yamine 0.22.0 → 0.22.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 69848a3d38cd9997ca18e52ea892aa57962524e0cd41df16199a651409e86b76
-  data.tar.gz: aebe3dd18c4bab95865491850bb940ca9a7e42c83f53d851b4d3ddd691f80305
+  metadata.gz: 1f20b021d3a702ab4aef776ac24e10683b12c1b4ba58b7ad4e5b11b91316eb78
+  data.tar.gz: 4ff8a2e59f075f38aa81d084d9aea45041346790aefd687ef2fc08669bc34737
 SHA512:
-  metadata.gz: 7c1bb5ef1104c29a53c8e4274a5b4a42f7231f895f40bb7d12defc97dee72232944340c24b4bec62b9a736d29bdab01d975b32cf6e1af7aaf7f1b643ec0ac602
-  data.tar.gz: 66ef5d87789c27a94994c0d24f1567c1a762d592ecbfb00b3d95db8a7f538f3c6868be3703a9870a88d0101aabb37dcfaba8f6db85b2e4a74799b4a4381c7280
+  metadata.gz: 2e2542be9656d87375b9ab29ac2862f33b2be289c7932aa99f2f29abf3b2a47f40e24623f2ab8b902021e6b42fe4ed48ebe7dfc4a86a3184ddf4f859cb359d40
+  data.tar.gz: 85d76ec111ee796d23b89879d414bf5a248504f58983a0064c3d43ffaa88d532a0f3b5d6542f21b09d2fba5acb57f20e673fcb5f7d13490108f321adbf1eb896

data/CHANGELOG.md

@@ -2,6 +2,44 @@
 
 ## [Unreleased]
 
+## [0.22.1] - 2026-09-29
+
+### Fixed
+
+- **macOS trusts the local CA now, instead of merely filing it.** A
+  non-elevated `yamine trust` added the certificate without naming any
+  policies, so macOS recorded a trust-store entry with no settings at
+  all: the CA sat in the login keychain trusted for nothing, and every
+  browser answered `ERR_CERT_AUTHORITY_INVALID` on every
+  `https://*.localhost` route. The add now passes `-p ssl -p basic` —
+  the same thing Keychain Access writes for Secure Sockets Layer + X.509
+  Basic — and `yamine trust` re-reads the trust store afterwards rather
+  than believing the exit status, so an add that recorded nothing is a
+  failure that names the exact `security add-trusted-cert` to run
+  instead of a success the browser will contradict.
+- **A CA that is in the keychain but untrusted repairs itself.** The
+  check that decided whether to trust compared fingerprints alone, so
+  once that bare certificate was in a keychain every later boot
+  concluded it was trusted and never touched it again — the check that
+  should have caught the broken state was the one hiding it. It now
+  needs both halves: the certificate in a keychain *and* a trust
+  setting recorded for its fingerprint. A machine left with a
+  policy-less entry therefore self-heals on the next `yamine trust` or
+  proxy boot, and one whose trust store cannot be read is left alone
+  rather than re-adding on every boot.
+- **A proxy running as a normal user trusts the CA too.** Trust used to
+  be attempted only when the proxy was root, so a first run without
+  `sudo` never tried and installed a CA that could not work. Every proxy
+  now ensures trust, elevated or not, and reports a failed attempt
+  rather than swallowing it. `YAMINE_SKIP_CA_TRUST` is the escape
+  hatch for machines whose CA arrives by MDM or a hand-run
+  `security add-trusted-cert`.
+- **`yamine doctor` names a CA the OS does not trust.** The recorded
+  marker says yamine trusted this certificate; it says nothing about
+  whether macOS agreed. `doctor` asks the OS too, so a CA that is
+  installed but untrusted — the state where every route fails TLS —
+  reads as "CA is installed but macOS does not trust it" and points at
+  `yamine trust` instead of passing as healthy.
 ## [0.22.0] - 2026-09-29
 
 ### Added

data/lib/yamine/cli/system.rb

@@ -517,15 +517,15 @@ module Yamine
       # expiring, or renamed.
       #
       # The ordering is the whole point, so it lives in one place rather
-      # than at each call site. `trusted?` compares a marker against the
-      # fingerprint of the certificate ON DISK, and a proxy regenerates
-      # the CA at boot when the name changes. Checking the marker before
-      # the CA is current therefore reads a stale match, skips trust, and
-      # lets the proxy come up serving a CA the keychain does not trust —
-      # breaking TLS for every route.
+      # than at each call site. The state-dir marker is only half of it
+      # (`Trust.trusted?` also asks the OS): a marker that says "we
+      # trusted this" survives a keychain that never took the setting,
+      # so checking it before the CA is current — or on its own — reads
+      # a stale match, skips trust, and lets the proxy come up serving a
+      # CA no browser trusts.
       def ca_current_and_trusted?(dir = Certs.state_dir)
         Certs.ensure_ca(dir)
-        Certs.trusted?(dir)
+        Trust.trusted?(dir)
       end
 
