@specific.dev/spectest 0.46.0 → 0.47.0

package/dist/daemon.js

@@ -933,8 +933,15 @@ async function ensureCaTrustedImage(serviceName, tag) {
     const ctxDir = path.join(WORKSPACE, ".spectest", "ca-trust", serviceName);
     await fs.mkdir(ctxDir, { recursive: true });
     await fs.copyFile(CA_PATH, path.join(ctxDir, "spectest-ca.crt"));
+    // An image that declares a non-root `USER` runs this step as that user,
+    // and writing the trust store then fails ("cannot create
+    // /etc/ssl/certs/ca-certificates.crt.new: Permission denied") — the CA
+    // silently never lands. Take root for the one command, then hand the
+    // image back its own user so containers still run as it.
+    const declaredUser = (await docker(["image", "inspect", "--format", "{{.Config.User}}", tag], 60_000)).stdout.trim();
+    const needsRoot = declaredUser !== "" && declaredUser !== "root" && declaredUser !== "0";
     const dockerfile = `FROM ${tag}
-COPY spectest-ca.crt /usr/local/share/ca-certificates/spectest-ca.crt
+${needsRoot ? "USER root\n" : ""}COPY spectest-ca.crt /usr/local/share/ca-certificates/spectest-ca.crt
 RUN if command -v update-ca-certificates >/dev/null 2>&1; then \\
       update-ca-certificates; \\
     elif command -v update-ca-trust >/dev/null 2>&1; then \\
@@ -942,7 +949,7 @@ RUN if command -v update-ca-certificates >/dev/null 2>&1; then \\
     else \\
       echo "[spectest] no system CA trust tool in image; env-var trust only"; \\
     fi
-`;
+${needsRoot ? `USER ${declaredUser}\n` : ""}`;
     await fs.writeFile(path.join(ctxDir, "Dockerfile"), dockerfile);
     const build = await docker(["build", "-t", tag, ctxDir], 300_000);
     if (build.code !== 0) {

package/dist/harness/container-run.d.ts

@@ -29,6 +29,12 @@
  * showed the problem, which is why it went unnoticed: only the appending
  * variable was in play.
  *
+ * **Deno is a third mechanism.** It reads none of those variables and
+ * trusts only its bundled Mozilla roots, so an edge function calling a
+ * fake fails with `UnknownIssuer` however the image is set up.
+ * `DENO_TLS_CA_STORE=mozilla,system` is what adds the platform store,
+ * and the platform store is `SSL_CERT_FILE` — the combined bundle.
+ *
  * **`command` and `args` are different overrides.** `command` replaces the
  * entrypoint and runs through `sh -c`; `args` keeps the entrypoint and
  * overrides CMD, which is what init-wrapped images like postgres need to

package/dist/harness/container-run.js

@@ -29,6 +29,12 @@
  * showed the problem, which is why it went unnoticed: only the appending
  * variable was in play.
  *
+ * **Deno is a third mechanism.** It reads none of those variables and
+ * trusts only its bundled Mozilla roots, so an edge function calling a
+ * fake fails with `UnknownIssuer` however the image is set up.
+ * `DENO_TLS_CA_STORE=mozilla,system` is what adds the platform store,
+ * and the platform store is `SSL_CERT_FILE` — the combined bundle.
+ *
  * **`command` and `args` are different overrides.** `command` replaces the
  * entrypoint and runs through `sh -c`; `args` keeps the entrypoint and
  * overrides CMD, which is what init-wrapped images like postgres need to
@@ -87,6 +93,13 @@ export function runContainerArgs(input) {
     // replacing ones take the combined bundle.
     args.push(`--volume=${input.caPath}:${input.caPath}:ro`);
     args.push("-e", `NODE_EXTRA_CA_CERTS=${input.caPath}`);
+    // Deno reads none of the above, and its default store is the bundled
+    // Mozilla roots alone — so a Deno runtime (a Supabase edge function is
+    // the usual one) rejects every certificate this environment mints, with
+    // or without the CA layered into the image. `system` adds the platform
+    // store, which resolves through `SSL_CERT_FILE`: the bundle below.
+    // `mozilla` stays first so the public roots survive.
+    args.push("-e", "DENO_TLS_CA_STORE=mozilla,system");
     const bundle = input.caBundle;
     if (bundle) {
         if (bundle !== input.caPath)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@specific.dev/spectest",
-  "version": "0.46.0",
+  "version": "0.47.0",
   "description": "Spectest SDK for defining test environments in TypeScript.",
   "type": "module",
   "main": "./dist/index.js",

