yamine 0.10.4 → 0.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 073eb6f5386c8500d62348d2093ebc11fa13dc291f6907d11410bcb1b81e09eb
-  data.tar.gz: 9750f59d2dd9cce11832d232d3d1cb11248b31e52545133ab2b998d21bdf9549
+  metadata.gz: 1efaa2b9488a10007f6a386cf874eb78b3e8489e9b772efb2e88713286e98e2d
+  data.tar.gz: 410ac56d153c94589d1d36fd1a6b5670ac215c6c5999ca956590acd3d7c46a98
 SHA512:
-  metadata.gz: a0cb84ba9b5fccda18721eb0de3bbb05667cffe97caf8882a3d3217d8dbee339319af2c72090f3b5bee41df198b01cc345e2dcb0e74b8ca9af202f2cd688e7ee
-  data.tar.gz: 89f533e131495a41e6e1613e09017b5e3b4d3a834bbaa5507bf2d13bdcb16054fb9320f36585d9b858d4f34c96734b3a5285fe04a0a8e01fac8227689573dfb4
+  metadata.gz: ed28898e26abce37591fb15902697e2f96d2dc4ed4bc20d951872c48f586e19482affdafb24606bbe8c95cd0016b63a637d45f23c15fd7778f6ebd9a2415e0b7
+  data.tar.gz: 075d1d80e12a0578377d956421bfbc7ac9dc61e414552262d0ffd61ea9613f1382732135c5b8e7c7af8fbfb9d54e02905d05bc53347cba7054ced38879fef0d4

data/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## [0.11.0] — 2026-09-11
+
+### Added
+
+- **Ruby, git, and curl now trust the local CA — so an app can call
+  another app at `https://<name>.localhost` with no configuration.** The
+  gap surfaced when anywaye (a Rails app) tried to reach anymark at
+  `https://anymark-directory.localhost`: `certificate verify failed`. The
+  CA was trusted everywhere a human looks (Safari, Chrome, curl) and
+  nowhere a child process looks — only Node was covered, via
+  `NODE_EXTRA_CA_CERTS`.
+
+  The naive fix is wrong in a way that shows up much later. `SSL_CERT_FILE`
+  does not *add* to OpenSSL's roots, it *replaces* them, so pointing it at
+  `~/.yamine/ca.pem` would break every public HTTPS call the app makes —
+  rubygems, payment APIs, an LLM provider — while fixing the local one. So
+  yamine now builds `~/.yamine/bundle.pem`: the system's roots plus its own
+  CA, regenerated only when either changes, and exports it as
+  `SSL_CERT_FILE` and `GIT_SSL_CAINFO` for every child. Node keeps getting
+  the CA alone, because its variable really is additive.
+
+  `yamine doctor` reports the bundle (`bundle: 129 certificates`), so a
+  missing or stale one is visible before an app fails on it, and a real
+  TLS handshake against a yamine-minted certificate is pinned by a test —
+  not just the presence of the environment variables.
+
 ## [0.10.4] — 2026-09-11
 
 ### Fixed

data/lib/yamine/certs.rb

@@ -44,6 +44,12 @@ module Yamine
       { cert: File.join(dir, "ca.pem"), key: File.join(dir, "ca-key.pem") }
     end
 
+    # The CA certificate's path on disk. Generated on first ask.
+    def ca_cert_path(dir = state_dir)
+      ensure_ca(dir)
+      ca_paths(dir)[:cert]
+    end
+
     def ensure_ca(dir = state_dir)
       FileUtils.mkdir_p(dir, mode: 0o755)
       Ownership.fix(dir)
@@ -79,6 +85,68 @@ module Yamine
        OpenSSL::PKey.read(File.read(paths[:key]))]
     end
 
