Generate ssl certs in a genrule instead of checking them in (#4950)

changelog_begin changelog_end For now this is only used for the daml-helper tests. I’ll shuffle things around and use it for all tests in a separate PR.
2024-09-20 01:07:18 +03:00 · 2020-03-12 10:36:40 +01:00 · 2020-03-12 10:36:40 +01:00 · e0d652df91
commit e0d652df91
parent 4c55a67e38
20 changed files with 130 additions and 425 deletions
--- a/.dadew
+++ b/.dadew
@ -10,6 +10,7 @@
        "vcredist-14.0.23026",
        "bazel",
        "nodejs-10.16.3",
+        "openssl",
        "python-3.6.7",
        "nsis-3.04",
        "maven-3.6.1",
--- a/20
+++ b/20
@ -142,6 +142,26 @@ dev_env_tool(
    win_tool = "msys2",
 )

+nixpkgs_package(
+    name = "openssl_nix",
+    attribute_path = "openssl",
+    fail_not_supported = False,
+    nix_file = "//nix:bazel.nix",
+    nix_file_deps = common_nix_file_deps,
+    repositories = dev_env_nix_repos,
+)
+
+dev_env_tool(
+    name = "openssl_dev_env",
+    nix_include = ["bin/openssl"],
+    nix_label = "@openssl_nix",
+    nix_paths = ["bin/openssl"],
+    tools = ["openssl"],
+    win_include = ["bin"],
+    win_paths = ["bin/openssl.exe"],
+    win_tool = "openssl",
+)
+
 # Tar & gzip dependency
 nixpkgs_package(
    name = "tar_nix",
--- a/daml-assistant/daml-helper/BUILD.bazel
+++ b/daml-assistant/daml-helper/BUILD.bazel
@ -3,6 +3,7 @@

 load("//bazel_tools:haskell.bzl", "da_haskell_binary", "da_haskell_library", "da_haskell_test")
 load("//bazel_tools/packaging:packaging.bzl", "package_app")
+load("@os_info//:os_info.bzl", "is_windows")

 da_haskell_library(
    name = "daml-helper-lib",
@ -63,16 +64,60 @@ package_app(
    visibility = ["//visibility:public"],
 )

+genrule(
+    name = "test-certificates",
+    srcs = [":openssl-extensions.cnf"],
+    outs = [
+        "ca.key",
+        "ca.crt",
+        "client.csr",
+        "client.crt",
+        "client.key",
+        "client.pem",
+        "server.csr",
+        "server.crt",
+        "server.key",
+        "server.pem",
+    ],
+    cmd = """
+set -eou pipefail
+{openssl_conf}
+# Generate CA key and crt
+$(location @openssl_dev_env//:openssl) genrsa -out $(location ca.key) 4096
+$(location @openssl_dev_env//:openssl) req -new -x509 -key $(location ca.key) -out $(location ca.crt) -subj '{cn}=0.0.0.0.ca' -days 3650
+
+# Generate server key, csr and crt
+$(location @openssl_dev_env//:openssl) genrsa -out $(location server.key) 4096
+$(location @openssl_dev_env//:openssl) pkey -in $(location server.key) -out $(location server.pem)
+$(location @openssl_dev_env//:openssl) req -new -key $(location server.key) -out $(location server.csr) -subj '{cn}=0.0.0.0.server'
+$(location @openssl_dev_env//:openssl) x509 -req -in $(location server.csr) -CA $(location ca.crt) -CAkey $(location ca.key) -CAcreateserial -out $(location server.crt) -extfile $(location openssl-extensions.cnf) -extensions req_ext -days 3650
+
+# Generate client key, csr and crt
+$(location @openssl_dev_env//:openssl) genrsa -out $(location client.key) 4096
+$(location @openssl_dev_env//:openssl) pkey -in $(location client.key) -out $(location client.pem)
+$(location @openssl_dev_env//:openssl) req -new -key $(location client.key) -out $(location client.csr) -subj '{cn}=0.0.0.0.client'
+$(location @openssl_dev_env//:openssl) x509 -req -in $(location client.csr) -CA $(location ca.crt) -CAkey $(location ca.key) -CAcreateserial -out $(location client.crt) -extfile $(location openssl-extensions.cnf) -extensions req_ext -days 3650
+
+    """.format(
+        openssl_conf =
+            "export OPENSSL_CONF=$$(dirname $(location @openssl_dev_env//:openssl))/cnf/openssl.cnf" if is_windows else "",
+        cn = "//CN" if is_windows else "/CN",
+    ),
+    tools = [
+        "@openssl_dev_env//:openssl",
+    ],
+)
+
 da_haskell_test(
    name = "ledger-tls",
    srcs = glob(["test/**/*.hs"]),
    data = [
        "daml-helper",
-        "test-certificates/ca.crt",
-        "test-certificates/client.crt",
-        "test-certificates/client.pem",
-        "test-certificates/server.crt",
-        "test-certificates/server.pem",
+        ":ca.crt",
+        ":client.crt",
