Merge topic 'test-https-connections' into release-3.26

3350c17451 ci: Enable file(DOWNLOAD) TLS_VERIFY test case in CI jobs
17b47da3d8 Tests: Add test for file(DOWNLOAD) with TLS_VERIFY

Acked-by: Kitware Robot <kwrobot@kitware.com>
Acked-by: buildbot <buildbot@kitware.com>
Merge-request: !8194

.gitlab/ci/configure_debian10_aarch64_ninja.cmake

@@ -74,6 +74,7 @@ set(CMake_TEST_IPO_WORKS_CXX "ON" CACHE BOOL "")
 set(CMake_TEST_IPO_WORKS_Fortran "ON" CACHE BOOL "")
 set(CMake_TEST_JQ "/usr/bin/jq" CACHE PATH "")
 set(CMake_TEST_Qt5 "ON" CACHE BOOL "")
+set(CMake_TEST_TLS_VERIFY_URL "https://gitlab.kitware.com" CACHE STRING "")
 set(CMake_TEST_UseSWIG "ON" CACHE BOOL "")
 
 include("${CMAKE_CURRENT_LIST_DIR}/configure_external_test.cmake")

.gitlab/ci/configure_debian10_ninja.cmake

@@ -80,6 +80,7 @@ set(CMake_TEST_IPO_WORKS_CXX "ON" CACHE BOOL "")
 set(CMake_TEST_IPO_WORKS_Fortran "ON" CACHE BOOL "")
 set(CMake_TEST_JQ "/usr/bin/jq" CACHE PATH "")
 set(CMake_TEST_Qt5 "ON" CACHE BOOL "")
+set(CMake_TEST_TLS_VERIFY_URL "https://gitlab.kitware.com" CACHE STRING "")
 set(CMake_TEST_UseSWIG "ON" CACHE BOOL "")
 
 if (NOT "$ENV{SWIFTC}" STREQUAL "")

.gitlab/ci/configure_fedora37_makefiles.cmake

@@ -80,6 +80,7 @@ if (NOT "$ENV{CMAKE_CI_NIGHTLY}" STREQUAL "")
   set(CMake_TEST_ISPC "ON" CACHE STRING "")
 endif()
 set(CMake_TEST_Qt5 "ON" CACHE BOOL "")
+set(CMake_TEST_TLS_VERIFY_URL "https://gitlab.kitware.com" CACHE STRING "")
 set(CMake_TEST_UseSWIG "ON" CACHE BOOL "")
 
 include("${CMAKE_CURRENT_LIST_DIR}/configure_external_test.cmake")

.gitlab/ci/configure_fedora37_ninja.cmake

@@ -2,6 +2,7 @@ set(CMake_TEST_GUI "ON" CACHE BOOL "")
 if (NOT "$ENV{CMAKE_CI_NIGHTLY}" STREQUAL "")
   set(CMake_TEST_ISPC "ON" CACHE STRING "")
 endif()
+set(CMake_TEST_TLS_VERIFY_URL "https://gitlab.kitware.com" CACHE STRING "")
 
 # "Release" flags without "-DNDEBUG" so we get assertions.
 set(CMAKE_C_FLAGS_RELEASE "-O3" CACHE STRING "")

.gitlab/ci/configure_macos_arm64_ninja.cmake

@@ -2,5 +2,6 @@ set(CMake_TEST_FindOpenMP "ON" CACHE BOOL "")
 set(CMake_TEST_FindOpenMP_C "ON" CACHE BOOL "")
 set(CMake_TEST_FindOpenMP_CXX "ON" CACHE BOOL "")
 set(CMake_TEST_GUI "ON" CACHE BOOL "")
+set(CMake_TEST_TLS_VERIFY_URL "https://gitlab.kitware.com" CACHE STRING "")
 include("${CMAKE_CURRENT_LIST_DIR}/configure_macos_common.cmake")
 include("${CMAKE_CURRENT_LIST_DIR}/configure_common.cmake")

.gitlab/ci/configure_macos_x86_64_makefiles.cmake

@@ -5,6 +5,7 @@ set(CMake_TEST_GUI "ON" CACHE BOOL "")
 if (NOT "$ENV{CMAKE_CI_NIGHTLY}" STREQUAL "")
   set(CMake_TEST_ISPC "ON" CACHE STRING "")
 endif()
+set(CMake_TEST_TLS_VERIFY_URL "https://gitlab.kitware.com" CACHE STRING "")
 
 include("${CMAKE_CURRENT_LIST_DIR}/configure_macos_common.cmake")
 include("${CMAKE_CURRENT_LIST_DIR}/configure_common.cmake")

