So I'm still a little confused. What are examples of tmpdir and @cert_file? To me, it looks like they get created in the current directory for the process, which is presumably whatever the current dir was when rspec was launched. Is that not the case?

The goal is for no files to ever be written under the repository dir -- i.e., if write access was denied under the repository directory, the test should still pass. I was thinking we'd initialie tmpdir using something like mktempname (or similarly named method) and then use that for all examples.