+        ":client.pem",
+        ":server.crt",
+        ":server.pem",
        "//ledger/sandbox:sandbox-binary",
    ],
    hackage_deps = [
--- a/daml-assistant/daml-helper/test-certificates/openssl-extensions.cnf
+++ b/daml-assistant/daml-helper/test-certificates/openssl-extensions.cnf
--- a/daml-assistant/daml-helper/test-certificates/ca.crt
+++ b/daml-assistant/daml-helper/test-certificates/ca.crt
@ -1,29 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIFCzCCAvOgAwIBAgIUNq1pb+dJ7bBrR5y8wGYXLw7KmNMwDQYJKoZIhvcNAQEL
-BQAwFTETMBEGA1UEAwwKMC4wLjAuMC5jYTAeFw0yMDAzMTExNTI0MTFaFw0zMDAz
-MDkxNTI0MTFaMBUxEzARBgNVBAMMCjAuMC4wLjAuY2EwggIiMA0GCSqGSIb3DQEB
-AQUAA4ICDwAwggIKAoICAQCU+h6lWtXUjbjERRE2E7w2fVTOrY0PTTnVASj3CIp4
-vKjDsJD15sb5G4HIMIj5y6fSvUJ+r/Lwn7X978og6j1V0mXrgP045EHQL9kxI3aE
-QOI6AoY70znHBD3GZHqmtyyOzSMrvBRYKNhESrRMiZ8qLp373xzOQiKX3nkPGTqQ
-WwdeEVD49j+fjLoWA8xq3NgJVn+B1Kh2NoudDQu90DDpPsJBuNaGSjqQRYm6QzWC
-Q4DUOgo6UEUeAt1Cx356tDOPRy+0YKAy3IaYOqWdZy4H2PKEmPkwV12fcNk0WcxU
-qpaYMc+42OCHgO3JdMzjhfxPGz/AozsTpuSL1np8UoSC4V9QmpekSMe3MzANXCpR
-94pMHqRVFCYsD5iOq7p3tD7ssW6P9DtCSEghSTJZkwGHGnJA5kyMGwIbh02Cdl+/
-q6zBqUeli6gfk6BmFyOT2tHycLn6sIV/1kXqc/KZ6y027Ps+/3K+jgH/ZD5n7Ap1
-38H8xTLa8HfRIFyWa5Yg9unWvSSJEJ0ym2wnOOcpOz2Fp5DWi5b9ZwGAMu+AyjmH
-06hd+PBj/ea3ivtg8PwuVgP22oZyYoqSFtkBfbCNf/zvaj1B0S2TSW6bw4AvGLru
-Xexrw6mIF36KoUTMm+1Kmm6P8J+a32yUX6nXsH4/D1BGa9FZDrl8mXea2Qp7jST5
-5wIDAQABo1MwUTAdBgNVHQ4EFgQUO9D6nqZsq1fdSn08Tlfp+r4bOlowHwYDVR0j
-BBgwFoAUO9D6nqZsq1fdSn08Tlfp+r4bOlowDwYDVR0TAQH/BAUwAwEB/zANBgkq
-hkiG9w0BAQsFAAOCAgEAFYZXbEtkF7XjzUalGF99r9tU/hTVsfGtL0lv9yXVQq9A
-FRCGc5BsMkuUtLbObdggMCLORvqpvmudL2fITtPE8RQ5xSPxS61gOJ+0glfv0O4k
-F7vXyTDXHzP1Pfx5iwh1t9AzL0Xz/6pxiW9kSZFTdDG6Ys6RSrEVecH6T1NdciBk
-S3skfhXMIy1hr5Z6l+5PIhCi+ONiPKtPbMCWJfHY01ul/gUNWmNWcL123rqvelQE
-pWedsS/j9+O08Ikr2IW+2einLcnMqHARtuX5ONgYaxWymcZKZofslTlAf8JqEweP
-VIbBytpKc5HeM4F4OI2siqtH2Aw1IisX5D+HXJMTAZFKmatbvgH/C/WxWwr5SqeO
-V/6k3Sdwb/Hh+MK3V+zQvrRZdrVH5wn4PU6nM8hHREjri07nFCN80WIYbPOGEzLV
-wT/NqSPRq4dMnaUCe2kKSsSCBMVfRrpCFvdze6ZFdLiADBgifRvwl7V3RLKrJMYb
-zqjzQNmOtt5HPyymMJw9wfQ35HnbN073mp8taQ40LcO7orQ9g/1lNoj0s4Cysci3
-KdrvIBMkHxpffNsJjfZJoWxfmK07M5GEZoxTuLqE92o2LwfW/a1odjG7kmLld2ME
-ai1jux8N6SKrQ50XwbDvmSlL1NrDaCoxPYQMJ1YgkWWxK/YpNM3ruyhcyRmdDKo=
-----END CERTIFICATE-----
--- a/daml-assistant/daml-helper/test-certificates/ca.key
+++ b/daml-assistant/daml-helper/test-certificates/ca.key
@ -1,51 +0,0 @@
-----BEGIN RSA PRIVATE KEY-----
-MIIJJwIBAAKCAgEAlPoepVrV1I24xEURNhO8Nn1Uzq2ND0051QEo9wiKeLyow7CQ
-9ebG+RuByDCI+cun0r1Cfq/y8J+1/e/KIOo9VdJl64D9OORB0C/ZMSN2hEDiOgKG
-O9M5xwQ9xmR6prcsjs0jK7wUWCjYREq0TImfKi6d+98czkIil955Dxk6kFsHXhFQ
-+PY/n4y6FgPMatzYCVZ/gdSodjaLnQ0LvdAw6T7CQbjWhko6kEWJukM1gkOA1DoK
-OlBFHgLdQsd+erQzj0cvtGCgMtyGmDqlnWcuB9jyhJj5MFddn3DZNFnMVKqWmDHP
-uNjgh4DtyXTM44X8Txs/wKM7E6bki9Z6fFKEguFfUJqXpEjHtzMwDVwqUfeKTB6k
-VRQmLA+Yjqu6d7Q+7LFuj/Q7QkhIIUkyWZMBhxpyQOZMjBsCG4dNgnZfv6uswalH
-pYuoH5OgZhcjk9rR8nC5+rCFf9ZF6nPymestNuz7Pv9yvo4B/2Q+Z+wKdd/B/MUy
-2vB30SBclmuWIPbp1r0kiRCdMptsJzjnKTs9haeQ1ouW/WcBgDLvgMo5h9OoXfjw
-Y/3mt4r7YPD8LlYD9tqGcmKKkhbZAX2wjX/872o9QdEtk0lum8OALxi67l3sa8Op
-iBd+iqFEzJvtSppuj/Cfmt9slF+p17B+Pw9QRmvRWQ65fJl3mtkKe40k+ecCAwEA
-AQKCAgBi2oFBWb/v1caXvfjIuFm4knuW1QR39dd9JtLm8OzpZs5ZY60c7nBzVbRN
-gR8zGdcXeGxKIjiDQIcDpHysUKI4c28b0TC18ohVO5rUB2MaKO+0bH5j7io1i/Pt
-1DiqrXtMmoRO/fNF+Hxg/G0dKGjMFbjRK+AyYSIRQhd0VFpO9Ygy/CyNtuDK3xeP
-ih+3fSmBMLtVDCZoopMLuF9lKWN7MiC2eY8n9tNbbjkQto4oDODMcmLdBOyIGIB3
-UmbzxuU7mpHmEAPdHAXXt3qzsoaRwHxUTilz0VUXeks2eKukNrnM7aiXUJnUcFHY
-zr8x7nNYjo1EJ0wJI0IeJEiMfDjemL9zOgSfPJqv/Ns6iRtwfeDbncp5b57+2WH7
-lCfMbH8BAXA9+SfvGcbEtRy9EPl6ijfLhBklz7/LaGN5cYUSc4BYjkazcNoyQONP
-RXR2GOnbtwPfjHfLTERYD2HLOE/EV/IVoTD6iPKxp14iPwGxfUrbCNkY9puj6eL7
-5qAheFyx0DUqkPyoY5Ku5+ZATYEiWs3v6WWDvGwQsz6J/dRY34r90WaLeIEwKXuh
-8fVxP5nxAYiP3xvT1TwZLLDvNZ7qsgAnk1mFfVwHP65+x57qBmTI3ORbWPBE6voN
-6+nO2ICMVoK8ePISMQLS/RvM/AlJ4ghebUGznnh3hLjlDWHS6QKCAQEAw1Cvokcj
-OUWvWlO6FWymbY5aBQbZ6czdxxcxPDv35haTVmW+W2aMI+FSWGb8y9vwi+1OGod8
-bA8fRWHwqYaqMU8uH2OuSW0UpPF6gp2xvif46uMIMHrAGt+zyn0Z4JmRDW5RJ5pC
-5NmQzzObMTTxIKHpkcMZHb/y/zViRifJGwJY/x355R6JEEU7kQAL46DIkI7Q7cky
-NVPXGZGk31CXNBsBsy+o1QZvyk4RfwxOQhkckFzmApQOnayw+MhzDvXu15UjptxF
