Skip to content

Commit dd553bd

Browse files
jinseopkim0jinseopkim0
committed
fix: quickstart env variables
1 parent 8c7fb15 commit dd553bd

File tree

4 files changed

+299
-40
lines changed

4 files changed

+299
-40
lines changed

‎bazel/curl.BUILD‎

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,8 @@ CURL_WIN_COPTS = [
145145
"/DCURL_DISABLE_PROXY",
146146
"/DHAVE_LIBZ",
147147
"/DHAVE_ZLIB_H",
148+
"/DUSE_OPENSSL", # UPDATED: Enable OpenSSL interface
149+
"/DHAVE_BORINGSSL", # UPDATED: Explicitly define BoringSSL
148150
# Defining _USING_V110_SDK71_ is hackery to defeat curl's incorrect
149151
# detection of what OS releases we can build on with VC 2012. This
150152
# may not be needed (or may have to change) if the WINVER setting
@@ -157,8 +159,7 @@ CURL_WIN_SRCS = [
157159
"lib/inet_ntop.c",
158160
"lib/system_win32.c",
159161
"lib/x509asn1.c",
160-
"lib/vtls/schannel.c",
161-
"lib/vtls/schannel_verify.c",
162+
"lib/vtls/openssl.c", # UPDATED: Use OpenSSL/BoringSSL impl
162163
"lib/idn_win32.c",
163164
]
164165

@@ -455,12 +456,8 @@ cc_library(
455456
":define-ca-bundle-location",
456457
"@com_github_cares_cares//:ares",
457458
"@zlib",
458-
] + select({
459-
":windows": [],
460-
"//conditions:default": [
461-
"@boringssl//:ssl",
462-
],
463-
}),
459+
"@boringssl//:ssl", # UPDATED: Always link BoringSSL (even on Windows)
460+
],
464461
)
465462

466463
write_file(
@@ -495,9 +492,15 @@ write_file(
495492
"# define CURL_DISABLE_TELNET 1",
496493
"# define CURL_DISABLE_TFTP 1",
497494
"# define CURL_PULL_WS2TCPIP_H 1",
498-
"# define USE_WINDOWS_SSPI 1",
495+
"# define USE_OPENSSL 1", // UPDATED: Added
496+
"# define HAVE_BORINGSSL 1", // UPDATED: Added
497+
"# define HAVE_LIBSSL 1", // UPDATED: Added
498+
"# define HAVE_OPENSSL_SSL_H 1", // UPDATED: Added
499+
"# define HAVE_OPENSSL_CRYPTO_H 1",// UPDATED: Added
500+
"# define HAVE_OPENSSL_PEM_H 1", // UPDATED: Added
501+
"# define HAVE_OPENSSL_X509_H 1", // UPDATED: Added
502+
"# define HAVE_OPENSSL_ERR_H 1", // UPDATED: Added
499503
"# define USE_WIN32_IDN 1",
500-
"# define USE_SCHANNEL 1",
501504
"# define WANT_IDN_PROTOTYPES 1",
502505
"#elif defined(__APPLE__)",
503506
"# define HAVE_FSETXATTR_6 1",

‎ci/kokoro/windows/builds/bazel.ps1‎

Lines changed: 136 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
# you may not use this file except in compliance with the License.
77
# You may obtain a copy of the License at
88
#
9-
# https://www.apache.org/licenses/LICENSE-2.0
9+
# https://www.apache.org/licenses/LICENSE-2.0
1010
#
1111
# Unless required by applicable law or agreed to in writing, software
1212
# distributed under the License is distributed on an "AS IS" BASIS,
@@ -62,32 +62,151 @@ if ($LastExitCode) {
6262
. ci/kokoro/windows/lib/integration.ps1
6363

6464
function Invoke-REST-Quickstart {
65-
bazelisk $common_flags run $build_flags `
66-
//google/cloud/storage/quickstart:quickstart -- `
67-
"${env:GOOGLE_CLOUD_CPP_STORAGE_TEST_BUCKET_NAME}"
68-
if ($LastExitCode) {
69-
Write-Host -ForegroundColor Red "bazel run (storage/quickstart) failed with exit code ${LastExitCode}."
70-
Exit ${LastExitCode}
65+
param($bazel_bin)
66+
try {
67+
$executable = Join-Path $bazel_bin "google/cloud/storage/quickstart/quickstart.exe"
68+
Write-Host "Running REST Quickstart, attempting to run: $executable"
69+
if (-not (Test-Path $executable)) {
70+
Write-Host -ForegroundColor Red "Executable not found at the specified path."
71+
Exit 1
72+
}
73+
& $executable "${env:GOOGLE_CLOUD_CPP_STORAGE_TEST_BUCKET_NAME}"
74+
if ($LastExitCode) {
75+
Write-Host -ForegroundColor Red "Execution of (storage/quickstart) failed with exit code ${LastExitCode}."
76+
Exit ${LastExitCode}
77+
}
78+
} catch {
79+
Write-Host -ForegroundColor Red "Caught exception while trying to run storage/quickstart: $_"
80+
Exit 1
7181
}
7282
}
7383

