update cert to cacert

asher-pem-arm · asher-pem-arm · commit d814bd4bb294 · 2026-07-08T14:14:10.000Z
diff --git a/doc/getting_started.rst b/doc/getting_started.rst
@@ -446,14 +446,14 @@ Refer to the ``labgrid-coordinator`` man page for details.
 
 When you are connecting with ``labgrid-client`` or ``labgrid-exporter`` to a
 ``labgrid-coordinator`` that has TLS gRPC channels enabled you need to pass
-the ``--tls`` option. If ``--cert`` is not set, labgrid uses the host CA
-certificates to verify the coordinator certificate. Use ``--cert`` to provide
-a specific CA certificate instead.
+the ``--tls`` option. If ``--cacert`` is not set, labgrid uses the host CA
+certificates to verify the coordinator certificate. Use ``--cacert`` to provide
+a specific CA certificate or CA bundle instead.
 Refer to the ``labgrid-client`` and ``labgrid-exporter`` man pages for details.
 For ``RemotePlace`` connections from an environment config, set the
-``coordinator_tls`` option or ``LG_COORDINATOR_TLS``. If ``coordinator_cert``
-is not set, labgrid uses the host CA certificates. Set ``coordinator_cert``
-to provide a specific CA certificate instead.
+``coordinator_tls`` option or ``LG_COORDINATOR_TLS``. If ``coordinator_cacert``
+is not set, labgrid uses the host CA certificates. Set ``coordinator_cacert``
+to provide a specific CA certificate or CA bundle instead.
 
 Using a Strategy
 ----------------
diff --git a/doc/man/client.rst b/doc/man/client.rst
@@ -137,7 +137,7 @@ Retrieve a list of places on a ``labgrid-coordinator`` that uses TLS gRPC channe
 
 .. code-block:: bash
 
-    $ labgrid-client --tls [--cert PATH] places
+    $ labgrid-client --tls [--cacert PATH] places
 
 See Also
 --------
diff --git a/doc/man/coordinator.rst b/doc/man/coordinator.rst
@@ -28,7 +28,7 @@ OPTIONS
 --tls
     enable TLS gRPC channel
 --cert
-    path to TLS certificate (in PEM format)
+    path to server TLS certificate (in PEM format)
 --key
     path to TLS key (in PEM format)
 -d, --debug
diff --git a/doc/man/device-config.rst b/doc/man/device-config.rst
@@ -47,10 +47,10 @@ OPTIONS KEYS
   enables a TLS gRPC channel for ``RemotePlace`` connections.
   Defaults to whether ``LG_COORDINATOR_TLS`` is set.
 
-``coordinator_cert``
-  path to the coordinator TLS certificate in PEM format for ``RemotePlace``
-  connections. If unset, the host CA certificates are used. Relative paths are
-  resolved relative to the configuration file.
+``coordinator_cacert``
+  path to a CA certificate or CA bundle in PEM format for verifying the
+  coordinator in ``RemotePlace`` connections. If unset, the host CA certificates
+  are used. Relative paths are resolved relative to the configuration file.
 
 .. _labgrid-device-config-images:
 
diff --git a/doc/man/exporter.rst b/doc/man/exporter.rst
@@ -29,8 +29,8 @@ OPTIONS
     coordinator ``HOST[:PORT]`` to connect to, defaults to ``127.0.0.1:20408``
 --tls
     enable TLS gRPC channel
---cert
-    path to TLS certificate (in PEM format)
+--cacert
+    path to CA certificate or CA bundle for verifying the coordinator (in PEM format)
 -i, --isolated
     enable isolated mode (always request SSH forwards)
 -n, --name
@@ -107,7 +107,7 @@ Same as above, but connecting to a ``labgrid-coordinator`` that uses TLS gRPC ch
 
 .. code-block:: bash
 
-    $ labgrid-exporter --tls [--cert PATH] -n myname my-config.yaml
+    $ labgrid-exporter --tls [--cacert PATH] -n myname my-config.yaml
 
