PHPC-2164: Refactor run-ocsp-responder.sh to use activate-ocspvenv.sh

.evergreen/config.yml

@@ -377,9 +377,13 @@ functions:
   "run OCSP responder":
     - command: shell.exec
       params:
+        shell: bash
         script: |
           ${PREPARE_SHELL}
-          TEST_COLUMN=${TEST_COLUMN} CERT_TYPE=${CERT_TYPE} USE_DELEGATE=${USE_DELEGATE} sh ${PROJECT_DIRECTORY}/.evergreen/run-ocsp-responder.sh
+          TEST_COLUMN=${TEST_COLUMN} \
+          CERT_TYPE=${CERT_TYPE} \
+          USE_DELEGATE=${USE_DELEGATE} \
+          ${PROJECT_DIRECTORY}/.evergreen/run-ocsp-responder.sh
 
   "run tests":
     - command: shell.exec

.evergreen/run-ocsp-responder.sh

@@ -1,98 +1,87 @@
-#! /bin/bash
-# Run an OCSP mock responder server if necessary.
-#
-# See the tests described in the specification for more info:
-# https://github.com/mongodb/specifications/tree/master/source/ocsp-support/tests#integration-tests-permutations-to-be-tested.
-# Precondition: mongod is NOT running. The responder should be started first.
+#!/usr/bin/env bash
+set -o errexit
+
+# Run an mock OCSP responder server if necessary. This script should be invoked
+# before starting any MongoDB servers.
 #
 # Environment variables:
 #
 # TEST_COLUMN
-#   Required. Corresponds to a column of the test matrix. Set to one of the following:
-#   TEST_1, TEST_2, TEST_3, TEST_4, SOFT_FAIL_TEST, MALICIOUS_SERVER_TEST_1, MALICIOUS_SERVER_TEST_2
+#   Required. Corresponds to a column of the test matrix. Set to one of the
+#   following: "TEST_1", "TEST_2", "TEST_3", "TEST_4", "SOFT_FAIL_TEST",
+#   "MALICIOUS_SERVER_TEST_1", or "MALICIOUS_SERVER_TEST_2".
+#
+#   See: https://github.com/mongodb/specifications/blob/master/source/ocsp-support/tests/README.rst#integration-tests-permutations-to-be-tested
+#
 # CERT_TYPE
-#   Required. Set to either rsa or ecdsa.
+#   Required. Set to either "rsa" or "ecdsa".
+#
 # USE_DELEGATE
-#   Optional. May be ON or OFF. If a test requires use of a responder, this decides whether
-#   the responder uses a delegate certificate. Defaults to "OFF"
-# SKIP_PIP_INSTALL
-#   Optional. Skip pip install for required packages for mock responder.
+#   Optional. May be "ON" or "OFF". If a test requires use of a responder, this
+#   determines whether responder uses a delegate certificate. Defaults to "OFF".
 #
-# Example:
-# TEST_COLUMN=TEST_1 CERT_TYPE=rsa ./run-ocsp-test.sh
+# DRIVERS_TOOLS
+#   Required. Path to clone of drivers-evergreen-tools repository.
 #
-
-# Fail on any command returning a non-zero exit status.
-set -o errexit
+# PROJECT_DIRECTORY
+#   Required. If a test requires use a responder, its output will be logged to a
+#   ocsp-responder.log file in this directory.
 
 USE_DELEGATE=${USE_DELEGATE:-OFF}
 
-if [ -z "$TEST_COLUMN" -o -z "$CERT_TYPE" ]; then
-    echo "Required environment variable unset. See file comments for help."
-    exit 1;
+if [ -z "${CERT_TYPE}" ] || [ -z "${TEST_COLUMN}" ]; then
+    echo "CERT_TYPE and TEST_COLUMN are required."
+    exit 1
 fi
-echo "TEST_COLUMN=$TEST_COLUMN"
-echo "CERT_TYPE=$CERT_TYPE"
-echo "USE_DELEGATE=$USE_DELEGATE"
-echo "SKIP_PIP_INSTALL=$SKIP_PIP_INSTALL"
 