       # Root-only CA trust: the System keychain (all users, no prompt).

data/lib/yamine/doctor.rb

@@ -192,6 +192,15 @@ module Yamine
       unless Certs.trusted?(dir)
         return Check.new(name: "ca", ok: false, message: "CA not trusted — run: yamine trust")
       end
+      # The marker says WE trusted this certificate; it says nothing about
+      # whether the OS recorded a trust setting for it. A CA sitting in
+      # the keychain with no trust setting is the state that produced
+      # ERR_CERT_AUTHORITY_INVALID on every route, with the marker
+      # cheerfully reporting success.
+      unless Trust.trusted?(dir)
+        return Check.new(name: "ca", ok: false,
+          message: "CA is installed but macOS does not trust it — run: yamine trust")
+      end
 
       # Trusted CAs that are not the one now on disk. They accumulate from
       # CA regeneration (missing, expiring, or renamed — the ask-local

data/lib/yamine/proxy.rb

@@ -107,7 +107,7 @@ module Yamine
       servers.each { |s| s.listen(@port) }
       @port = servers.first.addr[1]
       Ownership.chown_state_dir(@store.dir)
-      ensure_system_ca_trust if Process.uid.zero?
+      ensure_ca_trust
       trap("INT") { stop(servers) }
       trap("TERM") do
         @supervisor&.shutdown
@@ -188,14 +188,30 @@ module Yamine
 
     private
 
-    # A root proxy (launchd service or sudo daemon) is the one process
-    # that can trust the CA into the System keychain silently — no GUI
-    # popup. Idempotent: the state-dir marker makes repeat boots a no-op.
-    def ensure_system_ca_trust
-      return if Certs.trusted?(@state_dir)
+    # The proxy is the process the browser's TLS stack actually talks to,
+    # so it is where the CA has to be trusted — as root, into the System
+    # keychain silently, and as a normal user, into the login keychain.
+    # A non-elevated proxy used to skip this entirely, which is how a
+    # first run as an ordinary user installed a CA that could not work.
+    #
+    # `Trust.trusted?` asks the trust store, not just the state-dir
+    # marker, so a CA that is present but untrusted is repaired instead
+    # of being short-circuited. Trust.trust only writes the marker once
+    # the trust setting is confirmed, so a failure is retried (and
+    # reported) on the next boot rather than cached as a success.
+    #
+    # YAMINE_SKIP_CA_TRUST is for machines whose CA arrives some other
+    # way — an MDM profile, a hand-run `security add-trusted-cert` — and
+    # for the suite, which spawns real proxies and must never reach a real
+    # keychain.
+    def ensure_ca_trust
+      return if ENV["YAMINE_SKIP_CA_TRUST"]
+      return if Trust.trusted?(@state_dir)
 
       result = Trust.trust(@state_dir)
-      @on_error.call("CA trust warning: #{result[:error]}") unless result[:trusted]
+      return if result[:trusted]
+
+      @on_error.call("CA trust warning: #{result[:error]}")
     end
 
     def admit?

data/lib/yamine/trust.rb

@@ -1,10 +1,41 @@
 # frozen_string_literal: true
 
 require "open3"
+require "tmpdir"
 
 module Yamine
   # Install the local CA into the OS trust store.
   module Trust
+    SYSTEM_KEYCHAIN = "/Library/Keychains/System.keychain"
+
+    # The policies a browser's TLS stack evaluates a leaf under: SSL
+    # server (the hostname check) and X.509 basic (the chain build).
+    #
+    # They have to be named, and this is measured, not assumed.
+    # `add-trusted-cert -r trustRoot` with no `-p` exits 0 and records
+    # the certificate in the trust store with NO `trustSettings` array at
+    # all: `security dump-trust-settings` reports "Number of trust
+    # settings : 0", and `security trust-settings-export` shows a
+    # trustList entry holding only issuerName/modDate/serialNumber. What
+    # the CA is trusted FOR is then unstated, and whether such an entry
+    # is honoured at all depends on the certificate also being installed
+    # in a keychain the evaluator searches — on the machine this was
+    # fixed on, it was not, and every browser answered
+    # ERR_CERT_AUTHORITY_INVALID.
+    #
+    # With `-p ssl -p basic` the same call records
+    # kSecTrustSettingsPolicyName sslServer + basicX509, and per
+    # SecTrustSettings.h a settings entry with no explicit
+    # kSecTrustSettingsResult defaults to kSecTrustSettingsResultTrustRoot
+    # ("trust this root cert"). That is also what Keychain Access writes
+    # for a certificate set to Secure Sockets Layer + X.509 Basic.
+    MACOS_TRUST_POLICIES = %w[-p ssl -p basic].freeze
+
+    # SecTrustSettingsResult (Security/SecTrustSettings.h). Only these
+    # two grant trust; 3 is Deny and 4 is Unspecified, so a CA whose only
+    # setting is one of those is explicitly NOT trusted.
+    TRUST_RESULTS = [1, 2].freeze
+
     module_function
 
     def platform
@@ -31,6 +62,33 @@ module Yamine
       { trusted: false, error: e.message }
     end
 
