chore: move cert itests to spec tests (#23607)

tests/integration/cert_tests.rs

@@ -1,301 +0,0 @@
-// Copyright 2018-2024 the Deno authors. All rights reserved. MIT license.
-
-use deno_tls::rustls;
-use deno_tls::rustls_pemfile;
-use deno_tls::TlsStream;
-use std::io::BufReader;
-use std::io::Cursor;
-use std::io::Read;
-use std::sync::Arc;
-use test_util as util;
-use test_util::itest;
-use test_util::itest_flaky;
-use url::Url;
-use util::testdata_path;
-use util::TestContext;
-
-itest_flaky!(cafile_url_imports {
-  args: "run --quiet --reload --cert tls/RootCA.pem cert/cafile_url_imports.ts",
-  output: "cert/cafile_url_imports.ts.out",
-  http_server: true,
-});
-
-itest_flaky!(cafile_ts_fetch {
-  args:
-    "run --quiet --reload --allow-net --cert tls/RootCA.pem cert/cafile_ts_fetch.ts",
-  output: "cert/cafile_ts_fetch.ts.out",
-  http_server: true,
-});
-
-itest_flaky!(cafile_eval {
-  args: "eval --cert tls/RootCA.pem fetch('https://localhost:5545/cert/cafile_ts_fetch.ts.out').then(r=>r.text()).then(t=>console.log(t.trimEnd()))",
-  output: "cert/cafile_ts_fetch.ts.out",
-  http_server: true,
-});
-
-itest_flaky!(cafile_info {
-  args:
-    "info --quiet --cert tls/RootCA.pem https://localhost:5545/cert/cafile_info.ts",
-  output: "cert/cafile_info.ts.out",
-  http_server: true,
-});
-
-itest_flaky!(cafile_url_imports_unsafe_ssl {
-  args: "run --quiet --reload --unsafely-ignore-certificate-errors=localhost cert/cafile_url_imports.ts",
-  output: "cert/cafile_url_imports_unsafe_ssl.ts.out",
-  http_server: true,
-});
-
-itest_flaky!(cafile_ts_fetch_unsafe_ssl {
-  args:
-    "run --quiet --reload --allow-net --unsafely-ignore-certificate-errors cert/cafile_ts_fetch.ts",
-  output: "cert/cafile_ts_fetch_unsafe_ssl.ts.out",
-  http_server: true,
-});
-
-// TODO(bartlomieju): reenable, this test was flaky on macOS CI during 1.30.3 release
-// itest!(deno_land_unsafe_ssl {
-//   args:
-//     "run --quiet --reload --allow-net --unsafely-ignore-certificate-errors=deno.land cert/deno_land_unsafe_ssl.ts",
-//   output: "cert/deno_land_unsafe_ssl.ts.out",
-// });
-
-itest!(ip_address_unsafe_ssl {
-  args:
-    "run --quiet --reload --allow-net --unsafely-ignore-certificate-errors=1.1.1.1 cert/ip_address_unsafe_ssl.ts",
-  output: "cert/ip_address_unsafe_ssl.ts.out",
-});
-
-itest!(localhost_unsafe_ssl {
-  args: "run --quiet --reload --allow-net --unsafely-ignore-certificate-errors=deno.land cert/cafile_url_imports.ts",
-  output: "cert/localhost_unsafe_ssl.ts.out",
-  http_server: true,
-  exit_code: 1,
-});
-
-#[flaky_test::flaky_test]
-fn cafile_env_fetch() {
-  let module_url =
-    Url::parse("https://localhost:5545/cert/cafile_url_imports.ts").unwrap();
-  let context = TestContext::with_http_server();
-  let cafile = testdata_path().join("tls/RootCA.pem");
-
-  context
-    .new_command()
-    .args(format!("cache {module_url}"))
-    .env("DENO_CERT", cafile)
-    .run()
-    .assert_exit_code(0)
-    .skip_output_check();
-}
-
-#[flaky_test::flaky_test]
-fn cafile_fetch() {
-  let module_url =
-    Url::parse("http://localhost:4545/cert/cafile_url_imports.ts").unwrap();
-  let context = TestContext::with_http_server();
-  let cafile = testdata_path().join("tls/RootCA.pem");
-  context
-    .new_command()
-    .args(format!("cache --quiet --cert {} {}", cafile, module_url,))
-    .run()
-    .assert_exit_code(0)
-    .assert_matches_text("");
-}
-
-#[test]
-fn cafile_compile() {
-  let context = TestContext::with_http_server();
-  let temp_dir = context.temp_dir().path();
-  let output_exe = if cfg!(windows) {
-    temp_dir.join("cert.exe")
-  } else {
-    temp_dir.join("cert")
-  };
-  let output = context.new_command()
-    .args(format!("compile --quiet --cert ./tls/RootCA.pem --allow-net --output {} ./cert/cafile_ts_fetch.ts", output_exe))
-    .run();
-  output.skip_output_check();
-
-  context
-    .new_command()
-    .name(output_exe)
-    .run()
-    .assert_matches_text("[WILDCARD]\nHello\n");
-}
-
-#[flaky_test::flaky_test]
-fn cafile_install_remote_module() {
-  let context = TestContext::with_http_server();
-  let temp_dir = context.temp_dir();
-  let bin_dir = temp_dir.path().join("bin");
-  bin_dir.create_dir_all();
-  let cafile = util::testdata_path().join("tls/RootCA.pem");
-
-  let install_output = context
-    .new_command()
-    .args_vec([
-      "install",
-      "--cert",
-      &cafile.to_string_lossy(),
-      "--root",
-      &temp_dir.path().to_string_lossy(),
-      "-n",
-      "echo_test",
