yamine 0.10.4 → 0.11.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 073eb6f5386c8500d62348d2093ebc11fa13dc291f6907d11410bcb1b81e09eb
-  data.tar.gz: 9750f59d2dd9cce11832d232d3d1cb11248b31e52545133ab2b998d21bdf9549
+  metadata.gz: e48f66da1b02dd9ea589c1a30225d6b1f9dc46cd1abd92ffad90c27422b6d4ca
+  data.tar.gz: '0209cb0ce1c976c5f6a934ba0a74283f3b8064e2fc9aed493208c74077dd5a62'
 SHA512:
-  metadata.gz: a0cb84ba9b5fccda18721eb0de3bbb05667cffe97caf8882a3d3217d8dbee339319af2c72090f3b5bee41df198b01cc345e2dcb0e74b8ca9af202f2cd688e7ee
-  data.tar.gz: 89f533e131495a41e6e1613e09017b5e3b4d3a834bbaa5507bf2d13bdcb16054fb9320f36585d9b858d4f34c96734b3a5285fe04a0a8e01fac8227689573dfb4
+  metadata.gz: 2626fc9696988148d9637ffd1ce14adc7d7d656b03d61854296ff3b6c818fd82ff840fce5904395ac8d2b54c027c9f7e63f47f0f077609f896542af06c282d28
+  data.tar.gz: 110d265a913ee76a3ff40328c40cfdc0475e195c3e1518a490294dd2bb7bca0536edbaeedba7bc37815625aa3975880efdb1b1a66252b3c2a9ed16d6a2b5abd1

data/CHANGELOG.md

@@ -1,5 +1,59 @@
 # Changelog
 
+## [0.11.1] — 2026-09-11
+
+### Fixed
+
+- **`env:` in `config/local.yml` now actually reaches the processes.**
+  It never did. `build_env` was written, correct-looking, and had no
+  callers — so every top-level `env.clear` value and every `env.secret`
+  was parsed, validated, and dropped on the floor. It stayed invisible
+  because `DATABASE_URL` had its own path to the child; a config whose
+  *integration* depended on that block booted with the variable blank,
+  which looks exactly like a code bug.
+
+  Found while wiring a Rails app to a sibling service at
+  `https://other-app.localhost`: the URL was in `config/local.yml`, the
+  process had `nil`.
+
+  Both levels now merge, process over top-level, with `env.secret` names
+  resolved from `config/local.secrets` (or an existing export). A declared
+  secret nobody supplies warns at boot instead of starting blank — an app
+  with a missing API key fails somewhere far less obvious later.
+
+  yamine's own variables (`PORT`, `YAMINE_URL`, `DATABASE_URL`, the TLS
+  paths) are applied *after* the config, so a stray key in `local.yml`
+  cannot steer a process off its route. Pinned end to end by a test that
+  spawns a real process and reads the value out of its environment —
+  asserting on `build_env`'s return would have passed on the broken
+  version too.
+
+## [0.11.0] — 2026-09-11
+
+### Added
+
+- **Ruby, git, and curl now trust the local CA — so an app can call
+  another app at `https://<name>.localhost` with no configuration.** The
+  gap surfaced when anywaye (a Rails app) tried to reach anymark at
+  `https://anymark-directory.localhost`: `certificate verify failed`. The
+  CA was trusted everywhere a human looks (Safari, Chrome, curl) and
+  nowhere a child process looks — only Node was covered, via
+  `NODE_EXTRA_CA_CERTS`.
+
+  The naive fix is wrong in a way that shows up much later. `SSL_CERT_FILE`
+  does not *add* to OpenSSL's roots, it *replaces* them, so pointing it at
+  `~/.yamine/ca.pem` would break every public HTTPS call the app makes —
+  rubygems, payment APIs, an LLM provider — while fixing the local one. So
+  yamine now builds `~/.yamine/bundle.pem`: the system's roots plus its own
+  CA, regenerated only when either changes, and exports it as
+  `SSL_CERT_FILE` and `GIT_SSL_CAINFO` for every child. Node keeps getting
+  the CA alone, because its variable really is additive.
+
+  `yamine doctor` reports the bundle (`bundle: 129 certificates`), so a
+  missing or stale one is visible before an app fails on it, and a real
+  TLS handshake against a yamine-minted certificate is pinned by a test —
+  not just the presence of the environment variables.
+
 ## [0.10.4] — 2026-09-11
 