 SEE ALSO
 --------
diff --git a/labgrid/remote/client.py b/labgrid/remote/client.py
@@ -1869,7 +1869,11 @@ def get_parser(auto_doc_mode=False) -> "argparse.ArgumentParser | AutoProgramArg
         default=os.environ.get("LG_COORDINATOR_TLS") is not None,
         help="enable TLS gRPC channel",
     )
-    parser.add_argument("--cert", type=pathlib.PurePath, help="path to the server's TLS certificate (in PEM format)")
+    parser.add_argument(
+        "--cacert",
+        type=pathlib.PurePath,
+        help="path to CA certificate or CA bundle for verifying the coordinator (in PEM format)",
+    )
     parser.add_argument(
         "-c",
         "--config",
diff --git a/labgrid/remote/common.py b/labgrid/remote/common.py
@@ -108,10 +108,10 @@ def get_client_credentials(args: Namespace) -> Optional[grpc.ChannelCredentials]
     if not args.tls:
         return None
 
-    if not args.cert:
+    if not args.cacert:
         return grpc.ssl_channel_credentials(root_certificates=_fetch_root_certificates())
 
-    with open(args.cert, "rb") as fc:
+    with open(args.cacert, "rb") as fc:
         return grpc.ssl_channel_credentials(root_certificates=fc.read())
 
 
diff --git a/labgrid/remote/coordinator.py b/labgrid/remote/coordinator.py
@@ -1204,7 +1204,7 @@ def main():
         help="coordinator listening host and port",
     )
     parser.add_argument("--tls", action="store_true", default=False, help="enable TLS gRPC channel")
-    parser.add_argument("--cert", type=pathlib.PurePath, help="path to TLS certificate (in PEM format)")
+    parser.add_argument("--cert", type=pathlib.PurePath, help="path to server TLS certificate (in PEM format)")
     parser.add_argument("--key", type=pathlib.PurePath, help="path to TLS key (in PEM format)")
     parser.add_argument("-d", "--debug", action="store_true", default=False, help="enable debug mode")
     parser.add_argument("--pystuck", action="store_true", help="enable pystuck")
diff --git a/labgrid/remote/exporter.py b/labgrid/remote/exporter.py
@@ -1093,7 +1093,11 @@ def main():
         help="coordinator host and port",
     )
     parser.add_argument("--tls", action="store_true", default=False, help="enable TLS gRPC channel")
-    parser.add_argument("--cert", type=pathlib.PurePath, help="path to TLS certificate (in PEM format)")
+    parser.add_argument(
+        "--cacert",
+        type=pathlib.PurePath,
+        help="path to CA certificate or CA bundle for verifying the coordinator (in PEM format)",
+    )
     parser.add_argument(
         "-n",
         "--name",
diff --git a/labgrid/resource/remote.py b/labgrid/resource/remote.py
@@ -17,32 +17,29 @@ def __attrs_post_init__(self):
         self.ready = None
         self.unmanaged_resources = []
 
-    @staticmethod
-    def _is_tls_option_enabled(value):
-        if isinstance(value, str):
-            return value.strip().lower() == "true"
-
-        return value is True
-
     def _get_credentials(self):
         from ..remote.common import get_client_credentials
 
         tls = os.environ.get("LG_COORDINATOR_TLS") is not None
-        cert = None
+        cacert = None
 
         if self.env:
             config = self.env.config
             tls = config.get_option("coordinator_tls", tls)
+            if isinstance(tls, str):
+                tls = tls.strip().lower() == "true"
+            else:
+                tls = tls is True
 
-            cert = config.get_option("coordinator_cert", "")
-            if cert:
-                cert = config.resolve_path(str(cert))
+            cacert = config.get_option("coordinator_cacert", "")
+            if cacert:
+                cacert = config.resolve_path(str(cacert))
             else:
-                cert = None
+                cacert = None
 
         args = Namespace(
-            tls=self._is_tls_option_enabled(tls),
-            cert=cert,
+            tls=tls,
+            cacert=cacert,
         )
 
