test: extract PEM fixtures to resources and allowlist for gitleaks (crw-12394)

.gitleaks.toml

@@ -0,0 +1,4 @@
+[allowlist]
+paths = [
+    'src/test/resources/tls/.*',
+]

src/main/kotlin/com/redhat/devtools/gateway/auth/tls/PemUtils.kt

@@ -46,8 +46,7 @@ object PemUtils {
             .encodeToString(certificate.encoded)
 
         return buildString {
-            // notsecret
-            append("-----BEGIN CERTIFICATE-----\n")
+            append("-----BEGIN CERTIFICATE-----\n") // notsecret
             append(base64)
             append("\n-----END CERTIFICATE-----\n")
         }
@@ -69,13 +68,12 @@ object PemUtils {
         // JBTextField can strip or mangle newlines from pasted PEM → reformat if needed
         val reformatted = clean(normalized)
 
-        // notsecret
         val cleaned = reformatted
-            .replace("-----BEGIN PRIVATE KEY-----", "")
+            .replace("-----BEGIN PRIVATE KEY-----", "") // notsecret
             .replace("-----END PRIVATE KEY-----", "")
-            .replace("-----BEGIN RSA PRIVATE KEY-----", "")
+            .replace("-----BEGIN RSA PRIVATE KEY-----", "")  // notsecret
             .replace("-----END RSA PRIVATE KEY-----", "")
-            .replace("-----BEGIN EC PRIVATE KEY-----", "")
+            .replace("-----BEGIN EC PRIVATE KEY-----", "")  // notsecret
             .replace("-----END EC PRIVATE KEY-----", "")
             .replace("\\s".toRegex(), "")
 

src/test/kotlin/com/redhat/devtools/gateway/auth/tls/CertificateSourceTest.kt

@@ -214,9 +214,7 @@ class CertificateSourceTest {
     @Test
     fun `#fromUserInput normalizes and base64-encodes single-line PEM`() {
         // given — self-signed fixture for this suite only (openssl req … *.invalid), not from any cluster
-        val singleLinePem =
-            // notsecret
-            "-----BEGIN CERTIFICATE-----MIICmDCCAgGgAwIBAgIUV5nqmQtJt7MtAFJDk8/mI/LvDgIwDQYJKoZIhvcNAQELBQAwXjEwMC4GA1UEAwwnZmFrZS1ub3JtYWxpemF0aW9uLXRlc3QuZXhhbXBsZS5pbnZhbGlkMR0wGwYDVQQKDBRFeGFtcGxlIFRlc3QgRml4dHVyZTELMAkGA1UEBhMCWFgwHhcNMjYwNTEzMTMyMDE0WhcNMzYwNTEwMTMyMDE0WjBeMTAwLgYDVQQDDCdmYWtlLW5vcm1hbGl6YXRpb24tdGVzdC5leGFtcGxlLmludmFsaWQxHTAbBgNVBAoMFEV4YW1wbGUgVGVzdCBGaXh0dXJlMQswCQYDVQQGEwJYWDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAziSew4ot/f/avtFRNfMG9YlviyDbGf1UqViaGI2G4r7gUGSF1a//hNe8+mNMdDfyg/s1VelBR0ajAUU+R45N6DRJFAdy8dYaHVxzrxKe7apk2PIqXBo7CI59I2D2KMkEWrYtSDtyXhg8GNb753/Tkw+6ifXp/5Px5GLkU93AlzUCAwEAAaNTMFEwHQYDVR0OBBYEFG3l/ZZpH4IpTASMXlFoaQbQdOlIMB8GA1UdIwQYMBaAFG3l/ZZpH4IpTASMXlFoaQbQdOlIMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADgYEAvEWA5kcQYgD+U2lwKueYgL/habm8KcUb+e+DK0b4y0WcuoTCqH+2XWaxh5JdG6BLIC+EdFYn9SNm6lo1nv2pOppoyvE5w/xcoPB0rrXr8Eu5PGqKDOWF7YdPcEkjGqL+/TUGiGQmCY0zpTia8+MBDlZLwI9im0W4TJAL2/Lhryg=-----END CERTIFICATE-----"
+        val singleLinePem = TlsTestCertificates.singleLine(TlsTestCertificates.NORMALIZATION_PEM)
 
