From 47c54e55330076cc5f432bd641a068b0f34d9419 Mon Sep 17 00:00:00 2001 From: Mridul Gain Date: Tue, 18 Aug 2026 17:48:20 +0530 Subject: [PATCH 1/2] fix(saml): pin validator clock in tests to avoid fixture cert expiry TestVerifyUnsignedMessageAndSignedAssertionWithRootXmlNs started failing because testdata/oam-ca.pem expired 2026-06-28. Pin the dsig.ValidationContext clock in runVerify to a fixed date within all fixture certs' validity windows instead of relying on the real clock, so this doesn't recur when okta-ca.pem expires in December 2026. Co-Authored-By: Claude Sonnet 5 --- connector/saml/saml_test.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/connector/saml/saml_test.go b/connector/saml/saml_test.go index 03e891fe64..b97f98fcbd 100644 --- a/connector/saml/saml_test.go +++ b/connector/saml/saml_test.go @@ -549,6 +549,9 @@ func runVerify(t *testing.T, ca string, resp string, shouldSucceed bool) { s := certStore{[]*x509.Certificate{cert}} validator := dsig.NewDefaultValidationContext(s) + // Pin the validator's clock so signature checks don't fail once the + // fixture certs in testdata/ eventually expire in real time. + validator.Clock = dsig.NewFakeClockAt(time.Date(2020, 1, 1, 0, 0, 0, 0, time.UTC)) data, err := os.ReadFile(resp) if err != nil { From 428062591402f5532f8df0327b24f88e6ca15b8d Mon Sep 17 00:00:00 2001 From: Mridul Gain Date: Wed, 19 Aug 2026 14:38:17 +0530 Subject: [PATCH 2/2] fix(storage/kubernetes): fix Client name shadowing regression from lint cleanup PR #74's golangci-lint v2 migration blanket-replaced .ObjectMeta.Name with .Name across storage/kubernetes/storage.go and types.go to resolve staticcheck's QF1008 "embedded field" suggestions. That's safe for most types here, but storage/kubernetes.Client declares its own explicit `Name string` field (the client's display name, e.g. "dex client"), which shadows the embedded k8sapi.ObjectMeta.Name (the actual Kubernetes resource name, a hash of the client ID). Go silently resolves c.Name to the shallower, explicit field, so DeleteClient/UpdateClient started PUTting/DELETEing using the display name instead of the resource name -- which fails Kubernetes' DNS1123 name validation (or worse, could target the wrong resource if the display name happened to be a valid k8s name). This is exactly why staticcheck itself never flagged these two call sites (client.go:426,496) even though the blanket sed touched them -- the quickfix check is shadow-aware and only flags genuinely equivalent simplifications. This regression was introduced by mechanically applying more replacements than the linter actually flagged. Reverts these two call sites to c.ObjectMeta.Name. Verified this was the only affected type: Connector also declares its own Name field, but its delete/put call sites already used the id parameter directly and were untouched by the sed. Fixes the storage/kubernetes TestStorage/ClientCRUD and ClientConcurrentUpdate CI failures surfaced on this branch after merging master (which includes #74). Co-Authored-By: Claude Sonnet 5 --- storage/kubernetes/storage.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/storage/kubernetes/storage.go b/storage/kubernetes/storage.go index 00771815c3..84231e00fd 100644 --- a/storage/kubernetes/storage.go +++ b/storage/kubernetes/storage.go @@ -423,7 +423,7 @@ func (cli *client) DeleteClient(ctx context.Context, id string) error { if err != nil { return err } - return cli.delete(resourceClient, c.Name) + return cli.delete(resourceClient, c.ObjectMeta.Name) } func (cli *client) DeleteRefresh(ctx context.Context, id string) error { @@ -493,7 +493,7 @@ func (cli *client) UpdateClient(ctx context.Context, id string, updater func(old newClient := cli.fromStorageClient(updated) newClient.ObjectMeta = c.ObjectMeta - return cli.put(resourceClient, c.Name, newClient) + return cli.put(resourceClient, c.ObjectMeta.Name, newClient) } func (cli *client) UpdatePassword(ctx context.Context, email string, updater func(old storage.Password) (storage.Password, error)) error {