From a5985508817e5de73092a339f15ce7f9f701a20f Mon Sep 17 00:00:00 2001
From: Brian Rosmaita <rosmaita.fossdev@gmail.com>
Date: Fri, 15 Dec 2017 14:35:49 -0500
Subject: [PATCH] Restore functional testing under ssl

Closes-bug: #1738033
Change-Id: Ia3e2e210eea09ac07311f25ffa99ad0f4ced418d
---
 .zuul.yaml             |  2 --
 tools/fix_ca_bundle.sh | 37 +++++++++++++++++++++++++++++++++++++
 tox.ini                |  5 +++++
 3 files changed, 42 insertions(+), 2 deletions(-)
 create mode 100755 tools/fix_ca_bundle.sh

diff --git a/.zuul.yaml b/.zuul.yaml
index bd537dca..90a8fe35 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -26,8 +26,6 @@
         s-container: true
         s-object: true
         s-proxy: true
-        # TODO(rosmaita): restore ssl
-        tls-proxy: false
       # Hardcode glanceclient path so the job can be run on glance patches
       zuul_work_dir: src/git.openstack.org/openstack/python-glanceclient
 
diff --git a/tools/fix_ca_bundle.sh b/tools/fix_ca_bundle.sh
new file mode 100755
index 00000000..8e3dba20
--- /dev/null
+++ b/tools/fix_ca_bundle.sh
@@ -0,0 +1,37 @@
+# When the functional tests are run in a devstack environment, we
+# need to make sure that the python-requests module installed by
+# tox in the test environment can find the distro-specific CA store
+# where the devstack certs have been installed.
+#
+# assumptions:
+# - devstack is running
+# - the devstack tls-proxy service is running
+#
+# This code based on a function in devstack lib/tls
+function set_ca_bundle {
+    local python_cmd='.tox/functional/bin/python'
+    local capath=$($python_cmd -c $'try:\n from requests import certs\n print (certs.where())\nexcept ImportError: pass')
+    # of course, each distro keeps the CA store in a different location
+    local fedora_CA='/etc/pki/tls/certs/ca-bundle.crt'
+    local ubuntu_CA='/etc/ssl/certs/ca-certificates.crt'
+    local suse_CA='/etc/ssl/ca-bundle.pem'
+
+    # the distro CA is rooted in /etc, so if ours isn't, we need to
+    # change it
+    if [[ ! $capath == "" && ! $capath =~ ^/etc/.* && ! -L $capath ]]; then
+        if [[ -e $fedora_CA ]]; then
+            rm -f $capath
+            ln -s $fedora_CA $capath
+        elif [[ -e $ubuntu_CA ]]; then
+            rm -f $capath
+            ln -s $ubuntu_CA $capath
+        elif [[ -e $suse_CA ]]; then
+            rm -f $capath
+            ln -s $suse_CA $capath
+        else
+            echo "can't set CA bundle, expect tests to fail"
+        fi
+    fi
+}
+
+set_ca_bundle
diff --git a/tox.ini b/tox.ini
index c28c8c65..066bbc31 100644
--- a/tox.ini
+++ b/tox.ini
@@ -30,6 +30,11 @@ warnerror = True
 # for information on running the functional tests.
 setenv =
   OS_TEST_PATH = ./glanceclient/tests/functional
+whitelist_externals =
+    bash
+commands =
+    bash tools/fix_ca_bundle.sh
+    python setup.py testr --testr-args='{posargs}'
 
 [testenv:cover]
 commands = python setup.py testr --coverage --testr-args='{posargs}'