Rusoto: Directory Service integration tests fail

[matthewkmayer]

Our Directory Service integration tests fail with:

Running target/debug/deps/ds-58b46c26a95f949b

running 2 tests
test should_describe_trusts ... FAILED
test should_describe_directories ... FAILED

failures:

---- should_describe_trusts stdout ----
thread 'should_describe_trusts' panicked at 'called `Result::unwrap()` on an `Err` value: HttpDispatch(HttpDispatchError { message: "error trying to connect: The certificate was not trusted." })', src/libcore/result.rs:1084:5
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace.

---- should_describe_directories stdout ----
thread 'should_describe_directories' panicked at 'called `Result::unwrap()` on an `Err` value: HttpDispatch(HttpDispatchError { message: "error trying to connect: The certificate was not trusted." })', src/libcore/result.rs:1084:5


failures:
    should_describe_directories
    should_describe_trusts

test result: FAILED. 0 passed; 2 failed; 0 ignored; 0 measured; 0 filtered out

error: test failed, to rerun pass '--test ds'

To reproduce:
$ cd integration_tests/
$ cargo test --features ds

This requires an AWS account to test.

[pradovic]

Hi!
It seems that the tests fails only for us-east-1, on OS X. Looks like that the certificate returned by ds.us-east-1.amazonaws.com is a bit special, and the native-tls returns a non-trusted certificate, for this one, on OS X. I have opened an issue: https://github.com/sfackler/rust-native-tls/issues/143.
Seems to be the problem with an underlying Security.framework library, which is making it a bit complicated to fix this on the rusoto layer. Maybe it would make sense to "fix" the tests just by using the different bucket, and open the separate issue about this cert? Here is a PR for dummy fix, if you happen to agree with the idea: https://github.com/rusoto/rusoto/pull/1579.

Cheers!

[matthewkmayer]

Thanks for looking into this! Sounds like switching the region is the easiest thing for us to get the test working again.

I assume if OSX is rejecting the cert we could ask Amazon to publish a cert OSX can consume. 😄 More testing is probably needed on other platforms to verify the cause of this problem.

[pradovic]

No problem. The weird thing is that Golang & Python libs work with this certs, so I am assuming they are using there own implementation.

[iliana]

[puts on her AWS hat]

I’ve sent a few emails internally about that specific certificate. I’ll have a full write up once I give various teams a chance to do their own investigations.

[matthewkmayer]

Thanks for the fix @pradovic !