From 00ed443d002b697f21874a4fa2758822ca47a448 Mon Sep 17 00:00:00 2001
From: "pulse-triage[bot]"
 <249995291+pulse-triage[bot]@users.noreply.github.com>
Date: Thu, 1 Oct 2026 03:38:56 +0100
Subject: [PATCH] Use certificate-pin trust for the self-signed pipeline
 fixture

Match the client's existing self-signed pin contract while retaining VerifyConnection. The full TrueNAS suite includes the pin mismatch refusal control; production transport remains unchanged.

Contract-Neutral: Test-only trust configuration for a pinned synthetic TLS endpoint; production transport and API unchanged.
Change-source: pulse-maintainer
---
 internal/monitoring/truenas_poller_test.go | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/internal/monitoring/truenas_poller_test.go b/internal/monitoring/truenas_poller_test.go
index af66fc999e..145bfa6133 100644
--- a/internal/monitoring/truenas_poller_test.go
+++ b/internal/monitoring/truenas_poller_test.go
@@ -2247,7 +2247,11 @@ func TestTrueNASPartialReportingPipeline(t *testing.T) {
 	}))
 	defer server.Close()
 	fingerprint := fmt.Sprintf("%x", sha256.Sum256(server.Certificate().Raw))
-	client, err := truenas.NewClient(truenas.ClientConfig{Host: server.URL, APIKey: "synthetic", Fingerprint: fingerprint})
+	// Trust only this fixture certificate via VerifyConnection, rather than
+	// requiring httptest's self-signed certificate to have a public CA chain.
+	// Fingerprint pinning remains enforced (including the existing mismatch
+	// controls in internal/truenas); no production TLS setting is changed.
+	client, err := truenas.NewClient(truenas.ClientConfig{Host: server.URL, APIKey: "synthetic", Fingerprint: fingerprint, InsecureSkipVerify: true})
 	if err != nil {
 		t.Fatal(err)
 	}