From 3284b1c4906b90ca2e3864937c66d0fa30772ebf Mon Sep 17 00:00:00 2001
From: Lena <lena@omega>
Date: Sat, 1 Aug 2026 00:00:00 +0000
Subject: Enter git-forge-cloudflare

Runs git-forge on Cloudflare Containers with R2 for durable storage. A
Worker routes every request to one container through a Durable Object.
Inside it, syncd mirrors the data directory to the bucket and restores
it at boot, holding a write until it is durable.

git-forge is neither modified nor vendored: the image builds it from
its own repository at the commit named in forge.rev.
---
 main_test.go | 52 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 main_test.go

(limited to 'main_test.go')

diff --git a/main_test.go b/main_test.go
new file mode 100644
index 0000000..b4b0af2
--- /dev/null
+++ b/main_test.go
@@ -0,0 +1,52 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// The interception ca is added to the system roots and never substituted for
+// them: the one feature that reaches the internet directly is oidc, and it
+// verifies a real provider against the roots the image ships.
+func TestCABundle(t *testing.T) {
+	dir := t.TempDir()
+	sys := filepath.Join(dir, "ca-certificates.crt")
+	cf := filepath.Join(dir, "cloudflare.crt")
+	out := filepath.Join(dir, "ca-bundle.crt")
+	if err := os.WriteFile(sys, []byte("the system roots\n"), 0600); err != nil {
+		t.Fatal(err)
+	}
+
+	// No interception certificate, which is what a bare docker run gets.
+	if err := caBundle(sys, cf, out); err != nil {
+		t.Fatalf("with no interception ca: %v", err)
+	}
+	if got, err := os.ReadFile(out); err != nil || string(got) != "the system roots\n" {
+		t.Errorf("the bundle is %q: %v, want the system roots alone", got, err)
+	}
+
+	if err := os.WriteFile(cf, []byte("the interception ca\n"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	if err := caBundle(sys, cf, out); err != nil {
+		t.Fatalf("with one: %v", err)
+	}
+	got, err := os.ReadFile(out)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(got), "the system roots") {
+		t.Errorf("the system roots were replaced rather than added to: %q", got)
+	}
+	if !strings.Contains(string(got), "the interception ca") {
+		t.Errorf("the interception ca is not in the bundle: %q", got)
+	}
+
+	// A system store that is not there is a bundle that cannot be trusted, not
+	// an empty one.
+	if err := caBundle(filepath.Join(dir, "absent"), cf, out); err == nil {
+		t.Error("a missing system store was accepted")
+	}
+}
-- 
cgit v1.2.3