 ### Fixed

data/lib/yamine/certs.rb

@@ -44,6 +44,12 @@ module Yamine
       { cert: File.join(dir, "ca.pem"), key: File.join(dir, "ca-key.pem") }
     end
 
+    # The CA certificate's path on disk. Generated on first ask.
+    def ca_cert_path(dir = state_dir)
+      ensure_ca(dir)
+      ca_paths(dir)[:cert]
+    end
+
     def ensure_ca(dir = state_dir)
       FileUtils.mkdir_p(dir, mode: 0o755)
       Ownership.fix(dir)
@@ -79,6 +85,68 @@ module Yamine
        OpenSSL::PKey.read(File.read(paths[:key]))]
     end
 
+    # A CA bundle a child process can verify against: the system roots
+    # *plus* this CA.
+    #
+    # Why a bundle and not just the CA: `SSL_CERT_FILE` (Ruby/OpenSSL,
+    # curl, git) *replaces* the default store rather than adding to it, so
+    # pointing it at a file containing only our CA makes every public
+    # HTTPS request in that process fail verification. Concatenating gives
+    # both — yamine's names verify and rubygems, APIs, and git-over-https
+    # keep working.
+    #
+    # Built fresh when the CA or the system store changes, and cached
+    # otherwise: the bundle is ~230 KB and regenerating it on every boot
+    # would be pure waste, while serving a stale one after `yamine trust`
+    # regenerates the CA would silently break every TLS connection in the
+    # app.
+    def bundle_path(dir = state_dir)
+      File.join(dir, "bundle.pem")
+    end
+
+    # The system's own roots, in the order OpenSSL would consider them.
+    # SSL_CERT_FILE wins when set (that is the variable we are about to
+    # write, and a caller may have pointed it somewhere deliberately),
+    # else OpenSSL's compiled-in file, else the usual macOS/Linux paths.
+    def system_bundle
+      candidates = [ENV["SSL_CERT_FILE"],
+        OpenSSL::X509::DEFAULT_CERT_FILE,
+        "/etc/ssl/cert.pem",
+        "/etc/pki/tls/certs/ca-bundle.crt",
+        "/etc/ssl/certs/ca-certificates.crt"].compact
+      candidates.find { |path| File.file?(path) && File.size(path).positive? }
+    end
+
+    def ensure_bundle(dir = state_dir)
+      paths = ensure_ca(dir)
+      target = bundle_path(dir)
+      ca = File.read(paths[:cert])
+      system_file = system_bundle
+      # Regenerate when the CA changed, when the system store changed, or
+      # when the bundle is missing. mtime comparison is enough: these files
+      # are written by installers, not edited in place.
+      return target if bundle_current?(target, paths[:cert], system_file)
+
+      FileUtils.mkdir_p(dir)
+      content = +""
+      content << File.read(system_file) if system_file
+      content << "\n" unless content.empty? || content.end_with?("\n")
+      content << ca
+      File.write(target, content, mode: "w", perm: 0o644)
+      Ownership.fix(target)
+      target
+    end
+
+    def bundle_current?(target, ca_path, system_file)
+      return false unless File.file?(target)
+
+      target_mtime = File.mtime(target)
+      return false if File.mtime(ca_path) > target_mtime
+      return false if system_file && File.mtime(system_file) > target_mtime
+
+      true
+    end
+
     # Mint a leaf cert for one hostname, signed by the CA.
     def mint_host(hostname, ca_cert, ca_key)
       key = OpenSSL::PKey::EC.generate("prime256v1")

data/lib/yamine/cli/boot.rb

@@ -241,7 +241,8 @@ module Yamine
           app = runner.boot_run(name: item[:name], hostname: item[:hostname],
             url: item[:url], dir: Dir.pwd, command: item[:command],
             port: item[:port], force: opts[:force],
-            rails_dev_host: item[:hostname], database_url: db_url)
+            rails_dev_host: item[:hostname], database_url: db_url,
+            extra_env: build_env(resolved, item[:entry], proc_name: item[:name]))
           routes_registered << { hostnames: item[:hostnames], app: app }
 
