localHTTPSServerSuite.TestMustDisableSSLVerify fails in lxc

[Curtis Hovey]

We want to run the unit test suit in lxc because we think we can bring them up quicker on dedicated machines and easilly cleanup after a disaster. The localHTTPSServerSuite.TestMustDisableSSLVerify is the single failure I see when running tests in a trusty container. Can this test be made lxc safe?

FAIL: local_test.go:958: localHTTPSServerSuite.TestMustDisableSSLVerify

Started service at: https://127.0.0.1:44355
Set tools-metadata-url="https://127.0.0.1:44355/v1/1/juju-dist-test/tools"
Set image-metadata-url="https://127.0.0.1:44355/v1/1/juju-dist-test"
[LOG] 0:00.150 INFO juju.provider.openstack opening environment "sample-f150a12c20f4e3c8"
[LOG] 0:00.234 INFO juju.provider.openstack opening environment "sample-f150a12c20f4e3c8"
local_test.go:970:
    c.Assert(err, gc.ErrorMatches, "(.|\n)*x509: certificate signed by unknown authority")
... error string = "" +
... "cannot make Swift control container: failed to create container: juju-test-3d863561f8089564\n" +
... "caused by: authentication failed\n" +
... "caused by: failed executing the request https://127.0.0.1:44355/tokens\n" +
... "caused by: Post https://127.0.0.1:44355/tokens: x509: failed to load system roots and no roots provided"
... regex string = "" +
... "(.|\n" +
... ")*x509: certificate signed by unknown authority"

[LOG] 0:00.295 INFO juju.provider.common destroying environment "sample-f150a12c20f4e3c8"
[LOG] 0:00.298 DEBUG juju.provider.openstack terminating instances []
OOPS: 78 passed, 3 skipped, 1 FAILED
--- FAIL: Test (77.00 seconds)
FAIL
FAIL github.com/juju/juju/provider/openstack 77.356s

[Curtis Hovey (sinzui)]

I may have some insight into this error, possibly a fix in the setup of unit-tests. I had a related bzr error in lxc. The installation of ca-certificates before running make check allowed the test to pass. Then I realised I was testing with a simple trusty lxc instead of the juju-trusty-template container. The latter fails in different ways than the former. But but but we may be close to identifying additional install-build-deps that we tend to have on desktop and server images, but not in cloud images.

[Curtis Hovey (sinzui)]

After several rounds of tests, I can confirm ca-certificates fixes the issue. ca-certificates is required by ubuntu desktop derivatives, but not the cloud-images. The easy fix for this is to add ca-certificates to the Makefile, this will be a no-op for most people.