From 2215098295b5f946cc1a0634ed71706bee016f60 Mon Sep 17 00:00:00 2001 From: Stephen Hosom Date: Thu, 3 Sep 2026 14:10:28 -0400 Subject: [PATCH 1/5] Fix acceptance LDAP image pin The osixia/openldap:1.2.2 tag has been removed from Docker Hub, causing every acceptance matrix job to fail before tests start. Use the compatible, still-published 1.2.5 release from the same image series. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4f94e01c-1269-46f3-bae7-353dfb70afb1 --- spec/acceptance/docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spec/acceptance/docker-compose.yml b/spec/acceptance/docker-compose.yml index edfd915..b04f150 100644 --- a/spec/acceptance/docker-compose.yml +++ b/spec/acceptance/docker-compose.yml @@ -30,7 +30,7 @@ services: - "${DIR}/spec/acceptance/git-server/keys:/git-server/keys:ro" ldap-server: entrypoint: /acceptance/ldap-server/run-server.sh - image: osixia/openldap:1.2.2 + image: osixia/openldap:1.2.5 networks: ldap-network: aliases: From d2b24fe7e333f4886eacfd1d090b9052e2986974 Mon Sep 17 00:00:00 2001 From: Stephen Hosom Date: Thu, 3 Sep 2026 14:14:16 -0400 Subject: [PATCH 2/5] Adapt LDAP fixture to newer image Preserve the packaged schema sources needed during image bootstrap and configure the DH parameter filename introduced after 1.2.2. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4f94e01c-1269-46f3-bae7-353dfb70afb1 --- spec/acceptance/ldap-server/env/default.startup.yaml | 1 + spec/acceptance/ldap-server/run-server.sh | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/spec/acceptance/ldap-server/env/default.startup.yaml b/spec/acceptance/ldap-server/env/default.startup.yaml index ace4399..8458069 100644 --- a/spec/acceptance/ldap-server/env/default.startup.yaml +++ b/spec/acceptance/ldap-server/env/default.startup.yaml @@ -28,6 +28,7 @@ LDAP_TLS: true LDAP_TLS_CRT_FILENAME: ldap.crt LDAP_TLS_KEY_FILENAME: ldap.key LDAP_TLS_CA_CRT_FILENAME: ca.crt +LDAP_TLS_DH_PARAM_FILENAME: dhparam.pem LDAP_TLS_ENFORCE: true LDAP_TLS_CIPHER_SUITE: SECURE256:+SECURE128:-VERS-TLS-ALL:+VERS-TLS1.2:-RSA:-DHE-DSS:-CAMELLIA-128-CBC:-CAMELLIA-256-CBC diff --git a/spec/acceptance/ldap-server/run-server.sh b/spec/acceptance/ldap-server/run-server.sh index 7ededa9..05e759e 100755 --- a/spec/acceptance/ldap-server/run-server.sh +++ b/spec/acceptance/ldap-server/run-server.sh @@ -44,7 +44,7 @@ cp /acceptance/ldap-server/env/*.yaml /container/environment/99-default # Pre-install our schema (after killing most of the defaults from the container) rm -f /container/service/slapd/assets/config/bootstrap/ldif/0[345]*.ldif rm -rf /container/service/slapd/assets/config/bootstrap/schema/mmc -rm -f /etc/ldap/schema/* +rm -f /etc/ldap/schema/*.ldif cp /acceptance/ldap-server/schema/* /etc/ldap/schema/ cp /acceptance/ldap-server/ldif/bootstrap/*.ldif /container/service/slapd/assets/config/bootstrap/ldif From 1ad714ce6c14739ec207cc60440e40ca93922efe Mon Sep 17 00:00:00 2001 From: Stephen Hosom Date: Thu, 3 Sep 2026 14:17:30 -0400 Subject: [PATCH 3/5] Log LDAP bootstrap details Temporarily expose the image bootstrap diagnostics needed to identify the TLS configuration rejected by the replacement image. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4f94e01c-1269-46f3-bae7-353dfb70afb1 --- spec/acceptance/ldap-server/run-server.