-8moTQHc9DyNCt+g99Ia/OdMgzE0gL+GSHz5qaaL5AyleT3IRypN0PtikDQNUPd+S
-a2abor8Xqd2sQwKCAQEAw0O12oixOyc6mZyFjDqhw9f37Jed05GZQWglZeoAOXdD
-xx7u3qqwnDwCI5JJ5oy+45r7/edkyiqOVnjFjp8NRLVZMlWYSI+kOv8lE/3mgdjJ
-8kDxJOl74tfSPwm4hNELKFmpzTvoOFFuGuFV07rRo+iT+5BiCltb84NkerIMAqZ7
-ZmB+VSwP6HaqmmXDLOCVxCw7agDWaKgRPa5WGirTsjJQFBzy5tJ3RF9HLrCLMIy8
-kHobZyQH4RZsyHOLfpuE1R0mdnaGgGknLM/vT6pAWoNcsxP41HcBAQBDUyzyfnPz
-ruqr88h24HC7344D9WfOGgKLTukoDiXHBvZJKnlzjQKCAQA+Fw5ehkLaWB7QlkFX
-wjx+I3zWkEECJFB0lBjgzyeVi6O3GY0UPVtbpKuq0sKWhArKUNw9bsjNCVmlkucQ
-3XCJUGSXMfcb/INNlD6f+0Wf79EfyqC12K/tWyQqwO5TCj6kiGdgMZgGbGuukvdJ
-A02MVCyOW/lGDdlP7EabitZRscNdBsiEX9quw3OWOu+Mo3ZfDie5D/bYIRkGVdiV
-7WbD97nonsQLRIqRQ5QoUV8ngBgmhIHSXALxeQ6haAe7v8731b+JsgjCcZpBKibN
-AyaYlEntzFBKL6YDjJko34q2R/9IKbkDmkkS9G5XedzAhdpRELfdG4/OeMYNTLZX
-F9NFAoIBAGjOJwWs6LO/Uoywnl2t+rWLbd7nYib0tzWMGMai2ov9n7t4tu184F57
-Nwqwskm0saCoxyh40nhQbyWqnR737785Ny71Ek+gCZ5A5D3ewaJgIcSNZuFRENWo
-0YhUR13CdiKqPaGSzgmsa1SyLcb/Nxaq9wLHdFfqwWfq1juk5R1nDkTc9fHxPHih
-eOB2TlQAF2K7+wfiezKhQt/AeyaAZi/3IVQqVZXe0XU5TpOY3pyobW1+nMa3aCNA
-ThMpMW47OwjIJKTg6UBzMDu1P9Wao//xEghsZ9piJX/MDFbQgTeuNNVlz/WBW40L
-9UsAhs9pcA4131/zdTRiwnjSKGNL3OECggEAEBEI1PzNPKDpH+h3Yi55PDd8JMV6
-l9jpg80S7NmbkUrrG0KC1glq7NOXretovGCDDQ9jm0DpMGrINHFSqKoYqzUs7Kkv
-ug412UdZkO+kxZxrm9khjtCZ3TAx9rNqLSORxDDPX3c6Reai0XGAT2N4USibwnzl
-iTbXrHBFy02dx8orRG6NwVkRnnObp3yA0PxZKUefiG4IjAjVgnFr5eE1TMI4Yzyt
-OdgKHqHZL9yWPzop57FNFbq5hkA2YGspSAnHyOFO0F3e09wYTI23+wb7cEZ3CPl9
-uGgoeq7ISv0Ab6OSyOYj+He39ncIHnIIBV2N+W8brcQrfuLFuYZ2c5srPQ==
-----END RSA PRIVATE KEY-----
--- a/daml-assistant/daml-helper/test-certificates/ca.srl
+++ b/daml-assistant/daml-helper/test-certificates/ca.srl
@ -1 +0,0 @@
-09DC3E5E8C459093D747E436362D52E9231E62C2
--- a/daml-assistant/daml-helper/test-certificates/client.crt
+++ b/daml-assistant/daml-helper/test-certificates/client.crt
@ -1,28 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIE2jCCAsKgAwIBAgIUCdw+XoxFkJPXR+Q2Ni1S6SMeYsIwDQYJKoZIhvcNAQEL
-BQAwFTETMBEGA1UEAwwKMC4wLjAuMC5jYTAeFw0yMDAzMTExNTI0MTNaFw0zMDAz
-MDkxNTI0MTNaMBkxFzAVBgNVBAMMDjAuMC4wLjAuY2xpZW50MIICIjANBgkqhkiG
-9w0BAQEFAAOCAg8AMIICCgKCAgEAruK/+raI49fNgx4meLXTjFsv03mifaS+OFgo
-xfGL8AqU3rTTTUrUFqtX0L6pTvf2RuOHayKBNGVBEIajqzffSao8V0t4x+5/zHZ/
-E6XfRYt9m+y+3eR/iNO+YKOoCSVS309aIEZdWqXU2sHt3Ed6qO36+eI1fKR2nuyy
-MkjaC5VnAXT0oxgnayfr4eN3rzvDx2NahJG4cs/xpcmalwDfLGGeLx4bJOz770ew
-18/F3huVWNY5uDh9V602KQ6IMWqF+A+piP4MbE2nitELNhIY2mpBGeoUhbKV/qA7
-7thl1O2dojViowzXmvcmnVX3M/fMN464R9/qtX4Fz6RgalXE4aylLDgLkbeq25q8
-Z3aZKdPC3Y7oOgaYlS46xUZR9pUMT3eexSbGPiaRZI0V8KgJMZZJwAQNLkYj8ys5
-qc4EJ3lJbvnwnVVxoammDVogG1HOxgyJykBn/RurCJO+Xa2vcodSqXD3WJpJNT0Y
-fTLzWhptg/JuZILj7FkYJgZ2JinQAXbG4b/uJqxfryLz8yz49XeI4aKySQTHR/pG
-ln9c0cIngCPgKwKivg/kbRrzOH7pfkYR0znSCc2lDcfNor/3Qumcwv/m25BakU7D
-2NmXRZCIqFXfivutVit14ppBBfUOgTw4BV74XHAqvqtNmQCDh2/EwCO4zXb/AiPM
-UNgdxPECAwEAAaMeMBwwGgYDVR0RBBMwEYIJbG9jYWxob3N0hwR/AAABMA0GCSqG
-SIb3DQEBCwUAA4ICAQB0U2XPAZUQkNkRMjkAms6UL3V/KBZDV9CK4KwS7Tn9QUv5
-GQep/M9sh9YwkZiTVNzkhcPhi1LDrqIqPycEFnaO1nQpXLIYd0mmEykM3YSYgnHf
-6EkDADR9V9edJDJEZ6DUNeZVk/njidpJjF3TjOgl/v4eDB27R0647wEw4F64WoKe
-HNpXnHmSMcHPdV1mKds7wm9fbImFwwrOdgVZQsrawKJktlo77/hFlJvixtxIWRoS
-1gvV9AuRJ1zQ1vC5bOBtS/hbL2/Yx0Yzl/neJoPCXFCN6wll0UIm1iJ0EWxmRRyv
-svzaaYvwZv3MS9TbgirXlKCs7h7ULjbX27dZ7b+czzvcMVeK8HbLjaunBlqeqBkI
-33L3rBzY0U853UZzdIIPk7GHnEfg89OAVlxwTqAWhNa9if+mtccA3x1uRM4OzPmw
-4ULyMc5vOCVipYkS750wft+7mX0Nl0wDHfs2X7rqO8+uXsQEGX4oheHQwEgZJJc0
-iKuuWG4ry3DHS+RgjgHCVrWnbXr1OmpP9Kmg9smOooAJboaPrI0pFnkSWPYMYiSw
-HouujRycXjzQPjF2EpuSpvmzEO8PlHIOPkzGkL4LgfgbUVqMdhe7clNP4eRAaY9k
-aMV+7mab1+hdW6WhezKjzfbOFLHOCgv/t/4V5vAIrQTkqhyO4yHr+mJwzAy0kw==
-----END CERTIFICATE-----
--- a/daml-assistant/daml-helper/test-certificates/client.csr
+++ b/daml-assistant/daml-helper/test-certificates/client.csr
@ -1,26 +0,0 @@
-----BEGIN CERTIFICATE REQUEST-----
-MIIEXjCCAkYCAQAwGTEXMBUGA1UEAwwOMC4wLjAuMC5jbGllbnQwggIiMA0GCSqG
-SIb3DQEBAQUAA4ICDwAwggIKAoICAQCu4r/6tojj182DHiZ4tdOMWy/TeaJ9pL44
-WCjF8YvwCpTetNNNStQWq1fQvqlO9/ZG44drIoE0ZUEQhqOrN99JqjxXS3jH7n/M
-dn8Tpd9Fi32b7L7d5H+I075go6gJJVLfT1ogRl1apdTawe3cR3qo7fr54jV8pHae
-7LIySNoLlWcBdPSjGCdrJ+vh43evO8PHY1qEkbhyz/GlyZqXAN8sYZ4vHhsk7Pvv
-R7DXz8XeG5VY1jm4OH1XrTYpDogxaoX4D6mI/gxsTaeK0Qs2EhjaakEZ6hSFspX+
