx9PWGQ6t3x+hMK1HQl3g3hjXFhjaMpPSDqbgH+KQH3ykuyjRFy6 +kaErVUi1XWNJPWkwloJXlgpLTz7JXAS8BO98nY297QKBgHn5oyUJW9HEkBh7SP5k +CwMNGVynJ8+2phN8AcAhMH/RzFokQ4qlL2i3nHk7hg8ETcg5y56INPWsw3Xcx2bp +T2UouC9i3fhGlY4nZEunYntScUPCza4ynzBashEzVzCnOVFYBK9rjvGOP0bKftYK +czNbHJn06rJdbocE/JfW5m+u +-----END PRIVATE KEY----- diff --git a/test/integration/oauth/testdata/sanX509.conf b/test/integration/oauth/testdata/sanX509.conf new file mode 100644 index 0000000000..729de7a277 --- /dev/null +++ b/test/integration/oauth/testdata/sanX509.conf @@ -0,0 +1 @@ +subjectAltName=DNS:localhost,IP:127.0.0.1 diff --git a/test/integration/oauth/testdata/sanX509su.conf b/test/integration/oauth/testdata/sanX509su.conf new file mode 100644 index 0000000000..53fcac1275 --- /dev/null +++ b/test/integration/oauth/testdata/sanX509su.conf @@ -0,0 +1 @@ +subjectAltName=email:sampleuser@example.com From 5254db88c8a4565933788ee7b39700d926daaf32 Mon Sep 17 00:00:00 2001 From: Paul Flynn Date: Tue, 10 Mar 2026 16:28:57 -0400 Subject: [PATCH 2/5] fix(sdk): bump golang.org/x/net to v0.51.0 and remove test/integration from go.work Remove test/integration from go.work to fix Docker image build (Dockerfile does not copy test/ directory). The test module uses replace directives and works standalone with GOWORK=off. Also bumps golang.org/x/net to v0.51.0 to fix GO-2026-4559 (HTTP/2 panic vulnerability). Co-Authored-By: Claude Opus 4.6 Signed-off-by: Paul Flynn --- go.work | 1 - sdk/go.mod | 12 ++++++------ sdk/go.sum | 24 ++++++++++++------------ 3 files changed, 18 insertions(+), 19 deletions(-) diff --git a/go.work b/go.work index c8ab1243da..f897f17ac1 100644 --- a/go.work +++ b/go.work @@ -11,6 +11,5 @@ use ( ./protocol/go ./sdk ./service - ./test/integration ./tests-bdd ) diff --git a/sdk/go.mod b/sdk/go.mod index 57e9d161cd..e2aa55540b 100644 --- a/sdk/go.mod +++ b/sdk/go.mod @@ -16,8 +16,8 @@ require ( github.com/stretchr/testify v1.11.1 github.com/xeipuuv/gojsonschema v1.2.0 golang.org/x/oauth2 v0.34.0 - golang.org/x/text v0.32.0 - golang.org/x/tools v0.39.0 + golang.org/x/text v0.34.0 + golang.org/x/tools v0.41.0 google.golang.org/grpc v1.77.0 google.golang.org/protobuf v1.36.10 ) @@ -40,11 +40,11 @@ require ( github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect go.opentelemetry.io/otel v1.40.0 // indirect go.opentelemetry.io/otel/sdk/metric v1.40.0 // indirect - golang.org/x/crypto v0.45.0 // indirect - golang.org/x/mod v0.30.0 // indirect - golang.org/x/net v0.47.0 // indirect + golang.org/x/crypto v0.48.0 // indirect + golang.org/x/mod v0.32.0 // indirect + golang.org/x/net v0.51.0 // indirect golang.org/x/sync v0.19.0 // indirect - golang.org/x/sys v0.40.0 // indirect + golang.org/x/sys v0.41.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20251022142026-3a174f9686a8 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20251022142026-3a174f9686a8 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect diff --git a/sdk/go.sum b/sdk/go.sum index 220178c2fb..b7b66cbf97 100644 --- a/sdk/go.sum +++ b/sdk/go.sum @@ -82,22 +82,22 @@ go.opentelemetry.io/otel/sdk/metric v1.40.0 h1:mtmdVqgQkeRxHgRv4qhyJduP3fYJRMX4A go.opentelemetry.io/otel/sdk/metric v1.40.0/go.mod h1:4Z2bGMf0KSK3uRjlczMOeMhKU2rhUqdWNoKcYrtcBPg= go.opentelemetry.io/otel/trace v1.40.0 h1:WA4etStDttCSYuhwvEa8OP8I5EWu24lkOzp+ZYblVjw= go.opentelemetry.io/otel/trace v1.40.0/go.mod h1:zeAhriXecNGP/s2SEG3+Y8X9ujcJOTqQ5RgdEJcawiA= -golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q= -golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4= -golang.org/x/mod v0.30.0 h1:fDEXFVZ/fmCKProc/yAXXUijritrDzahmwwefnjoPFk= -golang.org/x/mod v0.30.0/go.mod