Overview

Stop maintaining a brittle static copy of certificate definitions under jstests/noPassthrough/libs/x509/main_certs.json. Instead, materialize main_certs.json as a public output of //x509:generate_main_certificates and have mkcert_is_deterministic.js read it via getX509Path("main_certs.json").

Background

main_certs.json was a checked-in snapshot of the JSON that generate_certificates already writes as a private intermediate for mkcert.py. The snapshot had already drifted from x509/main_certs_def.bzl (missing client_password_protected.pem, trusted-server-expired.pem, and the split_cert_and_key / pkcs12 settings on trusted-server.pem), so the determinism test was not exercising the same definitions Bazel uses.

Scope of Work

• x509/generate_certificates.bzl — write the definitions to a named certs_json_name output included in DefaultInfo
• x509/BUILD.bazel — set certs_json_name = "main_certs.json"
• jstests/noPassthrough/x509/mkcert_is_deterministic.js — consume the generated JSON via getX509Path("main_certs.json")
• Delete jstests/noPassthrough/libs/x509/main_certs.json and drop its suite data dependency

Follow-up / Known Interaction

Consuming the real definitions surfaces that trusted-server.pem and trusted-server-expired.pem produce non-reproducible PKCS#12 (.pfx) bundles. The determinism test currently fails on those files until a separate patch removes the pkcs12 settings from the main certificate definitions. Do not work around that in the JS test.

Acceptance Criteria

• generate_main_certificates installs bin/x509/main_certs.json
• mkcert_is_deterministic.js reads that generated file (no static jstests copy)
• Suite runfiles include _main/x509/main_certs.json
• Once PKCS#12 is removed from the main cert defs, the determinism test passes without .pfx exclusions