Repository navigation
tests: update CI nginx to 1.31.7. - #412
Merged
Merged
Conversation
Update the current nginx CI input from 1.31.6 to 1.31.7 and align any corresponding job names. Preserve other dependency versions and existing job coverage. Validate the changed YAML and shell steps, check the staged diff, and verify the nginx.org source archive reports version 1.31.7. Full builds and regression suites were not run locally.
Google can serve certificate chains rooted at GTS Root R4, while the shared Google test CA file only trusts GTS Root R1. This makes the SSL verification test fail with an unable-to-get-local-issuer error. Append the public R4 root from Google's official PKI repository while retaining R1 for endpoints that still use that chain. Verify the official root certificate and pass all 504 assertions in t/129-ssl-socket.t and t/170-ssl-session-reuse.t with nginx 1.31.7 and OpenSSL 3.5.7. Local tests use system DNS and a 50 ms startup delay to accommodate local DNS access and nginx restart timing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update CI nginx from
1.31.6to1.31.7in the existing OpenSSL matrix and job label.The Google TLS verification test trusted only GTS Root R1, while Google can serve a chain rooted at GTS Root R4. Append the official Google GTS Root R4 certificate to
t/cert/google.crt, retaining R1 so both certificate chains remain supported. The same certificate verification failure also occurred in the nginx 1.31.6 base CI.Validation:
git diff --check, and staged diff checks passed.t/129-ssl-socket.tandt/170-ssl-session-reuse.twith nginx 1.31.7 and OpenSSL 3.5.7. The tested binary's 91 stream module production files match this PR's source. Local tests used the system DNS andTEST_NGINX_SLEEP=0.05for local network access and process restart timing.The full build and regression results are recorded by this PR's CI checks.