7484
function Invoke-gRPC-Quickstart {
75-
bazelisk $common_flags run $build_flags `
76-
//google/cloud/pubsub/quickstart:quickstart -- `
77-
"${env:GOOGLE_CLOUD_PROJECT}" "${env:GOOGLE_CLOUD_CPP_PUBSUB_TEST_QUICKSTART_TOPIC}"
78-
if ($LastExitCode) {
79-
Write-Host -ForegroundColor Red "bazel run (pubsub/quickstart) failed with exit code ${LastExitCode}."
80-
Exit ${LastExitCode}
85+
param($bazel_bin)
86+
try {
87+
$executable = Join-Path $bazel_bin "google/cloud/pubsub/quickstart/quickstart.exe"
88+
Write-Host "Running gRPC Quickstart, attempting to run: $executable"
89+
if (-not (Test-Path $executable)) {
90+
Write-Host -ForegroundColor Red "Executable not found at the specified path."
91+
Exit 1
92+
}
93+
& $executable "${env:GOOGLE_CLOUD_PROJECT}" "${env:GOOGLE_CLOUD_CPP_PUBSUB_TEST_QUICKSTART_TOPIC}"
94+
if ($LastExitCode) {
95+
Write-Host -ForegroundColor Red "Execution of (pubsub/quickstart) failed with exit code ${LastExitCode}."
96+
Exit ${LastExitCode}
97+
}
98+
} catch {
99+
Write-Host -ForegroundColor Red "Caught exception while trying to run pubsub/quickstart: $_"
100+
Exit 1
81101
}
82102
}
83103

