pyrelukko 0.1.0__tar.gz → 0.3.0__tar.gz

pyrelukko-0.3.0/.gitlab-ci.yml

@@ -0,0 +1,137 @@
+variables:
+  FF_TIMESTAMPS: true
+  BUILD_IMAGE:
+    description: Used in rules, if "true" and web triggered it builds the image!
+    value: "false"
+    options:
+    - "false"
+    - "true"
+  IMAGE_NAME: py-rf-image
+  IMAGE_TAG:
+    description: >-
+      The "tag" added to the image name for the test / lint image.
+      Remove this when you trigger by hand an image build and want it to use
+      the new built image with Git short sha tag (X icon on the right)!
+    value: "latest"
+#  RUN_DOCS_PUBLISH:
+#    description: >-
+#      Used in rules, if "true" and web triggered it generates the docs and
+#      publishes them!
+#    value: "false"
+#    options:
+#    - "false"
+#    - "true"
+
+build-py-rf-image:
+  stage: build
+  image: docker:25
+  services:
+    - name: docker:25-dind
+      alias: docker
+  before_script:
+    - docker info
+  before_script:
+    - echo "Login to Gitlab container registry"
+    - echo "$CI_REGISTRY_PASSWORD" | docker login --username $CI_REGISTRY_USER --password-stdin $CI_REGISTRY
+  script:
+    - echo "Build container image..."
+    - ./cicd/build-py-rf-image.sh
+    - echo "Export IMAGE_TAG var to next stage!"
+    - echo "IMAGE_TAG=${CI_COMMIT_SHORT_SHA}" > image_tag.env
+    - echo "Build complete."
+  artifacts:
+    reports:
+      dotenv: image_tag.env
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+      changes:
+        - .gitlab-ci.yml
+        - cicd/build-py-rf-image.sh
+        - container/**/*
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH
+      changes:
+        - .gitlab-ci.yml
+        - cicd/build-py-rf-image.sh
+        - container/**/*
+    - if: $CI_PIPELINE_SOURCE == "web" && $BUILD_IMAGE == "true"
+      when: always
+
+run-pylint:
+  stage: test
+  image: "${CI_REGISTRY_IMAGE}/${IMAGE_NAME}:${IMAGE_TAG}"
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH
+      changes:
+        - src/**/*.py
+    - if: $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+      changes:
+        - src/**/*.py
+  before_script:
+    - echo "Running PyLint."
+  script:
+    - ./cicd/run_pylint.sh
+  artifacts:
+    when: always
+    expire_in: 2 week
+    paths:
+      - pylint.out.*
+
+
+run-pytest:
+  stage: test
+  image: "${CI_REGISTRY_IMAGE}/${IMAGE_NAME}:${IMAGE_TAG}"
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH
+      changes:
+        - src/**/*.py
+        - tests/test_*.py
+        - tests/conftest.py
+    - if: $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+      changes:
+        - src/**/*.py
+        - tests/test_*.py
+        - tests/conftest.py
+  before_script:
+    - echo "Running PyTest."
+  script:
+    - ./cicd/run_pytest.sh
+  artifacts:
+    when: always
+    expire_in: 2 week
+    paths:
+      - pytest-junit.xml
+    reports:
+      junit: pytest-junit.xml
+
+ 
+run-shellcheck:
+  stage: test
+  image: "${CI_REGISTRY_IMAGE}/${IMAGE_NAME}:${IMAGE_TAG}"
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH
+      changes:
+        - cicd/*.sh
+    - if: $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+      changes:
+        - cicd/*.sh
+  before_script:
+    - echo "Running ShellCheck."
+  script:
+    - ./cicd/run_shellcheck.sh
+ 
+# pages:
+#   stage: deploy
+#   image: "${CI_REGISTRY_IMAGE}/${IMAGE_NAME}:${IMAGE_TAG}"
+#   rules:
+#     - if: $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+#       changes:
+#         - src/**/*.py
+#     - if: $CI_PIPELINE_SOURCE == "web" && $RUN_DOCS_PUBLISH == "true"
+#       when: always
+#   before_script:
+#     - echo "Running Docs generation and publishing..."
+#   script:
+#     - ./cicd/run_docs_pages.sh
+#   artifacts:
+#     paths:
+#       - public

