feat: Add opt-in support for proxy CA cert installation (#318)

* feat: Add opt-in support for proxy CA cert installation * fix: Code review fixes * fix: Code review fixes * fix: Code review fixes * fix: Code review fixes * fix: Code review fixes * docs: Add limitation for MacOS MDM script
2026-08-03 07:24:09 +02:00 · 2026-06-03 23:15:02 +05:30
parent c3f3920d2e
commit 4f0db15ede
31 changed files with 1806 additions and 77 deletions
@@ -0,0 +1,45 @@
+package setup
+
+import (
+	"testing"
+
+	"github.com/safedep/pmg/internal/doctor"
+	"github.com/safedep/pmg/proxy/certmanager"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCACheckAbsentIsWarn(t *testing.T) {
+	res := evaluateCACheck(t.TempDir(), false, false, true)
+	assert.Equal(t, doctor.StatusWarn, res.Status)
+}
+
+func TestCACheckTrustedIsPass(t *testing.T) {
+	dir := t.TempDir()
+	ca, err := certmanager.GenerateCA(certmanager.PersistentCACertManagerConfig())
+	require.NoError(t, err)
+	require.NoError(t, certmanager.SaveCA(dir, ca))
+
+	res := evaluateCACheck(dir, true, false, true)
+	assert.Equal(t, doctor.StatusPass, res.Status)
+}
+
+func TestCACheckOnDiskNotTrustedMacWinIsFail(t *testing.T) {
+	dir := t.TempDir()
+	ca, err := certmanager.GenerateCA(certmanager.PersistentCACertManagerConfig())
+	require.NoError(t, err)
+	require.NoError(t, certmanager.SaveCA(dir, ca))
+
+	res := evaluateCACheck(dir, false, false, true) // userScopeSupported=true (mac/win)
+	assert.Equal(t, doctor.StatusFail, res.Status)
+}
+
+func TestCACheckOnDiskNotTrustedLinuxIsWarn(t *testing.T) {
+	dir := t.TempDir()
+	ca, err := certmanager.GenerateCA(certmanager.PersistentCACertManagerConfig())
+	require.NoError(t, err)
+	require.NoError(t, certmanager.SaveCA(dir, ca))
+
+	res := evaluateCACheck(dir, false, false, false) // userScopeSupported=false (linux)
+	assert.Equal(t, doctor.StatusWarn, res.Status)
+}