         // when
         val source = CertificateSource.fromPathOrPem(singleLinePem)!!
@@ -233,25 +231,7 @@ class CertificateSourceTest {
     @Test
     fun `#fromUserInput handles properly formatted multi-line PEM`() {
         // given - proper synthetic PEM with newlines
-        // notsecret
-        val multiLinePem = """
-            -----BEGIN CERTIFICATE-----
-            MIICmDCCAgGgAwIBAgIUV5nqmQtJt7MtAFJDk8/mI/LvDgIwDQYJKoZIhvcNAQEL
-            BQAwXjEwMC4GA1UEAwwnZmFrZS1ub3JtYWxpemF0aW9uLXRlc3QuZXhhbXBsZS5p
-            bnZhbGlkMR0wGwYDVQQKDBRFeGFtcGxlIFRlc3QgRml4dHVyZTELMAkGA1UEBhMC
-            WFgwHhcNMjYwNTEzMTMyMDE0WhcNMzYwNTEwMTMyMDE0WjBeMTAwLgYDVQQDDCdm
-            YWtlLW5vcm1hbGl6YXRpb24tdGVzdC5leGFtcGxlLmludmFsaWQxHTAbBgNVBAoM
-            FEV4YW1wbGUgVGVzdCBGaXh0dXJlMQswCQYDVQQGEwJYWDCBnzANBgkqhkiG9w0B
-            AQEFAAOBjQAwgYkCgYEAziSew4ot/f/avtFRNfMG9YlviyDbGf1UqViaGI2G4r7g
-            UGSF1a//hNe8+mNMdDfyg/s1VelBR0ajAUU+R45N6DRJFAdy8dYaHVxzrxKe7apk
-            2PIqXBo7CI59I2D2KMkEWrYtSDtyXhg8GNb753/Tkw+6ifXp/5Px5GLkU93AlzUC
-            AwEAAaNTMFEwHQYDVR0OBBYEFG3l/ZZpH4IpTASMXlFoaQbQdOlIMB8GA1UdIwQY
-            MBaAFG3l/ZZpH4IpTASMXlFoaQbQdOlIMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZI
-            hvcNAQELBQADgYEAvEWA5kcQYgD+U2lwKueYgL/habm8KcUb+e+DK0b4y0WcuoTC
-            qH+2XWaxh5JdG6BLIC+EdFYn9SNm6lo1nv2pOppoyvE5w/xcoPB0rrXr8Eu5PGqK
-            DOWF7YdPcEkjGqL+/TUGiGQmCY0zpTia8+MBDlZLwI9im0W4TJAL2/Lhryg=
-            -----END CERTIFICATE-----
-        """.trimIndent()
+        val multiLinePem = TlsTestCertificates.NORMALIZATION_PEM
 
         // when
         val source = CertificateSource.fromPathOrPem(multiLinePem)!!

src/test/kotlin/com/redhat/devtools/gateway/auth/tls/PemUtilsTest.kt

@@ -63,8 +63,7 @@ class PemUtilsTest {
 
     @Test
     fun `#isPem returns false for base64 content`() {
-        // notsecret
-        assertThat(PemUtils.isPem("LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0t")).isFalse()
+        assertThat(PemUtils.isPem("LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0t")).isFalse() // notsecret
     }
 