+    # True when the OS trust store will honour the CA in `dir`.
+    #
+    # The state-dir marker is only half the answer, and the half that
+    # lies: it records that WE trusted this exact certificate at some
+    # point, so it survives a keychain that never took the setting, a
+    # trust run that recorded nothing, and a CA that was regenerated
+    # under it. Treating the marker as "trusted" is how a machine kept a
+    # CA in its keychain that no browser would accept.
+    def trusted?(dir = Certs.state_dir)
+      return false unless Certs.trusted?(dir)
+      return true unless platform == :macos
+
+      paths = Certs.ca_paths(dir)
+      return false unless File.file?(paths[:cert])
+
+      macos_keychains.any? { |keychain| already_trusted?(paths[:cert], keychain) }
+    end
+
+    # The keychains a CA can be trusted into: the user's own, and — for
+    # an elevated run — the System one, which every user on the machine
+    # reads. Both are checked because the certificate on disk may have
+    # been trusted into either, and a CA trusted only as root is not
+    # trusted for a later unprivileged run (or the reverse).
+    def macos_keychains
+      [login_keychain, SYSTEM_KEYCHAIN].uniq
+    end
+
     # The fingerprint `security -Z` prints: uppercase hex, no colons.
     # Certificates are identified by THIS, never by common name: every CA
     # this project has generated shares a name with the others, so a
@@ -81,7 +139,7 @@ module Yamine
     end
 
     def keychains
-      [login_keychain, "/Library/Keychains/System.keychain"]
+      [login_keychain, SYSTEM_KEYCHAIN]
     end
 
     # Remove trusted certificates that carry one of our CA names but are
@@ -206,25 +264,142 @@ module Yamine
         return if already_trusted?(cert_path, keychain)
 
         _out, status = Command.capture2("security", "add-trusted-cert",
-          "-d", "-r", "trustRoot", "-k", keychain, cert_path)
-        raise CertError, "security add-trusted-cert (system) failed" unless status.success?
+          "-d", "-r", "trustRoot", *MACOS_TRUST_POLICIES, "-k", keychain, cert_path)
+        raise CertError, macos_trust_error(cert_path, keychain) unless status.success?
       else
+        # Not elevated: the user's own keychain, with the trust policies
+        # named. The certificate still has to be in a keychain — macOS
+        # builds the chain by searching keychains for the issuer, so a
+        # trust setting for a certificate that is not installed anywhere
+        # is dead weight. Measured: CA trusted but absent from every
+        # keychain => "unable to get local issuer certificate".
         keychain = login_keychain
         return if already_trusted?(cert_path, keychain)
 
         _out, status = Command.capture2("security", "add-trusted-cert",
-          "-r", "trustRoot", "-k", keychain, cert_path)
-        raise CertError, "security add-trusted-cert failed" unless status.success?
+          "-r", "trustRoot", *MACOS_TRUST_POLICIES, "-k", keychain, cert_path)
+        raise CertError, macos_trust_error(cert_path, keychain) unless status.success?
       end
+
+      # `add-trusted-cert` exits 0 for a certificate it merely filed —
+      # which is exactly what the policy-less invocation did on every
+      # non-elevated install. The exit status is not evidence of trust,
+      # only the trust store is: re-read it here, or the state-dir marker
+      # records a success no browser will ever agree with.
+      return if already_trusted?(cert_path, keychain)
+
+      raise CertError, macos_trust_error(cert_path, keychain)
     end
 