.gitlab/ci/configure_macos_x86_64_ninja.cmake

@@ -5,6 +5,7 @@ set(CMake_TEST_GUI "ON" CACHE BOOL "")
 if (NOT "$ENV{CMAKE_CI_NIGHTLY}" STREQUAL "")
   set(CMake_TEST_ISPC "ON" CACHE STRING "")
 endif()
+set(CMake_TEST_TLS_VERIFY_URL "https://gitlab.kitware.com" CACHE STRING "")
 
 include("${CMAKE_CURRENT_LIST_DIR}/configure_macos_common.cmake")
 include("${CMAKE_CURRENT_LIST_DIR}/configure_common.cmake")

.gitlab/ci/configure_windows_arm64_vs2022_ninja.cmake

@@ -1,5 +1,6 @@
 # Qt host tools are not yet available natively on windows-arm64.
 set(CMake_TEST_GUI "OFF" CACHE BOOL "")
+set(CMake_TEST_TLS_VERIFY_URL "https://gitlab.kitware.com" CACHE STRING "")
 set(BUILD_QtDialog "OFF" CACHE BOOL "")
 set(CMAKE_PREFIX_PATH "" CACHE STRING "")
 

.gitlab/ci/configure_windows_vs2022_x64_ninja.cmake

@@ -1,6 +1,7 @@
 if (NOT "$ENV{CMAKE_CI_NIGHTLY}" STREQUAL "")
   set(CMake_TEST_ISPC "ON" CACHE STRING "")
 endif()
+set(CMake_TEST_TLS_VERIFY_URL "https://gitlab.kitware.com" CACHE STRING "")
 
 include("${CMAKE_CURRENT_LIST_DIR}/configure_windows_msvc_cxx_modules_common.cmake")
 include("${CMAKE_CURRENT_LIST_DIR}/configure_windows_vs_common_ninja.cmake")

Tests/RunCMake/CMakeLists.txt

@@ -469,7 +469,15 @@ add_RunCMake_test(ctest_fixtures)
 add_RunCMake_test(define_property)
 add_RunCMake_test(file -DCYGWIN=${CYGWIN} -DMSYS=${MSYS})
 add_RunCMake_test(file-CHMOD -DMSYS=${MSYS})
-add_RunCMake_test(file-DOWNLOAD -DCMake_TEST_NO_NETWORK=${CMake_TEST_NO_NETWORK})
+foreach(var
+    CMake_TEST_NO_NETWORK
+    CMake_TEST_TLS_VERIFY_URL
+    )
+  if(DEFINED ${var})
+    list(APPEND file-DOWNLOAD_ARGS -D${var}=${${var}})
+  endif()
+endforeach()
+add_RunCMake_test(file-DOWNLOAD)
 add_RunCMake_test(file-RPATH -DCMAKE_SYSTEM_NAME=${CMAKE_SYSTEM_NAME})
 add_RunCMake_test(find_file)
 add_RunCMake_test(find_library -DCYGWIN=${CYGWIN} -DMSYS=${MSYS})

Tests/RunCMake/file-DOWNLOAD/RunCMakeTest.cmake

@@ -24,3 +24,8 @@ run_cmake(SHOW_PROGRESS)
 if(NOT CMake_TEST_NO_NETWORK)
   run_cmake(bad-hostname)
 endif()
+
+if(CMake_TEST_TLS_VERIFY_URL)
+  run_cmake(TLS_VERIFY-bad)
+  run_cmake_with_options(TLS_VERIFY-good -Durl=${CMake_TEST_TLS_VERIFY_URL})
+endif()

Tests/RunCMake/file-DOWNLOAD/TLS_VERIFY-bad-stdout.txt

@@ -0,0 +1 @@
+-- (60;"SSL peer certificate or SSH remote key was not OK"|35;"SSL connect error")

Tests/RunCMake/file-DOWNLOAD/TLS_VERIFY-bad.cmake

@@ -0,0 +1,6 @@
+file(DOWNLOAD https://expired.badssl.com TLS_VERIFY 1 STATUS status LOG log)
+message(STATUS "${status}")
+list(GET status 0 code)
+if(NOT code MATCHES "^(35|60)$")
+  message("${log}")
+endif()

Tests/RunCMake/file-DOWNLOAD/TLS_VERIFY-good-stdout.txt

@@ -0,0 +1 @@
+-- 0;"No error"

Tests/RunCMake/file-DOWNLOAD/TLS_VERIFY-good.cmake

@@ -0,0 +1,6 @@
+file(DOWNLOAD ${url} TLS_VERIFY 1 STATUS status LOG log)
+message(STATUS "${status}")
+list(GET status 0 code)
+if(NOT code EQUAL 0)
+  message("${log}")
+endif()