From 3074fda099d07dcc6f40db7e27cb16ef79a08dfc Mon Sep 17 00:00:00 2001
From: Zack Brady <zackbrady123@gmail.com>
Date: Tue, 11 Aug 2026 14:37:30 -0400
Subject: [PATCH] fixed serve tls int tests and added store copy int tests
 (#731)

---
 .github/workflows/tests.yaml   | 27 ++++++++++++++++++++-------
 testdata/certificate-script.sh |  4 +---
 2 files changed, 21 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index b69f4f6..7c9a682 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -216,7 +216,20 @@ jobs:
       - name: Verify - hauler store copy
         run: |
           hauler store copy --help
-          # need more tests here
+          # verify via registry target
+          hauler store serve registry --port 5002 --readonly=false &
+          until curl -sf http://localhost:5002/v2/_catalog; do : ; done
+          hauler store copy registry://localhost:5002 --plain-http
+          # verify blobs actually landed in the registry backend
+          [ $(find registry -type f | wc -l) -gt 0 ]
+          # verify via --only
+          hauler store copy registry://localhost:5002 --plain-http --only busybox
+          pkill -f "hauler store serve registry --port 5002"
+          rm -rf registry
+          # verify via directory target (files and charts only; images and cosign artifacts are skipped)
+          hauler store copy dir://./store-copy-output
+          test -f ./store-copy-output/hauler-manifest.yaml
+          rm -rf ./store-copy-output
 
       - name: Verify - hauler store extract
         run: |
@@ -354,9 +367,9 @@ jobs:
           until curl -sf http://localhost:5001/v2/_catalog; do : ; done
           pkill -f "hauler store serve registry --port 5001 --readonly"
           # verify via registry with different port with readonly with tls
-          # hauler store serve registry --port 5001 --readonly --tls-cert testdata/certs/server-cert.crt --tls-key testdata/certs/server-cert.key &
-          # until curl -sf --cacert testdata/certs/cacerts.pem https://localhost:5001/v2/_catalog; do : ; done
-          # pkill -f "hauler store serve registry --port 5001 --readonly --tls-cert testdata/certs/server-cert.crt --tls-key testdata/certs/server-cert.key"
+          hauler store serve registry --port 5001 --readonly --tls-cert testdata/certs/server-cert.crt --tls-key testdata/certs/server-cert.key &
+          until curl -sf --cacert testdata/certs/cacerts.pem https://localhost:5001/v2/_catalog; do : ; done
+          pkill -f "hauler store serve registry --port 5001 --readonly --tls-cert testdata/certs/server-cert.crt --tls-key testdata/certs/server-cert.key"
 
       - name: Verify - hauler store serve fileserver
         run: |
@@ -374,9 +387,9 @@ jobs:
           until curl -sf http://localhost:8000; do : ; done
           pkill -f "hauler store serve fileserver --port 8000 --timeout 120"
           # verify via fileserver with different port with timeout and tls
-          # hauler store serve fileserver --port 8000 --timeout 120 --tls-cert testdata/certs/server-cert.crt --tls-key testdata/certs/server-cert.key &
-          # until curl -sf --cacert testdata/certs/cacerts.pem https://localhost:8000; do : ; done
-          # pkill -f "hauler store serve fileserver --port 8000 --timeout 120 --tls-cert testdata/certs/server-cert.crt --tls-key testdata/certs/server-cert.key"
+          hauler store serve fileserver --port 8000 --timeout 120 --tls-cert testdata/certs/server-cert.crt --tls-key testdata/certs/server-cert.key &
+          until curl -sf --cacert testdata/certs/cacerts.pem https://localhost:8000; do : ; done
+          pkill -f "hauler store serve fileserver --port 8000 --timeout 120 --tls-cert testdata/certs/server-cert.crt --tls-key testdata/certs/server-cert.key"
 
       - name: Verify Hauler Store Contents
         run: |
diff --git a/testdata/certificate-script.sh b/testdata/certificate-script.sh
index 9c43e07..2522978 100755
--- a/testdata/certificate-script.sh
+++ b/testdata/certificate-script.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -e
+set -ex
 
 # setup directories
 mkdir -p testdata/certs
@@ -32,7 +32,6 @@ CN = CERTIFICATE AUTHORITY CERTIFICATE
 
 [v3_ca]
 keyUsage = critical, keyCertSign, cRLSign
-extendedKeyUsage = anyExtendedKeyUsage
 basicConstraints = critical, CA:TRUE
 EOF
 
@@ -71,7 +70,6 @@ CN = INTERMEDIARY CERTIFICATE AUTHORITY CERTIFICATE
 
 [v3_ca]
 keyUsage = critical, keyCertSign, cRLSign
-extendedKeyUsage = anyExtendedKeyUsage
 basicConstraints = critical, CA:TRUE
 EOF