-      "https://localhost:5545/echo.ts",
-    ])
-    .split_output()
-    .run();
-  println!("{}", install_output.stdout());
-  eprintln!("{}", install_output.stderr());
-  install_output.assert_exit_code(0);
-
-  let mut echo_test_path = bin_dir.join("echo_test");
-  if cfg!(windows) {
-    echo_test_path = echo_test_path.with_extension("cmd");
-  }
-  assert!(echo_test_path.exists());
-
-  let output = context
-    .new_command()
-    .name(echo_test_path)
-    .args("foo")
-    .env("PATH", util::target_dir())
-    .run();
-  output.assert_matches_text("[WILDCARD]foo");
-}
-
-#[flaky_test::flaky_test]
-fn cafile_bundle_remote_exports() {
-  let context = TestContext::with_http_server();
-
-  // First we have to generate a bundle of some remote module that has exports.
-  let mod1 = "https://localhost:5545/subdir/mod1.ts";
-  let cafile = util::testdata_path().join("tls/RootCA.pem");
-  let t = context.temp_dir();
-  let bundle = t.path().join("mod1.bundle.js");
-  context
-    .new_command()
-    .args_vec([
-      "bundle",
-      "--cert",
-      &cafile.to_string_lossy(),
-      mod1,
-      &bundle.to_string_lossy(),
-    ])
-    .run()
-    .skip_output_check()
-    .assert_exit_code(0);
-
-  assert!(bundle.is_file());
-
-  // Now we try to use that bundle from another module.
-  let test = t.path().join("test.js");
-  test.write(
-    "import { printHello3 } from \"./mod1.bundle.js\";
-printHello3();",
-  );
-
-  context
-    .new_command()
-    .args_vec(["run", "--quiet", "--check", &test.to_string_lossy()])
-    .run()
-    .assert_matches_text("[WILDCARD]Hello\n")
-    .assert_exit_code(0);
-}
-
-#[tokio::test]
-async fn listen_tls_alpn() {
-  let mut child = util::deno_cmd()
-    .current_dir(util::testdata_path())
-    .arg("run")
-    .arg("--unstable")
-    .arg("--quiet")
-    .arg("--allow-net")
-    .arg("--allow-read")
-    .arg("./cert/listen_tls_alpn.ts")
-    .arg("4504")
-    .stdout_piped()
-    .spawn()
-    .unwrap();
-  let stdout = child.stdout.as_mut().unwrap();
-  let mut msg = [0; 5];
-  let read = stdout.read(&mut msg).unwrap();
-  assert_eq!(read, 5);
-  assert_eq!(&msg, b"READY");
-
-  let mut reader = &mut BufReader::new(Cursor::new(include_bytes!(
-    "../testdata/tls/RootCA.crt"
-  )));
-  let certs = rustls_pemfile::certs(&mut reader).unwrap();
-  let mut root_store = rustls::RootCertStore::empty();
-  root_store.add_parsable_certificates(&certs);
-  let mut cfg = rustls::ClientConfig::builder()
-    .with_safe_defaults()
-    .with_root_certificates(root_store)
-    .with_no_client_auth();
-  cfg.alpn_protocols.push(b"foobar".to_vec());
-  let cfg = Arc::new(cfg);
-
-  let hostname = rustls::ServerName::try_from("localhost").unwrap();
-
-  let tcp_stream = tokio::net::TcpStream::connect("localhost:4504")
-    .await
-    .unwrap();
-  let mut tls_stream =
-    TlsStream::new_client_side(tcp_stream, cfg, hostname, None);
-
-  let handshake = tls_stream.handshake().await.unwrap();
-
-  assert_eq!(handshake.alpn, Some(b"foobar".to_vec()));
-
-  let status = child.wait().unwrap();
-  assert!(status.success());
-}
-
-#[tokio::test]
-async fn listen_tls_alpn_fail() {
-  let mut child = util::deno_cmd()
-    .current_dir(util::testdata_path())
-    .arg("run")
-    .arg("--unstable")
-    .arg("--quiet")
-    .arg("--allow-net")
-    .arg("--allow-read")
-    .arg("./cert/listen_tls_alpn_fail.ts")
-    .arg("4505")
-    .stdout_piped()
-    .spawn()
-    .unwrap();
-  let stdout = child.stdout.as_mut().unwrap();
-  let mut msg = [0; 5];
-  let read = stdout.read(&mut msg).unwrap();
-  assert_eq!(read, 5);
-  assert_eq!(&msg, b"READY");
-
-  let mut reader = &mut BufReader::new(Cursor::new(include_bytes!(
-    "../testdata/tls/RootCA.crt"
-  )));
-  let certs = rustls_pemfile::certs(&mut reader).unwrap();
-  let mut root_store = rustls::RootCertStore::empty();
-  root_store.add_parsable_certificates(&certs);
-  let mut cfg = rustls::ClientConfig::builder()
-    .with_safe_defaults()
-    .with_root_certificates(root_store)
-    .with_no_client_auth();
-  cfg.alpn_protocols.push(b"boofar".to_vec());
-  let cfg = Arc::new(cfg);
-
-  let hostname = rustls::ServerName::try_from("localhost").unwrap();
-
-  let tcp_stream = tokio::net::TcpStream::connect("localhost:4505")
-    .await
-    .unwrap();
-  let mut tls_stream =
-    TlsStream::new_client_side(tcp_stream, cfg, hostname, None);
-
-  tls_stream.handshake().await.unwrap_err();
-
-  let status = child.wait().unwrap();
-  assert!(status.success());
-}