         return get_client_credentials(args)
diff --git a/man/labgrid-client.1 b/man/labgrid-client.1
@@ -39,7 +39,7 @@ This is the client to control a boards status and interface with it on remote ma
 .INDENT 3.5
 .sp
 .EX
-usage: labgrid\-client [\-x ADDRESS] [\-\-tls] [\-\-cert CERT] [\-c CONFIG]
+usage: labgrid\-client [\-x ADDRESS] [\-\-tls] [\-\-cacert CACERT] [\-c CONFIG]
                       [\-p PLACE] [\-s STATE] [\-i INITIAL_STATE] [\-d] [\-v]
                       [\-P PROXY]
                       COMMAND ...
@@ -58,8 +58,8 @@ enable TLS gRPC channel
 .UNINDENT
 .INDENT 0.0
 .TP
-.B \-\-cert <cert>
-path to the server\(aqs TLS certificate (in PEM format)
+.B \-\-cacert <cacert>
+path to CA certificate or CA bundle for verifying the coordinator (in PEM format)
 .UNINDENT
 .INDENT 0.0
 .TP
@@ -1251,7 +1251,7 @@ Retrieve a list of places on a \fBlabgrid\-coordinator\fP that uses TLS gRPC cha
 .INDENT 3.5
 .sp
 .EX
-$ labgrid\-client \-\-tls [\-\-cert PATH] places
+$ labgrid\-client \-\-tls [\-\-cacert PATH] places
 .EE
 .UNINDENT
 .UNINDENT
diff --git a/man/labgrid-coordinator.1 b/man/labgrid-coordinator.1
@@ -55,7 +55,7 @@ make coordinator listen on host and port
 enable TLS gRPC channel
 .TP
 .B  \-\-cert
-path to TLS certificate (in PEM format)
+path to server TLS certificate (in PEM format)
 .TP
 .B  \-\-key
 path to TLS key (in PEM format)
diff --git a/man/labgrid-device-config.5 b/man/labgrid-device-config.5
@@ -65,10 +65,10 @@ Defaults to \fB127.0.0.1:20408\fP\&.
 enables a TLS gRPC channel for \fBRemotePlace\fP connections.
 Defaults to whether \fBLG_COORDINATOR_TLS\fP is set.
 .TP
-.B \fBcoordinator_cert\fP
-path to the coordinator TLS certificate in PEM format for \fBRemotePlace\fP
-connections. If unset, the host CA certificates are used. Relative paths are
-resolved relative to the configuration file.
+.B \fBcoordinator_cacert\fP
+path to a CA certificate or CA bundle in PEM format for verifying the
+coordinator in \fBRemotePlace\fP connections. If unset, the host CA certificates
+are used. Relative paths are resolved relative to the configuration file.
 .UNINDENT
 .SS IMAGES
 .sp
diff --git a/man/labgrid-exporter.1 b/man/labgrid-exporter.1
@@ -54,8 +54,8 @@ coordinator \fBHOST[:PORT]\fP to connect to, defaults to \fB127.0.0.1:20408\fP
 .B  \-\-tls
 enable TLS gRPC channel
 .TP
-.B  \-\-cert
-path to TLS certificate (in PEM format)
+.B  \-\-cacert
+path to CA certificate or CA bundle for verifying the coordinator (in PEM format)
 .TP
 .B  \-i\fP,\fB  \-\-isolated
 enable isolated mode (always request SSH forwards)
@@ -138,7 +138,7 @@ Same as above, but connecting to a \fBlabgrid\-coordinator\fP that uses TLS gRPC
 .INDENT 3.5
 .sp
 .EX
-$ labgrid\-exporter \-\-tls [\-\-cert PATH] \-n myname my\-config.yaml
+$ labgrid\-exporter \-\-tls [\-\-cacert PATH] \-n myname my\-config.yaml
 .EE
 .UNINDENT
 .UNINDENT
diff --git a/tests/test_remote.py b/tests/test_remote.py
@@ -172,7 +172,7 @@ def test_tls_coordinator_with_client(tmpdir):
         coord_spawn.expect("INFO:root:Coordinator ready", timeout=1)
 