{pyrelukko-0.1.0 → pyrelukko-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: pyrelukko
-Version: 0.1.0
+Version: 0.3.0
 Summary: Relukko client.
 Author-email: Reto Zingg <g.d0b3rm4n@gmail.com>
 Requires-Python: >=3.12
@@ -11,6 +11,7 @@ Classifier: License :: OSI Approved :: MIT License
 Classifier: Topic :: Internet :: WWW/HTTP
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Requires-Dist: requests >=2.32.3
+Requires-Dist: websockets >= 13.1
 Project-URL: Homepage, https://gitlab.com/relukko/pyrelukko
 Project-URL: Issues, https://gitlab.com/relukko/pyrelukko/-/issues
 

pyrelukko-0.3.0/cicd/build-py-rf-image.sh

@@ -0,0 +1,48 @@
+#!/bin/sh
+
+set -e
+
+SCRIPT_DIR=$(dirname "$(readlink -f "$0")")
+REPO_DIR="${SCRIPT_DIR}/.."
+CONTAINER_DIR="${REPO_DIR}/container"
+CONTAINER_CMD="docker"
+
+# IMAGE_NAME should normally come from .gitlab-ci.yml file,
+# set default for local usage.
+if [ -z "${IMAGE_NAME+x}" ]; then
+    IMAGE_NAME=py-rf-image-local
+fi
+
+cd "${CONTAINER_DIR}" || exit
+
+${CONTAINER_CMD} build -t "${IMAGE_NAME}:latest" --file Containerfile .
+
+${CONTAINER_CMD} images
+
+if [ -n "${CI_REGISTRY_IMAGE}" ]; then
+    # In Gitlab
+
+    # Tag with Git commit short sha and push
+    IMAGE_WITH_GIT_SHA="${CI_REGISTRY_IMAGE}/${IMAGE_NAME}:${CI_COMMIT_SHORT_SHA}"
+    echo "IMAGE_WITH_GIT_SHA: ${IMAGE_WITH_GIT_SHA}"
+
+    ${CONTAINER_CMD} tag "${IMAGE_NAME}:latest" "${IMAGE_WITH_GIT_SHA}"
+    ${CONTAINER_CMD} push "${IMAGE_WITH_GIT_SHA}"
+
+    if [ "${CI_COMMIT_BRANCH}" = "${CI_DEFAULT_BRANCH}" ]; then
+        # We run in default branch, also tag with latest
+        # Tag with "latest" (overwrites last 'latest' in registry) and push
+        IMAGE_WITH_LATEST="${CI_REGISTRY_IMAGE}/${IMAGE_NAME}:latest"
+
+        echo "Tag image with as 'latest': ${IMAGE_WITH_LATEST}"
+
+        ${CONTAINER_CMD} tag "${IMAGE_NAME}:latest" "${IMAGE_WITH_LATEST}"
+        ${CONTAINER_CMD} push "${IMAGE_WITH_LATEST}"
+    fi
+else
+    echo "Runs locally, no pushing!"
+fi
+
+cd -
+
+# vim:set softtabstop=4 shiftwidth=4 tabstop=4 expandtab:

pyrelukko-0.3.0/cicd/run_docs_pages.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+
+SCRIPT_DIR=$(dirname "$(readlink -f "$0")")
+REPO_DIR="${SCRIPT_DIR}/.."
+PUBLIC_DIR="${REPO_DIR}/public"
+
+# Main script execution
+main() {
+    mkdir -p "${PUBLIC_DIR}"
+    # libdoc --pythonpath ./src  Relukko  "${PUBLIC_DIR}/index.html"
+    echo "Not Implemented yet"
+}
+
+# Execute the main function
+main
+
+# vim:set softtabstop=4 shiftwidth=4 tabstop=4 expandtab:

