On Tue, May 23, 2017 at 1:54 AM, Glyph <glyph@twistedmatrix.com> wrote:

> On May 22, 2017, at 5:38 PM, Jason Litzinger <jlitzingerdev@gmail.com> wrote:
>
>> Thanks for spotting it - please submit a PR to fix it :)
> Copy that, was planning on it, though originally the context was in
> comparison to an existing benchmark.
>
> I assume the process/coding policies match submissions for Twisted
> Proper?  I briefly searched for docs specific to benchmark updates but
> didn't see anything glaring.

It's a bit less formal, but largely similar.  The main difference is that you should just file a Github issue rather than a Trac ticket.

> I'm sure I'll need some guidance as to the best way to do this in a
> fully isolated environment.  For example, the host cert is somewhat
> tricky.  The simplest thing would be to serve up a self-signed cert, but
> I think a realistic benchmark needs to validate a full chain and do
> hostname verification.  Is a PR discussion the best place for these
> questions?

You can keep asking questions here.

The benchmark could use the Cryptography x509 layer to do setup for a custom CA cert, similar to the way many unit tests in Twisted already do...

The cryptography APIs for making certs are pretty straightforward and well documented.  But if another example helps, here's some code that creates a self-signed ca cert and a client cert with an intermediate cert in between:

  https://github.com/LeastAuthority/txkube/blob/faa0374fcef6d089af39a98310f1bd798eb54b08/src/txkube/test/test_authentication.py#L17-L29
  https://github.com/LeastAuthority/txkube/blob/faa0374fcef6d089af39a98310f1bd798eb54b08/src/txkube/test/test_authentication.py#L276-L309

Jean-Paul