name: Tools Tests

on: [push, pull_request]

jobs:
  init:
    name: Initializing workflow
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.init.outputs.matrix }}
      repo: ${{ steps.init.outputs.repo }}
    steps:
      - name: Clone repository
        uses: actions/checkout@v2

      - name: Initialize workflow
        id: init
        env:
          BASE64_MATRIX: ${{ secrets.BASE64_MATRIX }}
          BASE64_REPO: ${{ secrets.BASE64_REPO }}
        run: |
          tests/bin/init-workflow.sh

  # docs/development/Building_PKI.md
  build:
    name: Building PKI
    needs: init
    runs-on: ubuntu-latest
    container: registry.fedoraproject.org/fedora:${{ matrix.os }}
    strategy:
      matrix: ${{ fromJSON(needs.init.outputs.matrix) }}
    steps:
      - name: Install git
        run: dnf install -y git

      - name: Clone repository
        uses: actions/checkout@v2

      - name: Install dependencies
        run: |
          dnf install -y dnf-plugins-core rpm-build
          dnf copr enable -y ${{ needs.init.outputs.repo }}
          dnf builddep -y --allowerasing --spec ./pki.spec --nogpgcheck

      - name: Build PKI packages
        run: ./build.sh --with-pkgs=base,server --with-timestamp --with-commit-id --work-dir=build rpm

      - name: Upload PKI packages
        uses: actions/upload-artifact@v2
        with:
          name: pki-build-${{ matrix.os }}
          path: build/RPMS/

  PKICertImport-test:
    name: Testing PKICertImport
    needs: [init, build]
    runs-on: ubuntu-latest
    container: registry.fedoraproject.org/fedora:${{ matrix.os }}
    strategy:
      matrix: ${{ fromJSON(needs.init.outputs.matrix) }}
    steps:
      - name: Clone repository
        uses: actions/checkout@v2

      - name: Download PKI packages
        uses: actions/download-artifact@v2
        with:
          name: pki-build-${{ matrix.os }}
          path: build/RPMS

      - name: Install PKI packages
        run: |
          dnf install -y dnf-plugins-core
          dnf copr enable -y ${{ needs.init.outputs.repo }}
          dnf -y localinstall build/RPMS/*

      - name: Run PKICertImport test
        run: bash base/util/src/test/shell/test_PKICertImport.bash

  # https://github.com/dogtagpki/pki/wiki/PKI-NSS-CLI
  pki-nss-rsa-test:
    name: Testing PKI NSS CLI with RSA
    needs: [init, build]
    runs-on: ubuntu-latest
    container: registry.fedoraproject.org/fedora:${{ matrix.os }}
    strategy:
      matrix: ${{ fromJSON(needs.init.outputs.matrix) }}
    steps:
      - name: Download PKI packages
        uses: actions/download-artifact@v2
        with:
          name: pki-build-${{ matrix.os }}
          path: build/RPMS

      - name: Install PKI packages
        run: |
          dnf install -y dnf-plugins-core
          dnf copr enable -y ${{ needs.init.outputs.repo }}
          dnf -y localinstall build/RPMS/*

      # https://github.com/dogtagpki/pki/wiki/Generating-CA-Signing-CSR-with-PKI-NSS
      - name: Create CA signing cert request with new RSA key
        run: |
          pki nss-cert-request \
              --key-type RSA \
              --subject "CN=Certificate Authority" \
              --ext /usr/share/pki/server/certs/ca_signing.conf \
              --csr ca_signing.csr
          openssl req -text -noout -in ca_signing.csr

      # https://github.com/dogtagpki/pki/wiki/Issuing-CA-Signing-Certificate-with-PKI-NSS
      - name: Issue self-signed CA signing cert
        run: |
          pki nss-cert-issue \
              --csr ca_signing.csr \
              --ext /usr/share/pki/server/certs/ca_signing.conf \
              --cert ca_signing.crt
          openssl x509 -text -noout -in ca_signing.crt

      - name: Import CA signing cert
        run: |
          pki nss-cert-import \
              --cert ca_signing.crt \
              --trust CT,C,C \
              ca_signing