tests/integration/mod.rs

@@ -10,8 +10,6 @@ mod bench;
 mod bundle;
 #[path = "cache_tests.rs"]
 mod cache;
-#[path = "cert_tests.rs"]
-mod cert;
 #[path = "check_tests.rs"]
 mod check;
 #[path = "compile_tests.rs"]

tests/integration/run_tests.rs

@@ -1,14 +1,21 @@
 // Copyright 2018-2024 the Deno authors. All rights reserved. MIT license.
 
+use std::io::BufReader;
+use std::io::Cursor;
+use std::io::Read;
+use std::io::Write;
+use std::process::Command;
+use std::process::Stdio;
+use std::sync::Arc;
+
 use bytes::Bytes;
 use deno_core::serde_json::json;
 use deno_core::url;
 use deno_fetch::reqwest;
+use deno_tls::rustls;
+use deno_tls::rustls_pemfile;
+use deno_tls::TlsStream;
 use pretty_assertions::assert_eq;
-use std::io::Read;
-use std::io::Write;
-use std::process::Command;
-use std::process::Stdio;
 use test_util as util;
 use test_util::itest;
 use test_util::TempDir;
@@ -5329,3 +5336,99 @@ fn node_process_stdin_unref_with_pty() {
       console.expect("START\r\nEND\r\n");
     });
 }
+
+#[tokio::test]
+async fn listen_tls_alpn() {
+  let mut child = util::deno_cmd()
+    .current_dir(util::testdata_path())
+    .arg("run")
+    .arg("--unstable")
+    .arg("--quiet")
+    .arg("--allow-net")
+    .arg("--allow-read")
+    .arg("./cert/listen_tls_alpn.ts")
+    .arg("4504")
+    .stdout_piped()
+    .spawn()
+    .unwrap();
+  let stdout = child.stdout.as_mut().unwrap();
+  let mut msg = [0; 5];
+  let read = stdout.read(&mut msg).unwrap();
+  assert_eq!(read, 5);
+  assert_eq!(&msg, b"READY");
+
+  let mut reader = &mut BufReader::new(Cursor::new(include_bytes!(
+    "../testdata/tls/RootCA.crt"
+  )));
+  let certs = rustls_pemfile::certs(&mut reader).unwrap();
+  let mut root_store = rustls::RootCertStore::empty();
+  root_store.add_parsable_certificates(&certs);
+  let mut cfg = rustls::ClientConfig::builder()
+    .with_safe_defaults()
+    .with_root_certificates(root_store)
+    .with_no_client_auth();
+  cfg.alpn_protocols.push(b"foobar".to_vec());
+  let cfg = Arc::new(cfg);
+
+  let hostname = rustls::ServerName::try_from("localhost").unwrap();
+
+  let tcp_stream = tokio::net::TcpStream::connect("localhost:4504")
+    .await
+    .unwrap();
+  let mut tls_stream =
+    TlsStream::new_client_side(tcp_stream, cfg, hostname, None);
+
+  let handshake = tls_stream.handshake().await.unwrap();
+
+  assert_eq!(handshake.alpn, Some(b"foobar".to_vec()));
+
+  let status = child.wait().unwrap();
+  assert!(status.success());
+}
+
+#[tokio::test]
+async fn listen_tls_alpn_fail() {
+  let mut child = util::deno_cmd()
+    .current_dir(util::testdata_path())
+    .arg("run")
+    .arg("--unstable")
+    .arg("--quiet")
+    .arg("--allow-net")
+    .arg("--allow-read")
+    .arg("./cert/listen_tls_alpn_fail.ts")
+    .arg("4505")
+    .stdout_piped()
+    .spawn()
+    .unwrap();
+  let stdout = child.stdout.as_mut().unwrap();
+  let mut msg = [0; 5];
+  let read = stdout.read(&mut msg).unwrap();
+  assert_eq!(read, 5);
+  assert_eq!(&msg, b"READY");
+
+  let mut reader = &mut BufReader::new(Cursor::new(include_bytes!(
+    "../testdata/tls/RootCA.crt"
+  )));
+  let certs = rustls_pemfile::certs(&mut reader).unwrap();
+  let mut root_store = rustls::RootCertStore::empty();
+  root_store.add_parsable_certificates(&certs);
+  let mut cfg = rustls::ClientConfig::builder()
+    .with_safe_defaults()
+    .with_root_certificates(root_store)
+    .with_no_client_auth();
+  cfg.alpn_protocols.push(b"boofar".to_vec());
+  let cfg = Arc::new(cfg);
+
+  let hostname = rustls::ServerName::try_from("localhost").unwrap();
+
+  let tcp_stream = tokio::net::TcpStream::connect("localhost:4505")
+    .await
+    .unwrap();
+  let mut tls_stream =
+    TlsStream::new_client_side(tcp_stream, cfg, hostname, None);
+
+  tls_stream.handshake().await.unwrap_err();
+
+  let status = child.wait().unwrap();
+  assert!(status.success());
+}

