yamine 0.10.0 → 0.10.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: db8822f4d49064d2cb61c2219c43c7049eafc7e44a2bb4b918981ef7a4bd8d11
-  data.tar.gz: 31c30cc196665056aab7f711c092003f775af0d684fc891adcf039da1603a96b
+  metadata.gz: 06f020588bc63954dd44b5a99b598995ec3e6f562c03756b867d26ff44178af8
+  data.tar.gz: 97f1613f7ad01d1362e4098651048addd3a4a738912c6bd83427e3ea9453ad8d
 SHA512:
-  metadata.gz: 85e04f77e692d458765ef87714bb83dac175f387dec1bba92bb46e4ac405d292d693a0292187bf427b6fc56bbbbf1263635bdcbcbd3426295531235aab51dc67
-  data.tar.gz: 226f812a9accf7265fcae4f1ae74328bb6229ee9199af790e2d744085fed517f7445a6c501c94b6ec188d8f0575677f91753831b9ef502349b4bf2f873b5dbf3
+  metadata.gz: 3f03809157db470e905542751e16d8a6cb6edd6b91a78637f20e85fb5670e6b30e15f717d1bbaed714c70b077a756fe97744bfb27521304606b2d661dea57eab
+  data.tar.gz: 83bb42d5eb49f6ee4007d04fa3e1b13024a46044d1afc7756a126f43384f60cb9c6ca57d7440d77ffcbacd37b9d95b04dbf8eb933bbf1676a10440e4951bdba7

data/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## [0.10.2] — 2026-09-10
+
+### Added
+
+- `doctor` reports trusted CAs that are no longer the one on disk
+  (`[warn] ca: CA trusted, but N superseded CA(s) are still trusted —
+  run: yamine trust`). Pruning only runs inside `trust`, so after a CA
+  regeneration (including the rename) a superseded root would sit in the
+  keychain waiting for the next missing-CA event — possibly forever.
+  Unrelated trusted roots are never counted, and an unreadable keychain
+  stays silent: doctor is a read-only probe and must not fail.
+
+
+## [0.10.1] — 2026-09-10
+
+### Fixed
+
+- **The CA is regenerated before trust is judged, not after.** Both
+  trust paths asked `Certs.trusted?` first, which compares the trust
+  marker against the certificate ON DISK. A proxy regenerates the CA at
+  boot when the on-disk one is missing, expiring, or renamed — so after
+  a rename the marker still matched the OLD certificate, trust was
+  skipped as "already done", and the proxy then came up serving a CA the
+  keychain did not trust: TLS verification fails for every route. The
+  check now brings the CA up to date first (`ca_current_and_trusted?`,
+  used by both paths).
+
+
 ## [0.10.0] — 2026-09-10
 
 The ask-local rename is finished: the two user-visible names it left

data/lib/yamine/cli/system.rb

@@ -334,13 +334,29 @@ module Yamine
         puts "Installed root LaunchDaemon on port 443 (state: #{state_dir})."
       end
 
+      # True when the trust store covers the CA this machine should be
+      # serving with — regenerating the CA first if it is missing,
+      # expiring, or renamed.
+      #
+      # The ordering is the whole point, so it lives in one place rather
+      # than at each call site. `trusted?` compares a marker against the
+      # fingerprint of the certificate ON DISK, and a proxy regenerates
+      # the CA at boot when the name changes. Checking the marker before
+      # the CA is current therefore reads a stale match, skips trust, and
+      # lets the proxy come up serving a CA the keychain does not trust —
+      # breaking TLS for every route.
+      def ca_current_and_trusted?(dir = Certs.state_dir)
+        Certs.ensure_ca(dir)
+        Certs.trusted?(dir)
+      end
+
       # Root-only CA trust: the System keychain (all users, no prompt).
       # Safe to call repeatedly — once the marker is set it is a no-op.
       # Prints before doing work: the System keychain add can take a few
       # seconds, and this runs in the root half of setup where silence
       # reads as a hang.
       def ensure_system_ca_trust
-        return if Certs.trusted?(Certs.state_dir)
+        return if ca_current_and_trusted?(Certs.state_dir)
 
         puts "    Trusting the CA into the System keychain..."
         result = Trust.trust
@@ -760,7 +776,7 @@ module Yamine
       # those users had already chosen to avoid.
       def ensure_workstation!(ctx)
         # 1. CA
-        unless Yamine::Certs.trusted?(ctx.store.dir)
+        unless ca_current_and_trusted?(ctx.store.dir)
           result = Yamine::Trust.trust
           unless result[:trusted]
             abort_setup("CA trust failed: #{result[:error]}",

data/lib/yamine/doctor.rb

@@ -174,11 +174,45 @@ module Yamine
       unless File.file?(paths[:cert])
         return Check.new(name: "ca", ok: false, message: "no CA yet — run: yamine trust")
       end
-      if Certs.trusted?(dir)
-        Check.new(name: "ca", ok: true, message: "CA trusted")
+      unless Certs.trusted?(dir)
+        return Check.new(name: "ca", ok: false, message: "CA not trusted — run: yamine trust")
+      end
+
+      # Trusted CAs that are not the one now on disk. They accumulate from
+      # CA regeneration (missing, expiring, or renamed — the ask-local
+      # rename regenerates every machine's CA), and a trusted root whose
+      # superseded private key is still on disk is a liability. Pruning
+      # only happens when `trust` runs, so after a rename it would wait
+      # for the next missing-CA event — i.e. possibly forever. Surface it
+      # here with the one command that clears it.
+      stale = stale_ca_count(dir)
+      if stale.positive?
+        Check.new(name: "ca", ok: true, warn: true,
+          message: "CA trusted, but #{stale} superseded CA(s) are still trusted" \
+            " — run: yamine trust")
       else
-        Check.new(name: "ca", ok: false, message: "CA not trusted — run: yamine trust")
+        Check.new(name: "ca", ok: true, message: "CA trusted")
+      end
+    end
+
+    # How many trusted certificates carry one of our CA names without
+    # being the CA currently on disk. Best-effort: 0 when the keychain
+    # cannot be read (doctor must never fail on a read-only probe).
+    def stale_ca_count(dir = Certs.state_dir)
+      return 0 unless Trust.respond_to?(:keychain_certs)
+
+      current = Trust.fingerprint_of(Certs.ca_paths(dir)[:cert])
+      return 0 unless current
+
+      names = Certs.ca_common_names
+      Trust.keychains.sum do |keychain|
+        Trust.keychain_certs(keychain).count do |entry|
+          entry[:fingerprint] != current &&
+            names.any? { |n| entry[:subject].include?(n) }
+        end
       end
+    rescue StandardError
+      0
     end
 
     def print(checks, out: $stdout, json: false)

data/lib/yamine/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Yamine
-  VERSION = "0.10.0"
+  VERSION = "0.10.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: yamine
 version: !ruby/object:Gem::Version
-  version: 0.10.0
+  version: 0.10.2
 platform: ruby
 authors:
 - Kaka Ruto