          # verify trust flags
          certutil -L -d /root/.dogtag/nssdb
          certutil -L -d /root/.dogtag/nssdb | sed -n 's/^ca_signing\s*\(\S\+\)\s*$/\1/p' > actual
          echo "CTu,Cu,Cu" > expected
          diff actual expected

          # verify key type
          certutil -K -d /root/.dogtag/nssdb
          certutil -K -d /root/.dogtag/nssdb | sed -n 's/^<.*>\s\+\(\S\+\)\s\+\S\+\s\+NSS Certificate DB:ca_signing$/\1/p' > actual
          echo rsa > expected
          diff actual expected

      # https://github.com/dogtagpki/pki/wiki/Generating-SSL-Server-CSR-with-PKI-NSS
      - name: Create SSL server cert request with new RSA key
        run: |
          pki nss-cert-request \
              --key-type RSA \
              --subject "CN=pki.example.com" \
              --ext /usr/share/pki/server/certs/sslserver.conf \
              --csr sslserver.csr
          openssl req -text -noout -in sslserver.csr

      # https://github.com/dogtagpki/pki/wiki/Issuing-SSL-Server-Certificate-with-PKI-NSS
      - name: Issue SSL server cert
        run: |
          pki nss-cert-issue \
              --issuer ca_signing \
              --csr sslserver.csr \
              --ext /usr/share/pki/server/certs/sslserver.conf \
              --cert sslserver.crt
          openssl x509 -text -noout -in sslserver.crt

      - name: Import SSL server cert
        run: |
          pki nss-cert-import \
              --cert sslserver.crt \
              sslserver

          # verify trust flags
          certutil -L -d /root/.dogtag/nssdb
          certutil -L -d /root/.dogtag/nssdb | sed -n 's/^sslserver\s*\(\S\+\)\s*$/\1/p' > actual
          echo "u,u,u" > expected
          diff actual expected

          # verify key type
          certutil -K -d /root/.dogtag/nssdb
          certutil -K -d /root/.dogtag/nssdb | sed -n 's/^<.*>\s\+\(\S\+\)\s\+\S\+\s\+NSS Certificate DB:sslserver$/\1/p' > actual
          echo rsa > expected
          diff actual expected

          # get key ID
          certutil -K -d /root/.dogtag/nssdb | sed -n 's/^<.*>\s\+\S\+\s\+\(\S\+\)\s\+NSS Certificate DB:sslserver$/\1/p' > sslserver_key_id

      - name: Delete SSL server cert
        run: |
          certutil -D -d /root/.dogtag/nssdb -n sslserver
          certutil -L -d /root/.dogtag/nssdb
          certutil -K -d /root/.dogtag/nssdb

      - name: Create new SSL server cert request with existing RSA key
        run: |
          pki nss-cert-request \
              --key-id `cat sslserver_key_id` \
              --subject "CN=pki.example.com" \
              --ext /usr/share/pki/server/certs/sslserver.conf \
              --csr new_sslserver.csr
          openssl req -text -noout -in new_sslserver.csr

      - name: Issue new SSL server cert
        run: |
          pki nss-cert-issue \
              --issuer ca_signing \
              --csr new_sslserver.csr \
              --ext /usr/share/pki/server/certs/sslserver.conf \
              --cert new_sslserver.crt
          openssl x509 -text -noout -in new_sslserver.crt

      - name: Import new SSL server cert
        run: |
          pki nss-cert-import \
              --cert new_sslserver.crt \
              new_sslserver

          # verify trust flags
          certutil -L -d /root/.dogtag/nssdb
          certutil -L -d /root/.dogtag/nssdb | sed -n 's/^new_sslserver\s*\(\S\+\)\s*$/\1/p' > actual
          echo "u,u,u" > expected
          diff actual expected

          # verify key type
          certutil -K -d /root/.dogtag/nssdb
          certutil -K -d /root/.dogtag/nssdb | sed -n 's/^<.*>\s\+\(\S\+\)\s\+\S\+\s\+NSS Certificate DB:new_sslserver$/\1/p' > actual
          echo rsa > expected
          diff actual expected