     @Test
@@ -80,9 +79,7 @@ class PemUtilsTest {
     @Test
     fun `#parseCertificate handles single-line PEM from JBTextField paste`() {
         // given - simulates pasting multi-line PEM into single-line JBTextField (newlines stripped)
-        val singleLinePem =
-            // notsecret
-            "-----BEGIN CERTIFICATE-----MIIDlTCCAn2gAwIBAgIUJ/MyNwdZC5vGYJMyYa5m4letZrYwDQYJKoZIhvcNAQELBQAwWjEnMCUGA1UEAwweZmFrZS11bml0LXRlc3QuZXhhbXBsZS5pbnZhbGlkMSIwIAYDVQQKDBlFeGFtcGxlIFRlc3QgRml4dHVyZSBPbmx5MQswCQYDVQQGEwJYWDAeFw0yNjA1MTMxMzE4MDJaFw0zNjA1MTAxMzE4MDJaMFoxJzAlBgNVBAMMHmZha2UtdW5pdC10ZXN0LmV4YW1wbGUuaW52YWxpZDEiMCAGA1UECgwZRXhhbXBsZSBUZXN0IEZpeHR1cmUgT25seTELMAkGA1UEBhMCWFgwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCG4CRbIkDOtpWzjWVW3V62FKzSfdAhdOJ/avqaPU2FiSjwEcBuVceoT5ilVjNWuDSqWeTrmwPjBfzywpB9OHrziqE5rRBnlyuxTMgxxbpNU8WEBFtn2RWvKen0uZOOLTro1oQsI6ALqKd07s8t9XjIZMEiOzhvKzYK6xQiqXjnYJqWAw3ZjhuvPcuvAALTXJMB6dASZNJ+q7gUd0gIMIjXVzAcj/QPxISwr3JMbpk+GvDnz0kFt7TFQRMqW56dbK36ukjDvLdFd+bbigE6m55vsGVdyZC55wBIB87ycn0zc3hgrfej4JVEqEhhlsifUkjGqNR2h9cdY3u58gzJwZP5AgMBAAGjUzBRMB0GA1UdDgQWBBSn488Oxr0rTEaI1Q3xHhxERrAZ5jAfBgNVHSMEGDAWgBSn488Oxr0rTEaI1Q3xHhxERrAZ5jAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAu0fWReMMgSMM2ctyslZ/b00FDUnDq713HQ+HH3sB28NVxvwKUHR637Z/VzX2HNlR5wuR2ulxKi6m54EBVCuE+T4kwPD/wx32RtGMAyuBlpamLC6WOdmVIVdYr66BRE7KdfTNnK+MJAa0duD5KniqxkdMU7ZxveHM6RRv/hDg0qybOxLSwetmfI9CRiw0qOGiX5PhCqsJVIf1FxRl2mPPO0HiI94AyenmZfatuz9Y8Pb/q7cgdXpX2x29dnqXXO91qbVHk+zIIsYowqsdnMTfqNHFSJGrNovvI63/GQ/8148oKAALaH4VgNOyVIdaKkPDR5I/WBnNmgJHFa/ozYnVi-----END CERTIFICATE-----"
+        val singleLinePem = TlsTestCertificates.singleLine(TlsTestCertificates.CA_PEM)
         // when
         val certificate = PemUtils.parseCertificate(singleLinePem)
         // then — self-signed RSA fixture generated for this test suite only (openssl req -x509 … *.invalid)
@@ -94,31 +91,7 @@ class PemUtilsTest {
     @Test
     fun `#parseCertificate handles properly formatted multi-line PEM`() {
         // given - proper synthetic PEM with newlines
-        // notsecret
-        val multiLinePem = """
-            -----BEGIN CERTIFICATE-----
-            MIIDlTCCAn2gAwIBAgIUJ/MyNwdZC5vGYJMyYa5m4letZrYwDQYJKoZIhvcNAQEL
-            BQAwWjEnMCUGA1UEAwweZmFrZS11bml0LXRlc3QuZXhhbXBsZS5pbnZhbGlkMSIw
