flake: TestValidate/regular #1602

CI Run Link: https://github.com/coder/coder/actions/runs/27788155477
Failed Jobs:

• https://github.com/coder/coder/actions/runs/27788155477/job/82230124745 (test-go-pg ubuntu-latest)
• https://github.com/coder/coder/actions/runs/27788155477/job/82230124749 (test-go-pg-17)

Commit Info:

• SHA: 56eb705b8cc5e38bdc07c6772e687592dda846df
• Author: Hugo Dutka
• coder/coder@56eb705

Error Evidence:

=== FAIL: coderd/azureidentity TestValidate/regular (0.01s)
    azureidentity_test.go:58:
        Error:       Received unexpected error:
                     verify pkcs7:
                         github.com/coder/coder/v2/coderd/azureidentity.Validate
                             /home/runner/work/coder/coder/coderd/azureidentity/azureidentity.go:265
                       - pkcs7: failed to verify certificate chain: x509: certificate signed by unknown authority

Root Cause:
TestValidate/regular runs in offline mode and relies on rootCertPool() for trust. On Linux, rootCertPool() returns x509.SystemCertPool() (see coderd/azureidentity/roots_other.go). The Azure PKCS7 payload in the test failed to chain to a trusted root in the runner’s system trust store, producing x509: certificate signed by unknown authority. This suggests a system root store mismatch/rotation or missing Azure root (possibly related to the recent change that embeds roots only on darwin).

Precise Assignment Analysis:

• git blame is not available via the API; used file history instead.
• git log --oneline -10 --follow coderd/azureidentity/azureidentity_test.go → 132fa87 (Spike Curtis) "fix: only embed Azure roots on darwin"
• git log --oneline -10 --follow coderd/azureidentity/azureidentity.go → 132fa87 (Spike Curtis) "fix: only embed Azure roots on darwin"
  Assigning to spikecurtis as the most recent meaningful modifier of root-trust behavior for this test/component.

Related Issues:

• coderd/azureidentity TestValidate/regular fails on MacOS #101 (macOS standards-compliance error; different failure mode)

Classification:
A. Flaky Test / certificate trust chain mismatch on Linux runners.

Reproduction:

• go test ./coderd/azureidentity -run TestValidate/regular -count=1