Start implementing Pebble-based integration testing

.github/workflows/pebble.yml

@@ -0,0 +1,26 @@
+name: Pebble
+
+on:
+  push:
+    branches: ['main', '*-ci']
+  pull_request:
+  schedule:
+    - cron: "25 6 * * 5"
+
+jobs:
+  integration:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Download Pebble
+        run: |
+          curl -L "https://github.com/letsencrypt/pebble/releases/latest/download/pebble-linux-amd64.tar.gz" | tar xz --strip-components=3
+          chmod +x pebble
+      - name: Download Pebble Challenge Test Server
+        run: |
+          curl -L "https://github.com/letsencrypt/pebble/releases/latest/download/pebble-challtestsrv-linux-amd64.tar.gz" | tar xz --strip-components=3
+          chmod +x pebble-challtestsrv
+      - name: Run integration test
+        run: RUST_LOG=integration=info cargo test --test integration

.github/workflows/rust.yml

@@ -2,7 +2,7 @@ name: CI
 
 on:
   push:
-    branches: ['main']
+    branches: ['main', '*-ci']
   pull_request:
   schedule:
     - cron: "25 6 * * 5"

.gitignore

@@ -1,2 +1,4 @@
 Cargo.lock
 target/
+.idea/
+/pebble*

Cargo.toml

@@ -39,10 +39,22 @@ thiserror = "2.0.3"
 anyhow = "1.0.66"
 clap = { version = "4.0.29", features = ["derive"] }
 rcgen = { version = "0.13", default-features = false, features = ["pem"] }
+rustls = { version = "0.23", default-features = false }
+tempfile = "3"
 tokio = { version = "1.22.0", features = ["macros", "rt", "rt-multi-thread", "time"] }
 tracing = "0.1.37"
-tracing-subscriber = "0.3.16"
+tracing-subscriber =  { version = "0.3.16", features = ["env-filter"] }
 
 [[example]]
 name = "provision"
 required-features = ["hyper-rustls"]
+
+# Pebble integration test.
+# Disabled by default because it requires pebble & pebble-challtestsrv.
+# Run with:
+#  PEBBLE=path/to/pebble CHALLTESTSRV=path/to/pebble-challtestsrv cargo test --test integration
+[[test]]
+name = "integration"
+harness = false
+test = false
+required-features = ["hyper-rustls"]

examples/certgen.rs

@@ -0,0 +1,30 @@
+//! This "example" is used for generating integration test certificates.
+//!
+//! It is not intended to be an example of using `instant-acme`.
+
+use std::fs;
+
+use rcgen::{BasicConstraints, DistinguishedName, DnType, IsCa, KeyPair};
+
+fn main() -> anyhow::Result<()> {
+    let ca_key = KeyPair::generate()?;
+    let mut distinguished_name = DistinguishedName::new();
+    distinguished_name.push(DnType::CommonName, "Pebble CA".to_owned());
+    let mut ca_params = rcgen::CertificateParams::default();
+    ca_params.distinguished_name = distinguished_name;
+    ca_params.is_ca = IsCa::Ca(BasicConstraints::Unconstrained);
+
+    let ca_cert = ca_params.self_signed(&ca_key)?;
+    fs::write("tests/testdata/ca.pem", ca_cert.pem())?;
+
+    let ee_key = KeyPair::generate()?;
+    fs::write("tests/testdata/server.key", ee_key.serialize_pem())?;
+
+    let mut ee_params =
+        rcgen::CertificateParams::new(["localhost".to_owned(), "127.0.0.1".to_owned()])?;
+    ee_params.distinguished_name = DistinguishedName::new();
+    let ee_cert = ee_params.signed_by(&ee_key, &ca_cert, &ca_key)?;
+    fs::write("tests/testdata/server.pem", ee_cert.pem())?;
+
+    Ok(())
+}