           say opts, "  -> #{item[:url]}"
@@ -261,7 +262,8 @@ module Yamine
           app = runner.spawn_http(name: item[:name], hostname: item[:hostname],
             url: item[:url], dir: Dir.pwd, command: item[:command],
             port: item[:port], rails_dev_host: item[:hostname],
-            database_url: db_url, force: opts[:force])
+            database_url: db_url, force: opts[:force],
+            extra_env: build_env(resolved, item[:entry], proc_name: item[:name]))
           # Tracked before registration so any later failure (a raise
           # during adopt, a crash while another process waits) can
           # always reap it. Duplicate names in named_pids are harmless.
@@ -359,7 +361,8 @@ module Yamine
         app = runner.boot_run(name: proc_name, hostname: "#{resolved.app}.#{proc_name}.internal",
           url: url, dir: Dir.pwd, command: ["sh", "-c", cmd], port: port,
           force: opts[:force], rails_dev_host: nil, register: false,
-          database_url: db_url)
+          database_url: db_url,
+          extra_env: build_env(resolved, entry, proc_name: proc_name))
         children << { name: proc_name, pid: app.pid }
         say opts, "  [#{proc_name}] background (pid #{app.pid})"
       end
@@ -398,18 +401,44 @@ module Yamine
         end
       end
 
-      def build_env(ctx, resolved, entry)
+      # The environment a process gets, from the config.
+      #
+      # Two levels, and the merge order is the point: top-level `env:`
+      # describes the whole app (an API URL every process needs), a
+      # process's own `env:` describes that process, and the process wins
+      # where they collide — "this one worker talks to staging" should not
+      # require restructuring the file.
+      #
+      # `env.clear` is literal values; `env.secret` names keys whose values
+      # come from config/local.secrets (dotenv, gitignored), so a credential
+      # stays out of the config file while still reaching the process. A
+      # named secret that is missing is reported rather than silently
+      # dropped: an app booting with a blank API key fails later, somewhere
+      # far less obvious.
+      def build_env(resolved, entry, proc_name: nil)
         env = {}
-        # Merge config env.clear
-        config_env = resolved.secrets || {}
+
+        top = resolved.env.is_a?(Hash) ? resolved.env : {}
+        (top["clear"] || {}).each { |k, v| env[k] = v }
+
         entry_env = entry["env"] || {}
         (entry_env["clear"] || {}).each { |k, v| env[k] = v }
-        # Merge secrets from config/local.secrets
-        secret_keys = entry_env["secret"] || []
-        secret_keys.each do |k|
-          env[k] = config_env[k] if config_env.key?(k)
+
+        secrets = resolved.secrets || {}
+        (Array(top["secret"]) + Array(entry_env["secret"])).uniq.each do |key|
+          if secrets.key?(key)
+            env[key] = secrets[key]
+          elsif ENV.key?(key)
+            # Already in the environment (a shell export, an agent's
+            # session) — the declaration is satisfied.
+            env[key] = ENV[key]
+          else
+            label = proc_name ? "#{proc_name}: " : ""
+            $stderr.puts "  #{label}warning: env.secret lists #{key}, but it is not in " \
+                         "config/local.secrets (and not in the environment) — starting without it"
+          end
         end
-        # Host env (dotenv from .env) already in ENV
+
         env
       end
 

data/lib/yamine/doctor.rb

@@ -33,6 +33,7 @@ module Yamine
       checks << check_routes(store)
       checks << check_dns(store)
       checks << check_ca
+      checks << check_ca_bundle
       checks
     end
 
@@ -195,6 +196,22 @@ module Yamine
       end
     end
 
+    # The child-process trust bundle. Its absence is not theoretical: an
+    # app whose process was started before the bundle existed (or with a
+    # regenerated CA) fails every call to another *.localhost with
+    # "certificate verify failed". Regenerating it here is safe and is
+    # exactly what the next boot would do anyway.
+    def check_ca_bundle
+      dir = Certs.state_dir
+      return Check.new(name: "bundle", ok: false, message: "no CA yet — run: yamine trust") unless File.file?(Certs.ca_paths(dir)[:cert])
+
+      target = Certs.ensure_bundle(dir)
+      count = File.read(target).scan("BEGIN CERTIFICATE").size
+      Check.new(name: "bundle", ok: true, message: "#{count} certificates (system roots + yamine CA)")
+    rescue StandardError => e
+      Check.new(name: "bundle", ok: false, message: "could not build #{Certs.bundle_path(dir)}: #{e.message}")
+    end
+
     # How many trusted certificates carry one of our CA names without
     # being the CA currently on disk. Best-effort: 0 when the keychain
     # cannot be read (doctor must never fail on a read-only probe).

