build the test certificate in code instead of committing one

swarm-secret-client/src/cert.rs

@@ -49,15 +49,68 @@ pub fn file_validity(path: &Path) -> Result<(i64, i64), Error> {
 pub(crate) mod tests {
     use super::*;
 
-    /// Self-signed, CN `hive-agent-atlas`, valid 2026-01-01T00:00:00Z to
-    pub(crate) const CERT_PEM: &str = include_str!("../test-cert.pem");
+    /// The window `certificate_pem` is built with: 2026-01-01T00:00:00Z to
+    /// 2026-04-01T00:00:00Z.
     pub(crate) const NOT_BEFORE: i64 = 1_767_225_600;
     pub(crate) const NOT_AFTER: i64 = 1_775_001_600;
 
+    /// A certificate valid from `not_before` to `not_after` (unix seconds),
+    /// PEM-encoded. The name, key and signature are placeholders: [`validity`]
+    /// reads the window and verifies nothing.
+    pub(crate) fn certificate_pem(not_before: i64, not_after: i64) -> String {
+        use x509_cert::der::{
+            EncodePem as _,
+            asn1::{BitString, ObjectIdentifier, UtcTime},
+            pem::LineEnding,
+        };
+        use x509_cert::{
+            Certificate, TbsCertificate, Version,
+            name::Name,
+            serial_number::SerialNumber,
+            spki::{AlgorithmIdentifierOwned, SubjectPublicKeyInfoOwned},
+            time::{Time, Validity},
+        };
+
+        let time = |secs: i64| {
+            let secs = u64::try_from(secs).expect("a date after 1970");
+            Time::UtcTime(
+                UtcTime::from_unix_duration(std::time::Duration::from_secs(secs))
+                    .expect("a date UTCTime can hold"),
+            )
+        };
+        let algorithm = AlgorithmIdentifierOwned {
+            oid: ObjectIdentifier::new_unwrap("1.2.840.10045.4.3.2"),
+            parameters: None,
+        };
+        let cert = Certificate {
+            tbs_certificate: TbsCertificate {
+                version: Version::V3,
+                serial_number: SerialNumber::new(&[1]).expect("a serial number"),
+                signature: algorithm.clone(),
+                issuer: Name::default(),
+                validity: Validity {
+                    not_before: time(not_before),
+                    not_after: time(not_after),
+                },
+                subject: Name::default(),
+                subject_public_key_info: SubjectPublicKeyInfoOwned {
+                    algorithm: algorithm.clone(),
+                    subject_public_key: BitString::from_bytes(&[0]).expect("a bit string"),
+                },
+                issuer_unique_id: None,
+                subject_unique_id: None,
+                extensions: None,
+            },
+            signature_algorithm: algorithm,
+            signature: BitString::from_bytes(&[0]).expect("a bit string"),
+        };
+        cert.to_pem(LineEnding::LF).expect("encodes")
+    }
+
     #[test]
     fn the_window_is_read_from_the_certificate() {
         assert_eq!(
-            validity(CERT_PEM).expect("a well-formed certificate"),
+            validity(&certificate_pem(NOT_BEFORE, NOT_AFTER)).expect("a well-formed certificate"),
             (NOT_BEFORE, NOT_AFTER)
         );
     }
@@ -77,7 +130,7 @@ pub(crate) mod tests {
             std::env::temp_dir().join(format!("swarm-secret-client-cert-{}", std::process::id()));
         std::fs::create_dir_all(&dir).expect("scratch dir");
         let path = dir.join("cert.pem");
-        std::fs::write(&path, CERT_PEM).expect("write");
+        std::fs::write(&path, certificate_pem(NOT_BEFORE, NOT_AFTER)).expect("write");
         assert_eq!(
             file_validity(&path).expect("readable"),
             (NOT_BEFORE, NOT_AFTER)

swarm-secret-client/src/cert_metrics.rs

@@ -97,7 +97,7 @@ mod tests {
     use opentelemetry_sdk::metrics::{InMemoryMetricExporter, PeriodicReader, SdkMeterProvider};
     use std::path::PathBuf;
 
-    use crate::cert::tests::{CERT_PEM, NOT_AFTER, NOT_BEFORE};
+    use crate::cert::tests::{NOT_AFTER, NOT_BEFORE, certificate_pem};
 
     /// A provider with both gauges registered for `path`, and the exporter it
     /// flushes into.
@@ -152,7 +152,7 @@ mod tests {
     fn both_gauges_report_the_files_window_under_the_cert_label() {
         let dir = scratch("window");
         let path = dir.join("cert.pem");
-        std::fs::write(&path, CERT_PEM).expect("write");
+        std::fs::write(&path, certificate_pem(NOT_BEFORE, NOT_AFTER)).expect("write");
         let (provider, exporter) = registered(&path);
         assert_eq!(
             collect(&provider, &exporter),
@@ -192,7 +192,7 @@ mod tests {
         let path = dir.join("cert.pem");
         let (provider, exporter) = registered(&path);
         assert_eq!(collect(&provider, &exporter), []);
-        std::fs::write(&path, CERT_PEM).expect("write");
+        std::fs::write(&path, certificate_pem(NOT_BEFORE, NOT_AFTER)).expect("write");
         assert_eq!(collect(&provider, &exporter).len(), 2);
         std::fs::remove_dir_all(&dir).expect("cleanup");
     }

swarm-secret-client/test-cert.pem

@@ -1,11 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIBizCCATGgAwIBAgIUSFpuYmy1UoHvq/MYiyrAudRaWXcwCgYIKoZIzj0EAwIw
-GzEZMBcGA1UEAwwQaGl2ZS1hZ2VudC1hdGxhczAeFw0yNjAxMDEwMDAwMDBaFw0y
-NjA0MDEwMDAwMDBaMBsxGTAXBgNVBAMMEGhpdmUtYWdlbnQtYXRsYXMwWTATBgcq
-hkjOPQIBBggqhkjOPQMBBwNCAAR7p2eZAxjiE1RdsuSHE3CcTjbnd4swzfnmqUPW
-9NJN7mvOtqEzxCKfOSFjaIhhyShIQ41/V6vGi80EPDB+uR56o1MwUTAdBgNVHQ4E
-FgQUxgZFsN1VY3ODrPS1NUfY/x3EnmswHwYDVR0jBBgwFoAUxgZFsN1VY3ODrPS1
-NUfY/x3EnmswDwYDVR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAgNIADBFAiEAnU9e
-WOioNTUNK9b6FignejpK5FpyrODUuH/iL4TqCh0CIAz6GzJeLebhRPvYlfVUofdV
-hWx3sOwmUgjkRQXoxY+p
------END CERTIFICATE-----