pyrelukko-0.3.0/cicd/run_pylint.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+
+SCRIPT_DIR=$(dirname "$(readlink -f "$0")")
+REPO_DIR="${SCRIPT_DIR}/.."
+
+# Main script execution
+main() {
+    pylint --verbose \
+            --rcfile "${REPO_DIR}/pyproject.toml" \
+            --output-format=json:pylint.out.json,parseable:pylint.out.txt,text \
+            "${REPO_DIR}"
+    pylint_exit_code=$?
+
+    pylint-json2html \
+        -o "${REPO_DIR}/pylint.out.html" \
+        "${REPO_DIR}/pylint.out.json"
+
+    return ${pylint_exit_code}
+}
+
+# Execute the main function
+main
+
+# vim:set softtabstop=4 shiftwidth=4 tabstop=4 expandtab:

pyrelukko-0.3.0/cicd/run_pytest.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+SCRIPT_DIR=$(dirname "$(readlink -f "$0")")
+REPO_DIR="${SCRIPT_DIR}/.."
+
+# Main script execution
+main() {
+    pytest --junit-xml "${REPO_DIR}/pytest-junit.xml"
+}
+
+# Execute the main function
+main
+
+# vim:set softtabstop=4 shiftwidth=4 tabstop=4 expandtab:

pyrelukko-0.3.0/cicd/run_shellcheck.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+SCRIPT_DIR=$(dirname "$(readlink -f "$0")")
+REPO_DIR="${SCRIPT_DIR}/.."
+
+# Main script execution
+main() {
+    shellcheck "${REPO_DIR}"/cicd/*.sh   
+}
+
+# Execute the main function
+main
+
+# vim:set softtabstop=4 shiftwidth=4 tabstop=4 expandtab:

pyrelukko-0.3.0/container/Containerfile

@@ -0,0 +1,5 @@
+FROM python:3.13-alpine
+
+RUN apk add --no-cache bash shellcheck
+COPY requirements.txt /opt/requirements.txt
+RUN pip install --no-cache-dir -r /opt/requirements.txt

pyrelukko-0.3.0/container/requirements.txt

@@ -0,0 +1,3 @@
+pylint==3.3.1
+pylint-json2html==0.5.0
+pytest==8.3.3

pyrelukko-0.3.0/pyproject.toml

@@ -0,0 +1,61 @@
+[project]
+name = "pyrelukko"
+authors = [
+    {name = "Reto Zingg", email = "g.d0b3rm4n@gmail.com"},
+]
+readme = "README.md"
+
+# https://pypi.org/pypi?%3Aaction=list_classifiers
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: MIT License",
+    "Topic :: Internet :: WWW/HTTP",
+    "Topic :: Software Development :: Libraries :: Python Modules",
+]
+requires-python = ">=3.12"
+dynamic = ["version", "description"]
+dependencies = [
+    "requests >=2.32.3",
+    "websockets >= 13.1",
+]
+
+[tool.flit.sdist]
+exclude = [".gitignore", "demo.py"]
+
+[project.urls]
+Homepage = "https://gitlab.com/relukko/pyrelukko"
+Issues = "https://gitlab.com/relukko/pyrelukko/-/issues"
+
+[build-system]
+requires = ["flit_core >=3.2,<4", "semantic-version >= 2.10"]
+build-backend = "flit_core.buildapi"
+
+[tool.pytest.ini_options]
+testpaths = [
+    "tests",
+]
+pythonpath = [
+    "src",
+]
+
+[tool.tox]
+requires = ["tox>=4.23"]
+env_list = ["3.13", "3.12"]
+
+[tool.tox.env_run_base]
+description = "Run test under {base_python}"
+commands = [["pytest"]]
+deps = ["httpx", "pytest", "testcontainers"]
+set_env = { VIRTUALENV_DISCOVERY = "pyenv" }
+pass_env = [ "TESTCONTAINERS_DOCKER_SOCKET_OVERRIDE", "DOCKER_HOST" ]
+
+[tool.pylint.main]
+# Files or directories to be skipped. They should be base names, not paths.
+ignore = ["LICENSE", "pyproject.toml", "version.py",
+          "README.md", "demo.py", "conftest.py", ".tox"]
+
+# Files or directories matching the regular expression patterns are skipped. The
+# regex matches against base names, not paths. The default value ignores Emacs
+# file locks
+ignore-patterns = ["^\\.#", "^test_"]

