webauthntestca

Overview ¶

Package webauthntestca materializes a synthetic, self-signed WebAuthn attestation trust-anchor certificate for the repo's fixture configs (configs/webauthn-passkey.json, configs/fedramp-baseline.json, configs/webauthn-and-webhook-combo.json, configs/webauthn-passkey-hardened.json), each of which points security.webauthn.attestation_roots_path at configs/testdata/webauthn-attestation-roots.pem (R10-2 step 4; APPSEC-14 requires the pairing whenever aaguid_allow_list is non-empty; webauthnx.NewServer fails closed on a nil pool).

The certificate is a public trust anchor only -- no private key is generated to disk or retained past Ensure returning. It is never used to sign or verify an actual attestation object in these fixtures' boot-time checks (webauthnx.NewServer only requires a non-nil *x509.CertPool; AAGUIDPolicy.Enforce, which would chain-verify a real attestation certificate against these roots, only runs during an actual WebAuthn registration ceremony, which none of the generation, build, or boot-smoke gates perform). Because of that, the file is generated fresh -- not committed -- and is gitignored like every other *.pem/*.key in this repo; GitLab's server-side push rule (`\.(pem|key)$`) exists to stop committed private keys, and this package keeps that class of file out of history entirely rather than working around the rule.

Ensure is idempotent and safe to call from multiple entry points (go test, make targets, tests/boot-all-configs.sh) and concurrently from parallel test binaries: a valid existing file is left untouched, and the write is atomic (temp file + rename) so a racing writer can never observe a partial file.