h1:lAsf5O2EvJeSFMiBxXDki7sCgAxEUcZHXoXMKT4GJKc= -golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY= -golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU= +golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts= +golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos= +golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c= +golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU= +golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo= +golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y= golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw= golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA= golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4= golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= -golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ= -golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= -golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU= -golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY= -golang.org/x/tools v0.39.0 h1:ik4ho21kwuQln40uelmciQPp9SipgNDdrafrYA4TmQQ= -golang.org/x/tools v0.39.0/go.mod h1:JnefbkDPyD8UU2kI5fuf8ZX4/yUeh9W877ZeBONxUqQ= +golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k= +golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= +golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk= +golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA= +golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc= +golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg= gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk= gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E= google.golang.org/genproto/googleapis/api v0.0.0-20251022142026-3a174f9686a8 h1:mepRgnBZa07I4TRuomDE4sTIYieg/osKmzIf4USdWS4= From 678417dfe5e1c60ae228af80015a0a64772fa6c1 Mon Sep 17 00:00:00 2001 From: Paul Flynn Date: Tue, 10 Mar 2026 16:37:50 -0400 Subject: [PATCH 3/5] fix: bump golang.org/x/net to v0.51.0 across all modules Fixes GO-2026-4559 (HTTP/2 panic vulnerability) in service, tests-bdd, and examples modules. The SDK was already bumped in the previous commit. Co-Authored-By: Claude Opus 4.6 Signed-off-by: Paul Flynn --- examples/go.mod | 8 ++++---- examples/go.sum | 16 ++++++++-------- service/go.mod | 8 ++++---- service/go.sum | 28 ++++++++++++++-------------- 4 files changed, 30 insertions(+), 30 deletions(-) diff --git a/examples/go.mod b/examples/go.mod index 7c524f2fe7..b7f28a57d4 100644 --- a/examples/go.mod +++ b/examples/go.mod @@ -42,11 +42,11 @@ require ( github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect github.com/xeipuuv/gojsonschema v1.2.0 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect - golang.org/x/crypto v0.45.0 // indirect - golang.org/x/net v0.47.0 // indirect + golang.org/x/crypto v0.48.0 // indirect + golang.org/x/net v0.51.0 // indirect golang.org/x/oauth2 v0.34.0 // indirect - golang.org/x/sys v0.38.0 // indirect - golang.org/x/text v0.32.0 // indirect + golang.org/x/sys v0.41.0 // indirect + golang.org/x/text v0.34.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20251029180050-ab9386a59fda // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20251029180050-ab9386a59fda // indirect gopkg.in/yaml.v3 v3.0.1 // indirect diff --git a/examples/go.sum b/examples/go.sum index 6b4f610f35..2663370f59 100644 --- a/examples/go.sum +++ b/examples/go.sum @@ -183,16 +183,16 @@ go.opentelemetry.io/otel/trace v1.38.0 h1:Fxk5bKrDZJUH+AMyyIXGcFAPah0oRcT+LuNtJr go.opentelemetry.io/otel/trace v1.38.0/go.mod h1:j1P9ivuFsTceSWe1oY+EeW3sc+Pp42sO++GHkg4wwhs= go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= -golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q= -golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4= -golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY= -golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU= +golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts= +golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos= +golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo= +golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y= golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw= golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA= -golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc= -golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= -golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU= -golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY= +golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k= +golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= +golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk= +golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA= gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk= gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E= google.golang.org/genproto/googleapis/api