erlang
Load certificates from systems keychain on darwin
The systems root keychain contains well know root certificates, yet is non-modifiable. As such, internal CA certificates (both root and intermediate) tend to get installed into the systems keychain in the context of an private organization. Not loading certs from this keychain results in differing behavior from other tools (e.g., openssl, curl, etc.). This commit changes to that so that ssl in conjunction with public key just works in such environments.
Resolves #8813
CT Test Results
2 files 17 suites 5m 29s ⏱️ 285 tests 283 ✅ 2 💤 0 ❌ 301 runs 299 ✅ 2 💤 0 ❌
Results for commit e461e038.
:recycle: This comment has been updated with latest results.
To speed up review, make sure that you have read Contributing to Erlang/OTP and that all checks pass.
See the TESTING and DEVELOPMENT HowTo guides for details about how to run test locally.
Artifacts
// Erlang/OTP Github Action Bot
![github-actions[bot] avatar](https://avatars.githubusercontent.com/in/15368?v=4 "Published by a pub.dev verified publisher"){kind=small}
Note that a test in the appropriate test suite has not been added, I wasn't sure how that would play out since an import call would be needed a may require a password.
To manually test this one simply needs to install a certificate into the systems keychain, startup erl, then verify the presence of the installed cert via public_key:cacerts_get/0.
Note that a test in the appropriate test suite has not been added, I wasn't sure how that would play out since an import call would be needed a may require a password.
To manually test this one simply needs to install a certificate into the systems keychain, startup erl, then verify the presence of the installed cert via
public_key:cacerts_get/0.
Confirmed, this can not be easily tested in a suite.
@starbelly ping
Apologies, I'll look at this tomorrow. Work whisked me away 😄
@dgud is OTP team ok with having a test that is only run when an environment variable is set? My thought here is if in a VM on github, we can import certs conditionally per an env var, this would solve the issue of not importing a cert on peoples machines when their running tests locally.
Should we just skip it for now, we don't have any github action tests on Darwin now, and adding tests that are not used feels like a bad idea.
Should we just skip it for now, we don't have any github action tests on Darwin now, and adding tests that are not used feels like a bad idea.
In this case I will adjust so that it doesn't result in a total failure if the systems keychain can not be read per your suggestion.
Should we just skip it for now, we don't have any github action tests on Darwin now, and adding tests that are not used feels like a bad idea.
In this case I will adjust so that it doesn't result in a total failure if the systems keychain can not be read per your suggestion.
Done.
Excited about this change! My company has a VPN cert that causes quite a few issues on our Macs so hopefully this will help.
What versions of OTP will this fix be in, now that its merged into the maint branch?