tests/specs/cert/cafile_bundle/RootCA.pem

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDIzCCAgugAwIBAgIJAMKPPW4tsOymMA0GCSqGSIb3DQEBCwUAMCcxCzAJBgNV
+BAYTAlVTMRgwFgYDVQQDDA9FeGFtcGxlLVJvb3QtQ0EwIBcNMTkxMDIxMTYyODIy
+WhgPMjExODA5MjcxNjI4MjJaMCcxCzAJBgNVBAYTAlVTMRgwFgYDVQQDDA9FeGFt
+cGxlLVJvb3QtQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDMH/IO
+2qtHfyBKwANNPB4K0q5JVSg8XxZdRpTTlz0CwU0oRO3uHrI52raCCfVeiQutyZop
+eFZTDWeXGudGAFA2B5m3orWt0s+touPi8MzjsG2TQ+WSI66QgbXTNDitDDBtTVcV
+5G3Ic+3SppQAYiHSekLISnYWgXLl+k5CnEfTowg6cjqjVr0KjL03cTN3H7b+6+0S
+ws4rYbW1j4ExR7K6BFNH6572yq5qR20E6GqlY+EcOZpw4CbCk9lS8/CWuXze/vMs
+OfDcc6K+B625d27wyEGZHedBomT2vAD7sBjvO8hn/DP1Qb46a8uCHR6NSfnJ7bXO
+G1igaIbgY1zXirNdAgMBAAGjUDBOMB0GA1UdDgQWBBTzut+pwwDfqmMYcI9KNWRD
+hxcIpTAfBgNVHSMEGDAWgBTzut+pwwDfqmMYcI9KNWRDhxcIpTAMBgNVHRMEBTAD
+AQH/MA0GCSqGSIb3DQEBCwUAA4IBAQB9AqSbZ+hEglAgSHxAMCqRFdhVu7MvaQM0
+P090mhGlOCt3yB7kdGfsIrUW6nQcTz7PPQFRaJMrFHPvFvPootkBUpTYR4hTkdce
+H6RCRu2Jxl4Y9bY/uezd9YhGCYfUtfjA6/TH9FcuZfttmOOlxOt01XfNvVMIR6RM
+z/AYhd+DeOXjr35F/VHeVpnk+55L0PYJsm1CdEbOs5Hy1ecR7ACuDkXnbM4fpz9I
+kyIWJwk2zJReKcJMgi1aIinDM9ao/dca1G99PHOw8dnr4oyoTiv8ao6PWiSRHHMi
+MNf4EgWfK+tZMnuqfpfO9740KzfcVoMNo4QJD4yn5YxroUOO/Azi
+-----END CERTIFICATE-----

tests/specs/cert/cafile_bundle/__test__.jsonc

@@ -0,0 +1,11 @@
+{
+  "tempDir": true,
+  "steps": [{
+    "args": "bundle --cert RootCA.pem https://localhost:5545/subdir/mod1.ts mod1.bundle.js",
+    "flaky": true,
+    "output": "[WILDCARD]"
+  }, {
+    "args": "run --quiet --check test.js",
+    "output": "[WILDCARD]Hello\n"
+  }]
+}

tests/specs/cert/cafile_bundle/test.js

@@ -0,0 +1,2 @@
+import { printHello3 } from "./mod1.bundle.js";
+printHello3();

tests/specs/cert/cafile_compile/RootCA.pem

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDIzCCAgugAwIBAgIJAMKPPW4tsOymMA0GCSqGSIb3DQEBCwUAMCcxCzAJBgNV
+BAYTAlVTMRgwFgYDVQQDDA9FeGFtcGxlLVJvb3QtQ0EwIBcNMTkxMDIxMTYyODIy
+WhgPMjExODA5MjcxNjI4MjJaMCcxCzAJBgNVBAYTAlVTMRgwFgYDVQQDDA9FeGFt
+cGxlLVJvb3QtQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDMH/IO
+2qtHfyBKwANNPB4K0q5JVSg8XxZdRpTTlz0CwU0oRO3uHrI52raCCfVeiQutyZop
+eFZTDWeXGudGAFA2B5m3orWt0s+touPi8MzjsG2TQ+WSI66QgbXTNDitDDBtTVcV
+5G3Ic+3SppQAYiHSekLISnYWgXLl+k5CnEfTowg6cjqjVr0KjL03cTN3H7b+6+0S
+ws4rYbW1j4ExR7K6BFNH6572yq5qR20E6GqlY+EcOZpw4CbCk9lS8/CWuXze/vMs
+OfDcc6K+B625d27wyEGZHedBomT2vAD7sBjvO8hn/DP1Qb46a8uCHR6NSfnJ7bXO
+G1igaIbgY1zXirNdAgMBAAGjUDBOMB0GA1UdDgQWBBTzut+pwwDfqmMYcI9KNWRD
+hxcIpTAfBgNVHSMEGDAWgBTzut+pwwDfqmMYcI9KNWRDhxcIpTAMBgNVHRMEBTAD
+AQH/MA0GCSqGSIb3DQEBCwUAA4IBAQB9AqSbZ+hEglAgSHxAMCqRFdhVu7MvaQM0
+P090mhGlOCt3yB7kdGfsIrUW6nQcTz7PPQFRaJMrFHPvFvPootkBUpTYR4hTkdce
+H6RCRu2Jxl4Y9bY/uezd9YhGCYfUtfjA6/TH9FcuZfttmOOlxOt01XfNvVMIR6RM
+z/AYhd+DeOXjr35F/VHeVpnk+55L0PYJsm1CdEbOs5Hy1ecR7ACuDkXnbM4fpz9I
+kyIWJwk2zJReKcJMgi1aIinDM9ao/dca1G99PHOw8dnr4oyoTiv8ao6PWiSRHHMi
+MNf4EgWfK+tZMnuqfpfO9740KzfcVoMNo4QJD4yn5YxroUOO/Azi
+-----END CERTIFICATE-----

tests/specs/cert/cafile_compile/__test__.jsonc

@@ -0,0 +1,22 @@
+{
+  "tempDir": true,
+  "steps": [{
+    "args": "compile --allow-net --cert ../RootCA.pem cafile_ts_fetch.ts",
+    "cwd": "cert",
+    "output": "[WILDCARD]"
+  }, {
+    "if": "windows",
+    "commandName": "./cafile_ts_fetch.exe",
+    "cwd": "cert",
+    "args": [],
+    "flaky": true,
+    "output": "[WILDCARD]\nHello\n"
+  }, {
+    "if": "unix",
+    "commandName": "./cafile_ts_fetch",
+    "cwd": "cert",
+    "args": [],
+    "flaky": true,
+    "output": "[WILDCARD]\nHello\n"
+  }]
+}

