woggioni/kca
2
0
Fork 0
Code Actions Packages Releases Activity

Use S3 object expiry for OCSP snapshots

Browse Source
This commit is contained in:
woggioni
2026-10-28 19:39:51 +00:00
parent 9da68a9625
commit a7cfda4167
17 changed files with 321 additions and 238 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/tests/test_routes_extra.py
+6 -2
View File
@@ -941,7 +941,8 @@ class OcspSnapshotTests(unittest.TestCase):
payload = response.json()
assert payload["enabled"] is False
snapshot = payload["snapshot"]
assert snapshot["schema"] == "kca-ocsp-status/v1"
assert snapshot["schema"] == "kca-ocsp-status/v2"
assert "generated_at" not in snapshot
assert snapshot["issuer"]["sha256"] == ca["fingerprint_sha256"]
entries = {entry["serial_hex"]: entry for entry in snapshot["entries"]}
assert len(snapshot["entries"]) == 1
@@ -1260,7 +1261,10 @@ class OcspSnapshotTests(unittest.TestCase):
call = fake.calls[0]
assert call["Bucket"] == "test-bucket"
assert call["Key"] == f"ocsp/{ca['id']}.json"
assert b"kca-ocsp-status/v1" in call["Body"]
assert b"kca-ocsp-status/v2" in call["Body"]
assert b"generated_at" not in call["Body"]
expires_in = (call["Expires"] - datetime.now(timezone.utc)).total_seconds()
assert 50 < expires_in <= 60
row = await OcspSnapshot.get(ca_id=ca["id"])
assert row.dirty is False
assert row.published_at is not None