Compare decoded RSA keys with Equal to fix a flaky test

[wallrj]

Fixes a flaky unit test that failed on #762 and blocked its merge until a retest.

Test_WriteKeypair and Test_Create compare a generated rsa.PrivateKey with one decoded from a PKCS#12 bundle using assert.Equal, which uses reflect.DeepEqual. The two keys are the same key but are not deeply equal about one time in a hundred. This PR compares them with the key's own Equal method instead.

Why does it flake?

Since Go 1.24 an rsa.PrivateKey holds an unexported FIPS key. Its precomputed dP, dQ and qInv values are byte slices, and they are encoded differently depending on how the key was made:

• Generated keys store them fixed-width: crypto/internal/fips140/rsa/rsa.go#L78
• Parsed keys store them minimal-width from big.Int.Bytes(): crypto/rsa/rsa.go#L583-L585

Whenever one of those three values has a leading zero byte, the slices differ in length and reflect.DeepEqual reports the keys as different. rsa.PrivateKey.Equal compares only N, E, D and the primes: crypto/rsa/rsa.go#L128-L144.

Failure from #762 and a standalone repro

The failed job on #762 shows the length mismatch:

=== FAIL: pkg/filestore Test_WriteKeypair/keystore_PKCS12_with_defined_file_and_password (0.01s)
    writer_test.go:450:
        	Diff:
        	--- Expected
        	+++ Actual
        	-   dP: ([]uint8) (len=128) {
        	-    00000000  00 22 38 93 0f a1 be 72  e5 0a 4d 80 d4 81 6b 71  |."8....r..M...kq|
        	+   dP: ([]uint8) (len=127) {
        	+    00000000  22 38 93 0f a1 be 72 e5  0a 4d 80 d4 81 6b 71 2e  |"8....r..M...kq.|

This test reproduces it without cert-manager code:

func TestDeepEqualFlake(t *testing.T) {
	for i := 0; i < 500; i++ {
		k, _ := rsa.GenerateKey(rand.Reader, 2048)
		der, _ := x509.MarshalPKCS8PrivateKey(k)
		p, _ := x509.ParsePKCS8PrivateKey(der)
		if !k.Equal(p) {
			t.Fatal("Equal false")
		}
		if !reflect.DeepEqual(k, p) {
			t.Fatalf("iteration %d: reflect.DeepEqual false while Equal true", i)
		}
	}
}

main_test.go:20: iteration 192: reflect.DeepEqual false while Equal true

With this PR both packages pass go test -count=20, and golangci-lint reports no issues.

[Claude Fable 5.1]

[Copilot]

Copilot review overview

🟢 Approval recommended

The flaky test comparisons are corrected without unresolved review issues.

Review effort: Lite
Findings: None

What changed in this PR

Fixes flaky RSA private-key comparisons in PKCS#12-related tests by using semantic key equality instead of reflective deep equality.

Changes:

• Replaced deep-equality assertions with RSA key Equal comparisons.
• Added comments explaining representation differences in newer Go versions.

File	Description
pkg/​keystore/​pkcs12/​pkcs12_test.go	Uses key-specific equality for decoded keys.
pkg/​filestore/​writer_test.go	Avoids flaky reflective comparisons for decoded RSA keys.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[erikgb]

/lgtm
/approve

Thanks, Richard!

[cert-manager-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: erikgb

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [erikgb]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment