Normalize CRLF line endings before CA chain deduplication check

[ahmad-can]

Fix duplicate issuing CA in certificate chain when line endings differ

Problem

When running sunbeam configure tls with a CA chain that already contained the issuing CA certificate, the provide-certificate action failed with:

Message: Action input is not valid.

The root cause was in generate_ca_chain(): it checks whether ca_certificate is already present in ca_chain to avoid duplicates. However, this check failed when the two copies of the same certificate used different line endings — the ca_certificate had CRLF (\r\n) while the ca_chain used LF (\n). The substring match returned False, causing the issuing CA to be appended again, producing a duplicate entry that manual-tls-certificates rejected as an invalid chain.

Fix

Normalize all three decoded certificate strings to LF line endings before the deduplication check and before combining the chain parts. This ensures consistent comparison regardless of the source line endings.

Changes

• sunbeam/features/interface/utils.py: Normalize \r\n → \n in generate_ca_chain() before deduplication and concatenation
• tests/unit/sunbeam/features/test_utils.py: Add test covering the CRLF/LF deduplication case

[Copilot]

Pull request overview

This PR fixes a TLS CA chain deduplication edge case in sunbeam configure tls where the same issuing CA certificate could be appended twice when the inputs differed only by CRLF vs LF line endings.

Changes:

• Normalize decoded certificate strings from CRLF (\r\n) to LF (\n) inside generate_ca_chain() before doing the “already present” check and before concatenating the final chain.
• Add a unit test that reproduces the CRLF/LF mismatch case and asserts the issuing CA is not duplicated.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
sunbeam-python/sunbeam/features/interface/utils.py	Normalizes line endings prior to CA cert presence check and chain construction to avoid duplicate CA entries.
sunbeam-python/tests/unit/sunbeam/features/test_utils.py	Adds a regression test ensuring CRLF/LF-equivalent CA certs are deduplicated.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.