{pyrelukko-0.1.0 → pyrelukko-0.3.0}/src/pyrelukko/pyrelukko.py

@@ -2,22 +2,20 @@
 TBD
 """
 import asyncio
+import json
 import logging
 import os
-import json
-import threading
 import ssl
+import threading
 import time
-
 from datetime import datetime
-from typing import Dict, List, Union
 from pathlib import Path
-from urllib3.util import Url, parse_url
-from urllib3.util.retry import Retry
+from typing import Dict, List, Union
 
 import requests
+from urllib3.util import Url, parse_url
+from urllib3.util.retry import Retry
 from websockets import ConnectionClosed as WsConnectionClosed
-
 from websockets.asyncio.client import connect as ws_connect
 
 from .retry import retry
@@ -30,6 +28,14 @@ SSL_KWARGS = [
     'options',
 ]
 
+RETRY_KWARGS = [
+    'tries',
+    'delay',
+    'backoff',
+    'max_delay',
+    'exceptions'
+]
+
 logger = logging.getLogger(__name__)
 
 
@@ -50,12 +56,21 @@ class RelukkoClient:
         """
         self.session = requests.Session()
         self.api_key = api_key
+        self.tries=4
+        self.delay=5
+        self.backoff=2.0
+        self.max_delay=None
+        self.exceptions = (
+            requests.ConnectionError,
+            RelukkoDoRetry,
+        )
         self._setup_session(api_key, **kwargs)
         self._setup_http_adapters_retry(**kwargs)
+        self._setup_pyrelukko_retry(**kwargs)
 
         self.base_url = self._setup_base_url(base_url)
         self.ws_url = self._setup_ws_url(str(self.base_url))
-        self.ssl_ctx = None
+        self.ssl_ctx: ssl.SSLContext = None
         self._setup_ssl_ctx(**kwargs)
 
         # event for websocket thread to signal it got a message
@@ -75,6 +90,15 @@ class RelukkoClient:
         self.base_url = self._setup_base_url(base_url or self.base_url)
         self.ws_url = self._setup_ws_url(str(self.base_url))
         self._setup_ssl_ctx(**kwargs)
+        self._setup_pyrelukko_retry(**kwargs)
+
+    def _setup_pyrelukko_retry(self, **kwargs):
+        for kwarg in RETRY_KWARGS:
+            setattr(
+                self,
+                kwarg,
+                kwargs.get(kwarg, getattr(self, kwarg))
+            )
 
     def _setup_http_adapters_retry(self, **kwargs):
         for _, http_adapter in self.session.adapters.items():
@@ -85,7 +109,7 @@ class RelukkoClient:
             http_adapter.max_retries = http_retry
 
     def _setup_session(self, api_key: str, **kwargs):
-        self.session.headers = {'X-api-Key': api_key}
+        self.session.headers['X-api-Key'] = api_key
         for key, value in kwargs.items():
             if hasattr(self.session, key):
                 setattr(self.session, key, value)
@@ -116,7 +140,7 @@ class RelukkoClient:
 
             # values from kwargs take precedence env vars
             ca_file = kwargs.get('cafile', ca_bundle_file)
-            ca_path = kwargs.get('capath', ca_bundle_path)
+            ca_path = kwargs.get('capath', f"{ca_bundle_path}/")
             ca_data = kwargs.get('cadata')
 
             if ca_file or ca_path or ca_data:
@@ -127,7 +151,7 @@ class RelukkoClient:
 
     def _setup_ws_url(self, ws_url: str) -> Url:
         url = ws_url.replace("http", "ws", 1)
-        return parse_url(f"{url}/deletions")
+        return parse_url(f"{url}/ws/broadcast")
 
     def _setup_base_url(self, base_url: Union[Url, str]) -> Url:
         if isinstance(base_url, str):
@@ -196,7 +220,7 @@ class RelukkoClient:
 
