glennpratt · January 10, 2026 05:16 · glennpratt · Jan 10, 2026
diff --git a/test-distribution-proxy-tls.sh b/test-distribution-proxy-tls.sh
 #!/bin/bash
 set -e

 # Setup directories
 TEST_DIR=$(pwd)/test-proxy-tls
 mkdir -p "$TEST_DIR/certs"
 cd "$TEST_DIR"

 echo "### 1. Generating Certificates"
 # CA
 openssl genrsa -out certs/ca.key 2048
 openssl req -new -x509 -days 365 -key certs/ca.key -out certs/ca.crt -subj "/CN=Test CA"

 # Server (Registry A)
 openssl genrsa -out certs/server.key 2048
 openssl req -new -key certs/server.key -out certs/server.csr -subj "/CN=localhost"
 echo "subjectAltName=DNS:localhost,IP:127.0.0.1" > certs/server.ext
 openssl x509 -req -days 365 -in certs/server.csr -CA certs/ca.crt -CAkey certs/ca.key -CAcreateserial -out certs/server.crt -extfile certs/server.ext

 # Client (Registry B)
 openssl genrsa -out certs/client.key 2048
 openssl req -new -key certs/client.key -out certs/client.csr -subj "/CN=client"
 openssl x509 -req -days 365 -in certs/client.csr -CA certs/ca.crt -CAkey certs/ca.key -CAcreateserial -out certs/client.crt

 echo "### 2. Creating Configuration Files"
 cat <<EOF > config-a.yaml
 version: 0.1
 log:
  level: debug
 storage:
  filesystem:
    rootdirectory: $TEST_DIR/registry-a
 http:
  addr: :5001
  tls:
    certificate: certs/server.crt
    key: certs/server.key
    clientcas:
      - certs/ca.crt
 EOF

 cat <<EOF > config-b.yaml
 version: 0.1
 log:
  level: debug
 storage:
  filesystem:
    rootdirectory: $TEST_DIR/registry-b
 proxy:
  remoteurl: https://localhost:5001
  tls:
    certificate: certs/client.crt
    key: certs/client.key
    rootcas:
      - certs/ca.crt
 http:
  addr: :5002
 EOF

 echo "### 3. Building Registry"
 cd ../
 go build -o "$TEST_DIR/registry" ./cmd/registry
 cd "$TEST_DIR"

 echo "### 4. Starting Registry A (Upstream)"
 OTEL_TRACES_EXPORTER=none ./registry serve config-a.yaml > registry-a.log 2>&1 &
 PID_A=$!

 echo "### Waiting for Registry A to be ready"
 until curl --cert certs/client.crt --key certs/client.key --cacert certs/ca.crt -s https://localhost:5001/v2/ > /dev/null; do
    echo "Registry A not ready, waiting..."
    sleep 1
 done

 echo "### 5. Starting Registry B (Proxy)"
 OTEL_TRACES_EXPORTER=none ./registry serve config-b.yaml > registry-b.log 2>&1 &
 PID_B=$!

 cleanup() {
    echo "### Cleaning up"
    kill $PID_A $PID_B 2>/dev/null || true
    # rm -rf "$TEST_DIR"
 }
 trap cleanup EXIT

 echo "### 5. Waiting for Registries to be ready"
 sleep 5

 echo "### 6. Verifying Proxy"
 # Check if Registry B can talk to Registry A
 # We use curl to Registry B which should trigger a proxy request to A
 echo "Executing: curl -v http://localhost:5002/v2/"
 RESPONSE=$(curl -s -w "\n\nHTTP Status: %{http_code}" http://localhost:5002/v2/)

 echo "$RESPONSE"
 HTTP_CODE=$(echo "$RESPONSE" | grep "HTTP Status:" | awk '{print $3}')

 if [ "$HTTP_CODE" == "200" ]; then
    echo ""
    echo "SUCCESS: Proxy successfully authenticated and communicated with upstream."
 else
    echo ""
    echo "FAILURE: Proxy returned HTTP $HTTP_CODE"
    echo "--- Registry A Log ---"
    cat registry-a.log
    echo "--- Registry B Log ---"
    cat registry-b.log
    exit 1
 fi

 echo "### 7. Checking Logs for Errors"
 # Check for errors in logs (excluding expected TLS handshake errors from health checks)
 # Note: We exclude "TLS handshake error" because curl attempts without certs are expected
 ERRORS_A=$(grep -i "level=error\|panic\|fatal" registry-a.log | grep -v "TLS handshake error" || true)
 ERRORS_B=$(grep -i "level=error\|panic\|fatal" registry-b.log || true)

 if [ -n "$ERRORS_A" ]; then
    echo "FAILURE: Found errors in Registry A log:"
    echo "$ERRORS_A"
    exit 1
 fi

 if [ -n "$ERRORS_B" ]; then
    echo "FAILURE: Found errors in Registry B log:"
    echo "$ERRORS_B"
    exit 1
 fi

 echo "SUCCESS: No errors found in logs"

 echo ""
 echo "### 8. Log Summary"
 echo "--- Registry A (last 20 lines) ---"
 tail -20 registry-a.log
 echo ""
 echo "--- Registry B (last 20 lines) ---"
 tail -20 registry-b.log

 echo ""
 echo "### Test Passed Successfully"
	#!/bin/bash
	set -e

	# Setup directories
	TEST_DIR=$(pwd)/test-proxy-tls
	mkdir -p "$TEST_DIR/certs"
	cd "$TEST_DIR"

	echo "### 1. Generating Certificates"
	# CA
	openssl genrsa -out certs/ca.key 2048
	openssl req -new -x509 -days 365 -key certs/ca.key -out certs/ca.crt -subj "/CN=Test CA"

