yamine 0.10.0 → 0.10.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: db8822f4d49064d2cb61c2219c43c7049eafc7e44a2bb4b918981ef7a4bd8d11
-  data.tar.gz: 31c30cc196665056aab7f711c092003f775af0d684fc891adcf039da1603a96b
+  metadata.gz: 73e497200efd0723559dff2f57e920e3d126d3caecf302770c37bec613d7998e
+  data.tar.gz: 2203cabc149df919703fb1182fb9ad76e9c6729d4ed105455c749dbfa7611593
 SHA512:
-  metadata.gz: 85e04f77e692d458765ef87714bb83dac175f387dec1bba92bb46e4ac405d292d693a0292187bf427b6fc56bbbbf1263635bdcbcbd3426295531235aab51dc67
-  data.tar.gz: 226f812a9accf7265fcae4f1ae74328bb6229ee9199af790e2d744085fed517f7445a6c501c94b6ec188d8f0575677f91753831b9ef502349b4bf2f873b5dbf3
+  metadata.gz: d30e26aec61c7036e349a84f6f241291756c7ee3207f6e1de210cb47465ccc94279619cc9657d3ecbc477b8983be8027ae2303d43456b4891762f79dec7bd885
+  data.tar.gz: 1a6a7e1b4e402b822a3d6f70ed6b19881c8927563c131875b322a7b750c9ec9368ba8a7f45ff99badfe55d23c54a964f163a80b8d10d6c45aa6a5a3ae5d9abc9

data/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## [0.10.1] — 2026-09-10
+
+### Fixed
+
+- **The CA is regenerated before trust is judged, not after.** Both
+  trust paths asked `Certs.trusted?` first, which compares the trust
+  marker against the certificate ON DISK. A proxy regenerates the CA at
+  boot when the on-disk one is missing, expiring, or renamed — so after
+  a rename the marker still matched the OLD certificate, trust was
+  skipped as "already done", and the proxy then came up serving a CA the
+  keychain did not trust: TLS verification fails for every route. The
+  check now brings the CA up to date first (`ca_current_and_trusted?`,
+  used by both paths).
+
+
 ## [0.10.0] — 2026-09-10
 
 The ask-local rename is finished: the two user-visible names it left

data/lib/yamine/cli/system.rb

@@ -334,13 +334,29 @@ module Yamine
         puts "Installed root LaunchDaemon on port 443 (state: #{state_dir})."
       end
 
+      # True when the trust store covers the CA this machine should be
+      # serving with — regenerating the CA first if it is missing,
+      # expiring, or renamed.
+      #
+      # The ordering is the whole point, so it lives in one place rather
+      # than at each call site. `trusted?` compares a marker against the
+      # fingerprint of the certificate ON DISK, and a proxy regenerates
+      # the CA at boot when the name changes. Checking the marker before
+      # the CA is current therefore reads a stale match, skips trust, and
+      # lets the proxy come up serving a CA the keychain does not trust —
+      # breaking TLS for every route.
+      def ca_current_and_trusted?(dir = Certs.state_dir)
+        Certs.ensure_ca(dir)
+        Certs.trusted?(dir)
+      end
+
       # Root-only CA trust: the System keychain (all users, no prompt).
       # Safe to call repeatedly — once the marker is set it is a no-op.
       # Prints before doing work: the System keychain add can take a few
       # seconds, and this runs in the root half of setup where silence
       # reads as a hang.
       def ensure_system_ca_trust
-        return if Certs.trusted?(Certs.state_dir)
+        return if ca_current_and_trusted?(Certs.state_dir)
 
         puts "    Trusting the CA into the System keychain..."
         result = Trust.trust
@@ -760,7 +776,7 @@ module Yamine
       # those users had already chosen to avoid.
       def ensure_workstation!(ctx)
         # 1. CA
-        unless Yamine::Certs.trusted?(ctx.store.dir)
+        unless ca_current_and_trusted?(ctx.store.dir)
           result = Yamine::Trust.trust
           unless result[:trusted]
             abort_setup("CA trust failed: #{result[:error]}",

data/lib/yamine/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Yamine
-  VERSION = "0.10.0"
+  VERSION = "0.10.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: yamine
 version: !ruby/object:Gem::Version
-  version: 0.10.0
+  version: 0.10.1
 platform: ruby
 authors:
 - Kaka Ruto