yamine 0.22.0 → 0.23.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 69848a3d38cd9997ca18e52ea892aa57962524e0cd41df16199a651409e86b76
-  data.tar.gz: aebe3dd18c4bab95865491850bb940ca9a7e42c83f53d851b4d3ddd691f80305
+  metadata.gz: 308817ac04ecc72d2d0af8ca1a9262d502d5dfb27d4b21a11403c12eebac4aa0
+  data.tar.gz: 0d8c7fdc05ef6bb45ca01165901f14d9d9d17b80e4e86d1c32614fb8f12594a0
 SHA512:
-  metadata.gz: 7c1bb5ef1104c29a53c8e4274a5b4a42f7231f895f40bb7d12defc97dee72232944340c24b4bec62b9a736d29bdab01d975b32cf6e1af7aaf7f1b643ec0ac602
-  data.tar.gz: 66ef5d87789c27a94994c0d24f1567c1a762d592ecbfb00b3d95db8a7f538f3c6868be3703a9870a88d0101aabb37dcfaba8f6db85b2e4a74799b4a4381c7280
+  metadata.gz: ffc43e16572dee62e053441f56aa2472fbf3c388b80fdbbae17a79fbae0a4e6fae03819dd72d0830239aaaabfa8d04b1952433083cb9339fb7776b2b2bdbbf5e
+  data.tar.gz: d51b33e1780b9cd49cc87655bdb51adfc007736c29b67ac580fda2c2126c7cf80471e24fc4446f805f9230435af6e682132eaed599de5d7222e2125cb3c1294b

data/CHANGELOG.md

@@ -2,6 +2,78 @@
 
 ## [Unreleased]
 
+## [0.23.0] - 2026-10-02
+
+### Fixed
+
+- **A stalled response body closes the connection instead of appending a
+  502 into a live 200.** When a response relay went quiet past the idle
+  bound, the IdleTimeout escaped `forward`'s two rescues (it is neither
+  HeadTimeout nor EOFError), landed in `handle`'s generic IOError rescue,
+  and rendered a whole second response head into the body the browser was
+  already reading. The page died of the corruption with no error anywhere
+  naming a cause — DevTools even showed the 502 as if a server had sent
+  it. A response whose head has been sent can now only end one way: the
+  connection closes, the stall is logged with the request that died, and
+  no second head is ever written.
+- **`backend-refused` no longer lies about what failed.** `dial` mapped
+  every SystemCallError to :refused, so a proxy out of file descriptors
+  answered "Nothing is listening at 127.0.0.1:4486" and sent the reader
+  off to restart an app that was perfectly fine. EMFILE/ENFILE now read
+  as `proxy-exhausted` and blame the proxy's own limit; every other dial
+  error reads as `proxy-unreachable`; a backend that accepts and closes
+  without answering reads as `backend-gone` instead of masquerading as
+  refused. The 502 page says which of these it was, and carries the fix
+  for that failure rather than a start command for an app that is up.
+
+### Added
+
+- **The root daemon can finally be debugged.** The launchd plist and the
+  systemd unit carried no log paths, so the one proxy process serving
+  traffic discarded every error it ever reported — the mislabeled 502
+  above was invisible precisely because of this. Both streams now land
+  in `proxy.log` in the state dir, and the daemon rotates that log at
+  boot (one generation kept), the same rule the spawned proxy already
+  applied.
+
+## [0.22.1] - 2026-09-29
+
+### Fixed
+
+- **macOS trusts the local CA now, instead of merely filing it.** A
+  non-elevated `yamine trust` added the certificate without naming any
+  policies, so macOS recorded a trust-store entry with no settings at
+  all: the CA sat in the login keychain trusted for nothing, and every
+  browser answered `ERR_CERT_AUTHORITY_INVALID` on every
+  `https://*.localhost` route. The add now passes `-p ssl -p basic` —
+  the same thing Keychain Access writes for Secure Sockets Layer + X.509
+  Basic — and `yamine trust` re-reads the trust store afterwards rather
+  than believing the exit status, so an add that recorded nothing is a
+  failure that names the exact `security add-trusted-cert` to run
+  instead of a success the browser will contradict.
+- **A CA that is in the keychain but untrusted repairs itself.** The
+  check that decided whether to trust compared fingerprints alone, so
+  once that bare certificate was in a keychain every later boot
+  concluded it was trusted and never touched it again — the check that
+  should have caught the broken state was the one hiding it. It now
+  needs both halves: the certificate in a keychain *and* a trust
+  setting recorded for its fingerprint. A machine left with a
+  policy-less entry therefore self-heals on the next `yamine trust` or
+  proxy boot, and one whose trust store cannot be read is left alone
+  rather than re-adding on every boot.
+- **A proxy running as a normal user trusts the CA too.** Trust used to
+  be attempted only when the proxy was root, so a first run without
+  `sudo` never tried and installed a CA that could not work. Every proxy
+  now ensures trust, elevated or not, and reports a failed attempt
+  rather than swallowing it. `YAMINE_SKIP_CA_TRUST` is the escape
+  hatch for machines whose CA arrives by MDM or a hand-run
+  `security add-trusted-cert`.
+- **`yamine doctor` names a CA the OS does not trust.** The recorded
+  marker says yamine trusted this certificate; it says nothing about
+  whether macOS agreed. `doctor` asks the OS too, so a CA that is
+  installed but untrusted — the state where every route fails TLS —
+  reads as "CA is installed but macOS does not trust it" and points at
+  `yamine trust` instead of passing as healthy.
 ## [0.22.0] - 2026-09-29
 