	# Server (Registry A)
	openssl genrsa -out certs/server.key 2048
	openssl req -new -key certs/server.key -out certs/server.csr -subj "/CN=localhost"
	echo "subjectAltName=DNS:localhost,IP:127.0.0.1" > certs/server.ext
	openssl x509 -req -days 365 -in certs/server.csr -CA certs/ca.crt -CAkey certs/ca.key -CAcreateserial -out certs/server.crt -extfile certs/server.ext

	# Client (Registry B)
	openssl genrsa -out certs/client.key 2048
	openssl req -new -key certs/client.key -out certs/client.csr -subj "/CN=client"
	openssl x509 -req -days 365 -in certs/client.csr -CA certs/ca.crt -CAkey certs/ca.key -CAcreateserial -out certs/client.crt

	echo "### 2. Creating Configuration Files"
	cat <<EOF > config-a.yaml
	version: 0.1
	log:
	level: debug
	storage:
	filesystem:
	rootdirectory: $TEST_DIR/registry-a
	http:
	addr: :5001
	tls:
	certificate: certs/server.crt
	key: certs/server.key
	clientcas:
	- certs/ca.crt
	EOF

	cat <<EOF > config-b.yaml
	version: 0.1
	log:
	level: debug
	storage:
	filesystem:
	rootdirectory: $TEST_DIR/registry-b
	proxy:
	remoteurl: https://localhost:5001
	tls:
	certificate: certs/client.crt
	key: certs/client.key
	rootcas:
	- certs/ca.crt
	http:
	addr: :5002
	EOF

	echo "### 3. Building Registry"
	cd ../
	go build -o "$TEST_DIR/registry" ./cmd/registry
	cd "$TEST_DIR"

	echo "### 4. Starting Registry A (Upstream)"
	OTEL_TRACES_EXPORTER=none ./registry serve config-a.yaml > registry-a.log 2>&1 &
	PID_A=$!

	echo "### Waiting for Registry A to be ready"
	until curl --cert certs/client.crt --key certs/client.key --cacert certs/ca.crt -s https://localhost:5001/v2/ > /dev/null; do
	echo "Registry A not ready, waiting..."
	sleep 1
	done

	echo "### 5. Starting Registry B (Proxy)"
	OTEL_TRACES_EXPORTER=none ./registry serve config-b.yaml > registry-b.log 2>&1 &
	PID_B=$!

	cleanup() {
	echo "### Cleaning up"
	kill $PID_A $PID_B 2>/dev/null \|\| true
	# rm -rf "$TEST_DIR"
	}
	trap cleanup EXIT

	echo "### 5. Waiting for Registries to be ready"
	sleep 5

	echo "### 6. Verifying Proxy"
	# Check if Registry B can talk to Registry A
	# We use curl to Registry B which should trigger a proxy request to A
	echo "Executing: curl -v http://localhost:5002/v2/"
	RESPONSE=$(curl -s -w "\n\nHTTP Status: %{http_code}" http://localhost:5002/v2/)

	echo "$RESPONSE"
	HTTP_CODE=$(echo "$RESPONSE" \| grep "HTTP Status:" \| awk '{print $3}')

	if [ "$HTTP_CODE" == "200" ]; then
	echo ""
	echo "SUCCESS: Proxy successfully authenticated and communicated with upstream."
	else
	echo ""
	echo "FAILURE: Proxy returned HTTP $HTTP_CODE"
	echo "--- Registry A Log ---"
	cat registry-a.log
	echo "--- Registry B Log ---"
	cat registry-b.log
	exit 1
	fi

	echo "### 7. Checking Logs for Errors"
	# Check for errors in logs (excluding expected TLS handshake errors from health checks)
	# Note: We exclude "TLS handshake error" because curl attempts without certs are expected
	ERRORS_A=$(grep -i "level=error\\|panic\\|fatal" registry-a.log \| grep -v "TLS handshake error" \|\| true)
	ERRORS_B=$(grep -i "level=error\\|panic\\|fatal" registry-b.log \|\| true)

	if [ -n "$ERRORS_A" ]; then
	echo "FAILURE: Found errors in Registry A log:"
	echo "$ERRORS_A"
	exit 1
	fi

	if [ -n "$ERRORS_B" ]; then
	echo "FAILURE: Found errors in Registry B log:"
	echo "$ERRORS_B"
	exit 1
	fi

	echo "SUCCESS: No errors found in logs"

	echo ""
	echo "### 8. Log Summary"
	echo "--- Registry A (last 20 lines) ---"
	tail -20 registry-a.log
	echo ""
	echo "--- Registry B (last 20 lines) ---"
	tail -20 registry-b.log

	echo ""
	echo "### Test Passed Successfully"
No results found