     def _check_response(self, response: requests.Response):
         match response.status_code:
-            case 200 | 201 | 404:
+            case 200 | 201 | 404 | 422:
                 return response.json()
             case 400 | 403:
                 err = response.json()
@@ -207,10 +231,12 @@ class RelukkoClient:
                 logger.info(err.get('status'), err.get('message'))
                 return None
             case 500 | 502 | 503 | 504:
-                logger.warning(response.status_code, response.text)
+                logger.warning("[%d](%s) %s",
+                    response.status_code, response.reason, response.text)
                 raise RelukkoDoRetry()
             case _:
-                logger.warning(response.status_code, response.text)
+                logger.warning("[%d](%s) %s",
+                    response.status_code, response.reason, response.text)
                 raise RuntimeError()
 
     def _make_request(
@@ -219,12 +245,10 @@ class RelukkoClient:
             method: str,
             payload: Dict=None) -> requests.Response:
 
-        excpetions = (
-            requests.ConnectionError,
-            RelukkoDoRetry,
-        )
 
-        @retry(logger, exceptions=excpetions, delay=10)
+        @retry(logger, exceptions=self.exceptions, tries=self.tries,
+               delay=self.delay, backoff=self.backoff,
+               max_delay=self.max_delay)
         def _do_request():
             response = self.session.request(
                 method=method,
@@ -274,13 +298,14 @@ class RelukkoClient:
         url = f"{self.base_url}/v1/locks/"
         return self._make_request(url, "GET")
 
-    def update_relukko(self, lock_id: str, creator: str, expires_at: datetime):
+    def update_relukko(
+            self, lock_id: str, creator: str=None, expires_at: datetime=None):
         """
         TBD
         """
         if isinstance(expires_at, datetime):
             expires_at = expires_at.isoformat()
-        else:
+        elif expires_at is not None:
             raise ValueError("has to be datetime!")
 
         payload = {
@@ -288,7 +313,7 @@ class RelukkoClient:
             "expires_at": expires_at,
         }
         url = f"{self.base_url}/v1/locks/{lock_id}"
-        return self._make_request(url, "POST", payload)
+        return self._make_request(url, "PUT", payload)
 
     def delete_relukko(self, lock_id: str):
         """

pyrelukko-0.3.0/src/pyrelukko/testcontainers.py

@@ -0,0 +1,90 @@
+# pylint: skip-file
+"""
+Testcontainers to be used in PyTests, for a fixture see tests/conftest.py
+(relukko_backend):
+
+@pytest.fixture(scope="session")
+def relukko_backend():
+    with Network() as rl_net:
+        with RelukkoDbContainer(net=rl_net, initdb_dir=INITDB_DIR,
+            image="postgres:16", hostname="relukkodb") as _db:
+            db_url = "postgresql://relukko:relukko@relukkodb/relukko"
+            with RelukkoContainer(rl_net, db_url=db_url) as backend:
+                relukko = RelukkoClient(
+                    base_url=backend.get_api_url(), api_key="somekey")
+                yield relukko, backend
+"""
+import socket
+from pathlib import Path
+
+from testcontainers.core.network import Network
+from testcontainers.core.waiting_utils import wait_container_is_ready
+from testcontainers.generic import ServerContainer
+from testcontainers.postgres import PostgresContainer
+
+
+class RelukkoContainer(ServerContainer):
+    def __init__(self, net: Network,
+                 image="registry.gitlab.com/relukko/relukko:0.10.0", db_url=None):
+        self.db_url = db_url
+        self.net = net
+        super(RelukkoContainer, self).__init__(image=image, port=3000)
+
+    def _configure(self):
+        self.with_env("DATABASE_URL", self.db_url)
+        self.with_env("RELUKKO_API_KEY", "somekey")
+        self.with_env("RELUKKO_USER", "relukko")
+        self.with_env("RELUKKO_PASSWORD", "relukko")
+        self.with_env("RELUKKO_BIND_ADDR", "0.0.0.0")
+        self.with_network(self.net)
+
+    def get_api_url(self) -> str:
+        return f"http://localhost:{self.get_exposed_port(3000)}"
+
+    def _create_connection_url(self) -> str:
+        return f"{self.get_api_url()}/healthchecker"
+
+
+class RelukkoDbContainer(PostgresContainer):
+    def __init__(
+            self, net: Network,
+            initdb_dir: Path,
+            image: str = "postgres:latest",
+            port: int = 5432,
+            username: str | None = None,
+            password: str | None = None,
+            dbname: str | None = None,
+            driver: str | None = "psycopg2",
+            **kwargs) -> None:
+        self.net = net
+        self.initdb_dir = initdb_dir
+        super().__init__(image, port, username, password, dbname, driver, **kwargs)
+
+    def _configure(self) -> None:
+        self.with_volume_mapping(self.initdb_dir, "/docker-entrypoint-initdb.d", "Z")
+        self.with_env("POSTGRES_USER", "relukko")
+        self.with_env("POSTGRES_PASSWORD", "relukko")
+        self.with_env("POSTGRES_DB", "relukko")
+        self.with_network(self.net)
+
+    @wait_container_is_ready()
+    def _connect(self) -> None:
+        packet = bytes([
+            0x00, 0x00, 0x00, 0x52, 0x00, 0x03, 0x00, 0x00, 
+            0x75, 0x73, 0x65, 0x72, 0x00, 0x72, 0x65, 0x6c, 
+            0x75, 0x6b, 0x6b, 0x6f, 0x00, 0x64, 0x61, 0x74, 
+            0x61, 0x62, 0x61, 0x73, 0x65, 0x00, 0x72, 0x65, 
+            0x6c, 0x75, 0x6b, 0x6b, 0x6f, 0x00, 0x61, 0x70, 
+            0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 
+            0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x00, 0x70, 
+            0x73, 0x71, 0x6c, 0x00, 0x63, 0x6c, 0x69, 0x65, 
+            0x6e, 0x74, 0x5f, 0x65, 0x6e, 0x63, 0x6f, 0x64, 
+            0x69, 0x6e, 0x67, 0x00, 0x55, 0x54, 0x46, 0x38, 
+            0x00, 0x00
+        ])
+        port = self.get_exposed_port(self.port)
+        with socket.create_connection(("localhost", port)) as sock:
+            sock.send(packet)
+            buf = sock.recv(40)
+            if len(buf) == 0 and "SCRAM-SHA" not in buf:
+                raise ConnectionError