-oDvu2GXU7Z2iNWKjDNea9yadVfcz98w3jrhH3+q1fgXPpGBqVcThrKUsOAuRt6rb
-mrxndpkp08Ldjug6BpiVLjrFRlH2lQxPd57FJsY+JpFkjRXwqAkxlknABA0uRiPz
-KzmpzgQneUlu+fCdVXGhqaYNWiAbUc7GDInKQGf9G6sIk75dra9yh1KpcPdYmkk1
-PRh9MvNaGm2D8m5kguPsWRgmBnYmKdABdsbhv+4mrF+vIvPzLPj1d4jhorJJBMdH
-+kaWf1zRwieAI+ArAqK+D+RtGvM4ful+RhHTOdIJzaUNx82iv/dC6ZzC/+bbkFqR
-TsPY2ZdFkIioVd+K+61WK3XimkEF9Q6BPDgFXvhccCq+q02ZAIOHb8TAI7jNdv8C
-I8xQ2B3E8QIDAQABoAAwDQYJKoZIhvcNAQELBQADggIBAHG+LyIdv0FDW/ms0H9O
-pxuo9bhqTUw9dX/wX3PlFY9b9MZB+B9DfcMN5bYMqZhx7Mpqku0M/8XE4PCK/IPQ
-qmOEEvdpS2RH6t/fjKowjFBwGFUctX+oi0wvNGS5Kq4mTRB2bXRmGTgqhtNF5kKi
-hE/4oo4BArPquSE6ltimIuUgTGL68/sOFj1UAd5AoThzK5KPr02Hej39ZB0qrJOa
-jY4cxaMkEU84XrZG/aVE0Ohj53CgWan5b7X2kpUT5fYV6cvm6N8K9clJQ+8tEbzB
-I844RzkfTPpVOmaJtXoeO7DIa1SwekD2g0nI5LIltszm6jI09LkS/GzGEvC4tE/P
-X28mI7V+qpn8D2HqwLRBBh67MPD2VLqTtYds7Ep+CrblMVASlAA6DX4e9pbcZFpD
-zbHQ0PT6Mqlftk/OLswk7ASmSyy8OS7cfEakYq8iP91jjfYzcicn8E3/LTJTOyeF
-BNiiH64vWdI2ISdhMLGAQ2hkRJM7uspnNvp3LVsTXAYF/PSFuEENXAq61C1uo/0E
-S1CUHTkW6CAxvCCNZCtvZmnHpO3bJsT9t3yQM/O/lCSBcm06Qi8M08xxmj2J+Maj
-+afqPNd+2s89aBUCvBTuPGGAvG4oLOrjFj2wuUG7j/k0zmK3zwOmPzWyM6Qa4zNS
-is/36r/j4vJze5VdJeRPYHUF
-----END CERTIFICATE REQUEST-----
--- a/daml-assistant/daml-helper/test-certificates/client.key
+++ b/daml-assistant/daml-helper/test-certificates/client.key
@ -1,51 +0,0 @@
-----BEGIN RSA PRIVATE KEY-----
-MIIJKAIBAAKCAgEAruK/+raI49fNgx4meLXTjFsv03mifaS+OFgoxfGL8AqU3rTT
-TUrUFqtX0L6pTvf2RuOHayKBNGVBEIajqzffSao8V0t4x+5/zHZ/E6XfRYt9m+y+
-3eR/iNO+YKOoCSVS309aIEZdWqXU2sHt3Ed6qO36+eI1fKR2nuyyMkjaC5VnAXT0
-oxgnayfr4eN3rzvDx2NahJG4cs/xpcmalwDfLGGeLx4bJOz770ew18/F3huVWNY5
-uDh9V602KQ6IMWqF+A+piP4MbE2nitELNhIY2mpBGeoUhbKV/qA77thl1O2dojVi
-owzXmvcmnVX3M/fMN464R9/qtX4Fz6RgalXE4aylLDgLkbeq25q8Z3aZKdPC3Y7o
-OgaYlS46xUZR9pUMT3eexSbGPiaRZI0V8KgJMZZJwAQNLkYj8ys5qc4EJ3lJbvnw
-nVVxoammDVogG1HOxgyJykBn/RurCJO+Xa2vcodSqXD3WJpJNT0YfTLzWhptg/Ju
-ZILj7FkYJgZ2JinQAXbG4b/uJqxfryLz8yz49XeI4aKySQTHR/pGln9c0cIngCPg
-KwKivg/kbRrzOH7pfkYR0znSCc2lDcfNor/3Qumcwv/m25BakU7D2NmXRZCIqFXf
-ivutVit14ppBBfUOgTw4BV74XHAqvqtNmQCDh2/EwCO4zXb/AiPMUNgdxPECAwEA
-AQKCAgBZg9SyNoZA4S/fIiqc9KywlegX/ZVvbEi1PGK6VtXC6xeiGrphQKDobZGI
-Vl8A/ajARiwFaWbq87znAZN6yyFuakVyhT3wUCJ3/Fs1KlzrEugbTIWxvAiPd5pl
-ir8y1zjg9pPyGzIjeOhHhKYEb03Yc99X0jKAdwoEdLENTf7VmQZdV4j0hiN/FLMH
-L1AOkK+4OiGV46Sel9NfgZ6wFhElfV3jTiykrOyTYIWjIUVtV38NNrHamoeFvjIP
-t9F8QcMK4rFrXmXrdaABTNjJN2AjQ+nIoukYOf3OlCO5MGiHIYzi/yJaxPMC7eiE
-9gCPSBHuig3HNFTFyxicXM3A/9/CrfEFKTCcVrHsc/prPt7QOF6K/O80sggJ2ISg
-Sks/0qgmOJ15OviZk9nmMEY2K7qfQpUxaWeA/IADGqyoJx/MkhSrFwU4uLBHymZN
-fjbNKg2gAED2oucRUkqc1tW4L+k6TC0i1PnsLWIr6JUEc1YEiNkiehPojmvX8SeH
-MqQlAnGdVBzGBBvspLVg6SGQBDcRRejWlIYuGHEvWLKDe21/R4yT142nywDiJ+vC
-Lsq5ZgHkFMl3l3K3s+jNbLm3zIRGZ3PHjKWQUal5k61ImsgE1UtrWnlIqCDzTgWZ
-exUWCP23o9n+LXht4nDFHq+12pxyukmQJBJEVC76+lJjI4Rg8QKCAQEA6JQxxR2V
-jbEg9+9x4JHLoWwrZizAAA12TpQGbGfrnO+eFA7Am1m2rACglR+8wWK4OPao6I3R
-XjIsKoja87AtnEIjSoQXeplqjCKO4RaAFDewTU0nrvrwU92Pf3hHUwhuwARiPJtS
-Q6GMFNS5BYEuS4Y2nyFEXtJVPmEBLpU4dLbUzJCrTE8Yd/PO64ukjY34lwOXKo8f
-CP3GX1VfoGzdDypyR1mDctAxfhavoHqej4xqFjUHGZeSpibDowml1fCc+S/2mrsn
-hHzIsdjE/t1BmuWWofv5ECao65LRjG50/qY0/+idIW8SJqLV/LPeXo8lN2MVPCLk
-xURdH040CKND9QKCAQEAwH8+4xG4MACeg7P8uhpFRUgtkp5TtqK338cJOKAJ9mkT
-87mE7Tc92pbqjWZEvJJRu36LVr3mgK6dfVDGJ5E0yZTd9hrYL0HNNwCVWxjEc7b0
-Lzb3M+8qfMErgE01FtHyveppaIH1wLkYu3Zg4YA+ouEztGbsRkFE82rB1JRFu5SU
-BVq+cF7oGnGGregI+p8vDfkoJcG4Qt9u7JPwtuzh8MRTb+ryEjW0WLxU8euw7FrE
-DPWS91/X9KAQc+lDlotDFwQrhOLzvMo27PtYiarS8oduLriqG94ENBrH2NkBok1W
-oBpeJd+29CbgkugtWPTmaH0PwhqeTmMQVmwLkFybjQKCAQAFsiNp5WiVOMJK8CVE
-z61B/ckuTmhBWBMOp5dkrkLZ7BBeA2J6K39KxRUpscZIoidK1debImX/PZFRVVqv
-XyAu1HvSxltg2EMAvZPsNUXbuOVrbzlKksCx/RoXkBWHFgzITRMu0sr39wvcMr15
-QgmlNds+mGz5OYN27J8/yc3BJf0eKWjYjJNX1LO7lwbnpJNy91aLZ0fmS3jBOvEF
-l8TuKybzUmDivfCIWvvgHUCm2VR7yL6sxMaFpStjYcga7jKZ86/BaFX2a6vqlxlz
-+G0z4u2GeApId/npEwZovwfEeMORhNvcRsEWCyTcdHc8r5rEuXt6powdvKffLWYe
-1AjFAoIBAQCmpkKqUG/V1uNkf9DeyNmJhlg1463zomFvcR+xjxOw6P1l9gl3WGjL
-MfYzngMKAd6SZJZ67QJ+Cy27DM/P92zsy11xr4HTP7NK1811xTZmO1ChA4P1yStO
-P+nKNI0uiWoOMr84w7IfO9+Gg5CSCPWxCyg5GRWaKO1pktXllMvd/l47WHkgTXnB
-UuFW81e6qU8SWM8CCPjdpBOi6tztcJyWVVEqxgr16tqMK9eabQKJTHcIBR5L3QTX