v0.0.0-20251029180050-ab9386a59fda h1:+2XxjfsAu6vqFxwGBRcHiMaDCuZiqXGDUDVWVtrFAnE= diff --git a/service/go.mod b/service/go.mod index f57ef4de08..30c844e0e8 100644 --- a/service/go.mod +++ b/service/go.mod @@ -50,7 +50,7 @@ require ( go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.39.0 go.opentelemetry.io/otel/sdk v1.40.0 go.opentelemetry.io/otel/trace v1.40.0 - golang.org/x/net v0.47.0 + golang.org/x/net v0.51.0 google.golang.org/grpc v1.77.0 google.golang.org/protobuf v1.36.10 gopkg.in/natefinch/lumberjack.v2 v2.2.1 @@ -169,12 +169,12 @@ require ( go.opentelemetry.io/proto/otlp v1.9.0 // indirect go.uber.org/mock v0.6.0 // indirect go.uber.org/multierr v1.11.0 // indirect - golang.org/x/crypto v0.45.0 // indirect + golang.org/x/crypto v0.48.0 // indirect golang.org/x/exp v0.0.0-20250911091902-df9299821621 // indirect golang.org/x/oauth2 v0.34.0 // indirect golang.org/x/sync v0.19.0 // indirect - golang.org/x/sys v0.40.0 // indirect - golang.org/x/text v0.32.0 + golang.org/x/sys v0.41.0 // indirect + golang.org/x/text v0.34.0 google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect sigs.k8s.io/yaml v1.4.0 // indirect diff --git a/service/go.sum b/service/go.sum index 251673b7f4..8a7e789d32 100644 --- a/service/go.sum +++ b/service/go.sum @@ -379,19 +379,19 @@ go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0= go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= -golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q= -golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4= +golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts= +golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos= golang.org/x/exp v0.0.0-20250911091902-df9299821621 h1:2id6c1/gto0kaHYyrixvknJ8tUK/Qs5IsmBtrc+FtgU= golang.org/x/exp v0.0.0-20250911091902-df9299821621/go.mod h1:TwQYMMnGpvZyc+JpB/UAuTNIsVJifOlSkrZkhcvpVUk= golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/mod v0.30.0 h1:fDEXFVZ/fmCKProc/yAXXUijritrDzahmwwefnjoPFk= -golang.org/x/mod v0.30.0/go.mod h1:lAsf5O2EvJeSFMiBxXDki7sCgAxEUcZHXoXMKT4GJKc= +golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c= +golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU= golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM= -golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY= -golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU= +golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo= +golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y= golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw= golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -408,23 +408,23 @@ golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ= -golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= +golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k= +golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU= -golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254= +golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg= +golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU= -golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY= +golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk= +golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA= golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0= golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q= golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= -golang.org/x/tools v0.39.0 h1:ik4ho21kwuQln40uelmciQPp9SipgNDdrafrYA4TmQQ= -golang.org/x/tools v0.39.0/go.mod h1:JnefbkDPyD8UU2kI5fuf8ZX4/yUeh9W877ZeBONxUqQ= +golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc= +golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= From bf26798c290ac50f5af932820c0605001e248977 Mon Sep 17 00:00:00 2001 From: Paul Flynn Date: Tue, 10 Mar 2026 16:53:14 -0400 Subject: [PATCH 4/5] fix(test): address review feedback on integration test code quality - Replace panic with s.Require().NoError in SetupSuite - Check tls.LoadX509KeyPair and x509.SystemCertPool errors immediately - Handle jwt.NewBuilder().Build() errors in mock server handlers - Use restrictive file permissions (0o644/0o600) for container certs/keys - Check keycloak.MappedPort errors instead of ignoring them Co-Authored-By: Claude Opus 4.6 Signed-off-by: Paul Flynn --- test/integration/oauth/oauth_test.go | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-) diff --git a/test/integration/oauth/oauth_test.go b/test/integration/oauth/oauth_test.go index db3abd0742..81db49ec9a 100644 --- a/test/integration/oauth/oauth_test.go +++ b/test/integration/oauth/oauth_test.go @@ -45,9 +45,7 @@ func TestOAuthTestSuite(t *testing.T) { func (s *OAuthSuite) SetupSuite() { // Generate RSA Key to use for DPoP dpopKey, err := rsa.GenerateKey(rand.Reader, 4096) - if err != nil { - panic(err) - } + s.Require().NoError(err, "failed to generate dpop key") dpopJWK, err := jwk.FromRaw(dpopKey) s.Require().NoError(err) @@ -76,9 +74,10 @@ func (s *OAuthSuite) TestCertExchangeFromKeycloak() { ClientAuth: "secret", } cert, err := tls.LoadX509KeyPair("testdata/sampleuser.crt", "testdata/sampleuser.key") - rootCAs, _ := x509.SystemCertPool() - rootCAs.AppendCertsFromPEM(ca) s.Require().NoError(err) + rootCAs, err := x509.SystemCertPool() + s.Require().NoError(err) + rootCAs.AppendCertsFromPEM(ca) tlsConfig := &tls.Config{ MinVersion: tls.VersionTLS12, Certificates: []tls.Certificate{cert}, @@ -317,10 +316,11 @@ func (s *OAuthSuite) TestClientSecretWithNonce() { s.T().Errorf("Nonce is not a string") } - tok, _ := jwt.NewBuilder(). + tok, err := jwt.NewBuilder(). Issuer("example.org/fake"). IssuedAt(time.Now()). Build() + s.NoError(err) responseBytes, err := json.Marshal(tok) if err != nil { @@ -406,10 +406,11 @@ func (s *OAuthSuite) TestSignedJWTWithNonce() { s.T().Logf("didn't get nonce assertion") } - tok, _ := jwt.NewBuilder(). + tok, err := jwt.NewBuilder(). Issuer("example.org/fake"). IssuedAt(time.Now()). Build() + s.NoError(err) responseBytes, err := json.Marshal(tok) if err != nil { @@ -518,9 +519,9 @@ func setupKeycloak(ctx context.Context, t *testing.T) (tc.Container, string, str "--spi-truststore-file-hostname-verification-policy=ANY", }, Files: []tc.ContainerFile{ - {HostFilePath: "testdata/new-ca.jks", ContainerFilePath: "/truststore/truststore.jks", FileMode: int64(0o777)}, - {HostFilePath: "testdata/localhost.crt", ContainerFilePath: "/etc/x509/tls/localhost.crt", FileMode: int64(0o777)}, - {HostFilePath: "testdata/localhost.key", ContainerFilePath: "/etc/x509/tls/localhost.key", FileMode: int64(0o777)}, + {HostFilePath: "testdata/new-ca.jks", ContainerFilePath: "/truststore/truststore.jks", FileMode: int64(0o644)}, + {HostFilePath: "testdata/localhost.crt", ContainerFilePath: "/etc/x509/tls/localhost.crt", FileMode: int64(0o644)}, + {HostFilePath: "testdata/localhost.key", ContainerFilePath: "/etc/x509/tls/localhost.key", FileMode: int64(0o600)}, }, Env: map[string]string{ "KEYCLOAK_ADMIN": "admin", @@ -551,10 +552,12 @@ func setupKeycloak(ctx context.Context, t *testing.T) (tc.Container, string, str if err != nil { t.Fatalf("error starting keycloak container: %v", err) } - port, _ := keycloak.MappedPort(ctx, "8082") + port, err := keycloak.MappedPort(ctx, "8082") + require.NoError(t, err) keycloakBase := "http://localhost:" + port.Port() - httpPort, _ := keycloak.MappedPort(ctx, "8083") + httpPort, err := keycloak.MappedPort(ctx, "8083") + require.NoError(t, err) keycloakHTTPSBase := "https://localhost:" + httpPort.Port() realm := "test" From 8a6ba8cd796603ff1ccc2b1ad3445d76666aa6d9 Mon Sep 17 00:00:00 2001 From: Paul Flynn Date: Wed, 11 Mar 2026 13:03:25 -0400 Subject: [PATCH 5/5] fix(sdk): remove duplicate testdata left behind after test migration The PEM keys and certs in sdk/auth/oauth/testdata/ were copied to test/integration/oauth/testdata/ but the originals were not removed. No SDK code references them anymore. Co-Authored-By: Claude Opus 4.6 Signed-off-by: Paul Flynn --- sdk/auth/oauth/testdata/localhost.crt | 26 ------------- sdk/auth/oauth/testdata/localhost.key | 28 ------------- sdk/auth/oauth/testdata/new-ca.crt | 33 ---------------- sdk/auth/oauth/testdata/new-ca.jks | Bin 1514 -> 0 bytes sdk/auth/oauth/testdata/new-ca.key | 52 ------------------------- sdk/auth/oauth/testdata/sampleuser.crt | 26 ------------- sdk/auth/oauth/testdata/sampleuser.key | 28 ------------- sdk/auth/oauth/testdata/sanX509.conf | 1 - sdk/auth/oauth/testdata/sanX509su.conf | 1 - 9 files changed, 195 deletions(-) delete mode 100644 sdk/auth/oauth/testdata/localhost.crt delete mode 100644 sdk/auth/oauth/testdata/localhost.key delete mode 100644 sdk/auth/oauth/testdata/new-ca.crt delete mode 100644 sdk/auth/oauth/testdata/new-ca.jks delete mode 100644 sdk/auth/oauth/testdata/new-ca.key delete mode 100644 sdk/auth/oauth/testdata/sampleuser.crt delete mode 100644 sdk/auth/oauth/testdata/sampleuser.key delete mode 100644 sdk/auth/oauth/testdata/sanX509.conf delete mode 100644 sdk/auth/oauth/testdata/sanX509su.conf diff --git a/sdk/auth/oauth/testdata/localhost.crt b/sdk/auth/oauth/testdata/localhost.crt deleted file mode 100644 index 2bfe20210f..0000000000 --- a/sdk/auth/oauth/testdata/localhost.crt +++ /dev/null @@ -1,26 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIEYzCCAkugAwIBAgIUBcYOn2rG6y98ADDpKoj20huHt9IwDQYJKoZIhvcNAQEL -BQAwYzELMAkGA1UEBhMCVVMxDDAKBgNVBAgMA0RldjEMMAoGA1UEBwwDRGV2MRQw -EgYDVQQKDAtLZXljbG9hayBDQTEMMAoGA1UECwwDRGV2MRQwEgYDVQQDDAtLZXlj -bG9hayBDQTAeFw0yNTA0MjUxNzM3NDRaFw0zNTA0MjMxNzM3NDRaMBQxEjAQBgNV -BAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALKr -vtDsVS4BRBmkgGn9rz4Z3H4K2R9oMgoMFSj8AIzTSgJEGPHWE3BHgh3V3OPc4BJ4 -OjAn0fSpdNulqLBUBNJnMKZCDOTfs/JB7gBNg1uB4Hba3Umc2rPMHyzk4YX7uqIL -jYqKbMtEoDQ548AuHUNYHu+Iee7ukjVlV7jNF9W++Vo6y9p2yoo6C9ClF+9sSaHT -XhcU8a8aEDUet2cTdgiEMGJm3Cd3wAGAzFMN+mJdHecuZ2m6Ze582N/+ZLLwsWGy -fJzJ21FJsn002Zw+E1utleR0yL2W0kjRw5Fd0YysXKhSdKQQ9kyBBubjuYVhLfWB -xkXVV5gTlqNfuS1+6McCAwEAAaNeMFwwGgYDVR0RBBMwEYIJbG9jYWxob3N0hwR/ -AAABMB0GA1UdDgQWBBQ2FSk/BRC2TbNtGYDVVbWtdlHOijAfBgNVHSMEGDAWgBTO -xVPaQyhUx7eUgwjg20dWE23uJzANBgkqhkiG9w0BAQsFAAOCAgEAXCriDq5LLPrc -qLy6IDxWkz9ulkFXf77ZyprKrIrgOASbq7Nwz/wsAYydq0PBTUGHY0/akDt/O5Tt -37e3i7kN5aVzMUAb05j7JBPeQqzs1CVySSPkCWb2DzqHajIpWp8SkzRVCBLRu3l8 -T3yS8q1BDVteu5SZV88Z6eTTdq0/0Fw6iWKIELiKRx7fMcUyKhwTE07Y6QujvxVc -P7pgn9EU1mF2leOQy9RrAbzJPDkeLa/zLE9Pjh48Ea8sjEXlORE58WVAxqVstxKj -QjbIMv5H/DUqYRoi/bXfTQU+xs9ucblbmBibIgTYWiAwaNxgmHbYfG6IrPdb1VLD -X1J29A01ADQOb4rnU85tPC5fBAcP3tZhlMzjxi/LYHR0iPOhGKAQcKc1DpZqgbHs -FmPdNcPsVc8rOElXSkdrXvEgMDGXH9oFV//gwv5Sb2tI12O8MmmGNg8zZp+wJiPC -hyoqy5SAll0uaEY6YBHBgRB/40QsObkyVlFavuqipJ2eWmNdkRjVHnPTK5kOML86 -fQE0ChJu8bmRj1Dy4GQfKgEiuB3r9sHke11IdQo4zoZRNdSm0NKuQ1kqMgjoFubl -kmwEfUhKyGH7zSV7CFSejA59rE675da3mJcva2vYvY1XG5/T3vdkUtuOTUtqD8l0 -xSJN7KHHieas/nabhc4wP2/YheNaFuM= ------END CERTIFICATE----- diff --git a/sdk/auth/oauth/testdata/localhost.key b/sdk/auth/oauth/testdata/localhost.key deleted file mode 100644 index 0d1791bcfc..0000000000 --- a/sdk/auth/oauth/testdata/localhost.key +++ /dev/null @@ -1,28 +0,0 @@ ------BEGIN PRIVATE KEY----- -MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCyq77Q7FUuAUQZ -pIBp/a8+Gdx+CtkfaDIKDBUo/ACM00oCRBjx1hNwR4Id1dzj3OASeDowJ9H0qXTb -paiwVATSZzCmQgzk37PyQe4ATYNbgeB22t1JnNqzzB8s5OGF+7qiC42KimzLRKA0 -OePALh1DWB7viHnu7pI1ZVe4zRfVvvlaOsvadsqKOgvQpRfvbEmh014XFPGvGhA1 -HrdnE3YIhDBiZtwnd8ABgMxTDfpiXR3nLmdpumXufNjf/mSy8LFhsnycydtRSbJ9 -NNmcPhNbrZXkdMi9ltJI0cORXdGMrFyoUnSkEPZMgQbm47mFYS31gcZF1VeYE5aj -X7ktfujHAgMBAAECggEBAKcd8y3RT97m+j6N2jrJOMd6Qv11wh4ZRGyXXpdmFlGi -M2ApN7fDx4zGpdKoPaK37rH32F1AcaZJde8YZM8A1z3BnQR1VUAiaVqYBjgsSEgo -E763+jEnUHzJ2QMR1kuO58M30R0bWqVJvBr9ZqRTvbVG0DC1028DoKfm8YT9+GRI -Ws18LiLRoWO67Wrw1hu/uX/xA482qqLBn6JGQVcgGkvtQvBqdBzKRXaOkznZc0Sk -nHVHOanKGRtAYUQCu7jga2BuayCn4rofbpCT4SUmyHSjA0mSHIgpRdBCyslSKkeO -az3Qv6K19o3u4HrKQJxsuqW/ka4j0bN11WOBvB+UbxkCgYEA39PsFidZvu4l6Wzs -GYbAD1N5SgLAtqvwCwCIiF8ZCUBe9ORYoPN+yvlHyQ2SMyqDUYdJ8j+RWey9Geg+ -juSIwkrtl9bNgVRiCPLrddYdod/F71QeCHqlTYkkomLaYODDRkoFS6jNXDRZxaZK -IXBr3y28PwfPpwT4LGtp71PgQ0sCgYEAzFo00Y83Iz/7jnV8wm97En7JL3y4yXMx -9kE+zj2kJWBL5HtH6mVOEFy6npSKkeqR25oF4WV2zyLyu022m1YSJxbC+XMe2qZZ -+dUuhEggGBkTfTMl+eWUedizuDPq7vd5AHeVn9+Oaxl0W/pBnqLAyGDVnyxkZkC+ -uUHD811oRvUCgYEA1qXEFWa9UTXPE7DKJpysGMaDXW+QYl43AEYNqUIRn2ak6ZMG -T6vTX1F5/xxNpVXSw1/LkU5W1PcMTgkD3ULayADVIzTytWE39r8HAWVJ24/eoOp5 -NsZvOhEYGcZVCGzjt8eKlokWD6OAp+QV2UWXnVqd2ZBjGhfQ68BCwiocuksCgYAn -+9Jv2lzIeeFni1dg1901zjbhIr8pM2/oJfX69paidYgD6Zc1pqKykuI02w2N5V6q -oCVcZ7TqbIUf3uHG3P1qRorZsgusbnYWav7SBSa6cFWe3p4kmiYF/T+U4BusrCEx -1TQiduRv0igxQvMJ7gBYdJH3tgDi/PIUX2jOuk0H7QKBgDxOWfRezUgS0IoXA4fk -l5wAmPuc3h/PmiluaR4tM/rusXK7sz+LyqeuVv20qEW1+fiSJYEpavr9WHzZYbYh -AgJE6n5UCWMogSmq4LzqI1dXU45lXytL3aDYwoo+UK8L0FsYi5FSI8pgXLRIpUY/ -JXfGmyC6web7ytelgOEG8vBo ------END PRIVATE KEY----- diff --git a/sdk/auth/oauth/testdata/new-ca.crt b/sdk/auth/oauth/testdata/new-ca.crt deleted file mode 100644 index c5c90e00fd..0000000000 --- a/sdk/auth/oauth/testdata/new-ca.crt +++ /dev/null @@ -1,33 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIFpzCCA4+gAwIBAgIURqqRmFi5XM46wV4AnUYwX8jD/pMwDQYJKoZIhvcNAQEL -BQAwYzELMAkGA1UEBhMCVVMxDDAKBgNVBAgMA0RldjEMMAoGA1UEBwwDRGV2MRQw -EgYDVQQKDAtLZXljbG9hayBDQTEMMAoGA1UECwwDRGV2MRQwEgYDVQQDDAtLZXlj -bG9hayBDQTAeFw0yNTA0MjUxNzE4MzZaFw0zNTA0MjMxNzE4MzZaMGMxCzAJBgNV -BAYTAlVTMQwwCgYDVQQIDANEZXYxDDAKBgNVBAcMA0RldjEUMBIGA1UECgwLS2V5 -Y2xvYWsgQ0ExDDAKBgNVBAsMA0RldjEUMBIGA1UEAwwLS2V5Y2xvYWsgQ0EwggIi -MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCXW/6kmmZ95KWjuMj/PUEoBD1s -Zp4LEnF+e4+rIKov/wT+kRCtaH2PO4Xg96WtvWBpm0vHLS4jIPiwjnxuuDHFQBF9 -LFI0JW+MAVvFJc12qeT6E6nGM+lX54gtitL6zvcIM+vaXoUlPz8JmDPk8jbmKlTG -GwAdtPOguF1xAMQSAqXGd9m2TXsenj9y3B8F8wQ5yeHyiw8Xc619rh7d72CjBBFH -TkvfE/NDIA0iWS729+0ZyUTCwrFqLXEjPAXvInmHT6FizI+wGgJXLnAhUZu1k/4M -/EtL0NmB+TL/oiQSAdryei5z41u9wzsObdHhhzY/r614UeZbR3BY8l2FcpE9jHYO -8AX6xhFxJYLZYxFx1kZ3DAurzCbsYzyxrMRjOmTrRYYPWggEfBrnu7UROJIHp01X -8Q+KWfgSH7ElTm74Jh47wB0apghpVhB2BzZrmWkExNF0kTozfNxXjoccWakFoXwy -atMZtXpZIh3J+EigvyaLcG6eP5gWpA1NUbg7f885114+xysEqlbErC4pyO0oPjUo -n3Ur2EG4WZEksTVUKqgtnuq3HnOz9PmNSXJLq5ICFs+s/Rj4jyCVvaLVcJHNz63a -J7iNEYUznC1Vy3TW826YuHO+ZsCwYiLNZKDv+OpfbIHwUDoELcN02mEqCPW1CdVR -XpvT8f/pJNnJG5N+ywIDAQABo1MwUTAdBgNVHQ4EFgQUzsVT2kMoVMe3lIMI4NtH -VhNt7icwHwYDVR0jBBgwFoAUzsVT2kMoVMe3lIMI4NtHVhNt7icwDwYDVR0TAQH/ -BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAgEAhjGrCNBy6Qk7oDI5bdCjN7avz/cL -CYXQhX19NLrneGOCd+7ZTsCjdR3khiFZwRdSxS2M6x61OYPgObBmwZhAIsAPvPu9 -g2wNhYTCQfRTL2fhHqFdDQbr9Bz+QIZiBPv0mDJo7I6iDdcfGcr5JR37ziiUzcpS -CR2rULzkT2TpT+XtOB1dFeDnwVvoMklIGCEBsIuUpF8CWGxDbW5cdKhqkKR9MZXK -BKr9IEtuNCfU3GkBBUbIyqgs2UT7eCQ/bcDSoXHvoJ87Q4AGeekGLXjBiesvegNF -dSDnsNdQ06G2IZpXUQwJmbke/UJ4xubkJnu9HxtnhswOOjaiNj1I0qqo+c2j88SH -lhUktwjtTtStg5a1s8JTHLVnreBmcbixZnKHySLrDczt1LCvDsyFMDq81prHjjFl -TRYAmDCF4TbVUbX8BWha4J7k784fMHUqq+rXW2HC4CPYuL8zKneoufrCjYOO+Jwp -0E/S8Ln3lugjpo6FiZMpqqz3doJe9X3A49gbRY9yardTwEhbYM0Nch0No9P1xgMu -ffCu7xm10Y+PG/z9YtZBOOMvK7qzZIhdRIqz7KZxmpQFu7HcbcrT833idbATbqOr -1mwb9hW711Vtwp20Z+ZAAbSdKj/OX9rEMoBywGuhRAeIY+9sJR4zcYlZnVk3uBIv -wi+lNvGtM5PexTk= ------END CERTIFICATE----- diff --git a/sdk/auth/oauth/testdata/new-ca.jks b/sdk/auth/oauth/testdata/new-ca.jks deleted file mode 100644 index 4bb5e7dbdaa708cd4b42e2eca83922b3983873a0..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1514 zcmezO_TO6u1_mY|W(3o0d8y^P$%#PjwA`N&{}@;!^h^yb85mes8#J*lH)vw+U%<@7 z$iyV#wrb*xh@CO#tPaL8%ylz}KXLfqWCLC{POUbNw(q=*jNGgY2FZrp2Apinp)72| zOrgPsJO*4K4hIjjOKKU6#}46%7zlynxOlj|Q!A5m@)NTaoE>3mxKY$Fqo^^E6X!KD zH83$UH8eN0FgA-4=QRd#jiFrnIHHM33EA_EtPIReO#BQ6O-x)&O-zgo)1&__nUz-i zWa;7^C;r(Z}t-#Lt5-->HhwYTS- zVf^Hi*)y$>W6}(=TRtz?5nIS`M2KnWvGSYSe5>W=*%#fBXZ_4#dGg_>ZhrCNwYBTy z?!Hf0%p&OS=Y3!Jv$F!PQl#Fu?{6hfx*R&RF-x~l*@pGKQf0gU!lX0(8>E=R^$HXN zXK$VSkLQoK_l28{KaKt`QW0Xj^{Gm)_;K{!!`6Jc7az8p*{@$)5%?_Hy&&RKY-`a( z+nzGM53IkA2^Ok0-AooNyyjNU!@c^9+M8sXjcbl1Tcx~qZR3yPV5yOMzI&^n#U%FS zzTqGFyCQ!G$!}Ek%ln}wXMI3cY8gjnm_Ql3S@z6KmLnHSCR!QS+zIb%mx)}-y0FG5 z>$2q5sz@c-lRrEb>{sh9$eU+BLu?7JZ{QB=`tz38jI- z6>K%0qZ@j<u7QSCF-`cr>t@0(CZpFdQ*ZNh=uB8gk zH(U?6yl|W1tnfe{&Y3&q{yJ40d-g=Fdat~6dfOR3E3-vrwjP&Ot@wF%@#iD$(?nIa zbG-GtvbK5J*3E~4WwxfTeUMhTV`ExT`$?tOyl38C*|47POsj#_o@=v?