         with pexpect.spawn(
-            f"python -m labgrid.remote.client --tls --cert {cert} reserve abc=123", cwd=tmpdir
+            f"python -m labgrid.remote.client --tls --cacert {cert} reserve abc=123", cwd=tmpdir
         ) as client_spawn:
             client_spawn.expect("  state: waiting", timeout=1)
             client_spawn.close()
@@ -200,7 +200,7 @@ def test_tls_coordinator_with_exporter(tmpdir):
         coord_spawn.expect("INFO:root:Coordinator ready", timeout=1)
 
         with pexpect.spawn(
-            f"python -m labgrid.remote.exporter --tls --cert {cert} {config}", cwd=tmpdir
+            f"python -m labgrid.remote.exporter --tls --cacert {cert} {config}", cwd=tmpdir
         ) as exporter_spawn:
             exporter_spawn.expect(
                 "add resource Testport/NetworkSerialPort: NetworkSerialPort/OrderedDict.*", timeout=1
@@ -269,7 +269,7 @@ def test_get_server_credentials_valid(tmpdir):
 def test_get_client_credentials_not_tls():
     args = {
         "tls": False,
-        "cert": None,
+        "cacert": None,
     }
 
     ns = argparse.Namespace(**args)
@@ -283,7 +283,7 @@ def test_get_client_credentials_valid(tmpdir):
 
     args = {
         "tls": True,
-        "cert": cert_path,
+        "cacert": cert_path,
     }
 
     ns = argparse.Namespace(**args)
@@ -342,12 +342,12 @@ def start_session(address, *, extra=None, credentials=None, **kwargs):
 
 
 @pytest.mark.parametrize(
-    ("options", "tls_env", "expected_tls", "expected_cert"),
+    ("options", "tls_env", "expected_tls", "expected_cacert"),
     [
         pytest.param({}, False, False, None, id="default-no-tls"),
         pytest.param({}, True, True, None, id="tls-env"),
         pytest.param(
-            {"coordinator_tls": True, "coordinator_cert": "cert.pem"},
+            {"coordinator_tls": True, "coordinator_cacert": "cert.pem"},
             False,
             True,
             "cert.pem",
@@ -358,14 +358,14 @@ def start_session(address, *, extra=None, credentials=None, **kwargs):
         pytest.param({"coordinator_tls": "false"}, True, False, None, id="config-string-overrides-env"),
     ],
 )
-def test_remote_place_client_credentials(monkeypatch, tmpdir, options, tls_env, expected_tls, expected_cert):
+def test_remote_place_client_credentials(monkeypatch, tmpdir, options, tls_env, expected_tls, expected_cacert):
     cert_path, _ = setup_tmp_cert_key(tmpdir)
     assert cert_path.basename == "cert.pem"
-    if expected_cert:
-        expected_cert = str(tmpdir.join(expected_cert))
+    if expected_cacert:
+        expected_cacert = str(tmpdir.join(expected_cacert))
 
     captured = _capture_remote_place_credentials(monkeypatch, tmpdir, options=options, tls_env=tls_env)
 
     assert captured["args"].tls is expected_tls
-    assert captured["args"].cert == expected_cert
+    assert captured["args"].cacert == expected_cacert
     assert captured["credentials"] == ("credentials" if expected_tls else None)

Original file line number	Diff line number	Diff line change
`@@ -1204,7 +1204,7 @@ def main():`
`1204`	`1204`	`help="coordinator listening host and port",`
`1205`	`1205`	`)`
`1206`	`1206`	`parser.add_argument("--tls", action="store_true", default=False, help="enable TLS gRPC channel")`
`1207`		`- parser.add_argument("--cert", type=pathlib.PurePath, help="path to TLS certificate (in PEM format)")`
	`1207`	`+ parser.add_argument("--cert", type=pathlib.PurePath, help="path to server TLS certificate (in PEM format)")`
`1208`	`1208`	`parser.add_argument("--key", type=pathlib.PurePath, help="path to TLS key (in PEM format)")`
`1209`	`1209`	`parser.add_argument("-d", "--debug", action="store_true", default=False, help="enable debug mode")`
`1210`	`1210`	`parser.add_argument("--pystuck", action="store_true", help="enable pystuck")`