{pyrelukko-0.1.0 → pyrelukko-0.3.0}/src/pyrelukko/version.py

@@ -1,2 +1,2 @@
 # pylint: disable=all
-__version__ = "0.1.0"
+__version__ = "0.3.0"

pyrelukko-0.3.0/tests/cert/5d868fca.0

@@ -0,0 +1 @@
+rootCA.crt

pyrelukko-0.3.0/tests/cert/README.md

@@ -0,0 +1,11 @@
+# How To
+```
+openssl req -subj '/CN=Relukko CA' -x509 -sha256 -days 7300 -noenc -newkey rsa:2048 -keyout rootCA.key -out rootCA.crt -addext keyUsage=critical,cRLSign,digitalSignature,keyCertSign
+
+ln -s rootCA.crt "$(openssl x509 -hash -noout -in rootCA.crt).0"
+
+openssl req -subj '/CN=relukko' -newkey rsa:2048 -noenc -keyout relukko.key -out relukko.csr -addext keyUsage=critical,digitalSignature,keyEncipherment,keyAgreement -addext extendedKeyUsage=critical,serverAuth
+
+openssl x509 -req -CA rootCA.crt -CAkey rootCA.key -in relukko.csr -out relukko.crt -days 7299 -CAcreateserial
+openssl x509 -inform PEM -in rootCA.crt  -outform DER -out rootCA.der
+```

