Pin route-proxy's acme templates beside its manifest (issue 849)

modules/route-proxy/cmd/route-provider/provider_test.go

@@ -105,4 +105,21 @@ func TestRouteProxyIsNotMovedAndKeepsItsOwnFiles(t *testing.T) {
 	if got := hex.EncodeToString(sum[:]); got != "57a39de0943d8b33b9db6cb998ce97f8793602cca6cdfa5849c1c392390454a3" {
 		t.Fatalf("route-proxy's own manifest changed: digest %s", got)
 	}
+	// The two acme templates are pinned the same way (issue 849): they are what the proxy's certificates are asked
+	// with, so a change to either is a change to the public ingress.
+	for file, want := range map[string]string{
+		"acme.env":          "d66eba145c893080e30e013329fc00e51395f0c31fc8621a20c7b26abc11b52f",
+		"internal-acme.env": "baf4da75379183758c8ae505be4dd8a79d5b089ae1e7c8ded4d232df40251df5",
+	} {
+		text, err := os.ReadFile("../../files/" + file)
+		if err != nil {
+			t.Fatal(err)
+		}
+		sum := sha256.Sum256(text)
+		if got := hex.EncodeToString(sum[:]); got != want {
+			t.Fatalf("route-proxy's files/%s changed: digest %s, pinned %s; if the change is meant, check that the "+
+				"public and internal ingress still ask for the certificates they should, then pin the new digest here",
+				file, got, want)
+		}
+	}
 }