          # verify key ID
          certutil -K -d /root/.dogtag/nssdb | sed -n 's/^<.*>\s\+\S\+\s\+\(\S\+\)\s\+NSS Certificate DB:new_sslserver$/\1/p' > new_sslserver_key_id
          diff sslserver_key_id new_sslserver_key_id

  # https://github.com/dogtagpki/pki/wiki/PKI-NSS-CLI
  pki-nss-ecc-test:
    name: Testing PKI NSS CLI with ECC
    needs: [init, build]
    runs-on: ubuntu-latest
    container: registry.fedoraproject.org/fedora:${{ matrix.os }}
    strategy:
      matrix: ${{ fromJSON(needs.init.outputs.matrix) }}
    steps:
      - name: Download PKI packages
        uses: actions/download-artifact@v2
        with:
          name: pki-build-${{ matrix.os }}
          path: build/RPMS

      - name: Install PKI packages
        run: |
          dnf install -y dnf-plugins-core
          dnf copr enable -y ${{ needs.init.outputs.repo }}
          dnf -y localinstall build/RPMS/*

      # https://github.com/dogtagpki/pki/wiki/Generating-CA-Signing-CSR-with-PKI-NSS
      - name: Create CA signing cert request with new EC key
        run: |
          pki nss-cert-request \
              --key-type EC \
              --curve nistp256 \
              --subject "CN=Certificate Authority" \
              --ext /usr/share/pki/server/certs/ca_signing.conf \
              --csr ca_signing.csr
          openssl req -text -noout -in ca_signing.csr

      # https://github.com/dogtagpki/pki/wiki/Issuing-CA-Signing-Certificate-with-PKI-NSS
      - name: Issue self-signed CA signing cert
        run: |
          pki nss-cert-issue \
              --csr ca_signing.csr \
              --ext /usr/share/pki/server/certs/ca_signing.conf \
              --cert ca_signing.crt
          openssl x509 -text -noout -in ca_signing.crt

      - name: Import CA signing cert
        run: |
          pki nss-cert-import \
              --cert ca_signing.crt \
              --trust CT,C,C \
              ca_signing

          # verify trust flags
          certutil -L -d /root/.dogtag/nssdb
          certutil -L -d /root/.dogtag/nssdb | sed -n 's/^ca_signing\s*\(\S\+\)\s*$/\1/p' > actual
          echo "CTu,Cu,Cu" > expected
          diff actual expected

          # verify key type
          certutil -K -d /root/.dogtag/nssdb
          certutil -K -d /root/.dogtag/nssdb | sed -n 's/^<.*>\s\+\(\S\+\)\s\+\S\+\s\+NSS Certificate DB:ca_signing$/\1/p' > actual
          echo ec > expected
          diff actual expected

      # https://github.com/dogtagpki/pki/wiki/Generating-SSL-Server-CSR-with-PKI-NSS
      - name: Create SSL server cert request with new EC key
        run: |
          pki nss-cert-request \
              --key-type EC \
              --curve nistp256 \
              --subject "CN=pki.example.com" \
              --ext /usr/share/pki/server/certs/sslserver.conf \
              --csr sslserver.csr
          openssl req -text -noout -in sslserver.csr

      # https://github.com/dogtagpki/pki/wiki/Issuing-SSL-Server-Certificate-with-PKI-NSS
      - name: Issue SSL server cert
        run: |
          pki nss-cert-issue \
              --issuer ca_signing \
              --csr sslserver.csr \
              --ext /usr/share/pki/server/certs/sslserver.conf \
              --cert sslserver.crt
          openssl x509 -text -noout -in sslserver.crt

      - name: Import SSL server cert
        run: |
          pki nss-cert-import \
              --cert sslserver.crt \
              sslserver

          # verify trust flags
          certutil -L -d /root/.dogtag/nssdb
          certutil -L -d /root/.dogtag/nssdb | sed -n 's/^sslserver\s*\(\S\+\)\s*$/\1/p' > actual
          echo "u,u,u" > expected
          diff actual expected

          # verify key type
          certutil -K -d /root/.dogtag/nssdb
          certutil -K -d /root/.dogtag/nssdb | sed -n 's/^<.*>\s\+\(\S\+\)\s\+\S\+\s\+NSS Certificate DB:sslserver$/\1/p' > actual
          echo ec > expected
          diff actual expected