-            IAYDVQQKDBlFeGFtcGxlIFRlc3QgRml4dHVyZSBPbmx5MQswCQYDVQQGEwJYWDAe
-            Fw0yNjA1MTMxMzE4MDJaFw0zNjA1MTAxMzE4MDJaMFoxJzAlBgNVBAMMHmZha2Ut
-            dW5pdC10ZXN0LmV4YW1wbGUuaW52YWxpZDEiMCAGA1UECgwZRXhhbXBsZSBUZXN0
-            IEZpeHR1cmUgT25seTELMAkGA1UEBhMCWFgwggEiMA0GCSqGSIb3DQEBAQUAA4IB
-            DwAwggEKAoIBAQCG4CRbIkDOtpWzjWVW3V62FKzSfdAhdOJ/avqaPU2FiSjwEcBu
-            VceoT5ilVjNWuDSqWeTrmwPjBfzywpB9OHrziqE5rRBnlyuxTMgxxbpNU8WEBFtn
-            2RWvKen0uZOOLTro1oQsI6ALqKd07s8t9XjIZMEiOzhvKzYK6xQiqXjnYJqWAw3Z
-            jhuvPcuvAALTXJMB6dASZNJ+q7gUd0gIMIjXVzAcj/QPxISwr3JMbpk+GvDnz0kF
-            t7TFQRMqW56dbK36ukjDvLdFd+bbigE6m55vsGVdyZC55wBIB87ycn0zc3hgrfej
-            4JVEqEhhlsifUkjGqNR2h9cdY3u58gzJwZP5AgMBAAGjUzBRMB0GA1UdDgQWBBSn
-            488Oxr0rTEaI1Q3xHhxERrAZ5jAfBgNVHSMEGDAWgBSn488Oxr0rTEaI1Q3xHhxE
-            RrAZ5jAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAu0fWReMMg
-            SMM2ctyslZ/b00FDUnDq713HQ+HH3sB28NVxvwKUHR637Z/VzX2HNlR5wuR2ulxK
-            i6m54EBVCuE+T4kwPD/wx32RtGMAyuBlpamLC6WOdmVIVdYr66BRE7KdfTNnK+MJ
-            Aa0duD5KniqxkdMU7ZxveHM6RRv/hDg0qybOxLSwetmfI9CRiw0qOGiX5PhCqsJV
-            If1FxRl2mPPO0HiI94AyenmZfatuz9Y8Pb/q7cgdXpX2x29dnqXXO91qbVHk+zII
-            sYowqsdnMTfqNHFSJGrNovvI63/GQ/8148oKAALaH4VgNOyVIdaKkPDR5I/WBnNm
-            gJHFa/ozYnVi
-            -----END CERTIFICATE-----
-        """.trimIndent()
+        val multiLinePem = TlsTestCertificates.CA_PEM
         // when
         val certificate = PemUtils.parseCertificate(multiLinePem)
         //then
@@ -129,9 +102,7 @@ class PemUtilsTest {
     @Test
     fun `#parseCertificate handles single-line EC certificate`() {
         // given
-        // notsecret
-        val singleLineEcPem =
-            "-----BEGIN CERTIFICATE-----MIICDzCCAbWgAwIBAgIUJM+lFwR1WyaM0pOqgloNGsvTLjEwCgYIKoZIzj0EAwIwXTEqMCgGA1UEAwwhZmFrZS1lYy11bml0LXRlc3QuZXhhbXBsZS5pbnZhbGlkMSIwIAYDVQQKDBlFeGFtcGxlIFRlc3QgRml4dHVyZSBPbmx5MQswCQYDVQQGEwJYWDAeFw0yNjA1MTMxMzE5MjdaFw0zNjA1MTAxMzE5MjdaMF0xKjAoBgNVBAMMIWZha2UtZWMtdW5pdC10ZXN0LmV4YW1wbGUuaW52YWxpZDEiMCAGA1UECgwZRXhhbXBsZSBUZXN0IEZpeHR1cmUgT25seTELMAkGA1UEBhMCWFgwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASjD1l8BUS3K/y60I9tUn6njNT378eh6rtqWA9JUM4Rij4iIOnnRRjBuN0L+fF/ojNgakEG6Dc17z6C1t3oJjCSo1MwUTAdBgNVHQ4EFgQUIsiKjviTVSQMf52xWPlEu6+/cU0wHwYDVR0jBBgwFoAUIsiKjviTVSQMf52xWPlEu6+/cU0wDwYDVR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAgNIADBFAiAWbprqeHYk2Ov262fzisXbyLmSlNa9uOMQXCaxmqm6tQIhAIgIr5jIokOT+ThCgant0Jr/XUEryzF7tpvAD/lJkwv9-----END CERTIFICATE-----"
