feat: Generate testing TLS certs on the fly

.gitignore

@@ -5,6 +5,7 @@ results/
 # rust compiled binary target directory:
 **/target
 # other:
+testing-certs
 **/*.rs.bk
 .idea/
 .env

Cargo.toml

@@ -108,6 +108,7 @@ prost-types = "0.12.6"
 proptest = { version = "1", default-features = false, features = ["std"] }
 pyo3 = { version = "0.24.1", features = ["experimental-async"]}
 rand = "0.8.5"
+rcgen = "0.13.2"
 regex = "1.11.1"
 reqwest = { version = "0.11.27", default-features = false, features = ["rustls-tls", "stream", "json"] }
 rustls-pemfile = "2.2.0"

influxdb3/Cargo.toml

@@ -96,6 +96,7 @@ futures.workspace = true
 hyper.workspace = true
 insta.workspace = true
 pretty_assertions.workspace = true
+rcgen.workspace = true
 reqwest.workspace = true
 serde.workspace = true
 serde_json.workspace = true

influxdb3/tests/server/mod.rs

@@ -209,6 +209,7 @@ impl TestServer {
     }
 
     async fn spawn_inner(config: &impl ConfigProvider) -> Self {
+        create_certs().await;
         let mut command = Command::cargo_bin("influxdb3").expect("create the influxdb3 command");
         let command = command
             .arg("serve")
@@ -555,6 +556,60 @@ impl TestServer {
     }
 }
 
+/// Generate certs for tests if they do not already exist. For the most part this
+/// is needed only in CI for fresh builds. Locally it'll generate them the first
+/// time and then should be valid for longer than anyone is alive or this software
+/// is used.
+pub async fn create_certs() {
+    use rcgen::CertificateParams;
+    use rcgen::IsCa;
+    use rcgen::KeyPair;
+    use std::fs;
+    use std::fs::OpenOptions;
+    use std::io::ErrorKind;
+
+    const LOCK_FILE: &str = "../testing-certs/certs.lock";
+    const ROOT_FILE: &str = "../testing-certs/rootCA.pem";
+    const LOCAL_FILE: &str = "../testing-certs/localhost.pem";
+    const LOCAL_KEY_FILE: &str = "../testing-certs/localhost.key";
+
+    if fs::exists(ROOT_FILE).unwrap()
+        && fs::exists(LOCAL_FILE).unwrap()
+        && fs::exists(LOCAL_KEY_FILE).unwrap()
+    {
+        return;
+    }
+
+    fs::create_dir_all("../testing-certs").unwrap();
+    let lock_file = OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .open(LOCK_FILE);
+    match lock_file.map_err(|e| e.kind()) {
+        Ok(_) => {
+            let mut ca = CertificateParams::new(Vec::new()).unwrap();
+            let ca_key = KeyPair::generate().unwrap();
+            let local_key = KeyPair::generate().unwrap();
+            ca.is_ca = IsCa::Ca(rcgen::BasicConstraints::Unconstrained);
+            let ca = ca.self_signed(&ca_key).unwrap();
+            let localhost = CertificateParams::new(vec!["localhost".into()]).unwrap();
+            let localhost = localhost.signed_by(&local_key, &ca, &ca_key).unwrap();
+
+            fs::write(ROOT_FILE, ca.pem()).unwrap();
+            fs::write(LOCAL_FILE, localhost.pem()).unwrap();
+            fs::write(LOCAL_KEY_FILE, local_key.serialize_pem()).unwrap();
+
+            fs::remove_file(LOCK_FILE).unwrap();
+        }
+        Err(ErrorKind::AlreadyExists) => {
+            while fs::exists(LOCK_FILE).unwrap() {
+                tokio::time::sleep(Duration::from_millis(50)).await;
+            }
+        }
+        Err(_) => panic!("Failed to acquire cert lock"),
+    }
+}
+
 /// Write to the server with the line protocol
 pub async fn write_lp_to_db(
     server: &TestServer,