flow runner register keeps the CA in the Flow home by absolute path, and a relative ca in runner.toml is read against the home, so a service finds it from any directory (closes #98) 0d663e91c598

- **`flow runner register --ca` keeps the CA in the Flow home (#98):** it wrote the path as given, so `--ca hub-ca.pem` left `ca = "hub-ca.pem"` in runner.toml and a service started elsewhere could not find it. Register now copies the file to the home's `hub-ca.pem` and records that copy's absolute path, and a relative `ca` already in runner.toml is read against the home.

/// The hub's CA certificate as `flow runner register --ca` keeps it (#98).

pub const CA_PEM: &str = "hub-ca.pem";

            let mut runner: RunnerConfig = toml::from_str(&text).with_context(|| format!("parse {}", registered.display()))?;

            // A relative CA there is the home's (#98): register keeps its

            // copy there, and the service may start in any directory.

            runner.ca = runner.ca.map(|ca| if ca.is_absolute() { ca } else { root.join(ca) });

            config.runner = Some(runner);

    }

    /// #98: runner.toml's relative CA is the home's, wherever flow starts.

    #[test]

    fn a_registered_runners_relative_ca_is_in_its_home() {

        let dir = tempfile::tempdir().unwrap();

        std::fs::write(dir.path().join(RUNNER_TOML), "hub = \"https://hub\"\ntoken = \"t\"\nca = \"hub-ca.pem\"\n").unwrap();

        let home = Home::locate(Some(dir.path())).unwrap();

        assert_eq!(home.config.runner.unwrap().ca, Some(dir.path().join("hub-ca.pem")));

        std::fs::write(dir.path().join(RUNNER_TOML), "hub = \"https://hub\"\ntoken = \"t\"\nca = \"/etc/ssl/hub.pem\"\n").unwrap();

        let home = Home::locate(Some(dir.path())).unwrap();

        assert_eq!(home.config.runner.unwrap().ca, Some(PathBuf::from("/etc/ssl/hub.pem")));

        let kept = keep_ca(&home.root, ca)?;

        text.push_str(&format!("ca = {:?}\n", kept.display().to_string()));

/// Copy the hub's CA certificate `ca` into the Flow home `root` (#98) and

/// give the copy's absolute path, for runner.toml: a service starts in

/// another directory, and the file given may move or go.

fn keep_ca(root: &Path, ca: &Path) -> Result<PathBuf> {

    let kept = root.join(crate::home::CA_PEM);

    let same = matches!((std::fs::canonicalize(ca), std::fs::canonicalize(&kept)), (Ok(a), Ok(b)) if a == b);

    if !same {

        std::fs::copy(ca, &kept).with_context(|| format!("copy {} into {}", ca.display(), root.display()))?;

    }

    Ok(std::fs::canonicalize(&kept)?)

}

    /// #98: register keeps a copy of the CA in the home, by absolute path,

    /// and keeping the home's own copy again is a no-op.

    #[test]

    fn the_ca_is_kept_in_the_home_by_absolute_path() {

        let home = tempfile::tempdir().unwrap();

        let elsewhere = tempfile::tempdir().unwrap();

        let given = elsewhere.path().join("ca.pem");

        std::fs::write(&given, "PEM").unwrap();

        let kept = super::keep_ca(home.path(), &given).unwrap();

        assert!(kept.is_absolute() && kept.ends_with(crate::home::CA_PEM), "{kept:?}");

        assert_eq!(std::fs::read_to_string(&kept).unwrap(), "PEM");

        std::fs::remove_file(&given).unwrap();

        assert_eq!(super::keep_ca(home.path(), &kept).unwrap(), kept, "the home's copy again");

        assert_eq!(std::fs::read_to_string(&kept).unwrap(), "PEM");

    }