-+i7kOmDSFxRo+6o1bEm4+pOcjGj1Hhdr8gVYm3Rhlc6r0TeMqyo3+Z5yEwHI5im8
-q1+mryx7I+HJOeQHlgXRNQAy4W0NeK8NAoIBAAnoypco4fcLtYUCz1nOCvPYPEFM
-3blYgMXEwDBwTauEQ9iRrT3JSK8KGspLY96XHojtMCI8Nxz5A9KOLW3rwieSpmQP
-iEIG8b/DGgDATHBjPp0F1/sbJbNSOOt+e94FpY5fAwNlQBmISg4Ss1kSX1yPoGIu
-sczaIRVbRr6I0lFsciNWL4xKxrIo+dFQae5BGNK1a0lQjk3SuMWJDaODWqZoSTWT
-7Xpo9QSVJSffae964rY4IvO48cSrWF7KX3JLvqO40GBv8unIiGBuacP77dBEEOJc
-l5oYqbb2a9Y0m72tN/KyxPNGxXtBdtKILK6X3D3DWRTAhhd8pNJ8V8UO4vA=
-----END RSA PRIVATE KEY-----
--- a/daml-assistant/daml-helper/test-certificates/client.pem
+++ b/daml-assistant/daml-helper/test-certificates/client.pem
@ -1,52 +0,0 @@
-----BEGIN PRIVATE KEY-----
-MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQCu4r/6tojj182D
-HiZ4tdOMWy/TeaJ9pL44WCjF8YvwCpTetNNNStQWq1fQvqlO9/ZG44drIoE0ZUEQ
-hqOrN99JqjxXS3jH7n/Mdn8Tpd9Fi32b7L7d5H+I075go6gJJVLfT1ogRl1apdTa
-we3cR3qo7fr54jV8pHae7LIySNoLlWcBdPSjGCdrJ+vh43evO8PHY1qEkbhyz/Gl
-yZqXAN8sYZ4vHhsk7PvvR7DXz8XeG5VY1jm4OH1XrTYpDogxaoX4D6mI/gxsTaeK
-0Qs2EhjaakEZ6hSFspX+oDvu2GXU7Z2iNWKjDNea9yadVfcz98w3jrhH3+q1fgXP
-pGBqVcThrKUsOAuRt6rbmrxndpkp08Ldjug6BpiVLjrFRlH2lQxPd57FJsY+JpFk
-jRXwqAkxlknABA0uRiPzKzmpzgQneUlu+fCdVXGhqaYNWiAbUc7GDInKQGf9G6sI
-k75dra9yh1KpcPdYmkk1PRh9MvNaGm2D8m5kguPsWRgmBnYmKdABdsbhv+4mrF+v
-IvPzLPj1d4jhorJJBMdH+kaWf1zRwieAI+ArAqK+D+RtGvM4ful+RhHTOdIJzaUN
-x82iv/dC6ZzC/+bbkFqRTsPY2ZdFkIioVd+K+61WK3XimkEF9Q6BPDgFXvhccCq+
-q02ZAIOHb8TAI7jNdv8CI8xQ2B3E8QIDAQABAoICAFmD1LI2hkDhL98iKpz0rLCV
-6Bf9lW9sSLU8YrpW1cLrF6IaumFAoOhtkYhWXwD9qMBGLAVpZurzvOcBk3rLIW5q
-RXKFPfBQInf8WzUqXOsS6BtMhbG8CI93mmWKvzLXOOD2k/IbMiN46EeEpgRvTdhz
-31fSMoB3CgR0sQ1N/tWZBl1XiPSGI38UswcvUA6Qr7g6IZXjpJ6X01+BnrAWESV9
-XeNOLKSs7JNghaMhRW1Xfw02sdqah4W+Mg+30XxBwwrisWteZet1oAFM2Mk3YCND
-6cii6Rg5/c6UI7kwaIchjOL/IlrE8wLt6IT2AI9IEe6KDcc0VMXLGJxczcD/38Kt
-8QUpMJxWsexz+ms+3tA4Xor87zSyCAnYhKBKSz/SqCY4nXk6+JmT2eYwRjYrup9C
-lTFpZ4D8gAMarKgnH8ySFKsXBTi4sEfKZk1+Ns0qDaAAQPai5xFSSpzW1bgv6TpM
-LSLU+ewtYivolQRzVgSI2SJ6E+iOa9fxJ4cypCUCcZ1UHMYEG+yktWDpIZAENxFF
-6NaUhi4YcS9YsoN7bX9HjJPXjafLAOIn68IuyrlmAeQUyXeXcrez6M1subfMhEZn
-c8eMpZBRqXmTrUiayATVS2taeUioIPNOBZl7FRYI/bej2f4teG3icMUer7XanHK6
-SZAkEkRULvr6UmMjhGDxAoIBAQDolDHFHZWNsSD373HgkcuhbCtmLMAADXZOlAZs
-Z+uc754UDsCbWbasAKCVH7zBYrg49qjojdFeMiwqiNrzsC2cQiNKhBd6mWqMIo7h
-FoAUN7BNTSeu+vBT3Y9/eEdTCG7ABGI8m1JDoYwU1LkFgS5LhjafIURe0lU+YQEu
-lTh0ttTMkKtMTxh3887ri6SNjfiXA5cqjx8I/cZfVV+gbN0PKnJHWYNy0DF+Fq+g
-ep6PjGoWNQcZl5KmJsOjCaXV8Jz5L/aauyeEfMix2MT+3UGa5Zah+/kQJqjrktGM
-bnT+pjT/6J0hbxImotX8s95ejyU3YxU8IuTFRF0fTjQIo0P1AoIBAQDAfz7jEbgw
-AJ6Ds/y6GkVFSC2SnlO2orffxwk4oAn2aRPzuYTtNz3aluqNZkS8klG7fotWveaA
-rp19UMYnkTTJlN32GtgvQc03AJVbGMRztvQvNvcz7yp8wSuATTUW0fK96mlogfXA
-uRi7dmDhgD6i4TO0ZuxGQUTzasHUlEW7lJQFWr5wXugacYat6Aj6ny8N+SglwbhC
-327sk/C27OHwxFNv6vISNbRYvFTx67DsWsQM9ZL3X9f0oBBz6UOWi0MXBCuE4vO8
-yjbs+1iJqtLyh24uuKob3gQ0GsfY2QGiTVagGl4l37b0JuCS6C1Y9OZofQ/CGp5O
-YxBWbAuQXJuNAoIBAAWyI2nlaJU4wkrwJUTPrUH9yS5OaEFYEw6nl2SuQtnsEF4D
-Ynorf0rFFSmxxkiiJ0rV15siZf89kVFVWq9fIC7Ue9LGW2DYQwC9k+w1Rdu45Wtv
-OUqSwLH9GheQFYcWDMhNEy7Syvf3C9wyvXlCCaU12z6YbPk5g3bsnz/JzcEl/R4p
-aNiMk1fUs7uXBuekk3L3VotnR+ZLeME68QWXxO4rJvNSYOK98Iha++AdQKbZVHvI
-vqzExoWlK2NhyBruMpnzr8FoVfZrq+qXGXP4bTPi7YZ4Ckh3+ekTBmi/B8R4w5GE
-29xGwRYLJNx0dzyvmsS5e3qmjB28p98tZh7UCMUCggEBAKamQqpQb9XW42R/0N7I
-2YmGWDXjrfOiYW9xH7GPE7Do/WX2CXdYaMsx9jOeAwoB3pJklnrtAn4LLbsMz8/3
-bOzLXXGvgdM/s0rXzXXFNmY7UKEDg/XJK04/6co0jS6Jag4yvzjDsh8734aDkJII
-9bELKDkZFZoo7WmS1eWUy93+XjtYeSBNecFS4VbzV7qpTxJYzwII+N2kE6Lq3O1w
-nJZVUSrGCvXq2owr15ptAolMdwgFHkvdBNf6LuQ6YNIXFGj7qjVsSbj6k5yMaPUe
-F2vyBVibdGGVzqvRN4yrKjf5nnITAcjmKbyrX6avLHsj4ck55AeWBdE1ADLhbQ14
-rw0CggEACejKlyjh9wu1hQLPWc4K89g8QUzduViAxcTAMHBNq4RD2JGtPclIrwoa
-yktj3pceiO0wIjw3HPkD0o4tbevCJ5KmZA+IQgbxv8MaAMBMcGM+nQXX+xsls1I4
-63573gWljl8DA2VAGYhKDhKzWRJfXI+gYi6xzNohFVtGvojSUWxyI1YvjErGsij5
-0VBp7kEY0rVrSVCOTdK4xYkNo4NapmhJNZPtemj1BJUlJ99p73ritjgi87jxxKtY
-Xspfcku+o7jQYG/y6ciIYG5pw/vt0EQQ4lyXmhiptvZr1jSbva038rLE80bFe0F2
-0ogsrpfcPcNZFMCGF3yk0nxXxQ7i8A==
-----END PRIVATE KEY-----
--- a/daml-assistant/daml-helper/test-certificates/generate-certs.sh
+++ b/daml-assistant/daml-helper/test-certificates/generate-certs.sh
@ -1,24 +0,0 @@
-#!/bin/sh
-# Copyright (c) 2020 The DAML Authors. All rights reserved.
