testing: SetEnv calls overlapped or not sufficiently separated

[Clockwork-Muse]

Go version

go version go1.25.9 X:nodwarf5 linux/amd64

Output of go env in your module/workspace:

AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE=''
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/var/home/xzero/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/var/home/xzero/.config/go/env'
GOEXE=''
GOEXPERIMENT='nodwarf5'
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2485329619=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/dev/null'
GOMODCACHE='/var/home/xzero/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/var/home/xzero/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/lib/golang'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/var/home/xzero/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='local'
GOTOOLDIR='/usr/lib/golang/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.25.9 X:nodwarf5'
GOWORK='/home/xzero/repositories/kustomize/go.work'
PKG_CONFIG='pkg-config'

What did you do?

I'm writing tests that each need to set an environment variable to different values for each test, and when executing all tests via go test in a class the outputs indicate either the environment variables are still being set concurrently, or not giving sufficient time to "settle".

Specifically, I'm testing networking code making calls to an HTTP-secured server spun up as part of the test, and as such I'm setting SSL_CERT_DIR with a (temp) folder containing a root CA cert.

These tests work perfectly well when run in isolation (eg, via go test -v -run TestPush), so the individual test code is good. Test code is generally of the form:

func TestPush(t *testing.T) {
	certificate, key := generateSelfSignedCert(t)
	t.Setenv("SSL_CERT_DIR", filepath.Dir(certificate))

	// Attempt code that makes calls to the server
}

I'm aware of #78614 , which indicates that the t.Setenv(...) call should mark tests as non-parallel.

What did you see happen?

The error messages from my tests indicate that it's not trusting the root certificate for the server for their particular test:

go test .
--- FAIL: TestNoCredentialFile (0.37s)
    pusher_test.go:496: 
                Error Trace:    /home/xzero/repositories/kustomize/api/internal/oci/pusher_test.go:496
                Error:          Error "failed to perform \"Exists\" on destination: Head \"https://localhost:36217/v2/something/manifests/sha256:2dd843d3d23fdef5920564e120bc6caf7c8d6c831c8eefb5cab58366656dd7c4\": tls: failed to verify certificate: x509: certificate signed by unknown authority" does not contain "basic credential not found"
                Test:           TestNoCredentialFile
--- FAIL: TestInvalidCredentials (0.35s)
    pusher_test.go:523: 
                Error Trace:    /home/xzero/repositories/kustomize/api/internal/oci/pusher_test.go:523
                Error:          Error "failed to perform \"Exists\" on destination: Head \"https://localhost:34943/v2/something/manifests/sha256:3016ad72970d1107bb724b538204ade3294019faa5026f13a51457c5a7bf98b8\": tls: failed to verify certificate: x509: certificate signed by unknown authority" does not contain "response status code 401: Unauthorized"
                Test:           TestInvalidCredentials
--- FAIL: TestPush (0.36s)
    pusher_test.go:553: 
                Error Trace:    /home/xzero/repositories/kustomize/api/internal/oci/pusher_test.go:553
                Error:          Received unexpected error:
                                failed to perform "Exists" on destination: Head "https://localhost:41103/v2/something/manifests/sha256:950a3464741e60b3f0c5920bdafe74134dcf7f9ad105b09212e30af86b27695d": tls: failed to verify certificate: x509: certificate signed by unknown authority
                Test:           TestPush
FAIL
FAIL    sigs.k8s.io/kustomize/api/internal/oci  1.792s
FAIL

What did you expect to see?

Tests ran sequentially, and didn't generate (unanticipated) errors.

[gabyhelp]

Related Issues

• testing: T.Setenv can be called after T.Parallel #55128 (closed)
• testing, cmd/go: dependencies in init functions are not recorded in the 'go test' cache key #44625

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[seankhliao]

This is crypto/x509 only parsing the cert pool once on first use, because that's a slow operation.

you'll need to manage your own cert pool.

[Clockwork-Muse]

.... well, that might be the root cause (so closing is legitimate), but that doesn't actually help me....

1. The application I'm modifying doesn't maintain its own cert pool
2. The library I'm working with for client calls doesn't expose a way to inject such a pool anyhow (although a future version of the library may support specifying a remote cert)
3. Attempting to do this via test suite (so shared override/certificate) won't work due to needing to run multiple classes/suites.