pyrelukko-0.3.0/tests/cert/relukko.crt

@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC9zCCAd+gAwIBAgIUXFQN+AOO7KFdiVNVFman8BLkRfkwDQYJKoZIhvcNAQEL
+BQAwFTETMBEGA1UEAwwKUmVsdWtrbyBDQTAeFw0yNDExMTYyMTM5MTNaFw00NDEx
+MTAyMTM5MTNaMBIxEDAOBgNVBAMMB3JlbHVra28wggEiMA0GCSqGSIb3DQEBAQUA
+A4IBDwAwggEKAoIBAQCljry3blOWFJRdinzcH4XzRnvKlhhofBhtRsPH+pvjmrHO
+v52rXj1XeHqXaEBevhNiN7lP5eg2UgOrs0KAVXYR2Na9Mxrh8ACX+IqeEJF9BKgO
+4t2RvItDU3SWxV3dIYMasBhe/iDXDKKZd/jVOiluL9zuxo9ltDagZxc72jWMnvrO
+lvlnZVEtH4n9i+hnx1daWRZG87DjO6d8I8F8nX6NTqJgBlrRm8jlcq2N/G8eHTFq
+OrLY4xk4CF+aVExpJrEGprfhNkbE025tJIbGNM9Xv+W0sI/nhEwJdv4ifEP/b+44
+n+KHrAurOboFYmRcoZ9Vn4C1KuYBvDOpgkwOs1wtAgMBAAGjQjBAMB0GA1UdDgQW
+BBSy6DZz/N1PW1mkQY7HUj3Fz6yZOjAfBgNVHSMEGDAWgBT+sHazfmyczKb0BV6r
+Z1JQ8Sfx9zANBgkqhkiG9w0BAQsFAAOCAQEAL1c1l3Azna1mh86haErurYk3EsiH
+KDGprRubdB5qfpa2GdAkhitp9juKYdKGdw877eOl5z7AMeMWAA8WXQ3z7jkQkUhU
+9wsZxNyHQajq6Lo9KsRxZiRKZX/fxagcnDem+4xTvzSlJoAT5p/CO5E31odwWkZN
+bg79I36nk87opISXzNAbMBcbQEV5R8l4PzNGs/DcrLzTC66FKxHHzyih4mlBF5mS
+/sMY5l9QNaJHKPK7fKZ5yxohkda7tDwtb5p0bbEUQlMeZIQ8r/go1b7/ppXXM5ei
+mTDcwKgeOBgVujqhvgGXOKtcHVfkrqcID+qgDMxYd7XXE/icGF3zmnHwDQ==
+-----END CERTIFICATE-----

pyrelukko-0.3.0/tests/cert/relukko.csr

@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICkDCCAXgCAQAwEjEQMA4GA1UEAwwHcmVsdWtrbzCCASIwDQYJKoZIhvcNAQEB
+BQADggEPADCCAQoCggEBAKWOvLduU5YUlF2KfNwfhfNGe8qWGGh8GG1Gw8f6m+Oa
+sc6/natePVd4epdoQF6+E2I3uU/l6DZSA6uzQoBVdhHY1r0zGuHwAJf4ip4QkX0E
+qA7i3ZG8i0NTdJbFXd0hgxqwGF7+INcMopl3+NU6KW4v3O7Gj2W0NqBnFzvaNYye
++s6W+WdlUS0fif2L6GfHV1pZFkbzsOM7p3wjwXydfo1OomAGWtGbyOVyrY38bx4d
+MWo6stjjGTgIX5pUTGkmsQamt+E2RsTTbm0khsY0z1e/5bSwj+eETAl2/iJ8Q/9v
+7jif4oesC6s5ugViZFyhn1WfgLUq5gG8M6mCTA6zXC0CAwEAAaA5MDcGCSqGSIb3
+DQEJDjEqMCgwDgYDVR0PAQH/BAQDAgOoMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMB
+MA0GCSqGSIb3DQEBCwUAA4IBAQBfEyjmGQtITqSsmoAQXEb11Cm/olsL5w6kEzgr
+/0K8ASvDvW+3yJ3U9OBngvgh6iQCJjYaixb8NtQS7yVWYEqJoaA0Hp1q0QDmRS/l
+MDLe2cILgbLQUKOf1jLtYsLG93Lb74HSGztjIIEoi3Wgrm5LLGc/cd28q8yw5c/j
+s1EntUHeNWCYAUIRvwmt+1UPcc8EBHH2DugGz2verzARdvLWAajL5r9ZIJkkU0kY
+fh5gnmVb6I6RtIXhWcXMUL9nBwzPCyJMd4cC/fueC+HxzLNhGldvVxj3cg7W57vR
+QnbG/qcJYN5WGhoHrWIiI90GufG4jifVvyQeBC/vQcymRlAL
+-----END CERTIFICATE REQUEST-----