From 333847234cea8bcb82b055b8508df26d466ffee2 Mon Sep 17 00:00:00 2001
From: Ryan Richard <richardry@vmware.com>
Date: Mon, 23 Mar 2026 12:26:03 -0700
Subject: [PATCH] remove tests made redundant in Go 1.26.1 by
 https://github.com/golang/go/issues/70942

---
 internal/certauthority/certauthority.go      |  4 +-
 internal/certauthority/certauthority_test.go | 39 +++-----------------
 2 files changed, 9 insertions(+), 34 deletions(-)

diff --git a/internal/certauthority/certauthority.go b/internal/certauthority/certauthority.go
index 292e0243c..1ab285785 100644
--- a/internal/certauthority/certauthority.go
+++ b/internal/certauthority/certauthority.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2026 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 // Package certauthority implements a simple x509 certificate authority suitable for use in an aggregated API service.
@@ -112,6 +112,7 @@ func newInternal(commonName string, ttl time.Duration, env env) (*CA, error) {
 	}
 
 	// Generate a new P256 keypair.
+	// Note that starting in Go 1.26, the second argument to GenerateKey is often ignored.
 	ca.privateKey, err = ecdsa.GenerateKey(elliptic.P256(), env.keygenRNG)
 	if err != nil {
 		return nil, fmt.Errorf("could not generate CA private key: %w", err)
@@ -136,6 +137,7 @@ func newInternal(commonName string, ttl time.Duration, env env) (*CA, error) {
 	}
 
 	// Self-sign the CA to get the DER certificate.
+	// Note that starting in Go 1.26, the first argument to CreateCertificate is often ignored.
 	caCertBytes, err := x509.CreateCertificate(env.signingRNG, &caTemplate, &caTemplate, &ca.privateKey.PublicKey, ca.privateKey)
 	if err != nil {
 		return nil, fmt.Errorf("could not issue CA certificate: %w", err)
diff --git a/internal/certauthority/certauthority_test.go b/internal/certauthority/certauthority_test.go
index 03e91f39e..2b45d7626 100644
--- a/internal/certauthority/certauthority_test.go
+++ b/internal/certauthority/certauthority_test.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2026 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package certauthority
@@ -121,31 +121,12 @@ func TestNewInternal(t *testing.T) {
 		{
 			name: "failed to generate CA serial",
 			env: env{
-				serialRNG:  strings.NewReader(""),
-				keygenRNG:  strings.NewReader(""),
-				signingRNG: strings.NewReader(""),
+				serialRNG: strings.NewReader(""),
 			},
 			wantErr: "could not generate CA serial: EOF",
 		},
-		{
-			name: "failed to generate CA key",
-			env: env{
-				serialRNG:  strings.NewReader(strings.Repeat("x", 64)),
-				keygenRNG:  strings.NewReader(""),
-				signingRNG: strings.NewReader(""),
-			},
-			wantErr: "could not generate CA private key: EOF",
-		},
-		{
-			name: "failed to self-sign",
-			env: env{
-				serialRNG:  strings.NewReader(strings.Repeat("x", 64)),
-				keygenRNG:  strings.NewReader(strings.Repeat("y", 64)),
-				signingRNG: strings.NewReader(""),
-				clock:      func() time.Time { return now },
-			},
-			wantErr: "could not issue CA certificate: EOF",
-		},
+		// Note: Can't cause failures in GenerateKey or CreateCertificate by passing empty readers anymore
+		// starting in Go 1.26.1, so those error cases are untested now.
 		{
 			name: "success",
 			ttl:  time.Minute,
@@ -247,16 +228,8 @@ func TestIssue(t *testing.T) {
 			},
 			wantErr: "could not generate serial number for certificate: EOF",
 		},
-		{
-			name: "failed to generate keypair",
-			ca: CA{
-				env: env{
-					serialRNG: strings.NewReader(strings.Repeat("x", numRandBytes)),
-					keygenRNG: strings.NewReader(""),
-				},
-			},
-			wantErr: "could not generate private key: EOF",
-		},
+		// Note: Can't cause failures in GenerateKey or CreateCertificate by passing empty readers anymore
+		// starting in Go 1.26.1, so those error cases are untested now.
 		{
 			name: "invalid CA certificate",
 			ca: CA{