-# SPDX-License-Identifier: Apache-2.0
-
-
-# Note (MK) We check in the certs to avoid incurring a dependency on openssl
-# so this script is not used on CI
-
-# Generate CA key and crt
-openssl genrsa -out ca.key 4096
-openssl req -new -x509 -key ca.key -out ca.crt -subj '/CN=0.0.0.0.ca' -days 3650
-
-# Generate server key, csr and crt
-openssl genrsa -out server.key 4096
-openssl pkey -in server.key -out server.pem
-openssl req -new -key server.key -out server.csr -subj '/CN=0.0.0.0.server'
-openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -extfile openssl-extensions.cnf -extensions req_ext -days 3650
-
-# Generate client key, csr and crt
-openssl genrsa -out client.key 4096
-openssl pkey -in client.key -out client.pem
-openssl req -new -key client.key -out client.csr -subj '/CN=0.0.0.0.client'
-openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt -extfile openssl-extensions.cnf -extensions req_ext -days 3650
-
--- a/daml-assistant/daml-helper/test-certificates/server.crt
+++ b/daml-assistant/daml-helper/test-certificates/server.crt
@ -1,28 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIE2jCCAsKgAwIBAgIUCdw+XoxFkJPXR+Q2Ni1S6SMeYsEwDQYJKoZIhvcNAQEL
-BQAwFTETMBEGA1UEAwwKMC4wLjAuMC5jYTAeFw0yMDAzMTExNTI0MTJaFw0zMDAz
-MDkxNTI0MTJaMBkxFzAVBgNVBAMMDjAuMC4wLjAuc2VydmVyMIICIjANBgkqhkiG
-9w0BAQEFAAOCAg8AMIICCgKCAgEAm7krHojgfzYKrWs6Z4K90CS7pQgxbh91zGF9
-lwc4g4oAgDntUZSQ1UhE/wr6xIjTXj000XTm1rsqaFwXCqoxHayT61iyixe9Qfge
-2V01wnGL/RHdyJ3RdVwpOmFinQk3sB6RKDCaPuNerU1VKxd3teRRw3xWcwoxkiS8
-6JMZ4xiSg6MjhN/es9cZGYT45uiZKH2GzOZT3X9BwSpMh3vZfmRsXzUB9ikcE5bY
-X+6V9o/akXRmp9HrdRlIB3EkAaKTBMRkWNwJqh+60ozhTjPSjDhAs5YmbwtK+7Rb
-6QFSuyXBorKlkW+8TT55xBMLvXvNd56lq2/jzxWHH58wMUYnWS7SoJHpcJIpd5Oz
-8iwURyTAGv1R2wNGcjp02uiKVR7cLqqTVvy3MvyO/1I9eHWikpRt3EVlmIrgj66I
-it+v5XUJDa+uFyrWYkrVsEZfU10a5EXLYq6eBjAX11NDsjKjGh9FWVHy7V/QZrGV
-lGWImK3KlQUugcXbefwowUvzPQZ7x+ajoNLVru8LGqWY9cx89lNYt8NUe3EOhQF2
-g2ahkO1fQ//YuLBenF4Mstm+RMx3PrxZ/YyR15dbcZ+7g2a4aSjq9q5r8Ss2D1S/
-I5UfqHDqZvTCoOl/hFDk5nF4anSiGsiUVMCwcn1LV0QgTw+N2v9p4kb2qRRPLaaq
-YfKrmckCAwEAAaMeMBwwGgYDVR0RBBMwEYIJbG9jYWxob3N0hwR/AAABMA0GCSqG
-SIb3DQEBCwUAA4ICAQAZmi2DeENnnpe31Vkc+IIO0vr0/4DF7qTWiSakEmZ9aMQ2
-pwGJXsax6sEmzV0GCFTGvvPYPb6+H36/AX0fu5G1nHoEiXq3M0t7aopQgD0KLLAe
-/r7hINhT38VQbblYVQW3eSRE19bnDJwbL/TreZQfog2JR7Xfq/dxQnolGC1whTTi
-xm/B6E9Kctp4vzwGTNG64X7UOCPT6TwuTKdZ5+9C/cDWivpO1UpGvaQieihbS7Uy
-/OyYllkx47ySXecOzRQvFzsX2+XjG0uFhNm8+jrctgCttHj5lE9TkFcvYlolbKon
-U+kEQ+IhWpfk4GKrZrm53rNZRov6NWc4bFZYPjQzmBnh86b5taoTCx2BWGeVe2F0
-BCE3OxzvJ+gXcaQmKOPutpJMvWhJQpbDSamslqyr7R2WR5201zhucgKt6w4PEh25
-4iILJ5vdqldRlFZyDW8lnRUCJa0sIuMdpp1cVXoiO+TK58SaOC3Oqwwbt6LQ6H6y
-Cp2n7WRLB0NcVvc/E4bGe+Yva9iIII2L4ISvYTzxwFrJ8lFw3FjawunZqeEFtSLA
-b1bpRCxdncbMlVMbAdGDu5bPo8ssNFBJce8/IoIzyq94WyKaG69uwm4HDT7h/fLb
-CoexUQlFXSd5gItwyb+Wsahx4JiKPhztoGkKAXODAbxaEafQd3wZfrIgFfy/IA==
-----END CERTIFICATE-----
--- a/daml-assistant/daml-helper/test-certificates/server.csr
+++ b/daml-assistant/daml-helper/test-certificates/server.csr
@ -1,26 +0,0 @@
-----BEGIN CERTIFICATE REQUEST-----
-MIIEXjCCAkYCAQAwGTEXMBUGA1UEAwwOMC4wLjAuMC5zZXJ2ZXIwggIiMA0GCSqG
-SIb3DQEBAQUAA4ICDwAwggIKAoICAQCbuSseiOB/Ngqtazpngr3QJLulCDFuH3XM
-YX2XBziDigCAOe1RlJDVSET/CvrEiNNePTTRdObWuypoXBcKqjEdrJPrWLKLF71B
-+B7ZXTXCcYv9Ed3IndF1XCk6YWKdCTewHpEoMJo+416tTVUrF3e15FHDfFZzCjGS
-JLzokxnjGJKDoyOE396z1xkZhPjm6JkofYbM5lPdf0HBKkyHe9l+ZGxfNQH2KRwT
-lthf7pX2j9qRdGan0et1GUgHcSQBopMExGRY3AmqH7rSjOFOM9KMOECzliZvC0r7
-tFvpAVK7JcGisqWRb7xNPnnEEwu9e813nqWrb+PPFYcfnzAxRidZLtKgkelwkil3
-k7PyLBRHJMAa/VHbA0ZyOnTa6IpVHtwuqpNW/Lcy/I7/Uj14daKSlG3cRWWYiuCP
-roiK36/ldQkNr64XKtZiStWwRl9TXRrkRctirp4GMBfXU0OyMqMaH0VZUfLtX9Bm
-sZWUZYiYrcqVBS6Bxdt5/CjBS/M9BnvH5qOg0tWu7wsapZj1zHz2U1i3w1R7cQ6F
-AXaDZqGQ7V9D/9i4sF6cXgyy2b5EzHc+vFn9jJHXl1txn7uDZrhpKOr2rmvxKzYP
-VL8jlR+ocOpm9MKg6X+EUOTmcXhqdKIayJRUwLByfUtXRCBPD43a/2niRvapFE8t
-pqph8quZyQIDAQABoAAwDQYJKoZIhvcNAQELBQADggIBAClS56MhPfgZgVEptfjw
-rQpQIlQMcFzKhLOGbJ2yOpatJ7HxHoNrdIUIZxddVItvKDC2VVFkTVR5b7yuDo8k
-0ikH/7g0LcZPO/p2X3fQhvZeVSfv3Gtuj1SZy4BuNGdhS/0Dh8a9VciRN+jzReA1
-xLDDpOSnAtH6HqwWAY/UqqO4jJa11rZtosFnmwr8hrOGrQ73Op5sj6naOa8bNWIH
-x6h42mkDIqJcQ7VBnEopB5Nkl5GhGAZjgCQcBLc9D4op6Gi4w0wID0M7b4SpE1fP
-isMoOOj9BzQJozryElEHUYZNn1C7xHJ/dAJmQshfnEt0MgonhRlxWbiDL25a2IeC
-rPtXc4d8fetljTBZUdO9J6yhONcO72O4MAf8j3GkM4BTnHcGn9Y6fOaduugX+U7u
-AKQBpgKVNDaHVAm3MS5PQE2AeiwFGsQRhDtMoA0Oiktjc2KxfGoalRxVWcspkUPp
-a8myhzNvHprmGYFp2E59ZGs8qAVOgYCTYsK2InNxFjyR6y6rNu+dXXEaxqODz73G
-UzDB65jn7snitBFVS5BZR0L4kvssDL7KpxaN+UeM8TwrQ0mes1X5825Be8pVsKU6
-jvEpMHuLuXdCwWxIyZAYBVXgiRlh+fSO3OnP393zDvdHzVBLrnyf6BFaKLY4eDGo
-R1QQnVWIzR51H230NfAyXgfO
-----END CERTIFICATE REQUEST-----
--- a/daml-assistant/daml-helper/test-certificates/server.key
+++ b/daml-assistant/daml-helper/test-certificates/server.key
@ -1,51 +0,0 @@
-----BEGIN RSA PRIVATE KEY-----
-MIIJJwIBAAKCAgEAm7krHojgfzYKrWs6Z4K90CS7pQgxbh91zGF9lwc4g4oAgDnt
-UZSQ1UhE/wr6xIjTXj000XTm1rsqaFwXCqoxHayT61iyixe9Qfge2V01wnGL/RHd
-yJ3RdVwpOmFinQk3sB6RKDCaPuNerU1VKxd3teRRw3xWcwoxkiS86JMZ4xiSg6Mj
