DL6ER 20164bff26 tests: resolve iCloud Private Relay zones from local pdns ...

The API query-count assertions depend on resolving mask.icloud.com, whose
mask.icloud.com -> mask.apple-dns.net CNAME chain was recursed to the public
internet. dnsmasq fires extra DNSKEY validation queries depending on whether
Apple currently DNSSEC-signs icloud.com / apple-dns.net, and Apple toggles this
over time. The runtime DS-probing workaround in conftest.py could not reliably
model dnsmasq's behaviour (e.g. when Apple returns SERVFAIL on DS), so the suite
went flaky again.

Serve the icloud.com and apple-dns.net zones from the local authoritative
PowerDNS server instead, so the chain resolves hermetically and the query counts
are deterministic regardless of Apple's upstream DNSSEC posture. The DS-probing
fixture is dropped and the expected counters become fixed constants again.

Signed-off-by: DL6ER <dl6er@dl6er.de>

2026-06-24 06:25:39 +00:00

..

json

…

libs

…

checkAPI.py

…

conftest.py

tests: resolve iCloud Private Relay zones from local pdns

2026-06-24 06:25:39 +00:00

openapi-enforcer.js

…

pytest.ini

…

test_api.py

tests: resolve iCloud Private Relay zones from local pdns

2026-06-24 06:25:39 +00:00

test_m_mutations.py

fix: accept punycode domains that libidn2 rejects under IDNA2008

2026-04-06 11:08:42 +02:00

test_openapi.py

…

test_s_auth_stress.py

Address review comments

2026-05-06 19:10:21 +02:00

test_z_auth.py

…

test-rate-limit.py

…