+        val singleLineEcPem = TlsTestCertificates.singleLine(TlsTestCertificates.EC_PEM)
         // when
         val certificate = PemUtils.parseCertificate(singleLineEcPem)
         // then
@@ -144,9 +115,7 @@ class PemUtilsTest {
         // PKCS#8 PEM is a throwaway RSA key generated only for this test (openssl genrsa /
         // pkcs8 -nocrypt). It is not paired with any certificate in this file, never belonged to
         // a cluster or host
-        // notsecret
-        val singleLineKey =
-            "-----BEGIN PRIVATE KEY-----MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCcxRFWa06rNo5xsdpGTLsETLviFAR4wdB0bylr6lHCuNpdW1gM1TyRvVvFyQWbJK+Dk+emSV7ocbUibUaxdhWQ1W1Jv7L/s3H4zzYdWpOF4LZ+W0wHVhav4AZjiU7GbvO15uK2gbfuEZHJ06uLTpKMh5uWRGpEBr0eNDE1Y6au1lpZtJSfgXuJRXHd+kbngjtmjb4XcW/3xCBbcAcpmXSCGgE9uV5uuYVmCwYBrLtHK5MUKz0i1F85XN2DEQwAEHEkg5d9Z0ypxoKHMRGmBkoN2t9SihAU04efHHKWk2GTDFZGY4Ga4w/YmmhoPM54gU7ONRN3LYRfThr0Y5ivJfPTAgMBAAECggEACqQ97GCAXeg9fG5BjirAjybToiG7DqS+t7NMBoKeENpncurea+Xq+fb2odMRdFnl0sgEHio2LQ/QPIlaa8rDj/9M2d1kvdgP0SnlAdJs19ZMd6tO2o33dZzUEjGh4p++ygbli39RXZxdCcGP5Xbsmml3dZh99ibW85PrZd+2fYD9hsO0CTRdlCLB0/Gy/yKW4iujlJyp1HfPFeiw/lKL5GwNSFpMJElwGcQUPVdXPqU+GzPJH1m54jFlYzIZCXuHW4U99+NPFj6foA5PjMS3ZXcEyWZfhuHbDYrqj3aKxRURWaNdGVxML6xSmdXvN/4yo7CkLUr1PN0apKACVS0FYQKBgQDUTP0aTp+ja3TNVtrv4K1v8Me3stlbxR9zeB/zL4QBjSkALBhz8xeYGYm4i1elH3Ch9jn2rHy9E8C7zxwZbW2mYHtV/Micyc6X03yqBuEVzsqlIxSUoUKM4yVTlje5jj6ggo/OJP86wUExbvsxkjocjrRitqk5eAlt6KHr5SxbqQKBgQC9CewRCFBJQpYaHDEpyVHlsgM6qwP4W4VvStScTQ1hXnHE7g0mQhKxiS+WgF6RJkhiJhTvRfSVm0/3PSLa9woEtgiNx+cPscHLFvR0y4RCbjA1QDIGLbQV9/e6ntnlup4nFrCEgA17oQtb/EGXMAIRL2SdsGpd3YEWrSchOxuhGwKBgQDJeyt17Qo6OMAIJJbxswRGyXdxUm5QVtsLZgTEceLQ6hvwSukGGb3ZntsCZlPOpPDq9Nh7z6UueHGgi+U6CI1YqhZDO/1UN342vwKABrlVTgUqBgoBKK4VMXl6Q4UtN98dy+sYlCoZo9DwTkhc+k7mTVTKnlop7U7dnTsWuk+HyQKBgHOAm39wr/WDPMlpTlS00FhjIvv2v+9ApE/yzeNOZQ2IMkVcGia1GkzlgHEZsC5J0NI/aG0mNiIvCnYLIb/eT32/Z4yRhsmdF8aqGOU/8GjSgJwYxDfoNu9xWijppENsefNyNppOz24pYRJsF/tzdt/fMD/1KZh+ncAoPg9c2S3fAoGAWzYz9FFDIXv8yx8e5eGJstq+F2GkOrTliPfjX5PP1NkIJ8vFxGVE6RKzn8FSoE+Xxz5GjcULoE0hno7p2oYqLQpd7pI3LyLTSZhTN0FKDHQQpPtzoo6hSda53i3AaI0VO6mRi3VJaSoWhUkz/4ULR1NuuWpW2oFD2hIEQZqkiDI=-----END PRIVATE KEY-----"