84104
if (Test-Integration-Enabled) {
85105
Write-Host "`n$(Get-Date -Format o) Running minimal quickstart prorams"
106+
107+
# 1. Install the certificates
86108
Install-Roots-Pem
87-
${env:GRPC_DEFAULT_SSL_ROOTS_FILE_PATH}="${env:KOKORO_GFILE_DIR}/roots.pem"
88-
${env:GOOGLE_APPLICATION_CREDENTIALS}="${env:KOKORO_GFILE_DIR}/kokoro-run-key.json"
89-
Invoke-REST-Quickstart
90-
Invoke-gRPC-Quickstart
109+
110+
# 2. Normalize paths to use Forward Slashes (/)
111+
# This is critical for C++ binaries (BoringSSL/libcurl) to parse paths correctly on Windows.
112+
$RawRootsPath = Join-Path $env:KOKORO_GFILE_DIR "roots.pem"
113+
$RootsPath = $RawRootsPath -replace '\\', '/'
114+
115+
$RawKeyPath = Join-Path $env:KOKORO_GFILE_DIR "kokoro-run-key.json"
116+
$KeyPath = $RawKeyPath -replace '\\', '/'
117+
118+
# 3. Set ALL SSL Environment Variables
119+
# OpenSSL/BoringSSL may look at SSL_CERT_FILE before CURL_CA_BUNDLE
120+
# Use Forward Slashes ($RootsPath) for BoringSSL
121+
$env:GRPC_DEFAULT_SSL_ROOTS_FILE_PATH = $RootsPath
122+
$env:CURL_CA_BUNDLE = $RootsPath
123+
$env:SSL_CERT_FILE = $RootsPath
124+
$env:GOOGLE_APPLICATION_CREDENTIALS = $KeyPath
125+
126+
# 4. Enable Deep Library Logging
127+
$env:GOOGLE_CLOUD_CPP_ENABLE_TRACING="http"
128+
$env:CURL_VERBOSE="1"
129+
130+
# --- DEBUG CHECKS ---
131+
Write-Host -ForegroundColor Cyan "`n--- DEBUG: Environment & File Check ---"
132+
Write-Host "Roots Path: $RootsPath"
133+
134+
Write-Host "`n[Check 1] Environment Variables:"
135+
Get-ChildItem Env: | Where-Object { $_.Name -match 'CURL_|GOOGLE_|GRPC_|SSL_' } | Format-Table -AutoSize | Out-Host
136+
137+
Write-Host "`n[Check 2] File Verify:"
138+
if (Test-Path $RootsPath) {
139+
Write-Host -ForegroundColor Green "File exists."
140+
Get-Item $RootsPath | Select-Object Length, LastWriteTime
141+
} else {
142+
Write-Host -ForegroundColor Red "CRITICAL: File not found at $RootsPath"
143+
}
144+
Write-Host "--- DEBUG END ---`n"
145+
146+
bazelisk $common_flags build $build_flags `
147+
//google/cloud/storage/quickstart:quickstart `
148+
//google/cloud/pubsub/quickstart:quickstart
149+
150+
$bazel_bin = (bazelisk $common_flags info $build_flags bazel-bin).Trim()
151+
# Fix bazel-bin path for PowerShell invocation just in case
152+
$bazel_bin = $bazel_bin.Replace('/', '\')
153+
Write-Host "bazel-bin directory: $bazel_bin"
154+
155+
# --- VERIFICATION EXPERIMENT START ---
156+
Write-Host -ForegroundColor Cyan "`n--- EXPERIMENT: The 'Strip & Retry' Test ---"
157+
158+
# Define paths
159+
$DirtyFile = $RawRootsPath
160+
$CleanFile = Join-Path $env:KOKORO_GFILE_DIR "roots_clean.pem"
161+
$CleanFileForward = $CleanFile -replace '\\', '/'
162+
163+
# Check for the "Poison" (\r)
164+
$text = [System.IO.File]::ReadAllText($DirtyFile)
165+
if ($text.Contains("`r")) {
166+
Write-Host -ForegroundColor Red "[CONFIRMED] 'roots.pem' contains Carriage Returns (\r)."
167+
Write-Host " Attempting to sanitize and run binary..."
168+
169+
# Create the Antidote (Remove all \r)
170+
$cleanText = $text.Replace("`r", "")
171+
[System.IO.File]::WriteAllText($CleanFile, $cleanText)
172+
Write-Host "Created sanitized file: $CleanFileForward"
173+
174+
# Run the Binary against the CLEAN file
175+
Write-Host "`nRunning quickstart.exe using CLEAN file..."
176+
177+
# Temporarily override the env var just for this test
178+
$env:CURL_CA_BUNDLE = $CleanFileForward
179+
$env:SSL_CERT_FILE = $CleanFileForward
180+
$env:GRPC_DEFAULT_SSL_ROOTS_FILE_PATH = $CleanFileForward
181+
182+
# Construct executable path
183+
$QuickstartExe = Join-Path $bazel_bin "google/cloud/storage/quickstart/quickstart.exe"
184+
185+
try {
186+
& $QuickstartExe "${env:GOOGLE_CLOUD_CPP_STORAGE_TEST_BUCKET_NAME}"
187+
if ($LastExitCode -eq 0) {
188+
Write-Host -ForegroundColor Green "`n[SUCCESS] The binary worked with the clean file!"
189+
Write-Host -ForegroundColor Green "CONCLUSION: Carriage Returns were the root cause."
190+
} else {
191+
Write-Host -ForegroundColor Red "`n[FAILURE] The binary still failed ($LastExitCode) even with the clean file."
192+
Write-Host -ForegroundColor Red "CONCLUSION: The issue is NOT carriage returns."
193+
}
194+
} catch {
195+
Write-Host "Execution failed: $_"
196+
}
197+
198+
# Restore Env Vars for standard test flow
199+
$env:CURL_CA_BUNDLE = $RootsPath
200+
$env:SSL_CERT_FILE = $RootsPath
201+
$env:GRPC_DEFAULT_SSL_ROOTS_FILE_PATH = $RootsPath
202+
} else {
203+
Write-Host -ForegroundColor Green "[INFO] 'roots.pem' is already clean (No \r). Experiment skipped."
204+
}
205+
Write-Host "------------------------------------------------"
206+
# --- VERIFICATION EXPERIMENT END ---
207+
208+
Invoke-REST-Quickstart $bazel_bin
209+
Invoke-gRPC-Quickstart $bazel_bin
91210
}
92211