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spec/acceptance/ldap-server/run-server.sh b/spec/acceptance/ldap-server/run-server.sh index 05e759e..094e5b2 100755 --- a/spec/acceptance/ldap-server/run-server.sh +++ b/spec/acceptance/ldap-server/run-server.sh @@ -49,7 +49,7 @@ cp /acceptance/ldap-server/schema/* /etc/ldap/schema/ cp /acceptance/ldap-server/ldif/bootstrap/*.ldif /container/service/slapd/assets/config/bootstrap/ldif # Launch openldap -nohup /usr/bin/python -u /container/tool/run -l info & +nohup /usr/bin/python -u /container/tool/run -l debug & OPENLDAP_PID=$! # Wait for the process to be running and connectable From 4758748049cbd2f55369fbd0ed034c340520dc5e Mon Sep 17 00:00:00 2001 From: Stephen Hosom Date: Thu, 3 Sep 2026 14:23:07 -0400 Subject: [PATCH 4/5] Use closest available OpenLDAP image The 1.2.5 build rejects the existing TLS fixture during bootstrap. Pin 1.2.4, the nearest available release to the removed 1.2.2 image, and restore normal LDAP logging. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4f94e01c-1269-46f3-bae7-353dfb70afb1 --- spec/acceptance/docker-compose.yml | 2 +- spec/acceptance/ldap-server/run-server.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/spec/acceptance/docker-compose.yml b/spec/acceptance/docker-compose.yml index b04f150..fe5e785 100644 --- a/spec/acceptance/docker-compose.yml +++ b/spec/acceptance/docker-compose.yml @@ -30,7 +30,7 @@ services: - "${DIR}/spec/acceptance/git-server/keys:/git-server/keys:ro" ldap-server: entrypoint: /acceptance/ldap-server/run-server.sh - image: osixia/openldap:1.2.5 + image: osixia/openldap:1.2.4 networks: ldap-network: aliases: diff --git a/spec/acceptance/ldap-server/run-server.sh b/spec/acceptance/ldap-server/run-server.sh index 094e5b2..05e759e 100755 --- a/spec/acceptance/ldap-server/run-server.sh +++ b/spec/acceptance/ldap-server/run-server.sh @@ -49,7 +49,7 @@ cp /acceptance/ldap-server/schema/* /etc/ldap/schema/ cp /acceptance/ldap-server/ldif/bootstrap/*.ldif /container/service/slapd/assets/config/bootstrap/ldif # Launch openldap -nohup /usr/bin/python -u /container/tool/run -l debug & +nohup /usr/bin/python -u /container/tool/run -l info & OPENLDAP_PID=$! # Wait for the process to be running and connectable From f4a492b580eda355c94b2ef4ffb920155fc8ec7a Mon Sep 17 00:00:00 2001 From: Stephen Hosom Date: Thu, 3 Sep 2026 15:07:04 -0400 Subject: [PATCH 5/5] Keep existing schema cleanup behavior The newer image emits a non-fatal schema conversion warning when the packaged schema sources are removed, matching the existing fixture behavior. Limit the compatibility fix to the required image and DH filename changes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4f94e01c-1269-46f3-bae7-353dfb70afb1 --- spec/acceptance/ldap-server/run-server.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spec/acceptance/ldap-server/run-server.sh b/spec/acceptance/ldap-server/run-server.sh index 05e759e..7ededa9 100755 --- a/spec/acceptance/ldap-server/run-server.sh +++ b/spec/acceptance/ldap-server/run-server.sh @@ -44,7 +44,7 @@ cp /acceptance/ldap-server/env/*.yaml /container/environment/99-default # Pre-install our schema (after killing most of the defaults from the container) rm -f /container/service/slapd/assets/config/bootstrap/ldif/0[345]*.ldif rm -rf /container/service/slapd/assets/config/bootstrap/schema/mmc -rm -f /etc/ldap/schema/*.ldif +rm -f /etc/ldap/schema/* cp /acceptance/ldap-server/schema/* /etc/ldap/schema/ cp /acceptance/ldap-server/ldif/bootstrap/*.ldif /container/service/slapd/assets/config/bootstrap/ldif