-hN/es9cZGYT45uiZKH2GzOZT3X9BwSpMh3vZfmRsXzUB9ikcE5bYX+6V9o/akXRm
-p9HrdRlIB3EkAaKTBMRkWNwJqh+60ozhTjPSjDhAs5YmbwtK+7Rb6QFSuyXBorKl
-kW+8TT55xBMLvXvNd56lq2/jzxWHH58wMUYnWS7SoJHpcJIpd5Oz8iwURyTAGv1R
-2wNGcjp02uiKVR7cLqqTVvy3MvyO/1I9eHWikpRt3EVlmIrgj66Iit+v5XUJDa+u
-FyrWYkrVsEZfU10a5EXLYq6eBjAX11NDsjKjGh9FWVHy7V/QZrGVlGWImK3KlQUu
-gcXbefwowUvzPQZ7x+ajoNLVru8LGqWY9cx89lNYt8NUe3EOhQF2g2ahkO1fQ//Y
-uLBenF4Mstm+RMx3PrxZ/YyR15dbcZ+7g2a4aSjq9q5r8Ss2D1S/I5UfqHDqZvTC
-oOl/hFDk5nF4anSiGsiUVMCwcn1LV0QgTw+N2v9p4kb2qRRPLaaqYfKrmckCAwEA
-AQKCAgAT6gkunXiALCwPY2ATrq+Rd7EbeMHBgHpzCaCi+MRsZfCMdVv5C9O9wsE4
-EHJjQdAuBAvGIXoHyeWxdN1perxPPCuqdCxZB08nqZBgYcAnPpgVY/yF1FDd/kwz
-cBLJXE1n03Div9xp4G/SH8qdeSHQ/ALMyhDQI2SVeOdDotQzq4fJF8rKCksTmpVW
-IyAlf2deuzbK60WcVNLW3g7tYJQ+yp7lSgUXMsipZKgFFKDO6DSeV1FtcrX2wqXo
-dbqSDvVYLblbd8AwpmAg3u1NL+lkDymPDcuadcpACB+c25N15W0u3kO4Jp7hDfVK
-ctkUgUmUW5B6LRPn/qvKCnSCSKNtXDGBs3TU4peLzjO3yUwnjih7NWYlJUtbpbJF
-E1cikiFnQ8jP52b9Un6Ilhw3hhQbj2IZaF0qKZjfDYDmsuSQuBHyiUoSwmtZwGN7
-vKETjG9JA/G2bxNuT7wQnij+eJbDL+eGXE58rl8oX4vWLJx3z7WiakQ7KUgyMZwu
-mpe6xxNKGPqcBiVkayKeP71wBQDhzLLEHdZzPQa8yoyU47qN98cRDj5ySbDIg26U
-7654opoOXUda3q4GUQBQiaCqWQPWXyn1VhbAMjeRqEYp3q9DJjYQlsfqJu8IVl8C
-W2GX1M6zXcUo7Wy7Q4UPtyJ8tb7z6No2CWDV+4AbHsC0Jy5ogQKCAQEAywKMfWE0
-dNCOGRjZpy60vOHJcyGeB1P6lAgxR0NeYzfjTyKui6BHDA/VPw+n0gsUehxC50Gd
-wMHfpzsbRZeQycFCPR2zVyNzzogD82g503ORofrxpMrlUKQZtWa243L6jelRAXoJ
-/a9inbi/DjVtQRr4IJ5C4Y2KS2GCSqYYma4JVVUQQl7GpA0SiY/qWgh71l13OSAn
-lZ7ZFRLoQJlx4mb2JpIAnm1nN7hdQFrTW3WRG2IfTc0OVOxYGz2f0m8JDDhajwlc
-Ncx+0LNhQ7mP7maT95s25gAz0l1Q4UsO0NYo799kc7zWBiAW0fNGxOG/z0dYlVh2
-7oZpSnoM5a5M8QKCAQEAxF7ZrcL2hQE8JGQdWEWcWpxUWobouhN9FeMAgz6of5ct
-qVQEGgIZIbWnmKr4XpIY3FpPljRGVdU8pcXW2e02cLw+z0+5XoYdzuQDX+wRRl4P
-vR0wt2rtNzpOByJUqsFvHi6aglt5NlT7Mq0pJMiKz+IpV9JVJMZM+1PuX1cO5YQ/
-Rvf3/4OwSY45Zg5d77llBxcF/yUdGwBuZX1fdB9YTht/UpY2Tz6SlMc8BlS9vca6
-FL5Q+OJieU343czJxzsB4T8aVZHbdUg2gO+PtYWvRFF2C1eWCLcFT1tsjztXWewD
-D0ZvYbPH9E2T1CDhTwzx/Qdqw5Uc6InLVCkoLuh6WQKCAQAf5kShJvcRK/xIIUmC
-Jaqsy2XWO4ATcrS7MhZcNk/Mk2mac76tnf/L+2jswc8DCE6taWdx4zOgqFY2dukw
-JELSERYReGtH1ABMgb7tLoF3on9NzprN5DvoUgDgKkWus9B/IBxkeQK85CRA2Fjd
-KLQEOPKoXXXw70a91ZKdnD/dViWNTRKC+1WHTa6OAxk2EIM1CfbD+TN/JTjDQPdR
-v0rP4pHnOaXzPwmrDcNJa3wusOiePurgVMpduc2WajaE4IGxc+F2/GeK5JlAvg8Y
-jz34nhG+JJuZxIpgEd21qQ+o7R39o0KrlQ6kY8JyNyH1qetz7KgUv5PgoypEU61X
-Ie5hAoIBAF/lAeA9CS3CgKA006+7rrMBDKB4qUXVJox9ok51VsuYBBBgmvAofiVc
-FFAVjdyA8+sHnz32oTJhQ5CgoF8j3CYJh5KtmBR04jGaX5uEKJt4a68qhhPL/7Os
-oVYSic4pUB4pHAL0sKi7rz/8F8+Cr2b9RrtAV5vxyr4hKpMcbIXgoxYBGfaJVJlW
-/ui7s1vR6Wgg8ii68w+wkji1lNucQv9BpleqSzM/l01YThO5Zj86wLxIhDpGM1iR
-nyqRSygjxLM+oZmP9N+9OACW/FLkycZPEZpQV1BCMDGkr8rya6HaA1R+TP4lUUwY
-Zkx9EgoMhE/QQ27nboqQX97lil394WECggEAI0XUmJ2tpWdOnuzfkIF/PMHKOaug
-98OJq46Gp6jjR/zsGiLOC2nHjOQRcAOc7L9bOCSJw8vtEdI2TEQ1Oaw3Sqa+gsGi
-hkP0WEnkpGHDxaaeiqDLuTFIFtgNG20r5BzDP55b+zwrVeZhctFhvg/F1iX24Y2u
-hE9yXcJ+5GHC8tvOJYhvuS/2Ql7LPkJCzDUwmrbhl0YHn6SzMur1AoKwEglUdX48
-Zc6H0qn6mkP3fNR8ttNdnHkXJUAr1VdCTExz4qy4yzdZ/0/pwWPIQ9O9eSXsIYs4
-KnqWBr6R0CMVz5ELu9rnauc4IkgR/Msz8aG1Jfh3d+CqZq1YLtHYmzXgrw==
-----END RSA PRIVATE KEY-----
--- a/daml-assistant/daml-helper/test-certificates/server.pem
+++ b/daml-assistant/daml-helper/test-certificates/server.pem
@ -1,52 +0,0 @@
-----BEGIN PRIVATE KEY-----
-MIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQCbuSseiOB/Ngqt
-azpngr3QJLulCDFuH3XMYX2XBziDigCAOe1RlJDVSET/CvrEiNNePTTRdObWuypo
-XBcKqjEdrJPrWLKLF71B+B7ZXTXCcYv9Ed3IndF1XCk6YWKdCTewHpEoMJo+416t
-TVUrF3e15FHDfFZzCjGSJLzokxnjGJKDoyOE396z1xkZhPjm6JkofYbM5lPdf0HB
-KkyHe9l+ZGxfNQH2KRwTlthf7pX2j9qRdGan0et1GUgHcSQBopMExGRY3AmqH7rS
-jOFOM9KMOECzliZvC0r7tFvpAVK7JcGisqWRb7xNPnnEEwu9e813nqWrb+PPFYcf
-nzAxRidZLtKgkelwkil3k7PyLBRHJMAa/VHbA0ZyOnTa6IpVHtwuqpNW/Lcy/I7/
-Uj14daKSlG3cRWWYiuCProiK36/ldQkNr64XKtZiStWwRl9TXRrkRctirp4GMBfX
-U0OyMqMaH0VZUfLtX9BmsZWUZYiYrcqVBS6Bxdt5/CjBS/M9BnvH5qOg0tWu7wsa
-pZj1zHz2U1i3w1R7cQ6FAXaDZqGQ7V9D/9i4sF6cXgyy2b5EzHc+vFn9jJHXl1tx
-n7uDZrhpKOr2rmvxKzYPVL8jlR+ocOpm9MKg6X+EUOTmcXhqdKIayJRUwLByfUtX
-RCBPD43a/2niRvapFE8tpqph8quZyQIDAQABAoICABPqCS6deIAsLA9jYBOur5F3
-sRt4wcGAenMJoKL4xGxl8Ix1W/kL073CwTgQcmNB0C4EC8YhegfJ5bF03Wl6vE88
-K6p0LFkHTyepkGBhwCc+mBVj/IXUUN3+TDNwEslcTWfTcOK/3Gngb9Ifyp15IdD8
-AszKENAjZJV450Oi1DOrh8kXysoKSxOalVYjICV/Z167NsrrRZxU0tbeDu1glD7K
-nuVKBRcyyKlkqAUUoM7oNJ5XUW1ytfbCpeh1upIO9VgtuVt3wDCmYCDe7U0v6WQP
-KY8Ny5p1ykAIH5zbk3XlbS7eQ7gmnuEN9Upy2RSBSZRbkHotE+f+q8oKdIJIo21c
-MYGzdNTil4vOM7fJTCeOKHs1ZiUlS1ulskUTVyKSIWdDyM/nZv1SfoiWHDeGFBuP
-YhloXSopmN8NgOay5JC4EfKJShLCa1nAY3u8oROMb0kD8bZvE25PvBCeKP54lsMv
-54ZcTnyuXyhfi9YsnHfPtaJqRDspSDIxnC6al7rHE0oY+pwGJWRrIp4/vXAFAOHM
-ssQd1nM9BrzKjJTjuo33xxEOPnJJsMiDbpTvrniimg5dR1rergZRAFCJoKpZA9Zf
-KfVWFsAyN5GoRiner0MmNhCWx+om7whWXwJbYZfUzrNdxSjtbLtDhQ+3Iny1vvPo
-2jYJYNX7gBsewLQnLmiBAoIBAQDLAox9YTR00I4ZGNmnLrS84clzIZ4HU/qUCDFH
-Q15jN+NPIq6LoEcMD9U/D6fSCxR6HELnQZ3Awd+nOxtFl5DJwUI9HbNXI3POiAPz
-aDnTc5Gh+vGkyuVQpBm1ZrbjcvqN6VEBegn9r2KduL8ONW1BGvggnkLhjYpLYYJK
-phiZrglVVRBCXsakDRKJj+paCHvWXXc5ICeVntkVEuhAmXHiZvYmkgCebWc3uF1A