          # get key ID
          certutil -K -d /root/.dogtag/nssdb | sed -n 's/^<.*>\s\+\S\+\s\+\(\S\+\)\s\+NSS Certificate DB:sslserver$/\1/p' > sslserver_key_id

      - name: Delete SSL server cert
        run: |
          certutil -D -d /root/.dogtag/nssdb -n sslserver
          certutil -L -d /root/.dogtag/nssdb
          certutil -K -d /root/.dogtag/nssdb

      - name: Create new SSL server cert request with existing EC key
        run: |
          pki nss-cert-request \
              --key-id `cat sslserver_key_id` \
              --subject "CN=pki.example.com" \
              --ext /usr/share/pki/server/certs/sslserver.conf \
              --csr new_sslserver.csr
          openssl req -text -noout -in new_sslserver.csr

      - name: Issue new SSL server cert
        run: |
          pki nss-cert-issue \
              --issuer ca_signing \
              --csr new_sslserver.csr \
              --ext /usr/share/pki/server/certs/sslserver.conf \
              --cert new_sslserver.crt
          openssl x509 -text -noout -in new_sslserver.crt

      - name: Import new SSL server cert
        run: |
          pki nss-cert-import \
              --cert new_sslserver.crt \
              new_sslserver

          # verify trust flags
          certutil -L -d /root/.dogtag/nssdb
          certutil -L -d /root/.dogtag/nssdb | sed -n 's/^new_sslserver\s*\(\S\+\)\s*$/\1/p' > actual
          echo "u,u,u" > expected
          diff actual expected

          # verify key type
          certutil -K -d /root/.dogtag/nssdb
          certutil -K -d /root/.dogtag/nssdb | sed -n 's/^<.*>\s\+\(\S\+\)\s\+\S\+\s\+NSS Certificate DB:new_sslserver$/\1/p' > actual
          echo ec > expected
          diff actual expected

          # verify key ID
          certutil -K -d /root/.dogtag/nssdb | sed -n 's/^<.*>\s\+\S\+\s\+\(\S\+\)\s\+NSS Certificate DB:new_sslserver$/\1/p' > new_sslserver_key_id
          diff sslserver_key_id new_sslserver_key_id

  # https://github.com/dogtagpki/pki/wiki/PKI-NSS-CLI
  pki-nss-hsm-test:
    name: Testing PKI NSS CLI with HSM
    needs: [init, build]
    runs-on: ubuntu-latest
    container: registry.fedoraproject.org/fedora:${{ matrix.os }}
    strategy:
      matrix: ${{ fromJSON(needs.init.outputs.matrix) }}
    steps:
      - name: Download PKI packages
        uses: actions/download-artifact@v2
        with:
          name: pki-build-${{ matrix.os }}
          path: build/RPMS

      - name: Install PKI packages
        run: |
          dnf install -y dnf-plugins-core softhsm
          dnf copr enable -y ${{ needs.init.outputs.repo }}
          dnf -y localinstall build/RPMS/*

      - name: Create HSM token
        run: |
          softhsm2-util --init-token \
              --label HSM \
              --so-pin Secret.123 \
              --pin Secret.123 \
              --free
          softhsm2-util --show-slots

      # https://github.com/dogtagpki/pki/wiki/Generating-CA-Signing-CSR-with-PKI-NSS
      - name: Generate CA signing cert request with key in HSM
        run: |
          echo "internal=" > password.conf
          echo "hardware-HSM=Secret.123" >> password.conf
          pki --token HSM -f password.conf nss-cert-request \
              --subject "CN=Certificate Authority" \
              --ext /usr/share/pki/server/certs/ca_signing.conf \
              --csr ca_signing.csr
          openssl req -text -noout -in ca_signing.csr

      # https://github.com/dogtagpki/pki/wiki/Issuing-CA-Signing-Certificate-with-PKI-NSS
      - name: Issue self-signed CA signing cert
        run: |
          pki --token HSM -f password.conf nss-cert-issue \
              --csr ca_signing.csr \
              --ext /usr/share/pki/server/certs/ca_signing.conf \
              --cert ca_signing.crt
          openssl x509 -text -noout -in ca_signing.crt

