feat: add support for certificate configuration in npm and php modules, update repository URLs in configuration files

Signed-off-by: d9pouces <github@19pouces.net>

tests/configs/Apk.yaml.j2

@@ -12,6 +12,7 @@ configurations:
     repositories:
     - name: demo
       url: https://host.docker.internal:{{ 'APK_REPO_PORT' | env }}/
+      url_to_replace: https://dl-cdn.alpinelinux.org/*
       key: |
 {{ 'dockerfiles/repos/040d0af5f97a0a44.rsa.pub' | file | indent(8, first=true) }}
   yum:

tests/configs/Apt.yaml.j2

@@ -13,6 +13,7 @@ configurations:
       uris:
       - https://host.docker.internal:{{ 'APT_REPO_PORT' | env }}/
       suites: ["./"]
+      uri-to-replace: http://deb.debian.org/*
       signed-by: |
 {{ 'dockerfiles/repos/apt-signing-key.pub.asc' | file | indent(8, first=true) }}
   apk:

tests/configs/Yum.yaml.j2

@@ -14,6 +14,7 @@ configurations:
     repositories:
     - name: demo
       index-url: https://host.docker.internal:{{ 'YUM_REPO_PORT' | env }}/
+      index-url-to-replace: https://mirrors.rockylinux.org/*
     keys: []
   python:
     repositories: []

tests/test_npm.py

@@ -28,6 +28,14 @@ EMPTY_CONFIG = {
     "organisation": "InterDiode",
 }
 
+CONFIG_WITH_CERTIFICATE_ONLY = {
+    "uuid": "12345678-1234-5678-1234-567812345678",
+    "organisation": "InterDiode",
+    "configurations": {
+        "certificates": [{"name": "interdiode-ca", "content": "-----BEGIN...-----"}]
+    },
+}
+
 
 def make_config(data: dict) -> Configuration:
     return Configuration.model_validate(data)
@@ -38,6 +46,13 @@ def test_is_relevant_false_when_no_repositories(tmp_path) -> None:
     assert NpmModule().is_relevant(context) is False
 
 
+def test_is_relevant_true_with_certificate_only(tmp_path) -> None:
+    context = Context(
+        config=make_config(CONFIG_WITH_CERTIFICATE_ONLY), dst=tmp_path / "dst", src=None
+    )
+    assert NpmModule().is_relevant(context) is True
+
+
 def test_is_relevant_true_with_repository(tmp_path) -> None:
     context = Context(
         config=make_config(CONFIG_WITH_REPO), dst=tmp_path / "dst", src=None
@@ -69,3 +84,50 @@ def test_apply_writes_additional_repositories_scoped(tmp_path) -> None:
         "registry=https://example.invalid/\n"
         "@myorg:registry=https://other.invalid/\n"
     )
+
+
+def test_apply_without_certificates_does_not_write_etc_environment(tmp_path) -> None:
+    dst = tmp_path / "dst"
+    context = Context(config=make_config(CONFIG_WITH_REPO), dst=dst, src=None)
+
+    NpmModule().apply(context)
+
+    assert not (dst / "etc/environment").exists()
+
+
+def test_apply_sets_node_extra_ca_certs_when_certificates_configured(
+    tmp_path,
+) -> None:
+    dst = tmp_path / "dst"
+    context = Context(
+        config=make_config(CONFIG_WITH_CERTIFICATE_ONLY), dst=dst, src=None
+    )
+
+    NpmModule().apply(context)
+
+    assert not (dst / "usr/local/etc/npmrc").exists()
+    environment = (dst / "etc/environment").read_text(encoding="utf-8")
+    assert environment == "NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt\n"
+
+
+def test_apply_merges_node_extra_ca_certs_into_existing_etc_environment(
+    tmp_path,
+) -> None:
+    src = tmp_path / "src"
+    src.mkdir()
+    (src / "etc").mkdir()
+    (src / "etc/environment").write_text(
+        "PATH=/usr/bin\nNODE_EXTRA_CA_CERTS=/old/stale.pem\n", encoding="utf-8"
+    )
+
+    dst = tmp_path / "dst"
+    context = Context(
+        config=make_config(CONFIG_WITH_CERTIFICATE_ONLY), dst=dst, src=src
+    )
+
+    NpmModule().apply(context)
+
+    environment = (dst / "etc/environment").read_text(encoding="utf-8")
+    assert environment == (
+        "PATH=/usr/bin\nNODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt\n"
+    )

tests/test_php.py

@@ -34,6 +34,14 @@ EMPTY_CONFIG = {
     "organisation": "InterDiode",
 }
 
+CONFIG_WITH_CERTIFICATE_ONLY = {
+    "uuid": "12345678-1234-5678-1234-567812345678",
+    "organisation": "InterDiode",
+    "configurations": {
+        "certificates": [{"name": "interdiode-ca", "content": "-----BEGIN...-----"}]
+    },
+}
+
 
 def make_config(data: dict) -> Configuration:
     return Configuration.model_validate(data)
@@ -44,6 +52,13 @@ def test_is_relevant_false_when_no_repositories(tmp_path) -> None:
     assert PhpModule().is_relevant(context) is False
 
 
+def test_is_relevant_true_with_certificate_only(tmp_path) -> None:
+    context = Context(
+        config=make_config(CONFIG_WITH_CERTIFICATE_ONLY), dst=tmp_path / "dst", src=None
+    )
+    assert PhpModule().is_relevant(context) is True
+
+
 def test_is_relevant_true_with_repository(tmp_path) -> None:
     context = Context(
         config=make_config(CONFIG_WITH_REPO), dst=tmp_path / "dst", src=None
@@ -79,3 +94,27 @@ def test_apply_writes_multiple_repositories_in_order(tmp_path) -> None:
     config_path = dst / "root/.composer/config.json"
     content = json.loads(config_path.read_text(encoding="utf-8"))
     assert [repo["name"] for repo in content["repositories"]] == ["demo", "other"]
+
+
+def test_apply_without_certificates_does_not_write_openssl_ini(tmp_path) -> None:
+    dst = tmp_path / "dst"
+    context = Context(config=make_config(CONFIG_WITH_REPO), dst=dst, src=None)
+
+    PhpModule().apply(context)
+
+    assert not (dst / "usr/local/etc/php/conf.d/id-configurator-openssl.ini").exists()
+
+
+def test_apply_sets_openssl_cafile_when_certificates_configured(tmp_path) -> None:
+    dst = tmp_path / "dst"
+    context = Context(
+        config=make_config(CONFIG_WITH_CERTIFICATE_ONLY), dst=dst, src=None
+    )
+
+    PhpModule().apply(context)
+
+    assert not (dst / "root/.composer/config.json").exists()
+    ini_content = (
+        dst / "usr/local/etc/php/conf.d/id-configurator-openssl.ini"
+    ).read_text(encoding="utf-8")
+    assert ini_content == "openssl.cafile=/etc/ssl/certs/ca-certificates.crt\n"