refactor(flows): extract SetupCACertificate to shared function

internal/flows/cert.go

@@ -0,0 +1,69 @@
+package flows
+
+import (
+	"fmt"
+	"os"
+	"time"
+
+	"github.com/safedep/dry/log"
+	"github.com/safedep/pmg/proxy/certmanager"
+	"github.com/safedep/pmg/truststore"
+)
+
+// SetupCACertificate loads the persisted CA from configDir or generates an
+// ephemeral one, merges it with the system CA bundle, and writes the result
+// to outputPath. Returns the certificate, whether it was ephemeral, and any
+// error. The caller is responsible for cleaning up outputPath when ephemeral.
+func SetupCACertificate(configDir, outputPath string) (*certmanager.Certificate, bool, error) {
+	caCert, persisted := loadPersistedCA(configDir)
+	ephemeral := !persisted
+
+	if persisted {
+		log.Debugf("Using persisted CA certificate from %s", configDir)
+		warnIfCANotTrusted()
+	} else {
+		log.Debugf("Generating ephemeral CA certificate for proxy MITM")
+		generated, err := certmanager.GenerateCA(certmanager.DefaultCertManagerConfig())
+		if err != nil {
+			return nil, false, fmt.Errorf("generate CA certificate: %w", err)
+		}
+		caCert = generated
+	}
+
+	merged := certmanager.MergeWithSystemCA(caCert.Certificate)
+	if err := os.WriteFile(outputPath, merged, 0o600); err != nil {
+		return nil, false, fmt.Errorf("write CA certificate to %s: %w", outputPath, err)
+	}
+
+	log.Debugf("CA certificate written to %s", outputPath)
+	return caCert, ephemeral, nil
+}
+
+func loadPersistedCA(dir string) (*certmanager.Certificate, bool) {
+	caCert, err := certmanager.LoadCA(dir)
+	if err != nil {
+		if !os.IsNotExist(err) {
+			log.Warnf("Failed to load persisted CA, using ephemeral: %v", err)
+		}
+		return nil, false
+	}
+
+	if caCert.IsExpired(time.Hour) {
+		log.Warnf("Persisted CA is expired; using ephemeral. Re-run `pmg setup cert install`")
+		return nil, false
+	}
+
+	return caCert, true
+}
+
+func warnIfCANotTrusted() {
+	user, system, err := truststore.Status(certmanager.CACommonName)
+	if err != nil {
+		log.Debugf("Could not determine CA trust status: %v", err)
+		return
+	}
+
+	if !user && !system {
+		log.Warnf("Persisted CA is not trusted in the OS store; native tools may reject TLS. Run `pmg setup cert install`.")
+	}
+}

internal/flows/proxy_flow.go

@@ -2,7 +2,6 @@ package flows
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -21,7 +20,6 @@ import (
 	"github.com/safedep/pmg/proxy"
 	"github.com/safedep/pmg/proxy/certmanager"
 	"github.com/safedep/pmg/proxy/interceptors"
-	"github.com/safedep/pmg/truststore"
 )
 
 type proxyFlow struct {
@@ -329,69 +327,11 @@ func handleExecutionResultError(err error) error {
 	return fmt.Errorf("failed to execute command: %w", err)
 }
 
-// setupCACertificate prefers the persisted CA (created by `pmg setup cert install`)
-// so the proxy signs leaves with the same CA that is in the OS trust store. When no
-// persisted CA exists it falls back to an ephemeral per-run CA, preserving original
-// behavior. The temp file always carries the pure CA merged with the system bundle so
-// env-var trust injection works on every platform.
 func (f *proxyFlow) setupCACertificate() (*certmanager.Certificate, string, error) {
 	dir := config.Get().ConfigDir()
-
+	outputPath := filepath.Join(os.TempDir(), fmt.Sprintf("pmg-ca-cert-%d.pem", os.Getpid()))
-	caCert, persisted := loadPersistedCA(dir)
+	cert, _, err := SetupCACertificate(dir, outputPath)
-	if persisted {
+	return cert, outputPath, err
-		log.Debugf("Using persisted CA certificate from %s", dir)
-		warnIfCANotTrusted()
-	} else {
-		log.Debugf("Generating ephemeral CA certificate for proxy MITM")
-		generated, err := certmanager.GenerateCA(certmanager.DefaultCertManagerConfig())
-		if err != nil {
-			return nil, "", fmt.Errorf("failed to generate CA certificate: %w", err)
-		}
-		caCert = generated
-	}
-
-	mergedPEM := certmanager.MergeWithSystemCA(caCert.Certificate)
-
-	tempDir := os.TempDir()
-	caCertPath := filepath.Join(tempDir, fmt.Sprintf("pmg-ca-cert-%d.pem", os.Getpid()))
-	if err := os.WriteFile(caCertPath, mergedPEM, 0o600); err != nil {
-		return nil, "", fmt.Errorf("failed to write CA certificate to %s: %w", caCertPath, err)
-	}
-
-	log.Debugf("CA certificate written to %s", caCertPath)
-	return caCert, caCertPath, nil
-}
-
-// loadPersistedCA returns the on-disk CA when present and not expired.
-func loadPersistedCA(dir string) (*certmanager.Certificate, bool) {
-	caCert, err := certmanager.LoadCA(dir)
-	if err != nil {
-		if !errors.Is(err, os.ErrNotExist) {
-			log.Warnf("Failed to load persisted CA, using ephemeral: %v", err)
-		}
-		return nil, false
-	}
-
-	if caCert.IsExpired(time.Hour) {
-		log.Warnf("Persisted CA is expired; using ephemeral. Re-run `pmg setup cert install`")
-		return nil, false
-	}
-
-	return caCert, true
-}
-
-// warnIfCANotTrusted logs a hint when the persisted CA is not in any OS store,
-// which matters for native tools (e.g. Go on macOS/Windows) that ignore the
-// injected env vars. Best-effort; never blocks the run.
-func warnIfCANotTrusted() {
-	user, system, err := truststore.Status(certmanager.CACommonName)
-	if err != nil {
-		log.Debugf("Could not determine CA trust status: %v", err)
-		return
-	}
-	if !user && !system {
-		log.Warnf("Persisted CA is not trusted in the OS store; native tools may reject TLS. Run `pmg setup cert install`.")
-	}
 }
 
 // createCertificateManager creates a certificate manager with the given CA certificate