tests/specs/cert/cafile_compile/cert/cafile_ts_fetch.ts

@@ -0,0 +1,3 @@
+fetch("https://localhost:5545/cert/cafile_ts_fetch.ts.out")
+  .then((r) => r.text())
+  .then((t) => console.log(t.trimEnd()));

tests/specs/cert/cafile_env_fetch/RootCA.pem

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDIzCCAgugAwIBAgIJAMKPPW4tsOymMA0GCSqGSIb3DQEBCwUAMCcxCzAJBgNV
+BAYTAlVTMRgwFgYDVQQDDA9FeGFtcGxlLVJvb3QtQ0EwIBcNMTkxMDIxMTYyODIy
+WhgPMjExODA5MjcxNjI4MjJaMCcxCzAJBgNVBAYTAlVTMRgwFgYDVQQDDA9FeGFt
+cGxlLVJvb3QtQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDMH/IO
+2qtHfyBKwANNPB4K0q5JVSg8XxZdRpTTlz0CwU0oRO3uHrI52raCCfVeiQutyZop
+eFZTDWeXGudGAFA2B5m3orWt0s+touPi8MzjsG2TQ+WSI66QgbXTNDitDDBtTVcV
+5G3Ic+3SppQAYiHSekLISnYWgXLl+k5CnEfTowg6cjqjVr0KjL03cTN3H7b+6+0S
+ws4rYbW1j4ExR7K6BFNH6572yq5qR20E6GqlY+EcOZpw4CbCk9lS8/CWuXze/vMs
+OfDcc6K+B625d27wyEGZHedBomT2vAD7sBjvO8hn/DP1Qb46a8uCHR6NSfnJ7bXO
+G1igaIbgY1zXirNdAgMBAAGjUDBOMB0GA1UdDgQWBBTzut+pwwDfqmMYcI9KNWRD
+hxcIpTAfBgNVHSMEGDAWgBTzut+pwwDfqmMYcI9KNWRDhxcIpTAMBgNVHRMEBTAD
+AQH/MA0GCSqGSIb3DQEBCwUAA4IBAQB9AqSbZ+hEglAgSHxAMCqRFdhVu7MvaQM0
+P090mhGlOCt3yB7kdGfsIrUW6nQcTz7PPQFRaJMrFHPvFvPootkBUpTYR4hTkdce
+H6RCRu2Jxl4Y9bY/uezd9YhGCYfUtfjA6/TH9FcuZfttmOOlxOt01XfNvVMIR6RM
+z/AYhd+DeOXjr35F/VHeVpnk+55L0PYJsm1CdEbOs5Hy1ecR7ACuDkXnbM4fpz9I
+kyIWJwk2zJReKcJMgi1aIinDM9ao/dca1G99PHOw8dnr4oyoTiv8ao6PWiSRHHMi
+MNf4EgWfK+tZMnuqfpfO9740KzfcVoMNo4QJD4yn5YxroUOO/Azi
+-----END CERTIFICATE-----

tests/specs/cert/cafile_env_fetch/__test__.jsonc

@@ -0,0 +1,8 @@
+{
+  "envs": {
+    "DENO_CERT": "$PWD/RootCA.pem"
+  },
+  "flaky": true,
+  "args": "cache https://localhost:5545/cert/cafile_url_imports.ts",
+  "output": "[WILDCARD]"
+}

tests/specs/cert/cafile_install/RootCA.pem

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDIzCCAgugAwIBAgIJAMKPPW4tsOymMA0GCSqGSIb3DQEBCwUAMCcxCzAJBgNV
+BAYTAlVTMRgwFgYDVQQDDA9FeGFtcGxlLVJvb3QtQ0EwIBcNMTkxMDIxMTYyODIy
+WhgPMjExODA5MjcxNjI4MjJaMCcxCzAJBgNVBAYTAlVTMRgwFgYDVQQDDA9FeGFt
+cGxlLVJvb3QtQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDMH/IO
+2qtHfyBKwANNPB4K0q5JVSg8XxZdRpTTlz0CwU0oRO3uHrI52raCCfVeiQutyZop
+eFZTDWeXGudGAFA2B5m3orWt0s+touPi8MzjsG2TQ+WSI66QgbXTNDitDDBtTVcV
+5G3Ic+3SppQAYiHSekLISnYWgXLl+k5CnEfTowg6cjqjVr0KjL03cTN3H7b+6+0S
+ws4rYbW1j4ExR7K6BFNH6572yq5qR20E6GqlY+EcOZpw4CbCk9lS8/CWuXze/vMs
+OfDcc6K+B625d27wyEGZHedBomT2vAD7sBjvO8hn/DP1Qb46a8uCHR6NSfnJ7bXO
+G1igaIbgY1zXirNdAgMBAAGjUDBOMB0GA1UdDgQWBBTzut+pwwDfqmMYcI9KNWRD
+hxcIpTAfBgNVHSMEGDAWgBTzut+pwwDfqmMYcI9KNWRDhxcIpTAMBgNVHRMEBTAD
+AQH/MA0GCSqGSIb3DQEBCwUAA4IBAQB9AqSbZ+hEglAgSHxAMCqRFdhVu7MvaQM0
+P090mhGlOCt3yB7kdGfsIrUW6nQcTz7PPQFRaJMrFHPvFvPootkBUpTYR4hTkdce
+H6RCRu2Jxl4Y9bY/uezd9YhGCYfUtfjA6/TH9FcuZfttmOOlxOt01XfNvVMIR6RM
+z/AYhd+DeOXjr35F/VHeVpnk+55L0PYJsm1CdEbOs5Hy1ecR7ACuDkXnbM4fpz9I
+kyIWJwk2zJReKcJMgi1aIinDM9ao/dca1G99PHOw8dnr4oyoTiv8ao6PWiSRHHMi
+MNf4EgWfK+tZMnuqfpfO9740KzfcVoMNo4QJD4yn5YxroUOO/Azi
+-----END CERTIFICATE-----

