From afb0eb6aa71019fab921f024935c39ec5eb269b7 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 3 Jul 2026 15:48:13 +0000 Subject: [PATCH 1/3] ci: add release workflow and v1.0.0 release notes Add a manually-dispatched GitHub Actions workflow that creates a GitHub release from a notes file under .github/release-notes/, and add the release notes for v1.0.0. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_0126cb3H46h57uDx2NmeV6b2 --- .github/release-notes/v1.0.0.md | 32 ++++++++++++++++++++++++++++ .github/workflows/release.yml | 37 +++++++++++++++++++++++++++++++++ 2 files changed, 69 insertions(+) create mode 100644 .github/release-notes/v1.0.0.md create mode 100644 .github/workflows/release.yml diff --git a/.github/release-notes/v1.0.0.md b/.github/release-notes/v1.0.0.md new file mode 100644 index 0000000..cd5200a --- /dev/null +++ b/.github/release-notes/v1.0.0.md @@ -0,0 +1,32 @@ +# OCSP Server Test Suite v1.0.0 + +First release of the OCSP Server Test Suite — a comprehensive testing application for OCSP (Online Certificate Status Protocol) servers with both GUI and monitoring capabilities. The tool runs structured tests against OCSP servers and provides detailed reporting with exportable results. + +## Highlights + +- **Comprehensive OCSP testing** — protocol compliance, security, performance, and status validation +- **GUI application** — user-friendly Tkinter interface with real-time monitoring and a dedicated monitoring tab +- **OCSP by serial number or certificate** — query servers using either a certificate file (PEM/DER) or a raw serial number +- **Multi-step OCSP signer validation** — 3-step validation process with automatic trust chain building for OCSP signature verification +- **Federal PKI support** — automatic detection of federal PKI environments, batch OCSP responses (DHS CA4, DoD), and enhanced DHS CA4 signature verification handling +- **CRL monitoring** — Certificate Revocation List retrieval and validation, including large CRL processing +- **Complex OCSP requests** — IKEv2 in-band OCSP, signed client requests, nonce handling, cryptographic preference tests, and non-issued certificate tests +- **Configuration management** — persistent settings via `ocsp_config.json`, with save-config support +- **Export capabilities** — results exportable in JSON and CSV formats + +## Installation + +See the [README](https://github.com/jgoodloe/OCSPTesting/blob/main/README.md) for full setup instructions on Windows, Linux, and macOS. On Windows, the Quick Setup Guide uses [Scoop](https://scoop.sh) for Git/OpenSSL and the Microsoft Store for Python — no Git required if you download the project ZIP. + +**Requirements:** Python 3.10+ (with tkinter), OpenSSL CLI, and the pinned Python dependencies in `requirements.txt` (`cryptography`, `requests`, `asn1crypto`). + +```bash +python -m venv venv +source venv/bin/activate # Windows: venv\Scripts\activate +pip install -r requirements.txt +python app.py +``` + +## Changelog + +See [CHANGELOG.md](https://github.com/jgoodloe/OCSPTesting/blob/main/CHANGELOG.md) for notable changes, including the reworked Windows install instructions. diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000..07c8e1b --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,37 @@ +name: Create Release + +on: + workflow_dispatch: + inputs: + tag: + description: "Tag to create the release under (e.g. v1.0.0)" + required: true + default: "v1.0.0" + target: + description: "Branch or commit SHA the tag should point to" + required: true + default: "main" + +permissions: + contents: write + +jobs: + release: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: Create GitHub release + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + notes_file=".github/release-notes/${{ inputs.tag }}.md" + if [ ! -f "$notes_file" ]; then + echo "Release notes file $notes_file not found" >&2 + exit 1 + fi + gh release create "${{ inputs.tag }}" \ + --repo "${{ github.repository }}" \ + --target "${{ inputs.target }}" \ + --title "OCSP Server Test Suite ${{ inputs.tag }}" \ + --notes-file "$notes_file" From 23c0cfd2d84743506526560c2d5ef2b57e592631 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 3 Jul 2026 15:49:05 +0000 Subject: [PATCH 2/3] ci: trigger release workflow on tag push workflow_dispatch requires the workflow to exist on the default branch, so trigger on v* tag pushes instead; the workflow runs from the tagged commit. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_0126cb3H46h57uDx2NmeV6b2 --- .github/workflows/release.yml | 24 +++++++++--------------- 1 file changed, 9 insertions(+), 15 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 07c8e1b..2568990 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,16 +1,9 @@ name: Create Release on: - workflow_dispatch: - inputs: - tag: - description: "Tag to create the release under (e.g. v1.0.0)" - required: true - default: "v1.0.0" - target: - description: "Branch or commit SHA the tag should point to" - required: true - default: "main" + push: + tags: + - "v*" permissions: contents: write @@ -25,13 +18,14 @@ jobs: env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | - notes_file=".github/release-notes/${{ inputs.tag }}.md" + tag="${{ github.ref_name }}" + notes_file=".github/release-notes/${tag}.md" if [ ! -f "$notes_file" ]; then echo "Release notes file $notes_file not found" >&2 exit 1 fi - gh release create "${{ inputs.tag }}" \ + gh release create "$tag" \ --repo "${{ github.repository }}" \ - --target "${{ inputs.target }}" \ - --title "OCSP Server Test Suite ${{ inputs.tag }}" \ - --notes-file "$notes_file" + --title "OCSP Server Test Suite $tag" \ + --notes-file "$notes_file" \ + --verify-tag From cb70fe24460cd0cfa48245898e14b990f2090203 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 3 Jul 2026 15:50:25 +0000 Subject: [PATCH 3/3] ci: release on release/v* branch creation and workflow_dispatch Tags cannot be pushed from this environment and workflow_dispatch only resolves workflows on the default branch, so also trigger the release when a release/v* branch is created. The job is idempotent: it exits early if the release already exists. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_0126cb3H46h57uDx2NmeV6b2 --- .github/workflows/release.yml | 39 ++++++++++++++++++++++++++++++++--- 1 file changed, 36 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2568990..ed1aa26 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,15 +1,28 @@ name: Create Release on: + create: push: + branches: + - "release/v*" tags: - "v*" + workflow_dispatch: + inputs: + tag: + description: "Tag to create the release under (e.g. v1.0.0)" + required: true + default: "v1.0.0" permissions: contents: write jobs: release: + if: >- + startsWith(github.ref, 'refs/tags/v') || + startsWith(github.ref, 'refs/heads/release/v') || + github.event_name == 'workflow_dispatch' runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 @@ -18,14 +31,34 @@ jobs: env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | - tag="${{ github.ref_name }}" + case "$GITHUB_REF" in + refs/tags/*) + tag="${GITHUB_REF#refs/tags/}" + extra_args=(--verify-tag) + ;; + refs/heads/release/*) + tag="${GITHUB_REF#refs/heads/release/}" + extra_args=(--target "$GITHUB_SHA") + ;; + *) + tag="${{ inputs.tag }}" + extra_args=(--target "$GITHUB_SHA") + ;; + esac + + if gh release view "$tag" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then + echo "Release $tag already exists; nothing to do." + exit 0 + fi + notes_file=".github/release-notes/${tag}.md" if [ ! -f "$notes_file" ]; then echo "Release notes file $notes_file not found" >&2 exit 1 fi + gh release create "$tag" \ - --repo "${{ github.repository }}" \ + --repo "$GITHUB_REPOSITORY" \ --title "OCSP Server Test Suite $tag" \ --notes-file "$notes_file" \ - --verify-tag + "${extra_args[@]}"