93212
# Shutdown the Bazel server to release any locks

‎ci/kokoro/windows/lib/integration.ps1‎

Lines changed: 129 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
# you may not use this file except in compliance with the License.
55
# You may obtain a copy of the License at
66
#
7-
# https://www.apache.org/licenses/LICENSE-2.0
7+
# https://www.apache.org/licenses/LICENSE-2.0
88
#
99
# Unless required by applicable law or agreed to in writing, software
1010
# distributed under the License is distributed on an "AS IS" BASIS,
@@ -14,29 +14,149 @@
1414

1515
# Helper functions to run the minimal integration tests
1616

17-
$PROJECT_ROOT = (Get-Item -Path ".\" -Verbose).FullName
17+
$PROJECT_ROOT = (Get-Item -Path ".\").FullName
1818
$integration_tests_config="${PROJECT_ROOT}/ci/etc/integration-tests-config.ps1"
1919
. "${integration_tests_config}"
2020

2121
function Test-Integration-Enabled {
2222
if ((Test-Path env:KOKORO_GFILE_DIR) -and
2323
(Test-Path "${env:KOKORO_GFILE_DIR}/kokoro-run-key.json")) {
24-
return $True
24+
return $True
2525
}
2626
return $False
2727
}
2828

29+
function Debug-Network {
30+
param([string]$targetUrl)
31+
Write-Host -ForegroundColor Cyan "`n--- NETWORK DEBUG START ($targetUrl) ---"
32+
try {
33+
$uri = New-Object System.Uri($targetUrl)
34+
$hostName = $uri.DnsSafeHost
35+
36+
# 1. DNS Resolution
37+
Write-Host "1. Testing DNS resolution for $hostName..."
38+
$dns = Resolve-DnsName -Name $hostName -ErrorAction SilentlyContinue
39+
if ($dns) { $dns | Format-Table -AutoSize | Out-Host } else { Write-Host -ForegroundColor Red "DNS Resolution FAILED" }
40+
41+
# 2. Basic TCP Connectivity (checking port 443)
42+
Write-Host "`n2. Testing TCP connectivity to $hostName`:443..."
43+
try {
44+
$tcp = Test-NetConnection -ComputerName $hostName -Port 443 -WarningAction SilentlyContinue
45+
if ($tcp.TcpTestSucceeded) { Write-Host "TCP connection SUCCEEDED" } else { Write-Host -ForegroundColor Red "TCP connection FAILED" }
46+
Write-Host "Detailed Info: $($tcp | Out-String)"
47+
} catch {
48+
Write-Host -ForegroundColor Red "Test-NetConnection failed to run: $_"
49+
}
50+
51+
# 3. Proxy Detection
52+
Write-Host "`n3. Checking System Proxy for $targetUrl..."
53+
$proxy = [System.Net.WebRequest]::GetSystemWebProxy()
54+
$proxyUri = $proxy.GetProxy($uri)
55+
Write-Host "Effective Proxy: $proxyUri"
56+
Write-Host "Is Bypassed: $($proxy.IsBypassed($uri))"
57+
58+
} catch {
59+
Write-Host -ForegroundColor Red "An error occurred during network debug: $_"
60+
}
61+
Write-Host -ForegroundColor Cyan "--- NETWORK DEBUG END ---`n"
62+
}
63+
2964
function Install-Roots-Pem {
30-
Write-Host -ForegroundColor Yellow "`n$(Get-Date -Format o) " `
31-
"Downloading roots.pem [$_]"
65+
Debug-Network -targetUrl "https://curl.se/ca/cacert.pem"
66+
$RootsPath = "${env:KOKORO_GFILE_DIR}/roots.pem"
67+
3268
ForEach($attempt in (1, 2, 3)) {
69+
Write-Host -ForegroundColor Yellow "`n$(Get-Date -Format o) " `
70+
"Downloading roots.pem [$attempt]"
3371
try {
34-
(New-Object System.Net.WebClient).Downloadfile(
35-
'https://pki.google.com/roots.pem',
36-
"${env:KOKORO_GFILE_DIR}/roots.pem")
72+
# 1. Download the Mozilla Bundle to memory string
73+
# We avoid saving to disk immediately to prevent PowerShell from adding CRLF
74+
$WebClient = New-Object System.Net.WebClient
75+
$MozillaCerts = $WebClient.DownloadString('https://curl.se/ca/cacert.pem')
76+
77+
# 2. Gather Windows System Certificates
78+
# We check both 'Root' (Trusted Root CAs) and 'CA' (Intermediate CAs)
79+
