From ab2a179a55ef153f52046ca787382d20124c8e64 Mon Sep 17 00:00:00 2001
From: d9pouces <github@19pouces.net>
Date: Mon, 7 Sep 2026 08:12:48 +0200
Subject: [PATCH] feat: update config-url configuration with Test CA
 certificate and Dockerfile enhancements

Signed-off-by: d9pouces <github@19pouces.net>
---
 tests/dockerfiles/ConfigUrl.Dockerfile        | 11 +++++--
 .../dockerfiles/repos/config-url-config.yaml  | 30 +++++++++++++++++--
 2 files changed, 36 insertions(+), 5 deletions(-)

diff --git a/tests/dockerfiles/ConfigUrl.Dockerfile b/tests/dockerfiles/ConfigUrl.Dockerfile
index 3a17244..e42525f 100644
--- a/tests/dockerfiles/ConfigUrl.Dockerfile
+++ b/tests/dockerfiles/ConfigUrl.Dockerfile
@@ -8,7 +8,12 @@ RUN id-configurator apply \
     --config-url-cacert-content "$CONFIG_URL_CACERT_CONTENT" \
     --src /src --dst /dst
 FROM target AS runtime
+ARG CONFIG_REPO_PORT
+RUN apt-get update && apt-get install -y --no-install-recommends curl
 COPY --from=configuration /dst/ /
-RUN grep -qx \
-    'test-only certificate fetched via --config-url by the id-configurator integration tests' \
-    /usr/local/share/ca-certificates/config-url-marker.crt
+# Proves the root CA the downloaded configuration installed is actually
+# trusted system-wide: no --insecure/--no-check-certificate here, unlike the
+# --config-url-cacert-content fetch above (which trusts only that one CA to
+# validate the download itself, before anything has been installed yet).
+RUN curl -fsS "https://host.docker.internal:${CONFIG_REPO_PORT}/config.yaml" \
+    | grep -q 'organisation: InterDiode'
diff --git a/tests/dockerfiles/repos/config-url-config.yaml b/tests/dockerfiles/repos/config-url-config.yaml
index 3231c32..b9d419d 100644
--- a/tests/dockerfiles/repos/config-url-config.yaml
+++ b/tests/dockerfiles/repos/config-url-config.yaml
@@ -4,11 +4,37 @@
 # (tests/dockerfiles/ConfigUrl.Dockerfile). No per-run templating is needed:
 # unlike the module-* fixtures, nothing in this document needs to reference
 # its own server's dynamic host:port.
+#
+# The certificate below is tests/certs/test-ca.crt.pem - the same Test CA
+# that signs repo-server.crt.pem in this directory. It's duplicated here
+# (rather than read at build time) because a Docker build's context is
+# this directory alone; keep both copies in sync if the Test CA is ever
+# regenerated.
 uuid: 8f3e4b2c-9a41-4d3e-8f1a-2b6c7d8e9f01
 organisation: InterDiode
 description: Configuration downloaded via --config-url
 configurations:
   certificates:
-  - name: config-url-marker
+  - name: Test CA
     content: |
-      test-only certificate fetched via --config-url by the id-configurator integration tests
+      -----BEGIN CERTIFICATE-----
+      MIIDdTCCAl2gAwIBAgIUKq4URHQwyg7IzJ3ViAGGlM9pGCwwDQYJKoZIhvcNAQEL
+      BQAwQjEeMBwGA1UECgwVaWQtY29uZmlndXJhdG9yLXRlc3RzMSAwHgYDVQQDDBdp
+      ZC1jb25maWd1cmF0b3IgVGVzdCBDQTAeFw0yNjA5MDUyMTA4MTNaFw00NjA4MzEy
+      MTA4MTNaMEIxHjAcBgNVBAoMFWlkLWNvbmZpZ3VyYXRvci10ZXN0czEgMB4GA1UE
+      AwwXaWQtY29uZmlndXJhdG9yIFRlc3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+      DwAwggEKAoIBAQD8bMteh3MDnbW6OoFMlhA4Z2QAabVoSFlSE/Si7ut+L/3v1GY4
+      lixenwLQc8a2koIH9CtmOodzfO7hpro/VUjYJ9J2eTsXLLiOg7OgggG1cKV9/kt7
+      RF0Q4hkcanGmiffc4xbz4ZedU6lP1vzLCsgU0A8OPt6svcNjGcWbjxss0KjgxGZ7
+      H4UKdL7Mv4W2Y6Fw1b4eV2M6jErkQK6IPXsHGFh7JkzliNcb0sX1VfbfauS84tBh
+      f3EHwzLNhbjtEmQhQdqgsg4Cbk/gWur//6aEvlD/X12PAUbrp4DFD+CDuVagLX7I
+      7TQBXNFGKhozzQuDg7DFg1gIV8SFx2m+s60/AgMBAAGjYzBhMB0GA1UdDgQWBBSb
+      zJ7DsaxwCeqbfOXGJ3x+u7bjozAfBgNVHSMEGDAWgBSbzJ7DsaxwCeqbfOXGJ3x+
+      u7bjozAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0B
+      AQsFAAOCAQEAEV1+dG3agh0S/AR8jC8M33HXFyvneCCRtfb5q/loJ//VoWPbD3Gs
+      G+2SR0MVN+KKOMBvCBh3KrNSgFF9iFmBjNCJJZ8ycDIszUK3xLjUP2EzN1pNNl8S
+      D/yHzUCro3547Q+I+Nn5zRciG95EpMvtkIWem4H8luYSBt7w8y9uDUKWzaca/v3z
+      oGZPZP99w8WVqMKGRbsK94wsTVsWiE+oHzSufwrhvZJfQQ4jU6102IEnRS/eQFXA
+      +fozgEWuFatZe3Gz0HUJakrzSBwSTV6wmnEHCfu+uwdns1Ttq5FylZ4StJHsmweL
+      14w1xa3tjC5bQ3e1QWK3R5InHcSZ7tLpGA==
+      -----END CERTIFICATE-----