tests/specs/cert/cafile_install/__test__.jsonc

@@ -0,0 +1,28 @@
+{
+  "tempDir": true,
+  "steps": [{
+    "args": [
+      "install",
+      "--cert",
+      "RootCA.pem",
+      "-n",
+      "echo_test",
+      "--root",
+      "$PWD",
+      "https://localhost:5545/echo.ts"
+    ],
+    "output": "[WILDCARD]"
+  }, {
+    "if": "windows",
+    "commandName": "./bin/echo_test.cmd",
+    "flaky": true,
+    "args": ["foo"],
+    "output": "[WILDCARD]foo"
+  }, {
+    "if": "unix",
+    "commandName": "./bin/echo_test",
+    "flaky": true,
+    "args": ["foo"],
+    "output": "[WILDCARD]foo"
+  }]
+}

tests/specs/cert/cafile_ts_fetch/RootCA.pem

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDIzCCAgugAwIBAgIJAMKPPW4tsOymMA0GCSqGSIb3DQEBCwUAMCcxCzAJBgNV
+BAYTAlVTMRgwFgYDVQQDDA9FeGFtcGxlLVJvb3QtQ0EwIBcNMTkxMDIxMTYyODIy
+WhgPMjExODA5MjcxNjI4MjJaMCcxCzAJBgNVBAYTAlVTMRgwFgYDVQQDDA9FeGFt
+cGxlLVJvb3QtQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDMH/IO
+2qtHfyBKwANNPB4K0q5JVSg8XxZdRpTTlz0CwU0oRO3uHrI52raCCfVeiQutyZop
+eFZTDWeXGudGAFA2B5m3orWt0s+touPi8MzjsG2TQ+WSI66QgbXTNDitDDBtTVcV
+5G3Ic+3SppQAYiHSekLISnYWgXLl+k5CnEfTowg6cjqjVr0KjL03cTN3H7b+6+0S
+ws4rYbW1j4ExR7K6BFNH6572yq5qR20E6GqlY+EcOZpw4CbCk9lS8/CWuXze/vMs
+OfDcc6K+B625d27wyEGZHedBomT2vAD7sBjvO8hn/DP1Qb46a8uCHR6NSfnJ7bXO
+G1igaIbgY1zXirNdAgMBAAGjUDBOMB0GA1UdDgQWBBTzut+pwwDfqmMYcI9KNWRD
+hxcIpTAfBgNVHSMEGDAWgBTzut+pwwDfqmMYcI9KNWRDhxcIpTAMBgNVHRMEBTAD
+AQH/MA0GCSqGSIb3DQEBCwUAA4IBAQB9AqSbZ+hEglAgSHxAMCqRFdhVu7MvaQM0
+P090mhGlOCt3yB7kdGfsIrUW6nQcTz7PPQFRaJMrFHPvFvPootkBUpTYR4hTkdce
+H6RCRu2Jxl4Y9bY/uezd9YhGCYfUtfjA6/TH9FcuZfttmOOlxOt01XfNvVMIR6RM
+z/AYhd+DeOXjr35F/VHeVpnk+55L0PYJsm1CdEbOs5Hy1ecR7ACuDkXnbM4fpz9I
+kyIWJwk2zJReKcJMgi1aIinDM9ao/dca1G99PHOw8dnr4oyoTiv8ao6PWiSRHHMi
+MNf4EgWfK+tZMnuqfpfO9740KzfcVoMNo4QJD4yn5YxroUOO/Azi
+-----END CERTIFICATE-----

tests/specs/cert/cafile_ts_fetch/__test__.jsonc

@@ -0,0 +1,19 @@
+{
+  "steps": [{
+    "args": "run --quiet --reload --allow-net --cert RootCA.pem cafile_ts_fetch.ts",
+    "flaky": true,
+    "output": "cafile_ts_fetch.ts.out"
+  }, {
+    "args": "eval --cert RootCA.pem fetch('https://localhost:5545/cert/cafile_ts_fetch.ts.out').then(r=>r.text()).then(t=>console.log(t.trimEnd()))",
+    "flaky": true,
+    "output": "cafile_ts_fetch.ts.out"
+  }, {
+    "args": "info --quiet --cert RootCA.pem https://localhost:5545/cert/cafile_info.ts",
+    "flaky": true,
+    "output": "cafile_info.ts.out"
+  }, {
+    "args": "cache --quiet --cert RootCA.pem http://localhost:4545/cert/cafile_url_imports.ts",
+    "flaky": true,
+    "output": ""
+  }]
+}

tests/specs/cert/cafile_ts_fetch/cafile_ts_fetch.ts

@@ -0,0 +1,3 @@
+fetch("https://localhost:5545/cert/cafile_ts_fetch.ts.out")
+  .then((r) => r.text())
+  .then((t) => console.log(t.trimEnd()));

tests/specs/cert/cafile_ts_fetch/cafile_ts_fetch.ts.out

@@ -0,0 +1,2 @@
+[WILDCARD]
+Hello

tests/specs/cert/cafile_ts_fetch_unsafe_ssl/__test__.jsonc

@@ -0,0 +1,5 @@
+{
+  "args": "run --quiet --reload --allow-net --unsafely-ignore-certificate-errors cafile_ts_fetch.ts",
+  "flaky": true,
+  "output": "cafile_ts_fetch_unsafe_ssl.ts.out"
+}

tests/specs/cert/cafile_ts_fetch_unsafe_ssl/cafile_ts_fetch.ts

@@ -0,0 +1,3 @@
+fetch("https://localhost:5545/cert/cafile_ts_fetch.ts.out")
+  .then((r) => r.text())
+  .then((t) => console.log(t.trimEnd()));

