disable worker(Wax.Metadata, []) during tests about wax

[tanguilp]

You can unset the access token in test env. The worker will start but won't try to download anything.

There's more to do regarding metadata management, such as allowing to enable (concurrently?) other sources for older hardware or hardware that has not published (possibly yet) its metadata. Will be for the next version probably

[ericsullivan]

Yeah, I was surprised my new yubikey wasn't there, then I read the dev page. I didn't try to integrate it though... I opened this issue when I was running #7. I guess it's only a problem if you're downloading from other sources that aren't gated by the access token.

[tanguilp]

It is also possible that metadata of an authenticator (key, laptop...) will not be published on this service, which is why I need to think of a way to allow additional metadata (file?).

However since it's a FIDO2/WebAuthn library I'm not comfortable with adding the FIDO1 metadata service. I'll wait a bit for an answer from the FIDO Alliance.

[tanguilp]

Tests actually use some metadata, so it'll be resolved when manual import of metadata will be implemented.

[dfalling]

I'd also like a way to disable the metadata update for tests. Every time I run tests I get the metadata error, which I'd love to suppress since this is what I want.

13:57:49.310 [warn] No access token configured for FIDO metadata, metadata not updated. Some attestation formats and types won't be supported

[tanguilp]

I'm currently working on a new version of Wax (0.2.0) which will be tested using the official test tools and those tests will be removed completely. I'll not forget to disable the metadata service. I could actually also make a separate library for updating metadata. I hope to make it available within 2-3 months.

[tanguilp]

I'm closing this bug without resolution. Indeed, some attestation formats require access to the metadata service (even if it's empty because no access token has been configured), and the tests are actually not the correct way to test the library. I'm considering removing them, but it's nonetheless a convenient way to quickly check there's no problem with the code.

Indeed there are a lot of problems with these tests: some certificates will expire sooner or later for example. The correct way would be to have a separate testing suite with its own metadata, but that's quite a huge work. Meanwhile, there's the official FIDO2 foundation test suite (which is not comprehensive in my opinion) and Wax 0.2.0 passes all the 165 tests.

If you really need the metadata or warn message to disappear, reopen explaining why it's so much needed.