Fix migration test: CA cert needs cRLSign key usage

Two issues fixed:

1. The synthetic CA cert in integration-compose.sh group 19 was created
   with `openssl req -x509 -new` without specifying key usage extensions.
   Go's x509.CreateRevocationList (since Go 1.20) requires the issuer
   cert to have the cRLSign key usage bit set, causing Revoke() to fail
   with HTTP 409 and the subsequent status check to show "signed" instead
   of "revoked".

   Fix: add an OpenSSL extensions config that includes
   basicConstraints=CA:TRUE and keyUsage=keyCertSign,cRLSign, matching
   what a real Puppet Server CA would have.

2. compose-migration.yml test-runner service referenced
   puppet-ca-integ:latest without a build directive, causing
   `docker compose build` to skip it and `up` to fail with a pull error.

   Fix: add build context pointing to Dockerfile.run, consistent with
   how compose.yml defines the same image.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: trevor-vaughan

compose-migration.yml

@@ -46,6 +46,9 @@ services:
   # 0600 root:root).  The test script copies them to a writable temp dir
   # before use — same as a real migration where an admin would scp/rsync.
   test-runner:
+    build:
+      context: .
+      dockerfile: Dockerfile.run
     image: puppet-ca-integ:latest
     user: "0:0"
     depends_on:

test/integration-compose.sh

@@ -1704,11 +1704,23 @@ _MIG_PID=""
 
 # --- 19a: Build a fake "old Puppet CA" directory with openssl ---
 # Create a CA cert + key the way Puppet Server would have them.
+# The cert must include keyCertSign + cRLSign key usage so that Go's
+# x509.CreateRevocationList accepts it as a valid CRL issuer.
 openssl genrsa -out "$_MIG_OLD/ca_key.pem" 2048 2>/dev/null
+cat > "$_MIG_OLD/ca_ext.cnf" <<CAEXTEOF
+[req]
+distinguished_name = dn
+x509_extensions    = v3_ca
+[dn]
+[v3_ca]
+basicConstraints = critical, CA:TRUE
+keyUsage         = critical, keyCertSign, cRLSign
+CAEXTEOF
 openssl req -x509 -new \
     -key "$_MIG_OLD/ca_key.pem" \
     -subj "/CN=Puppet CA: migration-test" \
     -days 3650 \
+    -config "$_MIG_OLD/ca_ext.cnf" \
     -out "$_MIG_OLD/ca_crt.pem" 2>/dev/null
 
 # Create a CRL signed by the old CA.