From b5a18598ed5df84bb38b69d2b533d363eb950ea7 Mon Sep 17 00:00:00 2001
From: MattJackson <1085847+MattJackson@users.noreply.github.com>
Date: Thu, 4 Jun 2026 16:38:58 -0700
Subject: [PATCH] host_certs: negative test only (no key-shaped material in
 code)

---
 src/keydb.rs | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/keydb.rs b/src/keydb.rs
index 2c90647..35ae6d6 100644
--- a/src/keydb.rs
+++ b/src/keydb.rs
@@ -174,4 +174,16 @@ mod tests {
         };
         assert!(KeydbSource::candidates_from(&db, &inputs("0xaabb")).is_empty());
     }
+
+    /// No keydb (or a LibreDrive deployment) → no host credentials, not an
+    /// error. (The positive parse is NOT tested here — it would require host
+    /// key material, which must never appear in code.)
+    #[test]
+    fn host_certs_empty_when_keydb_missing() {
+        assert!(
+            KeydbSource::new("/nonexistent/path/keydb.cfg")
+                .host_certs()
+                .is_empty()
+        );
+    }
 }