tests/specs/cert/cafile_url_imports/RootCA.pem

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDIzCCAgugAwIBAgIJAMKPPW4tsOymMA0GCSqGSIb3DQEBCwUAMCcxCzAJBgNV
+BAYTAlVTMRgwFgYDVQQDDA9FeGFtcGxlLVJvb3QtQ0EwIBcNMTkxMDIxMTYyODIy
+WhgPMjExODA5MjcxNjI4MjJaMCcxCzAJBgNVBAYTAlVTMRgwFgYDVQQDDA9FeGFt
+cGxlLVJvb3QtQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDMH/IO
+2qtHfyBKwANNPB4K0q5JVSg8XxZdRpTTlz0CwU0oRO3uHrI52raCCfVeiQutyZop
+eFZTDWeXGudGAFA2B5m3orWt0s+touPi8MzjsG2TQ+WSI66QgbXTNDitDDBtTVcV
+5G3Ic+3SppQAYiHSekLISnYWgXLl+k5CnEfTowg6cjqjVr0KjL03cTN3H7b+6+0S
+ws4rYbW1j4ExR7K6BFNH6572yq5qR20E6GqlY+EcOZpw4CbCk9lS8/CWuXze/vMs
+OfDcc6K+B625d27wyEGZHedBomT2vAD7sBjvO8hn/DP1Qb46a8uCHR6NSfnJ7bXO
+G1igaIbgY1zXirNdAgMBAAGjUDBOMB0GA1UdDgQWBBTzut+pwwDfqmMYcI9KNWRD
+hxcIpTAfBgNVHSMEGDAWgBTzut+pwwDfqmMYcI9KNWRDhxcIpTAMBgNVHRMEBTAD
+AQH/MA0GCSqGSIb3DQEBCwUAA4IBAQB9AqSbZ+hEglAgSHxAMCqRFdhVu7MvaQM0
+P090mhGlOCt3yB7kdGfsIrUW6nQcTz7PPQFRaJMrFHPvFvPootkBUpTYR4hTkdce
+H6RCRu2Jxl4Y9bY/uezd9YhGCYfUtfjA6/TH9FcuZfttmOOlxOt01XfNvVMIR6RM
+z/AYhd+DeOXjr35F/VHeVpnk+55L0PYJsm1CdEbOs5Hy1ecR7ACuDkXnbM4fpz9I
+kyIWJwk2zJReKcJMgi1aIinDM9ao/dca1G99PHOw8dnr4oyoTiv8ao6PWiSRHHMi
+MNf4EgWfK+tZMnuqfpfO9740KzfcVoMNo4QJD4yn5YxroUOO/Azi
+-----END CERTIFICATE-----

tests/specs/cert/cafile_url_imports/__test__.jsonc

@@ -0,0 +1,5 @@
+{
+  "args": "run --quiet --reload --cert RootCA.pem cafile_url_imports.ts",
+  "flaky": true,
+  "output": "cafile_url_imports.ts.out"
+}

tests/specs/cert/cafile_url_imports/cafile_url_imports.ts

@@ -0,0 +1,3 @@
+import { printHello } from "https://localhost:5545/subdir/mod2.ts";
+printHello();
+console.log("success");

tests/specs/cert/cafile_url_imports_unsafe_ssl/__test__.jsonc

@@ -0,0 +1,5 @@
+{
+  "args": "run --quiet --reload --unsafely-ignore-certificate-errors=localhost cafile_url_imports.ts",
+  "flaky": true,
+  "output": "cafile_url_imports_unsafe_ssl.ts.out"
+}

tests/specs/cert/cafile_url_imports_unsafe_ssl/cafile_url_imports.ts

@@ -0,0 +1,3 @@
+import { printHello } from "https://localhost:5545/subdir/mod2.ts";
+printHello();
+console.log("success");

tests/specs/cert/deno_land_unsafe_ssl/__test__.jsonc

@@ -0,0 +1,5 @@
+{
+  "flaky": true,
+  "args": "run --quiet --reload --allow-net --unsafely-ignore-certificate-errors=deno.land deno_land_unsafe_ssl.ts",
+  "output": "deno_land_unsafe_ssl.ts.out"
+}

tests/specs/cert/deno_land_unsafe_ssl/deno_land_unsafe_ssl.ts

@@ -0,0 +1,2 @@
+const r = await fetch("https://github.com");
+console.log(r.status);

tests/specs/cert/ip_address_unsafe_ssl/__test__.jsonc

@@ -0,0 +1,4 @@
+{
+  "args": "run --quiet --reload --allow-net --unsafely-ignore-certificate-errors=1.1.1.1 ip_address_unsafe_ssl.ts",
+  "output": "ip_address_unsafe_ssl.ts.out"
+}

tests/specs/cert/localhost_unsafe_ssl/__test__.jsonc

@@ -0,0 +1,5 @@
+{
+  "args": "run --quiet --reload --allow-net --unsafely-ignore-certificate-errors=deno.land cafile_url_imports.ts",
+  "output": "localhost_unsafe_ssl.ts.out",
+  "exitCode": 1
+}

tests/specs/cert/localhost_unsafe_ssl/cafile_url_imports.ts

@@ -0,0 +1,3 @@
+import { printHello } from "https://localhost:5545/subdir/mod2.ts";
+printHello();
+console.log("success");

tests/testdata/cert/deno_land_unsafe_ssl.ts

@@ -1,2 +0,0 @@
-const r = await fetch("https://google.com");
-console.log(r.status);

tests/util/server/src/builders.rs

@@ -546,9 +546,10 @@ impl TestCommandBuilder {
       return;
     }
 
-    let args = self.build_args();
+    let cwd = self.build_cwd();
+    let args = self.build_args(&cwd);
     let args = args.iter().map(|s| s.as_str()).collect::<Vec<_>>();
-    let mut envs = self.build_envs();
+    let mut envs = self.build_envs(&cwd);
     if !envs.contains_key("NO_COLOR") {
       // set this by default for pty tests
       envs.insert("NO_COLOR".to_string(), "1".to_string());
@@ -562,11 +563,6 @@ impl TestCommandBuilder {
       }
     }
 
