yamine 0.10.1 → 0.10.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 73e497200efd0723559dff2f57e920e3d126d3caecf302770c37bec613d7998e
-  data.tar.gz: 2203cabc149df919703fb1182fb9ad76e9c6729d4ed105455c749dbfa7611593
+  metadata.gz: 06f020588bc63954dd44b5a99b598995ec3e6f562c03756b867d26ff44178af8
+  data.tar.gz: 97f1613f7ad01d1362e4098651048addd3a4a738912c6bd83427e3ea9453ad8d
 SHA512:
-  metadata.gz: d30e26aec61c7036e349a84f6f241291756c7ee3207f6e1de210cb47465ccc94279619cc9657d3ecbc477b8983be8027ae2303d43456b4891762f79dec7bd885
-  data.tar.gz: 1a6a7e1b4e402b822a3d6f70ed6b19881c8927563c131875b322a7b750c9ec9368ba8a7f45ff99badfe55d23c54a964f163a80b8d10d6c45aa6a5a3ae5d9abc9
+  metadata.gz: 3f03809157db470e905542751e16d8a6cb6edd6b91a78637f20e85fb5670e6b30e15f717d1bbaed714c70b077a756fe97744bfb27521304606b2d661dea57eab
+  data.tar.gz: 83bb42d5eb49f6ee4007d04fa3e1b13024a46044d1afc7756a126f43384f60cb9c6ca57d7440d77ffcbacd37b9d95b04dbf8eb933bbf1676a10440e4951bdba7

data/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## [0.10.2] — 2026-09-10
+
+### Added
+
+- `doctor` reports trusted CAs that are no longer the one on disk
+  (`[warn] ca: CA trusted, but N superseded CA(s) are still trusted —
+  run: yamine trust`). Pruning only runs inside `trust`, so after a CA
+  regeneration (including the rename) a superseded root would sit in the
+  keychain waiting for the next missing-CA event — possibly forever.
+  Unrelated trusted roots are never counted, and an unreadable keychain
+  stays silent: doctor is a read-only probe and must not fail.
+
+
 ## [0.10.1] — 2026-09-10
 
 ### Fixed

data/lib/yamine/doctor.rb

@@ -174,11 +174,45 @@ module Yamine
       unless File.file?(paths[:cert])
         return Check.new(name: "ca", ok: false, message: "no CA yet — run: yamine trust")
       end
-      if Certs.trusted?(dir)
-        Check.new(name: "ca", ok: true, message: "CA trusted")
+      unless Certs.trusted?(dir)
+        return Check.new(name: "ca", ok: false, message: "CA not trusted — run: yamine trust")
+      end
+
+      # Trusted CAs that are not the one now on disk. They accumulate from
+      # CA regeneration (missing, expiring, or renamed — the ask-local
+      # rename regenerates every machine's CA), and a trusted root whose
+      # superseded private key is still on disk is a liability. Pruning
+      # only happens when `trust` runs, so after a rename it would wait
+      # for the next missing-CA event — i.e. possibly forever. Surface it
+      # here with the one command that clears it.
+      stale = stale_ca_count(dir)
+      if stale.positive?
+        Check.new(name: "ca", ok: true, warn: true,
+          message: "CA trusted, but #{stale} superseded CA(s) are still trusted" \
+            " — run: yamine trust")
       else
-        Check.new(name: "ca", ok: false, message: "CA not trusted — run: yamine trust")
+        Check.new(name: "ca", ok: true, message: "CA trusted")
+      end
+    end
+
+    # How many trusted certificates carry one of our CA names without
+    # being the CA currently on disk. Best-effort: 0 when the keychain
+    # cannot be read (doctor must never fail on a read-only probe).
+    def stale_ca_count(dir = Certs.state_dir)
+      return 0 unless Trust.respond_to?(:keychain_certs)
+
+      current = Trust.fingerprint_of(Certs.ca_paths(dir)[:cert])
+      return 0 unless current
+
+      names = Certs.ca_common_names
+      Trust.keychains.sum do |keychain|
+        Trust.keychain_certs(keychain).count do |entry|
+          entry[:fingerprint] != current &&
+            names.any? { |n| entry[:subject].include?(n) }
+        end
       end
+    rescue StandardError
+      0
     end
 
     def print(checks, out: $stdout, json: false)

data/lib/yamine/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Yamine
-  VERSION = "0.10.1"
+  VERSION = "0.10.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: yamine
 version: !ruby/object:Gem::Version
-  version: 0.10.1
+  version: 0.10.2
 platform: ruby
 authors:
 - Kaka Ruto