From 914d7411b258ae3e1c16471612432a8eb054a3ce Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Sun, 2 Aug 2026 00:07:02 +0000
Subject: [PATCH] Improve tests for httputil: cover
 ConfigureTLSTrustEnvironment Setenv error path

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 internal/httputil/tls_test.go | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/internal/httputil/tls_test.go b/internal/httputil/tls_test.go
index af194f24f..89c1e96c6 100644
--- a/internal/httputil/tls_test.go
+++ b/internal/httputil/tls_test.go
@@ -85,4 +85,14 @@ func TestConfigureTLSTrustEnvironment(t *testing.T) {
 		err := ConfigureTLSTrustEnvironment("/tmp/ca\r.crt")
 		assert.ErrorContains(t, err, "invalid TLS CA cert path contains newline")
 	})
+
+	t.Run("propagates os.Setenv failure", func(t *testing.T) {
+		// os.Setenv rejects values containing a NUL byte on all supported
+		// platforms; this exercises the wrapped-error return branch that is
+		// otherwise unreachable given the newline/carriage-return guard above.
+		err := ConfigureTLSTrustEnvironment("/tmp/ca\x00.crt")
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "failed to set")
+		assert.Contains(t, err.Error(), TLSTrustEnvKeys()[0])
+	})
 }