rb-portless 0.4.0 → 0.4.1.dev.20260707.17213cc

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 33ab8aad78892a8c3a4889fa0b5c7b27b26871e6db726b7e59213786890c0eb0
-  data.tar.gz: b6e68f4074485b5d8cb37814164bffba5f4f3a3e120a33bc5d46e66fe1d9502c
+  metadata.gz: 9c5231d955992c5d9c1dc235bce13b8ee6c5d50852147e50c8da632f1918c8a4
+  data.tar.gz: 60856b5d93cc1016c5a1fdde83ec692a681f1c060518c0437ffd9d642df190cf
 SHA512:
-  metadata.gz: 95fb0005242dee8b657e2cf129905214ba5fbc1785b84ba358dbb31e4cee8c578320b3e3086624b1faf22122ac1a6654ee8281ead950d81f26fd54d8ab70197c
-  data.tar.gz: de6f31af583cbe7307fbbd876361e681db21382d89362c51f23cf58d52f69b3334dd0788e11aefa04863e8b3d7375f41071d2c9f69828b0d873e456517f55ebd
+  metadata.gz: 3b391f24ff703e076ad3fb1df430024773cfbf1fb6acc9309ed8eb68d9395041db9e48521e5afd3a029fad80075ed6754c1f86a3ad7ab7fa033c5665a1be2443
+  data.tar.gz: 327c09c0c578019c00e0fc9f92513ad335f7faaf8408075d34003d2db2b37ba93571097149a009397ec89cf04de4d3b86a5ec03a6bb0ac43606010fe091f742a

data/CHANGELOG.md

@@ -4,6 +4,21 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [0.4.1]
+
+### Fixed
+
+- **Proxied apps could no longer verify public TLS certificates.** `run` set the
+  child's `SSL_CERT_FILE` to our local CA so the app would trust sibling
+  `.localhost` hosts — but that env var *replaces* OpenSSL's trust store rather
+  than extending it, so the app lost every public root and all outbound HTTPS
+  (payment APIs, S3, webhooks, exchange-rate feeds…) failed with `certificate
+  verify failed (unable to get local issuer certificate)`. `run` now hands apps
+  a combined bundle (the system's default roots **plus** our CA), assembled once
+  into `~/.rb-portless/ca-bundle.pem` and rebuilt when either input changes, so
+  apps trust the public web *and* our local hosts. Falls back to leaving
+  `SSL_CERT_FILE` unset when the CA or system roots can't be located.
+
 ## [0.4.0]
 
 ### Added

data/lib/portless/ca_bundle.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+require "openssl"
+require "fileutils"
+
+module Portless
+  # The CA bundle handed to proxied apps via SSL_CERT_FILE.
+  #
+  # SSL_CERT_FILE *replaces* OpenSSL's trust file rather than adding to it, so
+  # pointing an app at our local CA alone makes it distrust every public
+  # certificate — Frankfurter, Stripe, S3, GitHub — and all outbound HTTPS from
+  # the dev server fails with "unable to get local issuer certificate". We
+  # instead assemble a combined bundle (the system's default roots + our CA) and
+  # point apps at that, so they trust the public web *and* sibling .localhost
+  # hosts served under our CA.
+  module CaBundle
+    # Well-known system trust stores, tried when OpenSSL's compiled-in default
+    # isn't readable (varies by distro / OpenSSL build).
+    FALLBACK_ROOTS = [
+      "/etc/ssl/cert.pem",                     # macOS, OpenBSD
+      "/etc/ssl/certs/ca-certificates.crt",    # Debian, Ubuntu, Alpine
+      "/etc/pki/tls/certs/ca-bundle.crt",      # Fedora, RHEL
+      "/etc/ssl/ca-bundle.pem"                 # openSUSE
+    ].freeze
+
+    module_function
+
+    # Absolute path to the combined bundle, (re)building it when missing or older
+    # than either input. Returns nil when our CA doesn't exist yet or assembly
+    # fails, so the caller simply omits the SSL_CERT_FILE override (apps keep
+    # their own defaults) rather than shipping a broken trust store.
+    def path
+      return nil unless File.exist?(State.ca_cert)
+
+      bundle = bundle_path
+      rebuild(bundle) if stale?(bundle)
+      File.exist?(bundle) ? bundle : nil
+    rescue StandardError
+      nil
+    end
+
+    def bundle_path = State.path("ca-bundle.pem")
+
+    def stale?(bundle)
+      return true unless File.exist?(bundle)
+
+      inputs = [ State.ca_cert, system_roots ].compact.select { |f| File.exist?(f) }
+      inputs.empty? || inputs.any? { |f| File.mtime(f) > File.mtime(bundle) }
+    end
+
+    def rebuild(bundle)
+      State.ensure_dir!
+      pems = []
+      roots = system_roots
+      pems << File.read(roots) if roots && File.exist?(roots)
+      pems << File.read(State.ca_cert)
+
+      # Atomic write: concurrent app starts may both rebuild; a temp file + rename
+      # keeps any reader from seeing a half-written bundle.
+      tmp = "#{bundle}.#{Process.pid}.tmp"
+      File.write(tmp, "#{pems.join("\n").strip}\n")
+      File.rename(tmp, bundle)
+      State.fix_ownership(bundle)
+    end
+
+    # The public root store OpenSSL would use by default, so our bundle is a
+    # superset of it. An operator-set SSL_CERT_FILE wins (but never our own
+    # bundle, which would read itself in circles).
+    def system_roots
+      env = ENV["SSL_CERT_FILE"].to_s
+      return env if !env.empty? && env != bundle_path && File.exist?(env)
+
+      default = OpenSSL::X509::DEFAULT_CERT_FILE
+      return default if default && File.exist?(default)
+
+      FALLBACK_ROOTS.find { |f| File.exist?(f) }
+    end
+  end
+end

data/lib/portless/run_support.rb

@@ -12,8 +12,10 @@ module Portless
         "PORT" => port.to_s,
         "HOST" => "127.0.0.1",
         "PORTLESS_URL" => url,
-        # Let the app's own server-side TLS verification trust our CA.
-        "SSL_CERT_FILE" => (File.exist?(State.ca_cert) ? State.ca_cert : nil)
+        # Let the app's own server-side TLS verification trust our CA — via a
+        # bundle that *also* carries the public roots, so SSL_CERT_FILE replacing
+        # the trust store doesn't break the app's outbound HTTPS. See CaBundle.
+        "SSL_CERT_FILE" => CaBundle.path
       }.compact
       # Our own bundle (rb-portless is loaded via the app's Bundler binstub) must
       # not leak into the dev command — a foreman-style `bin/dev` isn't in the

data/lib/portless/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Portless
-  VERSION = "0.4.0"
+  VERSION = "0.4.1.dev.20260707.17213cc"
 end

data/lib/rb-portless.rb

@@ -15,6 +15,7 @@ require_relative "portless/health"
 require_relative "portless/privilege"
 require_relative "portless/hosts"
 require_relative "portless/certs"
+require_relative "portless/ca_bundle"
 require_relative "portless/trust"
 require_relative "portless/proxy"
 require_relative "portless/daemon"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rb-portless
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.4.1.dev.20260707.17213cc
 platform: ruby
 authors:
 - David Afonso
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-07-04 00:00:00.000000000 Z
+date: 2026-07-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: async
@@ -57,6 +57,7 @@ files:
 - README.md
 - exe/rb-portless
 - lib/portless/banner.rb
+- lib/portless/ca_bundle.rb
 - lib/portless/certs.rb
 - lib/portless/cli.rb
 - lib/portless/colors.rb