-OS=$(uname -s | tr '[:upper:]' '[:lower:]')
-case "$OS" in
-    cygwin*) OS="WINDOWS" ;;
-    darwin) OS="MACOS" ;;
-    *) OS="LINUX" ;;
+if [ "${CERT_TYPE}" != "rsa" ] && [ "${CERT_TYPE}" != "ecdsa" ]; then
+    echo "Unsupported value for CERT_TYPE: ${CERT_TYPE}"
+    exit 1
+fi
+
+case "${TEST_COLUMN}" in
+    "TEST_1" | "TEST_3")
+        RESPONDER="valid"
+        ;;
+
+    "TEST_2" | "TEST_4" | "MALICIOUS_SERVER_TEST_1")
+        RESPONDER="invalid"
+        ;;
+
+    "SOFT_FAIL_TEST" | "MALICIOUS_SERVER_TEST_2")
+        RESPONDER=""
+        ;;
+
+    *)
+        echo "Unsupported value for TEST_COLUMN: ${TEST_COLUMN}"
+        exit 1
+        ;;
 esac
 
-if [ "TEST_1" = "$TEST_COLUMN" ]; then
-    RESPONDER_REQUIRED="valid"
-elif [ "TEST_2" = "$TEST_COLUMN" ]; then
-    RESPONDER_REQUIRED="invalid"
-elif [ "TEST_3" = "$TEST_COLUMN" ]; then
-    RESPONDER_REQUIRED="valid"
-elif [ "TEST_4" = "$TEST_COLUMN" ]; then
-    RESPONDER_REQUIRED="invalid"
-elif [ "MALICIOUS_SERVER_TEST_1" = "$TEST_COLUMN" ]; then
-    RESPONDER_REQUIRED="invalid"
-else
-    RESPONDER_REQUIRED=""
-fi
+echo "TEST_COLUMN: ${TEST_COLUMN}"
+echo "CERT_TYPE: ${CERT_TYPE}"
+echo "USE_DELEGATE: ${USE_DELEGATE}"
 
-# Same responder is used for both server and client. So even stapling tests require a responder.
+if [ -n "$RESPONDER" ]; then
+    echo "Starting mock OCSP responder"
 
-if [ -n "$RESPONDER_REQUIRED" ]; then
-    echo "Starting mock responder"
-    if [ -z "$SKIP_PIP_INSTALL" ]; then
-        echo "Installing python dependencies"
-        # Installing dependencies.
-        if [ "$OS" = "WINDOWS" ]; then
-            /cygdrive/c/python/Python36/python --version
-            /cygdrive/c/python/Python36/python -m virtualenv venv_ocsp
-            PYTHON="$(pwd)/venv_ocsp/Scripts/python"
-        else
-            /opt/mongodbtoolchain/v3/bin/python3 -m venv ./venv_ocsp
-            PYTHON="$(pwd)/venv_ocsp/bin/python"
-        fi
+    cd ${DRIVERS_TOOLS}/.evergreen/ocsp
+    . ./activate-ocspvenv.sh
 
-        REQUIREMENTS="requirements.txt"
-        if [ ! -f "$REQUIREMENTS" ]; then
-           curl https://raw.githubusercontent.com/mongodb-labs/drivers-evergreen-tools/master/.evergreen/ocsp/mock-ocsp-responder-requirements.txt -o $REQUIREMENTS
-        fi
-        $PYTHON -m pip install -r $REQUIREMENTS
-    fi
-    cd "${DRIVERS_TOOLS}/.evergreen/ocsp/$CERT_TYPE"
-    if [ "$RESPONDER_REQUIRED" = "invalid" ]; then
+    if [ "${RESPONDER}" = "invalid" ]; then
         FAULT="--fault revoked"
     fi
-    if [ "ON" = "$USE_DELEGATE" ]; then
-        RESPONDER_SIGNER="ocsp-responder"
+
+    if [ "$USE_DELEGATE" = "ON" ]; then
+        SIGNER="ocsp-responder"
     else
-        RESPONDER_SIGNER="ca"
+        SIGNER="ca"
     fi
-    $PYTHON ../ocsp_mock.py \
-        --ca_file ca.pem \
-        --ocsp_responder_cert $RESPONDER_SIGNER.crt \
-        --ocsp_responder_key $RESPONDER_SIGNER.key \
+
+    python ocsp_mock.py \
+        --ca_file ${CERT_TYPE}/ca.pem \
+        --ocsp_responder_cert ${CERT_TYPE}/${SIGNER}.crt \
+        --ocsp_responder_key ${CERT_TYPE}/${SIGNER}.key \
         -p 8100 -v $FAULT \
-        > ${PROJECT_DIRECTORY}/responder.log 2>&1 &
-    cd -
+        > ${PROJECT_DIRECTORY}/ocsp-responder.log 2>&1 &
 fi