+    # A CA bundle a child process can verify against: the system roots
+    # *plus* this CA.
+    #
+    # Why a bundle and not just the CA: `SSL_CERT_FILE` (Ruby/OpenSSL,
+    # curl, git) *replaces* the default store rather than adding to it, so
+    # pointing it at a file containing only our CA makes every public
+    # HTTPS request in that process fail verification. Concatenating gives
+    # both — yamine's names verify and rubygems, APIs, and git-over-https
+    # keep working.
+    #
+    # Built fresh when the CA or the system store changes, and cached
+    # otherwise: the bundle is ~230 KB and regenerating it on every boot
+    # would be pure waste, while serving a stale one after `yamine trust`
+    # regenerates the CA would silently break every TLS connection in the
+    # app.
+    def bundle_path(dir = state_dir)
+      File.join(dir, "bundle.pem")
+    end
+
+    # The system's own roots, in the order OpenSSL would consider them.
+    # SSL_CERT_FILE wins when set (that is the variable we are about to
+    # write, and a caller may have pointed it somewhere deliberately),
+    # else OpenSSL's compiled-in file, else the usual macOS/Linux paths.
+    def system_bundle
+      candidates = [ENV["SSL_CERT_FILE"],
+        OpenSSL::X509::DEFAULT_CERT_FILE,
+        "/etc/ssl/cert.pem",
+        "/etc/pki/tls/certs/ca-bundle.crt",
+        "/etc/ssl/certs/ca-certificates.crt"].compact
+      candidates.find { |path| File.file?(path) && File.size(path).positive? }
+    end
+
+    def ensure_bundle(dir = state_dir)
+      paths = ensure_ca(dir)
+      target = bundle_path(dir)
+      ca = File.read(paths[:cert])
+      system_file = system_bundle
+      # Regenerate when the CA changed, when the system store changed, or
+      # when the bundle is missing. mtime comparison is enough: these files
+      # are written by installers, not edited in place.
+      return target if bundle_current?(target, paths[:cert], system_file)
+
+      FileUtils.mkdir_p(dir)
+      content = +""
+      content << File.read(system_file) if system_file
+      content << "\n" unless content.empty? || content.end_with?("\n")
+      content << ca
+      File.write(target, content, mode: "w", perm: 0o644)
+      Ownership.fix(target)
+      target
+    end
+
+    def bundle_current?(target, ca_path, system_file)
+      return false unless File.file?(target)
+
+      target_mtime = File.mtime(target)
+      return false if File.mtime(ca_path) > target_mtime
+      return false if system_file && File.mtime(system_file) > target_mtime
+
+      true
+    end
+
     # Mint a leaf cert for one hostname, signed by the CA.
     def mint_host(hostname, ca_cert, ca_key)
       key = OpenSSL::PKey::EC.generate("prime256v1")

data/lib/yamine/doctor.rb

@@ -33,6 +33,7 @@ module Yamine
       checks << check_routes(store)
       checks << check_dns(store)
       checks << check_ca
+      checks << check_ca_bundle
       checks
     end
 
@@ -195,6 +196,22 @@ module Yamine
       end
     end
 
+    # The child-process trust bundle. Its absence is not theoretical: an
+    # app whose process was started before the bundle existed (or with a
+    # regenerated CA) fails every call to another *.localhost with
+    # "certificate verify failed". Regenerating it here is safe and is
+    # exactly what the next boot would do anyway.
+    def check_ca_bundle
+      dir = Certs.state_dir
+      return Check.new(name: "bundle", ok: false, message: "no CA yet — run: yamine trust") unless File.file?(Certs.ca_paths(dir)[:cert])
+
+      target = Certs.ensure_bundle(dir)
+      count = File.read(target).scan("BEGIN CERTIFICATE").size
+      Check.new(name: "bundle", ok: true, message: "#{count} certificates (system roots + yamine CA)")
+    rescue StandardError => e
+      Check.new(name: "bundle", ok: false, message: "could not build #{Certs.bundle_path(dir)}: #{e.message}")
+    end
+
     # How many trusted certificates carry one of our CA names without
     # being the CA currently on disk. Best-effort: 0 when the keychain
     # cannot be read (doctor must never fail on a read-only probe).

data/lib/yamine/runner.rb

@@ -155,8 +155,26 @@ module Yamine
       env = { "YAMINE_URL" => url }
       env["PORT"] = port.to_s if port
       env["HOST"] = "127.0.0.1"
-      ca = File.join(Certs.state_dir, "ca.pem")
-      env["NODE_EXTRA_CA_CERTS"] = ca if File.file?(ca)
+
+      # TLS: yamine's names present certificates signed by its own CA, so
+      # every process that talks to one of them has to be told to trust it.
+      # Three clients, three conventions — and getting this wrong is not
+      # subtle. A Ruby app calling https://other-app.localhost fails with
+      # "certificate verify failed", which reads as a broken app rather
+      # than a missing trust setting:
+      #
+      #   * Ruby/OpenSSL, curl, and git honor SSL_CERT_FILE — but it
+      #     *replaces* the store, so it points at the bundle (the system's
+      #     roots plus our CA), never at our CA alone; a CA-only file would
+      #     break every public HTTPS call the app makes.
+      #   * git takes GIT_SSL_CAINFO as its own override.
+      #   * Node ignores both and reads NODE_EXTRA_CA_CERTS, which is
+      #     additive — the CA by itself is right there.
+      bundle = Certs.ensure_bundle
+      env["NODE_EXTRA_CA_CERTS"] = Certs.ca_cert_path
+      env["SSL_CERT_FILE"] = bundle
+      env["GIT_SSL_CAINFO"] = bundle
+
       # Rails blocks unknown Host headers in development. Allow the
       # proxied hostname so Rails apps boot behind yamine with zero
       # config — this replaces the yamine-rails hosts patch.

data/lib/yamine/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Yamine
-  VERSION = "0.10.4"
+  VERSION = "0.11.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: yamine
 version: !ruby/object:Gem::Version
-  version: 0.10.4
+  version: 0.11.0
 platform: ruby
 authors:
 - Kaka Ruto