# Image tests

`just test` builds the selected tier and runs the read-only checks in `rootfs/`.
For standard images, it also runs the CA trust, image derivation, and sysusers
tests in disposable container builds.

The CA trust rootfs check verifies that the refresh service is enabled in every
tier. `Containerfile.test-ca-trust` generates temporary test CAs and
exercises the installed service's command against stale trust bundles. It checks
vendor CA additions and removals, preservation of local anchors and distrust,
repeated refreshes, and removal of local policy in both the PEM and OpenSSL
bundles. No external CA or network endpoint is used by that test.

This models the trust-store state after an upgrade; it does not run an OSTree
merge, boot a systemd manager, or exercise deployment/rollback. Actual boot
ordering, service conditions, failure behavior, and initramfs consumers require
VM integration coverage, for which this repository currently has no local test
runner. The service is a host-bundle mitigation and is not a complete
solution for consumers that read trust earlier in boot or from the initramfs.