      - name: Import CA signing cert into internal token and HSM
        run: |
          pki --token HSM -f password.conf nss-cert-import \
              --cert ca_signing.crt \
              --trust CT,C,C \
              ca_signing

      - name: Verify CA signing cert trust flags in internal token
        run: |
          certutil -L -d /root/.dogtag/nssdb | sed -n 's/^ca_signing\s*\(\S\+\)\s*$/\1/p' > actual
          echo "CT,C,C" > expected
          diff actual expected

      - name: Verify CA signing cert trust flags in HSM
        run: |
          echo "Secret.123" > password.txt
          certutil -L -d /root/.dogtag/nssdb -h HSM -f password.txt | sed -n 's/^HSM:ca_signing\s*\(\S\+\)\s*$/\1/p' > actual
          echo "CTu,Cu,Cu" > expected
          diff actual expected

      - name: Remove HSM token
        run: softhsm2-util --delete-token --token HSM

  # docs/user/tools/Using-PKI-PKCS7-CLI.adoc
  pki-pkcs7-test:
    name: Testing PKI PKCS7 CLI
    needs: [init, build]
    runs-on: ubuntu-latest
    container: registry.fedoraproject.org/fedora:${{ matrix.os }}
    strategy:
      matrix: ${{ fromJSON(needs.init.outputs.matrix) }}
    steps:
      - name: Download PKI packages
        uses: actions/download-artifact@v2
        with:
          name: pki-build-${{ matrix.os }}
          path: build/RPMS

      - name: Install PKI packages
        run: |
          dnf install -y dnf-plugins-core
          dnf copr enable -y ${{ needs.init.outputs.repo }}
          dnf -y localinstall build/RPMS/*

      - name: Generate CA signing cert request
        run: |
          pki nss-cert-request \
              --subject "CN=Certificate Authority" \
              --ext /usr/share/pki/server/certs/ca_signing.conf \
              --csr ca_signing.csr

      - name: Issue self-signed CA signing cert
        run: |
          pki nss-cert-issue \
              --csr ca_signing.csr \
              --ext /usr/share/pki/server/certs/ca_signing.conf \
              --cert ca_signing.crt

      - name: Import CA signing cert
        run: |
          pki nss-cert-import \
              --cert ca_signing.crt \
              --trust CT,C,C \
              ca_signing

      - name: Generate SSL server cert request
        run: |
          pki nss-cert-request \
              --subject "CN=localhost.localdomain" \
              --ext /usr/share/pki/server/certs/sslserver.conf \
              --csr sslserver.csr

      - name: Issue SSL server cert signed by CA signing cert
        run: |
          pki nss-cert-issue \
              --issuer ca_signing \
              --csr sslserver.csr \
              --ext /usr/share/pki/server/certs/ca_signing.conf \
              --cert sslserver.crt

      - name: Import SSL server cert
        run: pki nss-cert-import sslserver --cert sslserver.crt

      - name: "Export SSL server cert chain into PKCS #7 chain"
        run: |
          pki pkcs7-export sslserver --pkcs7 cert_chain.p7b
          pki pkcs7-cert-find --pkcs7 cert_chain.p7b

      - name: Convert cert chain into separate PEM certificates
        run: |
          pki pkcs7-cert-export --pkcs7 cert_chain.p7b --output-prefix cert- --output-suffix .pem
          cat cert-0.pem
          cat cert-1.pem

      - name: "Merge PEM certificates into a PKCS #7 chain"
        run: |
          rm -f cert_chain.p7b
          pki pkcs7-cert-import --pkcs7 cert_chain.p7b --input-file cert-0.pem
          pki pkcs7-cert-import --pkcs7 cert_chain.p7b --input-file cert-1.pem --append
          pki pkcs7-cert-find --pkcs7 cert_chain.p7b

      - name: Remove certs from NSS database
        run: |
          certutil -D -d /root/.dogtag/nssdb -n sslserver
          certutil -D -d /root/.dogtag/nssdb -n ca_signing
          certutil -L -d /root/.dogtag/nssdb

