cmd.Env = append(cmd.Environ(), "GO_WANT_HELPER_PROCESS=1")
	cmd.SysProcAttr = &syscall.SysProcAttr{Chroot: d, Unshareflags: syscall.CLONE_NEWNS}

	out, err := cmd.CombinedOutput()
	if err != nil {
		if testenv.SyscallIsNotSupported(err) {
			t.Skipf("skipping: could not start process with CLONE_NEWNS and Chroot %q: %v", d, err)
		}
		t.Fatalf("unshare failed: %v\n%s", err, out)
	} else if len(out) != 0 {

			if err1 != 0 {
				goto childerror
			}
		}
	}

	// Chroot
	if chroot != nil {
		_, _, err1 = RawSyscall(SYS_CHROOT, uintptr(unsafe.Pointer(chroot)), 0, 0)
		if err1 != 0 {
			goto childerror
		}
	}

	// User and groups
	if cred = sys.Credential; cred != nil {
		ngroups = uintptr(len(cred.Groups))

        then:
        formatter.toString() == toPlatformLineSeparators("""Some thing.
Some other thing.""")
    }

    def "formats multiple nodes with children"() {
        when:
        formatter.node("root1")
        formatter.startChildren()
        formatter.node("child1")
        formatter.node("child2")
        formatter.endChildren()
        formatter.node("root2")
        formatter.startChildren()

	SYS_EXECVE               = 59  // { int|sys||execve(const char *path, char * const *argp, char * const *envp); }
	SYS_UMASK                = 60  // { mode_t|sys||umask(mode_t newmask); }
	SYS_CHROOT               = 61  // { int|sys||chroot(const char *path); }
	SYS_VFORK                = 66  // { int|sys||vfork(void); }
	SYS_SBRK                 = 69  // { int|sys||sbrk(intptr_t incr); }
	SYS_SSTK                 = 70  // { int|sys||sstk(int incr); }

	SYS_EXECVE               = 59  // { int|sys||execve(const char *path, char * const *argp, char * const *envp); }
	SYS_UMASK                = 60  // { mode_t|sys||umask(mode_t newmask); }
	SYS_CHROOT               = 61  // { int|sys||chroot(const char *path); }
	SYS_VFORK                = 66  // { int|sys||vfork(void); }
	SYS_SBRK                 = 69  // { int|sys||sbrk(intptr_t incr); }
	SYS_SSTK                 = 70  // { int|sys||sstk(int incr); }

	SYS_EXECVE               = 59  // { int|sys||execve(const char *path, char * const *argp, char * const *envp); }
	SYS_UMASK                = 60  // { mode_t|sys||umask(mode_t newmask); }
	SYS_CHROOT               = 61  // { int|sys||chroot(const char *path); }
	SYS_VFORK                = 66  // { int|sys||vfork(void); }
	SYS_SBRK                 = 69  // { int|sys||sbrk(intptr_t incr); }
	SYS_SSTK                 = 70  // { int|sys||sstk(int incr); }

	SYS_EXECVE               = 59  // { int|sys||execve(const char *path, char * const *argp, char * const *envp); }
	SYS_UMASK                = 60  // { mode_t|sys||umask(mode_t newmask); }
	SYS_CHROOT               = 61  // { int|sys||chroot(const char *path); }
	SYS_VFORK                = 66  // { int|sys||vfork(void); }
	SYS_SBRK                 = 69  // { int|sys||sbrk(intptr_t incr); }
	SYS_SSTK                 = 70  // { int|sys||sstk(int incr); }

			t.Errorf("%s: Unexpected extensions: wanted %v but got %v", id, expected, san)
		}
	}
}

func TestAppendRootCerts(t *testing.T) {
	root1 := "root-cert-1"
	expRootCerts := `root-cert-1
root-cert-2
root-cert-3`
	rootCerts, err := util.AppendRootCerts([]byte(root1), "./root-certs-for-testing.pem")
	if err != nil {
		t.Errorf("AppendRootCerts() returns an error: %v", err)
	} else if expRootCerts != string(rootCerts) {

	pty, procTTYName, err := testpty.Open()
	if err != nil {
		ptyErr := err.(*testpty.PtyError)
		if ptyErr.FuncName == "posix_openpt" && ptyErr.Errno == syscall.EACCES {
			t.Skip("posix_openpt failed with EACCES, assuming chroot and skipping")
		}
		t.Fatal(err)
	}
	defer pty.Close()
	procTTY, err := os.OpenFile(procTTYName, os.O_RDWR, 0)
	if err != nil {
		t.Fatal(err)
	}
	defer procTTY.Close()

	defer cancel()

	ctb1 := &certificatesv1alpha1.ClusterTrustBundle{
		ObjectMeta: metav1.ObjectMeta{
			Name: "ctb1",
		},
		Spec: certificatesv1alpha1.ClusterTrustBundleSpec{
			TrustBundle: mustMakeRoot(t, "root1"),
		},
	}

	ctb2 := &certificatesv1alpha1.ClusterTrustBundle{
		ObjectMeta: metav1.ObjectMeta{
			Name: "ctb2",
		},
		Spec: certificatesv1alpha1.ClusterTrustBundleSpec{