From 33ffcf068963f0a3e02113c8039989a33d0dfe06 Mon Sep 17 00:00:00 2001 From: robobun Date: Fri, 26 Jun 2026 20:30:30 +0000 Subject: [PATCH] test: stop asserting an OCSP URI on the live bun.sh certificate bun.sh's reissued certificate (Google Trust Services WE1) has no OCSP responder URI in its Authority Information Access extension, so the live-host assertion in node-tls-connect.test.ts fails on every lane. Assert the CA Issuers entry instead, which is still present, and check its shape rather than just that it is defined. Exact infoAccess parsing stays covered by the fixed-fixture x509 tests. --- test/js/node/tls/node-tls-connect.test.ts | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/test/js/node/tls/node-tls-connect.test.ts b/test/js/node/tls/node-tls-connect.test.ts index e52d06ba7257..075d3be8cf62 100644 --- a/test/js/node/tls/node-tls-connect.test.ts +++ b/test/js/node/tls/node-tls-connect.test.ts @@ -308,10 +308,11 @@ for (const { name, connect } of tests) { expect(cert.subject.CN).toBe("bun.sh"); expect(cert.subjectaltname).toContain("DNS:bun.sh"); expect(cert.infoAccess).toBeDefined(); - // we just check the types this can change over time + // The live cert's AIA contents change on reissue (public CAs stopped + // including OCSP URIs in 2025), so only assert the stable CA Issuers + // entry here; exact parsing is covered by the fixed-fixture x509 tests. const infoAccess = cert.infoAccess as NodeJS.Dict; - expect(infoAccess["OCSP - URI"]).toBeDefined(); - expect(infoAccess["CA Issuers - URI"]).toBeDefined(); + expect(infoAccess["CA Issuers - URI"]).toEqual(expect.arrayContaining([expect.stringMatching(/^https?:\/\//)])); expect(cert.ca).toBeFalse(); expect(cert.bits).toBeInteger(); // These can change: