asterisk: 24.0.0-rc3, TLS trunks qualified again

rc3 checks a qualify's certificate against the host name, so TLS trunks get
qualify_frequency = 60 and Test qualifies them. The upgrade check and
pnpm test:asterisk pass on rc3. Spec 01's copy of the Dockerfile is in sync
again, and the version test now compares all of it.

apps/api/test/asterisk-version.test.ts

@@ -15,12 +15,14 @@ describe('the pinned Asterisk', () => {
     ).toBe(VERIFIED_ASTERISK);
   });
 
-  it('is the one spec 01 §2 names', () => {
+  it('is the one spec 01 §2 names, and its copy of the Dockerfile is the file', () => {
     const spec = readFileSync(
       new URL('../../../docs/spec/01-infrastructure.md', import.meta.url),
       'utf8',
     );
     expect(spec).toContain(`**Pinned: \`${pinnedAsterisk()}\``);
-    expect(spec).toContain(`ARG ASTERISK_VERSION=${pinnedAsterisk()}`);
+    const copy = /^## 2\. [\s\S]*?^```dockerfile\n([\s\S]*?)^```$/m.exec(spec)?.[1];
+    const file = readFileSync(new URL('../../../asterisk/Dockerfile', import.meta.url), 'utf8');
+    expect(copy, 'spec 01 §2 has a copy of asterisk/Dockerfile: keep it the same').toBe(file);
   });
 });

apps/api/test/asterisk/verified.ts

@@ -4,7 +4,7 @@
 // `pnpm test:asterisk-upgrade` on the new image, act on each change it lists, then update this.
 import { readFileSync } from 'node:fs';
 
-export const VERIFIED_ASTERISK = '24.0.0-rc2';
+export const VERIFIED_ASTERISK = '24.0.0-rc3';
 
 /** The version asterisk/Dockerfile builds. */
 export function pinnedAsterisk(): string {
@@ -57,11 +57,11 @@ export const FACTS = {
     where: 'services/cdr.ts utc() adds the Z itself',
   },
   tlsQualifyByHostname: {
-    expect: false,
+    expect: true,
     what: 'a qualify OPTIONS over TLS checks the certificate against the host name, not the IP',
     where:
-      'generator/pjsip.ts sets qualify_frequency = 0 on TLS trunks because of this (08 §2.1); ' +
-      '24.0.0-rc3 says it fixes it ("Preserve target hostname for qualified OPTIONS destination")',
+      'generator/pjsip.ts qualifies TLS trunks and Test sends PJSIPQualify (08 §2.1). False on ' +
+      '24.0.0-rc2: a TLS trunk then showed as unreachable, so it had qualify_frequency = 0',
   },
 } as const;
 

apps/api/test/tls.test.ts

@@ -105,7 +105,7 @@ describe.skipIf(!hasTestDb || !hasOpenssl)('SIP TLS setting', () => {
     expect(await warningCodes()).not.toContain('tls_cert');
   });
 
-  it('a TLS trunk: no qualify, Test does not send OPTIONS, TLS stays on while it exists', async () => {
+  it('a TLS trunk: qualified like the others (24.0.0-rc3), TLS stays on while it exists', async () => {
     const trunk = await req('POST', '/api/trunks', {
       name: 'voip.ms TLS',
       serverHost: '127.0.0.1',
@@ -119,13 +119,15 @@ describe.skipIf(!hasTestDb || !hasOpenssl)('SIP TLS setting', () => {
     await t.app.generator.apply({ trigger: 'test' });
     const { readFile } = await import('node:fs/promises');
     const conf = await readFile(join(t.app.generator.dir, 'pjsip_selfphoneng.conf'), 'utf8');
-    expect(conf).toMatch(/contact = sip:127\.0\.0\.1:5061;transport=tls\nqualify_frequency = 0\n/);
+    expect(conf).toMatch(/contact = sip:127\.0\.0\.1:5061;transport=tls\nqualify_frequency = 60\n/);
     expect(conf).toMatch(/media_encryption = sdes/);
     expect(conf).toMatch(/verify_server = yes/);
     t.live.amiConnected = true;
     const test = await req('POST', `/api/trunks/${trunk.json().id}/test`);
     expect(test.statusCode).toBe(200);
-    expect(t.ami.actions.filter((a) => a.Action === 'PJSIPQualify')).toEqual([]);
+    expect(t.ami.actions.filter((a) => a.Action === 'PJSIPQualify')).toEqual([
+      expect.objectContaining({ Endpoint: `trunk-${trunk.json().id}` }),
+    ]);
     const off = await req('PATCH', '/api/settings', { 'sip.tlsEnabled': false });
     expect(off.statusCode).toBe(400);
     expect(off.json().error.message).toMatch(/uses TLS/);