data/lib/yamine/runner.rb

@@ -93,11 +93,16 @@ module Yamine
     # register: false spawns without a route (background processes).
     # Child output goes to log/yamine-<name>.log so `--wait` failure
     # payloads can tail it (same file the managed path uses).
+    #
+    # extra_env is the config's env.clear/env.secret for this process —
+    # yamine's own keys (PORT, YAMINE_URL, DATABASE_URL, the TLS vars)
+    # win over it, because those describe the boot rather than the app.
     def boot_run(name:, hostname:, url:, dir:, command:, port: nil, force: false,
-      rails_dev_host: nil, register: true, database_url: nil, spec: nil)
+      rails_dev_host: nil, register: true, database_url: nil, spec: nil,
+      extra_env: nil)
       port ||= Ports.find_free
       env = child_env(dir, url: url, port: port, rails_dev_host: rails_dev_host,
-        database_url: database_url)
+        database_url: database_url, extra_env: extra_env)
       path = log_path(dir, name)
       pid = with_clean_env { spawn(env, *command, chdir: dir, out: path, err: [:child, :out]) }
       Process.detach(pid)
@@ -124,9 +129,9 @@ module Yamine
     # Returns the placeholder App (target known before bind). Fate of
     # the backend is decided by wait, not by spawn.
     def spawn_http(name:, hostname:, url:, dir:, command:, port:, rails_dev_host: nil,
-      database_url: nil, force: false)
+      database_url: nil, force: false, extra_env: nil)
       env = child_env(dir, url: url, port: port, rails_dev_host: rails_dev_host,
-        database_url: database_url)
+        database_url: database_url, extra_env: extra_env)
       path = log_path(dir, name)
       pid = with_clean_env { spawn(env, *command, chdir: dir, out: path, err: [:child, :out]) }
       Process.detach(pid)
@@ -151,12 +156,34 @@ module Yamine
       false
     end
 
-    def child_env(dir, url:, port:, rails_dev_host: nil, database_url: nil)
-      env = { "YAMINE_URL" => url }
+    def child_env(dir, url:, port:, rails_dev_host: nil, database_url: nil, extra_env: nil)
+      # The config's own variables first, so everything below overrides
+      # them: PORT, YAMINE_URL, DATABASE_URL, and the TLS paths describe
+      # *this boot* and must not be lost to a stray key in local.yml.
+      env = (extra_env || {}).transform_keys(&:to_s).transform_values(&:to_s)
+      env["YAMINE_URL"] = url
       env["PORT"] = port.to_s if port
       env["HOST"] = "127.0.0.1"
-      ca = File.join(Certs.state_dir, "ca.pem")
-      env["NODE_EXTRA_CA_CERTS"] = ca if File.file?(ca)
+
+      # TLS: yamine's names present certificates signed by its own CA, so
+      # every process that talks to one of them has to be told to trust it.
+      # Three clients, three conventions — and getting this wrong is not
+      # subtle. A Ruby app calling https://other-app.localhost fails with
+      # "certificate verify failed", which reads as a broken app rather
+      # than a missing trust setting:
+      #
+      #   * Ruby/OpenSSL, curl, and git honor SSL_CERT_FILE — but it
+      #     *replaces* the store, so it points at the bundle (the system's
+      #     roots plus our CA), never at our CA alone; a CA-only file would
+      #     break every public HTTPS call the app makes.
+      #   * git takes GIT_SSL_CAINFO as its own override.
+      #   * Node ignores both and reads NODE_EXTRA_CA_CERTS, which is
+      #     additive — the CA by itself is right there.
+      bundle = Certs.ensure_bundle
+      env["NODE_EXTRA_CA_CERTS"] = Certs.ca_cert_path
+      env["SSL_CERT_FILE"] = bundle
+      env["GIT_SSL_CAINFO"] = bundle
+
       # Rails blocks unknown Host headers in development. Allow the
       # proxied hostname so Rails apps boot behind yamine with zero
       # config — this replaces the yamine-rails hosts patch.

data/lib/yamine/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Yamine
-  VERSION = "0.10.4"
+  VERSION = "0.11.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: yamine
 version: !ruby/object:Gem::Version
-  version: 0.10.4
+  version: 0.11.1
 platform: ruby
 authors:
 - Kaka Ruto