refactor: remove unused NPM_TO_COPY variable from build.py

Signed-off-by: d9pouces <github@19pouces.net>

tests/test_certificates.py

@@ -237,3 +237,37 @@ def test_apply_writes_bundle_to_rhel_style_symlinked_etccertsdir(tmp_path) -> No
     # /usr/lib/ssl/cert.pem is Debian/Ubuntu-specific: not OpenSSL's default
     # CAfile on this (RHEL-style) system, so it must not be created.
     assert not (dst / "usr/lib/ssl/cert.pem").exists()
+
+
+def test_apply_is_idempotent_when_src_and_dst_are_the_same_live_root(
+    tmp_path,
+) -> None:
+    # Regression test: applying directly to a live root (--src / --dst /,
+    # as the Ansible role does) where /usr/lib/ssl/cert.pem already exists
+    # (as it would on any host with ca-certificates already installed) must
+    # not resolve that pre-existing symlink away when recreating it - doing
+    # so would unlink/replace the bundle it points to instead, corrupting it
+    # into a symlink to itself and breaking every subsequent run.
+    root = tmp_path / "root"
+    etc_ssl_certs = root / "etc/ssl/certs"
+    etc_ssl_certs.mkdir(parents=True)
+    (etc_ssl_certs / "ca-certificates.crt").write_bytes(b"preexisting-bundle-bytes")
+    usr_lib_ssl = root / "usr/lib/ssl"
+    usr_lib_ssl.mkdir(parents=True)
+    (usr_lib_ssl / "cert.pem").symlink_to("/etc/ssl/certs/ca-certificates.crt")
+
+    context = Context(config=make_config(True), dst=root, src=root)
+
+    for _ in range(2):
+        CertificatesModule().apply(context)
+
+        bundle = etc_ssl_certs / "ca-certificates.crt"
+        assert not bundle.is_symlink()
+        assert bundle.read_bytes() == b"fake-cert-bytes\n"
+
+        openssl_default = usr_lib_ssl / "cert.pem"
+        assert openssl_default.is_symlink()
+        assert (
+            openssl_default.readlink().as_posix()
+            == "/etc/ssl/certs/ca-certificates.crt"
+        )