_Zg=8iZRSE zXnkmQHE`=6){LkJ^PapvCvQ-ywffcd=)^-0lyB_VZ>&|mV&|_zz0G|;=4f8^=dz?doQ{5 zVt>E%pT9}h94#K}Ywy~e(h=*@wfW7m!dX*TcW=Ctd+PG%+DD}ug!2}!zLq2XO?3D5 z(A-0Fx1>LFVB9iS%l=&ats_PaMF+AMy0CX7zt2&XGcN3moEvGrLrDLS{!+7#YmF!0 cJ8C(X*)~&7!*t3#nMlt|H>>=AUlmse06Ro%WdHyG diff --git a/sdk/auth/oauth/testdata/new-ca.key b/sdk/auth/oauth/testdata/new-ca.key deleted file mode 100644 index 2c16768045..0000000000 --- a/sdk/auth/oauth/testdata/new-ca.key +++ /dev/null @@ -1,52 +0,0 @@ ------BEGIN PRIVATE KEY----- -MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQCXW/6kmmZ95KWj -uMj/PUEoBD1sZp4LEnF+e4+rIKov/wT+kRCtaH2PO4Xg96WtvWBpm0vHLS4jIPiw -jnxuuDHFQBF9LFI0JW+MAVvFJc12qeT6E6nGM+lX54gtitL6zvcIM+vaXoUlPz8J -mDPk8jbmKlTGGwAdtPOguF1xAMQSAqXGd9m2TXsenj9y3B8F8wQ5yeHyiw8Xc619 -rh7d72CjBBFHTkvfE/NDIA0iWS729+0ZyUTCwrFqLXEjPAXvInmHT6FizI+wGgJX -LnAhUZu1k/4M/EtL0NmB+TL/oiQSAdryei5z41u9wzsObdHhhzY/r614UeZbR3BY -8l2FcpE9jHYO8AX6xhFxJYLZYxFx1kZ3DAurzCbsYzyxrMRjOmTrRYYPWggEfBrn -u7UROJIHp01X8Q+KWfgSH7ElTm74Jh47wB0apghpVhB2BzZrmWkExNF0kTozfNxX -joccWakFoXwyatMZtXpZIh3J+EigvyaLcG6eP5gWpA1NUbg7f885114+xysEqlbE -rC4pyO0oPjUon3Ur2EG4WZEksTVUKqgtnuq3HnOz9PmNSXJLq5ICFs+s/Rj4jyCV -vaLVcJHNz63aJ7iNEYUznC1Vy3TW826YuHO+ZsCwYiLNZKDv+OpfbIHwUDoELcN0 -2mEqCPW1CdVRXpvT8f/pJNnJG5N+ywIDAQABAoICABg+VCAHBRdGxMs1C/4Upczk -OkxpzAhc+LsizRptaHpjQBMK/EoHkbjxS+/X6tHUd/liYPWzBGVRtikIIYvVyqRc -BJEb72zKeZP0xxS3Cd0RuGCKlBJwT9X/JV5EvVIOosh4ZzTPwpwlMGfNLl649yx6 -/PTK8AP8xFsVZ2N0FR5cuIh8u5f00B18M7smNn029WcmMXUuazPn7j19DWpMmcTH -9YE03CKL6QEdmfegTk1Lh87Yteqg0axT6/+8m6didRHEd5vsxQUWyBIxGM/AE7nh -TaYZ0RurL55Jt9lJ82TDpvoDXPu99SdaJSmZ/diVq42cNM5asT7PR1elNm/rWlzr -V5ZJgjY7zvT6DQDLCMmD91iq6lTCeuAPmh4idH2E2Xer+vCaJWEH9svAMdvxP/53 -GzlwXa58VaqPagFODZ5DFmJNdXmWyEnujD02N29AD23PUw6GqzZaZlf8WGZbBiCb -ct2Zl27cgl9P6hUCjmq+uVF+MDL0dcIME73cD1f/utuK+LMpk5aR8o5yRRDUqlGr -qWsrCfbIje2kjHaZk1heI6a1u3pusDM7jDaeEYsyoiyThJgZs9PgTnS70IXia51o -I2pxPOiVS0KntnD4X5A8GaK1qkzwAo8rMXX7VxQRBfhZZVdtZpngMPVbLVOJ+RAI -Od/eHKnkBPCC4MuKyfQtAoIBAQDUPSajw+eVUVUwWVtgs9rxA4f/0mGwwKPZ7RIy -pfjVzkN3uEUZlh6dfU4hNtf12bcPnGTIU4cOPZogn7YPnFCiGVgZtDtlZ/11KuXS -mW98/pQz1HWQM/21UF7JmsMjcALTUi3uCbPE/RXg1XVunJDQaNlKui29o/7oqvJ7 -d8jzrGmUxdEv9dNqu2SpDSBzx1a2Fh+jMxgXaxUyVniCN5ZnbauNpTaWk48qPQ4+ -bCmim51HxuwfPu4ehTtH5qGWY9+DcTaKavwrWVYZGU+EI1iKaEqnNfMDPbqP1CCm -GSB8cQR8W1bTGHSF485wyaMMx/j6NDrvqkGB9veZuXhzTrTPAoIBAQC2kV66wxl0 -Fn/Ipa5xJNzhsCAtnUpUxJbEoBJYN5N3JtzNqbb92u9Nos46Ws9EA5odTDlih6oi -dPiMmXy9CMdjpjL/q10Pu40msZlt3QslYtJf4AHNlcuStumxcL1LySeCwi+5OOc5 -I1zIIcV08cqBhywZ3j6N1D8Y874ejUAf17OOXZoiyKG7JJkgxIpL32x+oNRnIAhN -iYHGgGe15nkOIFLYBnoC29Edx//ECkStX8iQuEq+D21fbQUnYksFlMPdjeeQANOt -7vZ1AiG+VCQqDRGqDrdGDCTVoxquE1mgflh4V6WvTb6fgjls401dxWFXLB9rposw -qPIAzguw/c1FAoIBAQCPaJ6CS65gs6tHVymqZv0Km6M6lfJSl2hfqZQBSyqfdZca -/xUZ29jl+7ReNwun4KuUTc2/mskIM1HAt4oydCH71fo0rBbyR1j44bqXGfw+Tlrf -xrCFdsv4xsy1lvBCMr6GAeJtFHs3IPe2iyWlTv9/A0nH95NOr9BfcJsWGHNdS2Ow -FhZqPMXVObgjjm4eLVSHBt3rzWt6721MLSeSfXMQggdIV5lSF3TGSqkkPrvHVzTo -Oh50YnZNgyLyS4Fl+CggTdBXqUCpHd1SakrTc3qxUxUWdRq2VvCHnQNOmG3eCBPK -34EEdGLP0YU9qtGUok626bHlHXrUEYduhOdBqq37AoIBAHayYuWIDRd1vVTFq3my -Xs15BiLB/d7JBcEG1YZ3c6/nG223Ztr7KdTPAcfc3J66vMtJkJGn5IyMgkBfVkNM -3t3B46xoTJP6+1Vp6HgOW73N1zswV9vDBVz5AU01IE2SldakzARfo615eUxA8LEM -tv2p1Zln7kGl+fQOHNCeQ0+wnPP1lU4CJWyX6drtDYEw3MgjZpU5tUw8F5zoRQV1 -t8TgbRw4ccFEC1ySeI6LooUaHjtBJo8VVqXRKqWleWNCimmUZjYw429VSvVeEnQ9 -HlocrxxifvPS12vypFkDCaWYH4r2aSlloYbxUsahrd5Ggvf7Ht6NpDdZ0CWH0QAc -swUCggEBAL5z899JEyRLharBIl1tUix3XDjqmpX+F2TRPQJrF6x8tAyoRyzFAOEf -F77uB03L/kF44SIGC92z/ZMGL7XIo7dJ/bDnyVOfirWvOUwF6JafJxGmJgutyge0 -RmfP05JElx9ztfX3SnIc48x6vVCSPeeNZifV/qYvsV+80fwru7TETF13p4xLL91B -F+MkUHRaclE/1rqXuEdAEV1rA0+v5YUCBdp+31N2wzh7vPw7BAo7STbNUxy7+n8g -lyvgh49iT2gZ25k8lkw5T7OzTV0rRWuXWG/QbcG+dSWS1zDNOSSqF/MrU44A6lGm -edwJUrNCzm6zmzfHkSsov6NIS3te55k= ------END PRIVATE KEY----- diff --git a/sdk/auth/oauth/testdata/sampleuser.crt b/sdk/auth/oauth/testdata/sampleuser.crt deleted file mode 100644 index eb1d3b071f..0000000000 --- a/sdk/auth/oauth/testdata/sampleuser.crt +++ /dev/null @@ -1,26 