[misiektoja]

Description

Quote both operands of both conditions in "CA MAY React To Cert Request With Invalid Is_ca In BasicConstraints False But KeyUsage keyCertSign".

Motivation and Context

IF '${body} == error' is a non-empty string and always true. Every response took the error branch, so even an ip was checked for badCertTemplate. The ELSE branch never ran and its unquoted rejection would fail to evaluate.

How Has This Been Tested?

robot --dryrun, robocop check and codespell pass for tests/basic.robot. Python 3.15 with Robot Framework 7.5.

[ralienpp]

@misiektoja you write IF '${body}' == 'error', but shouldn't it be IF ${body} == 'error'? (you stringify the variable, but it should remain in its original form, no?)

[misiektoja]

@misiektoja you write IF '${body}' == 'error', but shouldn't it be IF ${body} == 'error'? (you stringify the variable, but it should remain in its original form, no?)

IF ${body} == 'error' does not work here. Robot replaces ${body} with its text before it evaluates the expression, so Python sees error == 'error' and fails with NameError: name 'error' is not defined.

The form that keeps the original object is $body. a4f10b2 changes the first condition to IF $body == 'error'.

The second condition stays quoted. $status["status"] is a pyasn1 PKIStatus and $status["status"] != 'rejection' is True even for a rejection, so it needs the string form. I checked all three forms in a small Robot file with real responses.

BTW, while checking this against the mock CA I found one more gap. The mock CA answers this ir with an ip that has status rejection and failInfo badCertTemplate. On main the always true condition sent that ip into the error branch, so badCertTemplate was checked by accident. So, with this PR the ip goes to ELSE and a rejection is not checked at all. I think we shall add an ELSE to the inner IF that checks badCertTemplate - what do you think ?