1 files changed, 52 insertions, 0 deletions
diff --git a/main_test.go b/main_test.go
new file mode 100644
index 0000000..b4b0af2
--- /dev/null
+++ b/main_test.go
@@ -0,0 +1,52 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// The interception ca is added to the system roots and never substituted for
+// them: the one feature that reaches the internet directly is oidc, and it
+// verifies a real provider against the roots the image ships.
+func TestCABundle(t *testing.T) {
+	dir := t.TempDir()
+	sys := filepath.Join(dir, "ca-certificates.crt")
+	cf := filepath.Join(dir, "cloudflare.crt")
+	out := filepath.Join(dir, "ca-bundle.crt")
+	if err := os.WriteFile(sys, []byte("the system roots\n"), 0600); err != nil {
+		t.Fatal(err)
+	}
+
+	// No interception certificate, which is what a bare docker run gets.
+	if err := caBundle(sys, cf, out); err != nil {
+		t.Fatalf("with no interception ca: %v", err)
+	}
+	if got, err := os.ReadFile(out); err != nil || string(got) != "the system roots\n" {
+		t.Errorf("the bundle is %q: %v, want the system roots alone", got, err)
+	}
+
+	if err := os.WriteFile(cf, []byte("the interception ca\n"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	if err := caBundle(sys, cf, out); err != nil {
+		t.Fatalf("with one: %v", err)
+	}
+	got, err := os.ReadFile(out)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(got), "the system roots") {
+		t.Errorf("the system roots were replaced rather than added to: %q", got)
+	}
+	if !strings.Contains(string(got), "the interception ca") {
+		t.Errorf("the interception ca is not in the bundle: %q", got)
+	}
+
+	// A system store that is not there is a bundle that cannot be trusted, not
+	// an empty one.
+	if err := caBundle(filepath.Join(dir, "absent"), cf, out); err == nil {
+		t.Error("a missing system store was accepted")
+	}
+}