From a51e2c0fb42e9c98bdda16ee0b843e62ff8c76ce Mon Sep 17 00:00:00 2001 From: "fix-cat-pas@novox" Date: Fri, 16 Oct 2026 19:32:20 +0200 Subject: [PATCH] Pin route-proxy's acme templates beside its manifest (issue 849) --- .../cmd/route-provider/provider_test.go | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/modules/route-proxy/cmd/route-provider/provider_test.go b/modules/route-proxy/cmd/route-provider/provider_test.go index f5c4b7c2..6c580b97 100644 --- a/modules/route-proxy/cmd/route-provider/provider_test.go +++ b/modules/route-proxy/cmd/route-provider/provider_test.go @@ -105,4 +105,21 @@ func TestRouteProxyIsNotMovedAndKeepsItsOwnFiles(t *testing.T) { if got := hex.EncodeToString(sum[:]); got != "57a39de0943d8b33b9db6cb998ce97f8793602cca6cdfa5849c1c392390454a3" { t.Fatalf("route-proxy's own manifest changed: digest %s", got) } + // The two acme templates are pinned the same way (issue 849): they are what the proxy's certificates are asked + // with, so a change to either is a change to the public ingress. + for file, want := range map[string]string{ + "acme.env": "d66eba145c893080e30e013329fc00e51395f0c31fc8621a20c7b26abc11b52f", + "internal-acme.env": "baf4da75379183758c8ae505be4dd8a79d5b089ae1e7c8ded4d232df40251df5", + } { + text, err := os.ReadFile("../../files/" + file) + if err != nil { + t.Fatal(err) + } + sum := sha256.Sum256(text) + if got := hex.EncodeToString(sum[:]); got != want { + t.Fatalf("route-proxy's files/%s changed: digest %s, pinned %s; if the change is meant, check that the "+ + "public and internal ingress still ask for the certificates they should, then pin the new digest here", + file, got, want) + } + } }