+        val singleLineKey = TlsTestCertificates.singleLine(TlsTestCertificates.CLIENT_KEY_PEM)
         // when
         val privateKey = PemUtils.parsePrivateKey(singleLineKey)
         // then
@@ -157,9 +126,9 @@ class PemUtilsTest {
     @Test
     fun `#parseCertificate handles malformed PEM with only header newline`() {
         // given
-        // notsecret
-        val malformedPem =
-            "-----BEGIN CERTIFICATE-----\nMIIDlTCCAn2gAwIBAgIUJ/MyNwdZC5vGYJMyYa5m4letZrYwDQYJKoZIhvcNAQELBQAwWjEnMCUGA1UEAwweZmFrZS11bml0LXRlc3QuZXhhbXBsZS5pbnZhbGlkMSIwIAYDVQQKDBlFeGFtcGxlIFRlc3QgRml4dHVyZSBPbmx5MQswCQYDVQQGEwJYWDAeFw0yNjA1MTMxMzE4MDJaFw0zNjA1MTAxMzE4MDJaMFoxJzAlBgNVBAMMHmZha2UtdW5pdC10ZXN0LmV4YW1wbGUuaW52YWxpZDEiMCAGA1UECgwZRXhhbXBsZSBUZXN0IEZpeHR1cmUgT25seTELMAkGA1UEBhMCWFgwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCG4CRbIkDOtpWzjWVW3V62FKzSfdAhdOJ/avqaPU2FiSjwEcBuVceoT5ilVjNWuDSqWeTrmwPjBfzywpB9OHrziqE5rRBnlyuxTMgxxbpNU8WEBFtn2RWvKen0uZOOLTro1oQsI6ALqKd07s8t9XjIZMEiOzhvKzYK6xQiqXjnYJqWAw3ZjhuvPcuvAALTXJMB6dASZNJ+q7gUd0gIMIjXVzAcj/QPxISwr3JMbpk+GvDnz0kFt7TFQRMqW56dbK36ukjDvLdFd+bbigE6m55vsGVdyZC55wBIB87ycn0zc3hgrfej4JVEqEhhlsifUkjGqNR2h9cdY3u58gzJwZP5AgMBAAGjUzBRMB0GA1UdDgQWBBSn488Oxr0rTEaI1Q3xHhxERrAZ5jAfBgNVHSMEGDAWgBSn488Oxr0rTEaI1Q3xHhxERrAZ5jAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAu0fWReMMgSMM2ctyslZ/b00FDUnDq713HQ+HH3sB28NVxvwKUHR637Z/VzX2HNlR5wuR2ulxKi6m54EBVCuE+T4kwPD/wx32RtGMAyuBlpamLC6WOdmVIVdYr66BRE7KdfTNnK+MJAa0duD5KniqxkdMU7ZxveHM6RRv/hDg0qybOxLSwetmfI9CRiw0qOGiX5PhCqsJVIf1FxRl2mPPO0HiI94AyenmZfatuz9Y8Pb/q7cgdXpX2x29dnqXXO91qbVHk+zIIsYowqsdnMTfqNHFSJGrNovvI63/GQ/8148oKAALaH4VgNOyVIdaKkPDR5I/WBnNmgJHFa/ozYnVi-----END CERTIFICATE-----"
+        // header newline only; body and footer on one line
+        val malformedPem = TlsTestCertificates.singleLine(TlsTestCertificates.CA_PEM)
+            .replace("-----BEGIN CERTIFICATE-----", "-----BEGIN CERTIFICATE-----\n") // notsecret
         // when
         val certificate = PemUtils.parseCertificate(malformedPem)
         // then

src/test/kotlin/com/redhat/devtools/gateway/auth/tls/TlsConnectionProbeTestFixtures.kt

@@ -57,17 +57,13 @@ object TlsConnectionProbeTestFixtures {
 
     private val CHAR_ARRAY_EMPTY = CharArray(0)
 
-    val SERVER_KEY_PEM = TlsConnectionProbeTestFixtures::class.java.classLoader
-        .getResourceAsStream("tls/server-key.pem")!!.readBytes().toString(Charsets.UTF_8)
+    val SERVER_KEY_PEM = TlsTestCertificates.readTlsResource("server-key.pem")
 
-    val SERVER_CERT_PEM = TlsConnectionProbeTestFixtures::class.java.classLoader
-        .getResourceAsStream("tls/server-cert.pem")!!.readBytes().toString(Charsets.UTF_8)
+    val SERVER_CERT_PEM = TlsTestCertificates.readTlsResource("server-cert.pem")
 
-    val MISMATCH_KEY_PEM = TlsConnectionProbeTestFixtures::class.java.classLoader
-        .getResourceAsStream("tls/mismatch-key.pem")!!.readBytes().toString(Charsets.UTF_8)
+    val MISMATCH_KEY_PEM = TlsTestCertificates.readTlsResource("mismatch-key.pem")
 
-    val MISMATCH_CERT_PEM = TlsConnectionProbeTestFixtures::class.java.classLoader
-        .getResourceAsStream("tls/mismatch-cert.pem")!!.readBytes().toString(Charsets.UTF_8)
+    val MISMATCH_CERT_PEM = TlsTestCertificates.readTlsResource("mismatch-cert.pem")
 
     fun createServerSslContext(keyPem: String, certPem: String): SSLContext {
         val key = PemUtils.parsePrivateKey(keyPem)