package/src/daemon.ts

@@ -1221,8 +1221,17 @@ async function ensureCaTrustedImage(serviceName: string, tag: string): Promise<v
   const ctxDir = path.join(WORKSPACE, ".spectest", "ca-trust", serviceName);
   await fs.mkdir(ctxDir, { recursive: true });
   await fs.copyFile(CA_PATH, path.join(ctxDir, "spectest-ca.crt"));
+  // An image that declares a non-root `USER` runs this step as that user,
+  // and writing the trust store then fails ("cannot create
+  // /etc/ssl/certs/ca-certificates.crt.new: Permission denied") — the CA
+  // silently never lands. Take root for the one command, then hand the
+  // image back its own user so containers still run as it.
+  const declaredUser = (
+    await docker(["image", "inspect", "--format", "{{.Config.User}}", tag], 60_000)
+  ).stdout.trim();
+  const needsRoot = declaredUser !== "" && declaredUser !== "root" && declaredUser !== "0";
   const dockerfile = `FROM ${tag}
-COPY spectest-ca.crt /usr/local/share/ca-certificates/spectest-ca.crt
+${needsRoot ? "USER root\n" : ""}COPY spectest-ca.crt /usr/local/share/ca-certificates/spectest-ca.crt
 RUN if command -v update-ca-certificates >/dev/null 2>&1; then \\
       update-ca-certificates; \\
     elif command -v update-ca-trust >/dev/null 2>&1; then \\
@@ -1230,7 +1239,7 @@ RUN if command -v update-ca-certificates >/dev/null 2>&1; then \\
     else \\
       echo "[spectest] no system CA trust tool in image; env-var trust only"; \\
     fi
-`;
+${needsRoot ? `USER ${declaredUser}\n` : ""}`;
   await fs.writeFile(path.join(ctxDir, "Dockerfile"), dockerfile);
   const build = await docker(["build", "-t", tag, ctxDir], 300_000);
   if (build.code !== 0) {

package/src/harness/container-run.test.ts

@@ -101,6 +101,14 @@ describe("certificate trust", () => {
     );
   });
 
+  /** Deno ignores every variable above and ships its own root store, so
+   *  without this an edge function calling a fake gets `UnknownIssuer`
+   *  no matter what the image's trust store says. */
+  test("points Deno at the platform store as well as its own", () => {
+    const args = runContainerArgs(base({ caBundle: "/etc/spectest/ca-bundle.crt" }));
+    expect(envOf(args, "DENO_TLS_CA_STORE")).toBe("mozilla,system");
+  });
+
   test("with no bundle, the replacing variables are left unset", () => {
     const args = runContainerArgs(base({ caBundle: null }));
     expect(envOf(args, "SSL_CERT_FILE")).toBeUndefined();

package/src/harness/container-run.ts

@@ -29,6 +29,12 @@
  * showed the problem, which is why it went unnoticed: only the appending
  * variable was in play.
  *
+ * **Deno is a third mechanism.** It reads none of those variables and
+ * trusts only its bundled Mozilla roots, so an edge function calling a
+ * fake fails with `UnknownIssuer` however the image is set up.
+ * `DENO_TLS_CA_STORE=mozilla,system` is what adds the platform store,
+ * and the platform store is `SSL_CERT_FILE` — the combined bundle.
+ *
  * **`command` and `args` are different overrides.** `command` replaces the
  * entrypoint and runs through `sh -c`; `args` keeps the entrypoint and
  * overrides CMD, which is what init-wrapped images like postgres need to
@@ -132,6 +138,13 @@ export function runContainerArgs(input: ContainerRunInput): string[] {
   // replacing ones take the combined bundle.
   args.push(`--volume=${input.caPath}:${input.caPath}:ro`);
   args.push("-e", `NODE_EXTRA_CA_CERTS=${input.caPath}`);
+  // Deno reads none of the above, and its default store is the bundled
+  // Mozilla roots alone — so a Deno runtime (a Supabase edge function is
+  // the usual one) rejects every certificate this environment mints, with
+  // or without the CA layered into the image. `system` adds the platform
+  // store, which resolves through `SSL_CERT_FILE`: the bundle below.
+  // `mozilla` stays first so the public roots survive.
+  args.push("-e", "DENO_TLS_CA_STORE=mozilla,system");
   const bundle = input.caBundle;
   if (bundle) {
     if (bundle !== input.caPath) args.push(`--volume=${bundle}:${bundle}:ro`);