OpenCHAMI / ochami / 40742646346

93%

push

github

fix(tls): verify CA trust across network commands (#219)

Replace the two SMD-specific CA cases from #216 with a shared matrix of
all 108 network commands to verify trust consistently across the tree.
Keep cross-family behavior tests in cacert_test.go to follow the file
organization documented in #218 without including its reorganization.

Check that each command rejects an untrusted TLS server and succeeds
with --cacert. Reuse the same invocations for missing-CA tests and
compare the matrix with network leaf commands exposing --uri so new
commands cannot silently miss CA coverage. Reuse existing payload
fixtures and keep server setup in one place to limit duplication.

Fix RCS console trust by cloning the WebSocket dialer and the HTTP
client's TLS configuration at dial time. Honor certificates loaded after
client construction and keep trust settings local to each connection.
Explicitly discard post-interrupt read errors to preserve a clean exit
and satisfy both supported local and CI linter versions.

Keep the test server open until the console client sends its WebSocket
close reply and TLS close notification to avoid broken pipes on Linux.
Bound the drain with a read deadline and await the hijacked handler
before ending the test, since httptest.Server.Close does not wait for
it.

Verify behavior through TLS requests rather than counting certificate
loads, which would couple tests to the refactor's implementation.

Validate with make test PARALLEL=4, make coverage PARALLEL=4, 100 race
runs of both console TLS cases, and golangci-lint v2.15.0.

Signed-off-by: Devon Bautista <17506592+synackd@users.noreply.github.com>

6 of 6 new or added lines in 1 file covered. (100.0%)

13055 of 13995 relevant lines covered (93.28%)

706.61 hits per line