-    let cwd = self
-      .cwd
-      .as_ref()
-      .map(PathBuf::from)
-      .unwrap_or_else(|| std::env::current_dir().unwrap());
     let command_path = self.build_command_path();
 
     self.diagnostic_logger.writeln(format!(
@@ -699,19 +695,18 @@ impl TestCommandBuilder {
 
   fn build_command(&self) -> Command {
     let command_path = self.build_command_path();
-    let args = self.build_args();
+    let cwd = self.build_cwd();
+    let args = self.build_args(&cwd);
     self.diagnostic_logger.writeln(format!(
       "command {} {}",
       command_path,
       args.join(" ")
     ));
     let mut command = Command::new(command_path);
-    if let Some(cwd) = &self.cwd {
     self
       .diagnostic_logger
-        .writeln(format!("command cwd {}", cwd));
+      .writeln(format!("command cwd {}", cwd.display()));
-      command.current_dir(cwd);
+    command.current_dir(&cwd);
-    }
     if let Some(stdin) = &self.stdin {
       command.stdin(stdin.take());
     }
@@ -726,7 +721,7 @@ impl TestCommandBuilder {
     if self.env_clear {
       command.env_clear();
     }
-    let envs = self.build_envs();
+    let envs = self.build_envs(&cwd);
     command.envs(envs);
     command.stdin(Stdio::piped());
     command
@@ -747,7 +742,7 @@ impl TestCommandBuilder {
     }
   }
 
-  fn build_args(&self) -> Vec<String> {
+  fn build_args(&self, cwd: &Path) -> Vec<String> {
     if self.args_vec.is_empty() {
       std::borrow::Cow::Owned(
         self
@@ -764,11 +759,19 @@ impl TestCommandBuilder {
       std::borrow::Cow::Borrowed(&self.args_vec)
     }
     .iter()
-    .map(|arg| arg.replace("$TESTDATA", &testdata_path().to_string_lossy()))
+    .map(|arg| self.replace_vars(arg, cwd))
     .collect::<Vec<_>>()
   }
 
-  fn build_envs(&self) -> HashMap<String, String> {
+  fn build_cwd(&self) -> PathBuf {
+    self
+      .cwd
+      .as_ref()
+      .map(PathBuf::from)
+      .unwrap_or_else(|| std::env::current_dir().unwrap())
+  }
+
+  fn build_envs(&self, cwd: &Path) -> HashMap<String, String> {
     let mut envs = self.envs.clone();
     if !envs.contains_key("DENO_DIR") {
       envs.insert("DENO_DIR".to_string(), self.deno_dir.path().to_string());
@@ -788,12 +791,19 @@ impl TestCommandBuilder {
 
     // update any test variables in the env value
     for value in envs.values_mut() {
-      *value =
+      *value = self.replace_vars(value, cwd);
-        value.replace("$DENO_DIR", &self.deno_dir.path().to_string_lossy());
     }
 
     envs
   }
+
+  fn replace_vars(&self, text: &str, cwd: &Path) -> String {
+    // todo(dsherret): use monch to extract out the vars
+    text
+      .replace("$DENO_DIR", &self.deno_dir.path().to_string_lossy())
+      .replace("$TESTDATA", &testdata_path().to_string_lossy())
+      .replace("$PWD", &cwd.to_string_lossy())
+  }
 }
 
 pub struct DenoChild {

tests/util/server/src/macros.rs

@@ -65,30 +65,6 @@ macro_rules! itest(
 }
 );
 
-#[macro_export]
-macro_rules! itest_flaky(
-($name:ident {$( $key:ident: $value:expr,)*})  => {
-  #[flaky_test::flaky_test]
-  fn $name() {
-    $crate::timeout!();
-    let test = $crate::CheckOutputIntegrationTest {
-      $(
-        $key: $value,
-       )*
-      .. Default::default()
-    };
-    let output = test.output();
-    output.assert_exit_code(test.exit_code);
-    if !test.output.is_empty() {
-      assert!(test.output_str.is_none());
-      output.assert_matches_file(test.output);
-    } else {
-      output.assert_matches_text(test.output_str.unwrap_or(""));
-    }
-  }
-}
-);
-
 #[macro_export]
 macro_rules! context(
 ({$( $key:ident: $value:expr,)*})  => {
@@ -101,21 +77,6 @@ macro_rules! context(
 }
 );
 
-#[macro_export]
-macro_rules! itest_steps(
-($name:ident {$( $key:ident: $value:expr,)*})  => {
-  #[test]
-  fn $name() {
-    ($crate::CheckOutputIntegrationTestSteps {
-      $(
-        $key: $value,
-       )*
-      .. Default::default()
-    }).run()
-  }
-}
-);
-
 #[macro_export]
 macro_rules! command_step(
 ({$( $key:ident: $value:expr,)*})  => {

tools/lint.js

@@ -190,7 +190,7 @@ async function ensureNoNewITests() {
     "bench_tests.rs": 0,
     "bundle_tests.rs": 12,
     "cache_tests.rs": 0,
-    "cert_tests.rs": 3,
+    "cert_tests.rs": 0,
     "check_tests.rs": 23,
     "compile_tests.rs": 0,
     "coverage_tests.rs": 0,