src/test/kotlin/com/redhat/devtools/gateway/auth/tls/TlsTestCertificates.kt

@@ -15,31 +15,21 @@ import java.security.cert.X509Certificate
 
 object TlsTestCertificates {
 
-    // notsecret — synthetic self-signed fixture (see PemUtilsTest)
-    val CA_PEM: String = """
-        -----BEGIN CERTIFICATE-----
-        MIIDlTCCAn2gAwIBAgIUJ/MyNwdZC5vGYJMyYa5m4letZrYwDQYJKoZIhvcNAQEL
-        BQAwWjEnMCUGA1UEAwweZmFrZS11bml0LXRlc3QuZXhhbXBsZS5pbnZhbGlkMSIw
-        IAYDVQQKDBlFeGFtcGxlIFRlc3QgRml4dHVyZSBPbmx5MQswCQYDVQQGEwJYWDAe
-        Fw0yNjA1MTMxMzE4MDJaFw0zNjA1MTAxMzE4MDJaMFoxJzAlBgNVBAMMHmZha2Ut
-        dW5pdC10ZXN0LmV4YW1wbGUuaW52YWxpZDEiMCAGA1UECgwZRXhhbXBsZSBUZXN0
-        IEZpeHR1cmUgT25seTELMAkGA1UEBhMCWFgwggEiMA0GCSqGSIb3DQEBAQUAA4IB
-        DwAwggEKAoIBAQCG4CRbIkDOtpWzjWVW3V62FKzSfdAhdOJ/avqaPU2FiSjwEcBu
-        VceoT5ilVjNWuDSqWeTrmwPjBfzywpB9OHrziqE5rRBnlyuxTMgxxbpNU8WEBFtn
-        2RWvKen0uZOOLTro1oQsI6ALqKd07s8t9XjIZMEiOzhvKzYK6xQiqXjnYJqWAw3Z
-        jhuvPcuvAALTXJMB6dASZNJ+q7gUd0gIMIjXVzAcj/QPxISwr3JMbpk+GvDnz0kF
-        t7TFQRMqW56dbK36ukjDvLdFd+bbigE6m55vsGVdyZC55wBIB87ycn0zc3hgrfej
-        4JVEqEhhlsifUkjGqNR2h9cdY3u58gzJwZP5AgMBAAGjUzBRMB0GA1UdDgQWBBSn
-        488Oxr0rTEaI1Q3xHhxERrAZ5jAfBgNVHSMEGDAWgBSn488Oxr0rTEaI1Q3xHhxE
-        RrAZ5jAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAu0fWReMMg
-        SMM2ctyslZ/b00FDUnDq713HQ+HH3sB28NVxvwKUHR637Z/VzX2HNlR5wuR2ulxK
-        i6m54EBVCuE+T4kwPD/wx32RtGMAyuBlpamLC6WOdmVIVdYr66BRE7KdfTNnK+MJ
-        Aa0duD5KniqxkdMU7ZxveHM6RRv/hDg0qybOxLSwetmfI9CRiw0qOGiX5PhCqsJV
-        If1FxRl2mPPO0HiI94AyenmZfatuz9Y8Pb/q7cgdXpX2x29dnqXXO91qbVHk+zII
-        sYowqsdnMTfqNHFSJGrNovvI63/GQ/8148oKAALaH4VgNOyVIdaKkPDR5I/WBnNm
-        gJHFa/ozYnVi
-        -----END CERTIFICATE-----
-    """.trimIndent()
+    // synthetic fixtures loaded from src/test/resources/tls/
+    val CA_PEM: String = readTlsResource("ca-cert.pem")
+    val EC_PEM: String = readTlsResource("ec-cert.pem")
+    val NORMALIZATION_PEM: String = readTlsResource("normalization-cert.pem")
+    // PKCS#8 RSA key; not paired with a live cluster
+    val CLIENT_KEY_PEM: String = readTlsResource("client-key.pem")
+
+    fun readTlsResource(name: String): String =
+        TlsTestCertificates::class.java.classLoader
+            .getResourceAsStream("tls/$name")
+            ?.use { it.readBytes() }
+            ?.toString(Charsets.UTF_8)
+            ?: error("Missing TLS test resource: tls/$name")
+
+    fun singleLine(pem: String): String = pem.replace("\n", "").replace("\r", "")
 
     fun caCertificate(): X509Certificate = PemUtils.parseCertificate(CA_PEM)
 

src/test/kotlin/com/redhat/devtools/gateway/kubeconfig/BlockStyleFilePersisterTest.kt

@@ -21,8 +21,6 @@ import java.nio.file.Path
 
 class BlockStyleFilePersisterTest {
 
-    // notsecret — kubeconfig user token strings embedded in YAML snippets are invented test fixtures only.
-
     @TempDir
     lateinit var tempDir: Path
 

src/test/kotlin/com/redhat/devtools/gateway/kubeconfig/KubeConfigNamedUserTest.kt

@@ -18,8 +18,6 @@ import org.junit.jupiter.api.Test
 
 class KubeConfigNamedUserTest {
 
-    // notsecret — token and credential-like strings are invented test fixtures only.
-
     @Test
     fun `#fromMap is parsing named user`() {
         // given

src/test/kotlin/com/redhat/devtools/gateway/kubeconfig/KubeConfigUtilsTest.kt

@@ -26,7 +26,6 @@ import kotlin.io.path.writeText
 
 class KubeConfigUtilsTest {
 
-    // notsecret — tokens and URLs embedded in kubeconfig YAML snippets below are invented test fixtures only.
     @TempDir
     lateinit var tempDir: Path
 
@@ -436,7 +435,7 @@ class KubeConfigUtilsTest {
             current-context: dagobah-context
         """.trimIndent()
         )
-        // notsecret
+
         val kubeConfigFile2 = createTempKubeConfigFile(
             "config2", """
             apiVersion: v1