# as corporate proxies often sign with an Intermediate.
80+
Write-Host "Gathering Windows System Root Certificates..."
81+
$WindowsCerts = ""
82+
$storesToCheck = @("Root", "CA")
83+
84+
foreach ($storeName in $storesToCheck) {
85+
Write-Host -ForegroundColor Cyan "Processing Store: LocalMachine\$storeName"
86+
$certStore = New-Object System.Security.Cryptography.X509Certificates.X509Store -ArgumentList $storeName, "LocalMachine"
87+
$certStore.Open('ReadOnly')
88+
89+
$certStore.Certificates | ForEach-Object {
90+
$cert = $_
91+
Write-Host " Adding: $($cert.Subject)"
92+
93+
# Export to Base64
94+
$b64 = [Convert]::ToBase64String($cert.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Cert), 'InsertLineBreaks')
95+
96+
# Construct PEM with explicit Unix Newlines (\n)
97+
$header = "-----BEGIN CERTIFICATE-----"
98+
$footer = "-----END CERTIFICATE-----"
99+
$WindowsCerts += "$header`n$b64`n$footer`n"
100+
}
101+
$certStore.Close()
102+
}
103+
104+
# 3. Write Combined File with Strict UNIX Line Endings (\n)
105+
# We use .NET IO classes to bypass PowerShell's default CRLF behavior.
106+
Write-Host "Writing combined roots.pem with Unix LF line endings..."
107+
$FinalContent = $MozillaCerts + "`n" + $WindowsCerts
108+
109+
# Normalize: Replace any Windows \r\n with Unix \n
110+
# This is the CRITICAL FIX for BoringSSL/gRPC which can choke on Carriage Returns (\r)
111+
$FinalContent = $FinalContent -replace "`r`n", "`n"
112+
113+
[System.IO.File]::WriteAllText($RootsPath, $FinalContent, [System.Text.Encoding]::ASCII)
114+
115+
# --- DEBUG START ---
116+
Write-Host -ForegroundColor Cyan "`nDEBUG: Inspecting roots.pem..."
117+
118+
# Check for Seams/Corruption
119+
$corruption = Select-String -Path $RootsPath -Pattern "-----END CERTIFICATE----------BEGIN CERTIFICATE-----"
120+
if ($corruption) {
121+
Write-Host -ForegroundColor Red "FAIL: Found corrupted certificate boundaries!"
122+
} else {
123+
Write-Host -ForegroundColor Green "PASS: No certificate boundary corruption detected."
124+
}
125+
126+
# Check for Carriage Returns (The "BoringSSL Killer")
127+
if ($FinalContent.Contains("`r")) {
128+
Write-Host -ForegroundColor Red "FAIL: File still contains Carriage Returns (\r)!"
129+
} else {
130+
Write-Host -ForegroundColor Green "PASS: File contains strict Unix Line Feeds (\n)."
131+
}
132+
133+
Write-Host -ForegroundColor Cyan "`nDEBUG: Testing SSL connection to GCS..."
134+
135+
# Relax ErrorActionPreference so curl -v stderr doesn't crash the script
136+
$OldEAP = $ErrorActionPreference
137+
$ErrorActionPreference = "Continue"
138+
139+
try {
140+
& curl.exe --version
141+
& curl.exe -v https://storage.googleapis.com --cacert $RootsPath 2>&1 | Out-Host
142+
if ($LastExitCode -ne 0) {
143+
Write-Host -ForegroundColor Red "Curl exited with error code: $LastExitCode"
144+
} else {
145+
Write-Host -ForegroundColor Green "Curl connection test PASSED."
146+
}
147+
} catch {
148+
Write-Host -ForegroundColor Red "Debug curl command failed unexpectedly: $_"
149+
} finally {
150+
$ErrorActionPreference = $OldEAP
151+
}
152+
# --- DEBUG END ---
153+
37154
return
38155
} catch {
39-
Write-Host -ForegroundColor Yellow "`n$(Get-Date -Format o) download error"
156+
Write-Host -ForegroundColor Yellow "`n$(Get-Date -Format o) download/setup error: $_"
157+
if ($attempt -eq 3) {
158+
Debug-Network -targetUrl "https://storage.googleapis.com"
159+
}
40160
}
41161
Start-Sleep -Seconds (60 * $attempt)
42162
}

0 commit comments

Comments
 (0)