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIEazCCAlOgAwIBAgIUBcYOn2rG6y98ADDpKoj20huHt9MwDQYJKoZIhvcNAQEL -BQAwYzELMAkGA1UEBhMCVVMxDDAKBgNVBAgMA0RldjEMMAoGA1UEBwwDRGV2MRQw -EgYDVQQKDAtLZXljbG9hayBDQTEMMAoGA1UECwwDRGV2MRQwEgYDVQQDDAtLZXlj -bG9hayBDQTAeFw0yNTA0MjUxNzM5NDBaFw0zNTA0MjMxNzM5NDBaMBUxEzARBgNV -BAMMCnNhbXBsZXVzZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCa -Xs9WCGdFwtRcs8+NGyf8lebUQ55fBTKUn7Y6tIfox/f6Mtrtc9xUW+1fiO7PhiVx -RphAPdfttekLGB6LKYRmnBk58EBUQpbbC2mfxL8LhdEYz9XCq8pzGLI59IciRqHa -S1YMH9pHW7e5PDCuS5BrcA05gip5y6vyiLh80GWKwo/9Wf8A70KtLnk3ggrFKMXw -5DOCVzTM6ms6bVjqdXHK1c64q/kNcr4nrEiamV8KwH87UZ8qCMWkET5B4/+lTbgi -oEdPZ65FQVwMMUkCcFl+smwmiIZtjiTsnfsq8Tc/KcLz4VKRNB2E0mlOG3DHueNH -yVRuNoxfZYny50R+2m+DAgMBAAGjZTBjMCEGA1UdEQQaMBiBFnNhbXBsZXVzZXJA -ZXhhbXBsZS5jb20wHQYDVR0OBBYEFIRqJa0ogdeHeQARsqOEjheW9QJOMB8GA1Ud -IwQYMBaAFM7FU9pDKFTHt5SDCODbR1YTbe4nMA0GCSqGSIb3DQEBCwUAA4ICAQBj -KWqxC6Vtsc4J+ZTEwHD9qXVwLXkP9VUAaWkb40Er4Uflt09DIzrk1yN+3x33qRhf -TzcuhuDTQnZqO0QDEIm0dI3ju0rGSxFouqlqgrfmJeQ/ultPM2yzn2YRkhBId4Za -Bjbyh/yyowDQDns0S+nBGTBzEEqK7jiAY/jlI3JhFiw30iUoWG3iq70eqOU+yFgF -saCo+dldBeiKD2kBnP5GvRK8fcuPFI/m6fS08oA4J73+x110xNWRL2PvnUiJVujc -GA+O6GxoZa6GB0aVe/9Al8Xw/v+K16q7Oh09UpBBgx5g6f0LORQjl7SLdzbKglwY -qTumgMFFdqI6NyAqU2GxrYG1X9UwXdauVVMYqWk5UhaGYRE90mULfsukNGL3wn8f -2R0EnT1n5GYFteR4jueWMAMXsYs4VvwSWGjAndEQ0fhEztBqcPA5ATAg6IIbSciC -TZbIMsU0WwgysZ/SxJwa1/6ZFBQVdHKpPX0r8iibYU33ugCjz9jXmUPurjuXuc/Q -Ai2D8RwyOWp7Dg662ufLKcIn0aO9Hrs61pbTqhqKdbscuYRkhUn7zvtpIN/Q8AnN -8Xh4eq7c+Ox6LTkkv9iUo85d7UPSeRxdK+4xR2VmyuZdKlOAduURTAZeqIS+OJw7 -MzMup6L4gugLvIGdAXIKyVgHQH8Pjnqz8n2TcpZK3Q== ------END CERTIFICATE----- diff --git a/sdk/auth/oauth/testdata/sampleuser.key b/sdk/auth/oauth/testdata/sampleuser.key deleted file mode 100644 index baa7ed0dcf..0000000000 --- a/sdk/auth/oauth/testdata/sampleuser.key +++ /dev/null @@ -1,28 +0,0 @@ ------BEGIN PRIVATE KEY----- -MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCaXs9WCGdFwtRc -s8+NGyf8lebUQ55fBTKUn7Y6tIfox/f6Mtrtc9xUW+1fiO7PhiVxRphAPdfttekL -GB6LKYRmnBk58EBUQpbbC2mfxL8LhdEYz9XCq8pzGLI59IciRqHaS1YMH9pHW7e5 -PDCuS5BrcA05gip5y6vyiLh80GWKwo/9Wf8A70KtLnk3ggrFKMXw5DOCVzTM6ms6 -bVjqdXHK1c64q/kNcr4nrEiamV8KwH87UZ8qCMWkET5B4/+lTbgioEdPZ65FQVwM -MUkCcFl+smwmiIZtjiTsnfsq8Tc/KcLz4VKRNB2E0mlOG3DHueNHyVRuNoxfZYny -50R+2m+DAgMBAAECggEAbhP/i1zQr6k/n59E+F0OBYqrIF/bdeyR5fOBkZkcdTzr -MonDHaIJ0kn/GaneiTMiTgVGGkE/Ua3vMU8QsLF5TWYwguU0KiGVyzr3Jcu5Y7EX -qrbBumCgK7THmpYpKqLtVWl1QY4RK+NWPouSNyeBI2uysniEa3d19KvTyoUcc3Yw -be5aK+b3MXC5Ig7tuXXroM7ubBG4/MqHi9t7IPyTbgJw6iiqLPS9Lckjb6mSQVxr -zcwfc48MFgdkv/ZAKtSTYCrz8miUuTPvn7DfHdRlyN27AvDgw0VjNgD2JbQOkJNf -E08auB8oJHN65wo3i1Ko8iNp2JjySTU9udq2opwluQKBgQDMvWbuxq5nhQzdVcpo -zFVdAWhaWpjHzcSl2oy/r5fyIx5FlOk0spv/AOXNe0i76OYfsxKSdp8ewK9U8Y7g -LPg8Wf1Yh/xThgytcmltpylbWq9YliGIjakDQgXvGY/MzOi5jQoWkVtBU9KL74Fn -Cmv2V8I2/RcGnrQPFUtk5+pzhQKBgQDBBQZLu56MzyjD8s7gchODGuNH/uIZBGi0 -NcYaFa1coEXshFguXwp38kzuE+YhXbCw0s6IF8gz8F+coyXXnDMGt2J5K97mUfjo -Z+VeFV18uomEMpJNQ/AHqn6QIEpTKsisEKfROO7rFSKkZAkAUIGTUHhgcT6qRfDk -jmgWfjuxZwKBgQCpvcVe5P2m+Znmzr+XDwEesJIRhtbvn9sPHhheu3ef2hm42nJV -rFbEnbvoFfQBRl+znEUjhJD7cAhsxjAMD3xmnLz77xH1NUfBbP+XV2VkRdTl/uIi -Uj/zYYOF7Y1Y3/F6FEJu32fmy1Xdil2gTfWgMLXl3QKADId/kcoGCHhJ+QKBgQCT -7PfgPo/KNlF1qrYliQevKIIbARniNmDQC44hG4/bNvGfy+WQ1EG/nzCaHSH3XEg3 -m7ew0RkbxRJhhx9PWGQ6t3x+hMK1HQl3g3hjXFhjaMpPSDqbgH+KQH3ykuyjRFy6 -kaErVUi1XWNJPWkwloJXlgpLTz7JXAS8BO98nY297QKBgHn5oyUJW9HEkBh7SP5k -CwMNGVynJ8+2phN8AcAhMH/RzFokQ4qlL2i3nHk7hg8ETcg5y56INPWsw3Xcx2bp -T2UouC9i3fhGlY4nZEunYntScUPCza4ynzBashEzVzCnOVFYBK9rjvGOP0bKftYK -czNbHJn06rJdbocE/JfW5m+u ------END PRIVATE KEY----- diff --git a/sdk/auth/oauth/testdata/sanX509.conf b/sdk/auth/oauth/testdata/sanX509.conf deleted file mode 100644 index 729de7a277..0000000000 --- a/sdk/auth/oauth/testdata/sanX509.conf +++ /dev/null @@ -1 +0,0 @@ -subjectAltName=DNS:localhost,IP:127.0.0.1 diff --git a/sdk/auth/oauth/testdata/sanX509su.conf b/sdk/auth/oauth/testdata/sanX509su.conf deleted file mode 100644 index 53fcac1275..0000000000 --- a/sdk/auth/oauth/testdata/sanX509su.conf +++ /dev/null @@ -1 +0,0 @@ -subjectAltName=email:sampleuser@example.com