Make t/05_ca_hashes_up_to_date.t work

t/05_ca_hashes_up_to_date.t

@@ -4,14 +4,29 @@ use strict;
 use warnings;
 use Test::More;
 
-printf "\n%s\n", "Make sure CA certificate stores are older than their SPKI hashes \"~/etc/ca_hashes.txt\" ...";
+# Verify that etc/ca_hashes.txt is in sync with the CA bundles (etc/*.pem).
+# Regenerates the hashes and compares content, rather than relying on
+# file modification times (which git does not preserve).
 
-my $newer_bundles=`find etc/*.pem -newer etc/ca_hashes.txt`;
+# Regenerate ca_hashes.txt from the .pem bundles
+my $rc = system('./utils/create_ca_hashes.sh');
+is($rc, 0, "create_ca_hashes.sh exited successfully");
 
-#1
-is($newer_bundles,"","Checking if there's an output with a *.pem file. If so: run \"~/utils/create_ca_hashes.sh\"");
+# Check whether the regenerated file differs from what is committed.
+# Read git's exit status via system() and Perl's $?. Do NOT use a
+# backtick `...; echo $?`: Perl interpolates $? as the *previous*
+# command's status (the script's, always 0), so the shell would just
+# echo 0 and the diff would never be detected.
+my $diff_rc = system('git diff --quiet -- etc/ca_hashes.txt 2>/dev/null');
+my $has_diff = (($diff_rc >> 8) == 0) ? "0" : "1";
+
+# Restore the original file and remove the .bak the script creates
+system('git checkout -- etc/ca_hashes.txt 2>/dev/null');
+unlink 'etc/ca_hashes.txt.bak';
+
+is($has_diff, "0",
+   "ca_hashes.txt is up to date with the .pem bundles (run ./utils/create_ca_hashes.sh if not)");
 
-printf "\n";
 done_testing;