      - name: "Import PKCS #7 chain into NSS database"
        run: |
          pki pkcs7-import sslserver --pkcs7 cert_chain.p7b
          certutil -L -d /root/.dogtag/nssdb

      - name: Verify CA signing cert trust flags
        run: |
          certutil -L -d /root/.dogtag/nssdb | sed -n 's/^Certificate Authority *\(\S\+\)/\1/p' > actual
          echo "CTu,Cu,Cu" > expected
          diff actual expected

      - name: Verify SSL server cert trust flags
        run: |
          certutil -L -d /root/.dogtag/nssdb | sed -n 's/^sslserver *\(\S\+\)/\1/p' > actual
          echo "u,u,u" > expected
          diff actual expected

      - name: "Convert PKCS #7 chain into a series of PEM certificates"
        run: |
          pki pkcs7-cert-export --pkcs7 cert_chain.p7b --output-file cert_chain.pem
          cat cert_chain.pem

      - name: Remove certs from NSS database
        run: |
          certutil -D -d /root/.dogtag/nssdb -n sslserver
          certutil -D -d /root/.dogtag/nssdb -n "Certificate Authority"
          certutil -L -d /root/.dogtag/nssdb

      - name: Import PEM certificates into NSS database
        run: |
          rm -f cert_chain.p7b
          pki pkcs7-cert-import --pkcs7 cert_chain.p7b --input-file cert_chain.pem
          pki pkcs7-import sslserver --pkcs7 cert_chain.p7b
          certutil -L -d /root/.dogtag/nssdb

      - name: Verify CA signing cert trust flags
        run: |
          certutil -L -d /root/.dogtag/nssdb | sed -n 's/^Certificate Authority *\(\S\+\)/\1/p' > actual
          echo "CTu,Cu,Cu" > expected
          diff actual expected

      - name: Verify SSL server cert trust flags
        run: |
          certutil -L -d /root/.dogtag/nssdb | sed -n 's/^sslserver *\(\S\+\)/\1/p' > actual
          echo "u,u,u" > expected
          diff actual expected

  # https://github.com/dogtagpki/pki/wiki/PKI-PKCS12-CLI
  pki-pkcs12-test:
    name: Testing PKI PKCS12 CLI
    needs: [init, build]
    runs-on: ubuntu-latest
    strategy:
      matrix: ${{ fromJSON(needs.init.outputs.matrix) }}
    container: registry.fedoraproject.org/fedora:${{ matrix.os }}
    steps:
      - name: Download PKI packages
        uses: actions/download-artifact@v2
        with:
          name: pki-build-${{ matrix.os }}
          path: build/RPMS

      - name: Install PKI packages
        run: |
          dnf install -y dnf-plugins-core
          dnf copr enable -y ${{ needs.init.outputs.repo }}
          dnf -y localinstall build/RPMS/*

      - name: Generate CA signing cert request in NSS database
        run: |
          pki nss-cert-request \
              --subject "CN=Certificate Authority" \
              --ext /usr/share/pki/server/certs/ca_signing.conf \
              --csr ca_signing.csr

      - name: Issue self-signed CA signing cert
        run: |
          pki nss-cert-issue \
              --csr ca_signing.csr \
              --ext /usr/share/pki/server/certs/ca_signing.conf \
              --cert ca_signing.crt
          cat ca_signing.crt

      - name: Import CA signing cert into NSS database
        run: |
          pki nss-cert-import \
              --cert ca_signing.crt \
              --trust CT,C,C \
              ca_signing

      - name: Generate SSL server cert request in NSS database
        run: |
          pki nss-cert-request \
              --subject "CN=localhost.localdomain" \
              --ext /usr/share/pki/server/certs/sslserver.conf \
              --csr sslserver.csr

      - name: Issue SSL server cert signed by CA signing cert
        run: |
          pki nss-cert-issue \
              --issuer ca_signing \
              --csr sslserver.csr \
              --ext /usr/share/pki/server/certs/ca_signing.conf \
              --cert sslserver.crt
          cat sslserver.crt

      - name: Import SSL server cert into NSS database
        run: pki nss-cert-import --cert sslserver.crt sslserver