-WtNbdZEbYh9NzQ5U7FgbPZ/SbwkMOFqPCVw1zH7Qs2FDuY/uZpP3mzbmADPSXVDh
-Sw7Q1ijv32RzvNYGIBbR80bE4b/PR1iVWHbuhmlKegzlrkzxAoIBAQDEXtmtwvaF
-ATwkZB1YRZxanFRahui6E30V4wCDPqh/ly2pVAQaAhkhtaeYqvhekhjcWk+WNEZV
-1TylxdbZ7TZwvD7PT7lehh3O5ANf7BFGXg+9HTC3au03Ok4HIlSqwW8eLpqCW3k2
-VPsyrSkkyIrP4ilX0lUkxkz7U+5fVw7lhD9G9/f/g7BJjjlmDl3vuWUHFwX/JR0b
-AG5lfV90H1hOG39SljZPPpKUxzwGVL29xroUvlD44mJ5TfjdzMnHOwHhPxpVkdt1
-SDaA74+1ha9EUXYLV5YItwVPW2yPO1dZ7AMPRm9hs8f0TZPUIOFPDPH9B2rDlRzo
-ictUKSgu6HpZAoIBAB/mRKEm9xEr/EghSYIlqqzLZdY7gBNytLsyFlw2T8yTaZpz
-vq2d/8v7aOzBzwMITq1pZ3HjM6CoVjZ26TAkQtIRFhF4a0fUAEyBvu0ugXeif03O
-ms3kO+hSAOAqRa6z0H8gHGR5ArzkJEDYWN0otAQ48qhddfDvRr3Vkp2cP91WJY1N
-EoL7VYdNro4DGTYQgzUJ9sP5M38lOMNA91G/Ss/ikec5pfM/CasNw0lrfC6w6J4+
-6uBUyl25zZZqNoTggbFz4Xb8Z4rkmUC+DxiPPfieEb4km5nEimAR3bWpD6jtHf2j
-QquVDqRjwnI3IfWp63PsqBS/k+CjKkRTrVch7mECggEAX+UB4D0JLcKAoDTTr7uu
-swEMoHipRdUmjH2iTnVWy5gEEGCa8Ch+JVwUUBWN3IDz6wefPfahMmFDkKCgXyPc
-JgmHkq2YFHTiMZpfm4Qom3hrryqGE8v/s6yhVhKJzilQHikcAvSwqLuvP/wXz4Kv
-Zv1Gu0BXm/HKviEqkxxsheCjFgEZ9olUmVb+6LuzW9HpaCDyKLrzD7CSOLWU25xC
-/0GmV6pLMz+XTVhOE7lmPzrAvEiEOkYzWJGfKpFLKCPEsz6hmY/03704AJb8UuTJ
-xk8RmlBXUEIwMaSvyvJrodoDVH5M/iVRTBhmTH0SCgyET9BDbuduipBf3uWKXf3h
-YQKCAQAjRdSYna2lZ06e7N+QgX88wco5q6D3w4mrjoanqONH/OwaIs4LaceM5BFw
-A5zsv1s4JInDy+0R0jZMRDU5rDdKpr6CwaKGQ/RYSeSkYcPFpp6KoMu5MUgW2A0b
-bSvkHMM/nlv7PCtV5mFy0WG+D8XWJfbhja6ET3Jdwn7kYcLy284liG+5L/ZCXss+
-QkLMNTCatuGXRgefpLMy6vUCgrASCVR1fjxlzofSqfqaQ/d81Hy2012ceRclQCvV
-V0JMTHPirLjLN1n/T+nBY8hD0715JewhizgqepYGvpHQIxXPkQu72udq5zgiSBH8
-yzPxobUl+Hd34KpmrVgu0dibNeCv
-----END PRIVATE KEY-----
--- a/daml-assistant/daml-helper/test/DA/Daml/Helper/Test/Tls.hs
+++ b/daml-assistant/daml-helper/test/DA/Daml/Helper/Test/Tls.hs
@ -20,7 +20,7 @@ main = do
    setEnv "TASTY_NUM_THREADS" "1" True
    damlHelper <- locateRunfiles (mainWorkspace </> "daml-assistant" </> "daml-helper" </> exe "daml-helper")
    sandbox <- locateRunfiles (mainWorkspace </> "ledger" </> "sandbox" </> exe "sandbox-binary")
-    certDir <- locateRunfiles (mainWorkspace </> "daml-assistant" </> "daml-helper" </> "test-certificates")
+    certDir <- locateRunfiles (mainWorkspace </> "daml-assistant" </> "daml-helper")
    withTempFile $ \portFile ->
        withBinaryFile nullDevice ReadWriteMode $ \devNull ->
        defaultMain $ withResource (createSandbox devNull sandbox portFile (certDir </> "server.crt", certDir </> "server.pem") (certDir </> "ca.crt")) destroySandbox $ \getSandbox ->
--- a/dev-env/windows/manifests/innounp.json
+++ b/dev-env/windows/manifests/innounp.json
@ -0,0 +1,16 @@
+{
+    "version": "0.48",
+    "description": "Inno Setup Unpacker.",
+    "homepage": "http://innounp.sourceforge.net",
+    "license": "GPL-3.0-only",
+    "url": "https://raw.githubusercontent.com/scoopinstaller/binary-mirror/master/innounp/innounp048.rar",
+    "hash": "sha1:638a8ff3b87c40d12b43ca964e6777baca2176c8",
+    "bin": "innounp.exe",
+    "checkver": "Version\\s+([\\d\\.]+)\\s*<br>",
+    "autoupdate": {
+        "url": "https://raw.githubusercontent.com/scoopinstaller/binary-mirror/master/innounp/innounp$cleanVersion.rar",
+        "hash": {
+            "url": "$baseurl/innounp$cleanVersion.sha1"
+        }
+    }
+}
--- a/dev-env/windows/manifests/openssl.json
+++ b/dev-env/windows/manifests/openssl.json
@ -0,0 +1,41 @@
+{
+    "homepage": "https://slproweb.com/products/Win32OpenSSL.html",
+    "version": "1.1.1d",
+    "license": {
+        "identifier": "OpenSSL|Freeware",
+        "url": "https://www.openssl.org/source/license-openssl-ssleay.txt"
+    },
+    "description": "TLS/SSL toolkit",
+    "architecture": {
+        "64bit": {
+            "url": "https://slproweb.com/download/Win64OpenSSL-1_1_1d.exe",
+            "hash": "6afa17d0768cf91b6f69f31fbc67cab1ac2e3f40ccaaadb7a9d6c7fc37b38492"
+        },
+        "32bit": {
+            "url": "https://slproweb.com/download/Win32OpenSSL-1_1_1d.exe",
+            "hash": "414fb64197a60b4167b367a5b7975511231c439b9d0237625450cb87d47550ab"
+        }
+    },
+    "innosetup": true,
+    "bin": "bin\\openssl.exe",
+    "env_set": {
+        "OPENSSL_CONF": "$dir\\bin\\cnf\\openssl.cnf"
+    },
+    "env_add_path": "bin",
+    "checkver": "Win32 OpenSSL v([^\\s]+)",
+    "autoupdate": {
+        "architecture": {
+            "64bit": {
+                "url": "https://slproweb.com/download/Win64OpenSSL-$underscoreVersion.exe"
+            },
+            "32bit": {
+                "url": "https://slproweb.com/download/Win32OpenSSL-$underscoreVersion.exe"
+            }
+        },
+        "hash": {
+            "mode": "json",
+            "jp": "$.files.['$basename'].sha256",
+            "url": "https://raw.githubusercontent.com/slproweb/opensslhashes/master/win32_openssl_hashes.json"
+        }
+    }
+}
--- a/nix/bazel.nix
+++ b/nix/bazel.nix
@ -19,6 +19,7 @@ let shared = rec {
    jq
    netcat-gnu
    nodejs
+    openssl
    patchelf
    postgresql_9_6
    protobuf3_8