Add test to ensure that x509filestore loads existing certs from the

directory without modifying/overwriting them.

Signed-off-by: Ying Li <ying.li@docker.com>

trustmanager/x509filestore_test.go

@@ -5,6 +5,7 @@ import (
 	"encoding/pem"
 	"io/ioutil"
 	"os"
+	"path/filepath"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -22,6 +23,47 @@ func TestNewX509FileStore(t *testing.T) {
 	}
 }
 
+// NewX509FileStore loads any existing certs from the directory, and does
+// not overwrite any of the.
+func TestNewX509FileStoreLoadsExistingCerts(t *testing.T) {
+	tempDir, err := ioutil.TempDir("", "cert-test")
+	assert.NoError(t, err, "couldn't open temp directory")
+	defer os.RemoveAll(tempDir)
+
+	certBytes, err := ioutil.ReadFile("../fixtures/root-ca.crt")
+	assert.NoError(t, err, "couldn't read fixtures/root-ca.crt")
+	out, err := os.Create(filepath.Join(tempDir, "root-ca.crt"))
+	assert.NoError(t, err, "couldn't create a file in the temp dir")
+
+	// to distinguish it from the canonical format
+	distinguishingBytes := []byte{'\n', '\n', '\n', '\n', '\n', '\n'}
+	nBytes, err := out.Write(distinguishingBytes)
+	assert.NoError(t, err, "could not write newlines to the temporary file")
+	assert.Equal(t, len(distinguishingBytes), nBytes,
+		"didn't write all bytes to temporary file")
+
+	nBytes, err = out.Write(certBytes)
+	assert.NoError(t, err, "could not write cert to the temporary file")
+	assert.Equal(t, len(certBytes), nBytes,
+		"didn't write all bytes to temporary file")
+
+	err = out.Close()
+	assert.NoError(t, err, "could not close temporary file")
+
+	store, err := NewX509FileStore(tempDir)
+	assert.NoError(t, err, "failed to create a new X509FileStore")
+
+	expectedCert, err := LoadCertFromFile("../fixtures/root-ca.crt")
+	assert.NoError(t, err, "could not load root-ca.crt")
+	assert.Equal(t, store.GetCertificates(), []*x509.Certificate{expectedCert},
+		"did not load certificate already in the directory")
+
+	outBytes, err := ioutil.ReadFile(filepath.Join(tempDir, "root-ca.crt"))
+	assert.NoError(t, err, "couldn't read temporary file")
+	assert.Equal(t, distinguishingBytes, outBytes[:6], "original file overwritten")
+	assert.Equal(t, certBytes, outBytes[6:], "original file overwritten")
+}
+
 func TestAddCertX509FileStore(t *testing.T) {
 	// Read certificate from file
 	b, err := ioutil.ReadFile("../fixtures/root-ca.crt")