      - name: "Export all certs and keys from NSS database into PKCS #12 file"
        run: |
          pki pkcs12-export \
              --pkcs12-file test.p12 \
              --pkcs12-password Secret.123

      - name: "List certs in PKCS #12 file"
        run: |
          pki pkcs12-cert-find \
              --pkcs12-file test.p12 \
              --pkcs12-password Secret.123 | tee output
          # compare certs in PKCS #12 file and in NSS database
          sed -n 's/^\s*Friendly Name:\s*\(.\+\)\s*$/\1/p' output | sort > actual
          certutil -L -d /root/.dogtag/nssdb | tee output
          tail -n +5 output | awk '{print $1;}' | sort > expected
          diff actual expected

      - name: "List keys in PKCS #12 file"
        run: |
          pki pkcs12-key-find \
              --pkcs12-file test.p12 \
              --pkcs12-password Secret.123 | tee output
          # compare keys in PKCS #12 file and in NSS database
          sed -n 's/^\s*Key ID:\s*\(.\+\)\s*$/\1/p' output | sort > actual
          certutil -K -d /root/.dogtag/nssdb | tee output
          sed -n 's/^<.*>\s\+\S\+\s\+\(\S\+\).*/\1/p' output | sort > expected
          diff actual expected

      - name: "Export SSL server cert from PKCS #12 file"
        run: |
          pki pkcs12-cert-export \
              --pkcs12-file test.p12 \
              --pkcs12-password Secret.123 \
              --cert-file sslserver2.crt \
              sslserver
          # verify exported cert
          diff sslserver.crt sslserver2.crt

      - name: "Remove SSL server cert from PKCS #12 file"
        run: |
          pki pkcs12-cert-del \
              --pkcs12-file test.p12 \
              --pkcs12-password Secret.123 \
              sslserver
          # verify cert removal
          pki pkcs12-cert-find \
              --pkcs12-file test.p12 \
              --pkcs12-password Secret.123 | tee output
          sed -n 's/^\s*Friendly Name:\s*\(.\+\)\s*$/\1/p' output | sort > actual
          echo ca_signing > expected
          diff actual expected

      - name: "Re-import SSL server cert from NSS database into PKCS #12 file"
        run: |
          pki pkcs12-cert-import \
              --pkcs12-file test.p12 \
              --pkcs12-password Secret.123 \
              --append \
              --no-chain \
              sslserver
          # compare certs in PKCS #12 file and in NSS database
          pki pkcs12-cert-find \
              --pkcs12-file test.p12 \
              --pkcs12-password Secret.123 | tee output
          sed -n 's/^\s*Friendly Name:\s*\(.\+\)\s*$/\1/p' output | sort > actual
          certutil -L -d /root/.dogtag/nssdb | tail -n +5 | awk '{print $1;}' | sort > expected
          diff actual expected
          # compare keys in PKCS #12 file and in NSS database
          pki pkcs12-key-find \
              --pkcs12-file test.p12 \
              --pkcs12-password Secret.123 | tee output
          sed -n 's/^\s*Key ID:\s*\(.\+\)\s*$/\1/p' output | sort > actual
          certutil -K -d /root/.dogtag/nssdb | sed -n 's/^<.*>\s\+\S\+\s\+\(\S\+\).*/\1/p' | sort > expected
          diff actual expected

      - name: "Import all certs and keys from PKCS #12 file into a new NSS database"
        run: |
          pki -d nssdb pkcs12-import \
              --pkcs12-file test.p12 \
              --pkcs12-password Secret.123
          # compare certs in new and old NSS databases
          certutil -L -d nssdb | tee output
          tail -n +5 output | awk '{print $1;}' | sort > actual
          certutil -L -d /root/.dogtag/nssdb | tail -n +5 | awk '{print $1;}' | sort > expected
          diff actual expected
          # compare keys in new and old NSS databases
          certutil -K -d nssdb | tee output
          sed -n 's/^<.*>\s\+\S\+\s\+\(\S\+\).*/\1/p' output | sort > actual
          certutil -K -d /root/.dogtag/nssdb | sed -n 's/^<.*>\s\+\S\+\s\+\(\S\+\).*/\1/p' | sort > expected
          diff actual expected
