From ab9fea7d6b5fd44336b690b2e8011fa7947d8ab4 Mon Sep 17 00:00:00 2001
From: Polina Bungina <27892524+hughcapet@users.noreply.github.com>
Date: Fri, 12 May 2023 10:42:53 +0200
Subject: [PATCH] Fix openssl certificate generation in behave tests (#2672)

--addext -> -addext (doesn't work on macOS)
set keyfile permissions to 600 (to avoid "private key file has group or world access")
---
 features/environment.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/features/environment.py b/features/environment.py
index b915fd99..c3fcce00 100644
--- a/features/environment.py
+++ b/features/environment.py
@@ -7,6 +7,7 @@ import psutil
 import re
 import shutil
 import signal
+import stat
 import subprocess
 import sys
 import tempfile
@@ -1060,10 +1061,11 @@ def before_all(context):
     try:
         with open(os.devnull, 'w') as null:
             ret = subprocess.call(['openssl', 'req', '-nodes', '-new', '-x509', '-subj', '/CN=batman.patroni',
-                                   '--addext', 'subjectAltName=IP:127.0.0.1', '-keyout', context.keyfile,
+                                   '-addext', 'subjectAltName=IP:127.0.0.1', '-keyout', context.keyfile,
                                    '-out', context.certfile], stdout=null, stderr=null)
             if ret != 0:
                 raise Exception
+            os.chmod(context.keyfile, stat.S_IWRITE | stat.S_IREAD)
     except Exception:
         context.keyfile = context.certfile = None