-    # Adding the same certificate twice is not harmless: it is how the
-    # trust store accumulated duplicates across repeated setup runs.
+    def macos_trust_error(cert_path, keychain)
+      domain = (keychain == "/Library/Keychains/System.keychain") ? ["-d"] : []
+      command = (["security", "add-trusted-cert", *domain, "-r", "trustRoot",
+        *MACOS_TRUST_POLICIES, "-k", keychain, cert_path]).join(" ")
+      "macOS recorded no trust setting for the CA in #{keychain}. " \
+        "Writing user trust settings needs authorization, which a detached " \
+        "or headless run cannot grant — run this in a terminal, then retry: " \
+        "#{command}"
+    end
+
+    # True when macOS will actually honour this certificate as a CA.
+    #
+    # BOTH halves are required, and the second one is the one that used
+    # to be missing:
+    #
+    #   1. the certificate is in the keychain, so the trust evaluator can
+    #      find the issuer when it builds the chain; and
+    #   2. the trust store records a trust SETTING for its fingerprint.
+    #
+    # Presence alone is not trust: a certificate in a keychain with no
+    # trust setting fails with CSSMERR_TP_NOT_TRUSTED. Neither is a bare
+    # trust-list entry — the key with no `trustSettings` array that
+    # `add-trusted-cert` without `-p` leaves behind, which
+    # `security dump-trust-settings` counts as zero settings. Requiring
+    # a real setting costs one corrective add on a machine that has the
+    # bare kind (the add upgrades it in place, without duplicating the
+    # certificate) and nothing thereafter, so the stricter reading
+    # converges rather than looping.
+    #
+    # The fingerprint comparison stays: adding a certificate twice is not
+    # harmless, and it is how the trust store filled up with duplicates.
+    # It is now a necessary condition rather than the whole answer.
     def already_trusted?(cert_path, keychain)
       fp = fingerprint_of(cert_path)
       return false unless fp
+      return false unless keychain_fingerprints(keychain, common_name: nil).include?(fp)
 
-      keychain_fingerprints(keychain, common_name: nil).include?(fp)
+      trust_setting?(fp, keychain)
+    end
+
+    # The trust settings the OS records, as plist XML, or nil when macOS
+    # cannot be asked at all.
+    #
+    # The trust store is keyed by the certificate's SHA-1 fingerprint —
+    # the same identity `security -Z` prints — so this never has to match
+    # on a common name, which every yamine CA shares.
+    #
+    # `security trust-settings-export` is the only `security` subcommand
+    # that reports the SETTING rather than the presence:
+    # `dump-trust-settings` lists certificates and a count of their
+    # settings, `find-certificate` lists certificates. The admin domain
+    # needs `-d`; without it only the user's own settings are exported,
+    # so a root install would look untrusted forever.
+    #
+    # The certificate's own key is looked up by the caller, so a store
+    # that holds no entry for it comes back as XML WITHOUT it — that is a
+    # definite answer (never trusted), not an unreadable one.
+    def trust_settings(keychain)
+      file = File.join(Dir.tmpdir, "yamine-trust-#{Process.pid}-#{rand(1 << 32)}.plist")
+      _out, status = Command.capture2("security", "trust-settings-export",
+        *("-d" if keychain == SYSTEM_KEYCHAIN), file)
+      return nil unless status.success?
+
+      # Read back through plutil rather than parsing the plist here: it
+      # is Apple's own reader, and it keeps this file free of a plist
+      # parser (rexml is a bundled gem, unavailable under bundler).
+      xml, converted = Command.capture2("plutil", "-convert", "xml1", "-o", "-", file)
+      converted.success? ? xml : nil
+    rescue SystemCallError
+      nil
+    ensure
+      File.unlink(file) if file && File.file?(file)
+    end
+
+    # True when the trust store records a trust SETTING that grants
+    # trust for this certificate.
+    #
+    # Returns TRUE when the trust store cannot be read. That direction
+    # is deliberate: a check that always answers "not trusted" turns
+    # every boot into a re-add, and a re-add in the user domain can
+    # raise a GUI authorization prompt — a worse failure than the one
+    # this fixes.
+    def trust_setting?(fingerprint, keychain)
+      settings = trust_settings(keychain)
+      return true if settings.nil?
+
+      entry = plist_dict_after(settings, fingerprint)
+      return false unless entry&.include?("<key>trustSettings</key>")
+
+      granted = entry.scan(%r{<key>kSecTrustSettingsResult</key>\s*<integer>(\d+)</integer>}).flatten
+      return true if granted.empty? # policies only: defaults to trustRoot
+
+      granted.any? { |result| TRUST_RESULTS.include?(result.to_i) }
+    end
+
+    # The `<dict>` that follows `key`, nested dicts included. A
+    # trustSettings array is a list of dicts, so a lazy `.*?</dict>`
+    # would stop in the middle of the very array being read.
+    def plist_dict_after(xml, key)
+      at = xml.index("<key>#{key}</key>")
+      return nil unless at
+
+      rest = xml[(at + 1)..]
+      depth = 0
+      rest.scan(/<dict>|<\/dict>/) do
+        depth += ($~[0] == "<dict>" ? 1 : -1)
+        return rest[0...$~.end(0)] if depth.zero?
+      end
+      nil
     end
 
     def login_keychain

data/lib/yamine/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Yamine
-  VERSION = "0.22.0"
+  VERSION = "0.22.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: yamine
 version: !ruby/object:Gem::Version
-  version: 0.22.0
+  version: 0.22.1
 platform: ruby
 authors:
 - Kaka Ruto