 ### Added

data/lib/yamine/cli/system.rb

@@ -97,6 +97,11 @@ module Yamine
           if foreground
             write_tls_marker(ctx, tls)
             write_tlds_file(ctx, tlds)
+            # The daemon appends to this log for its whole life (launchd
+            # and systemd both redirect their streams here), so each boot
+            # rotates first — one generation kept, the same rule the
+            # spawned proxy's Log.open_append already applies.
+            Log.rotate(File.join(ctx.store.dir, "proxy.log"))
             # Record BEFORE serving. This process (the launchd/systemd
             # service, or a hand-run foreground proxy) IS the proxy, and
             # every reader trusts these files: doctor, Context's URL
@@ -468,8 +473,37 @@ module Yamine
         # the user-writable gem directory it was staged from. (The
         # interpreter stays RbConfig.ruby: no root-owned Ruby >= 3.2
         # exists, so that residual risk is reported, not hidden.)
+        plist = launchd_plist(state_dir: state_dir, home: home)
+        remove_legacy_launchd(dir)
+        FileUtils.mkdir_p(dir)
+        path = File.join(dir, "#{LAUNCHD_LABEL}.plist")
+        File.write(path, plist)
+        File.chmod(0o644, path)
+        # launchd requires /Library/LaunchDaemons plists to be
+        # root-owned; we are root here (sudo re-exec). Enforce it
+        # explicitly: File.write keeps an existing file's owner, so a
+        # stale user-owned plist from an older version would otherwise
+        # survive the overwrite and bootstrap fails with error 5.
+        # Trust the CA into the System keychain while elevated: silent
+        # (no GUI popup) and trusted for every user on the machine.
+        File.chown(0, 0, path) if Process.uid.zero?
+        ensure_system_ca_trust
+        puts "    Registering the launchd service on port 443..."
+        launchctl_bootstrap(path)
+        puts "Installed root LaunchDaemon on port 443 (state: #{state_dir})."
+        puts "    Payload: #{PrivilegedPayload.bin_path} (root-owned, version-independent)."
+        puts "    Log: #{File.join(state_dir, "proxy.log")}."
+      end
+
+      # Pure plist builder (testable without root). Both output streams
+      # point at the state dir's proxy.log: a root daemon whose errors
+      # launchd discards cannot be debugged at all, and one whole
+      # misdiagnosed failure class came from exactly that blindness —
+      # the proxy's own account of a dial failure never reached disk.
+      def launchd_plist(state_dir:, home:)
         payload_bin = PrivilegedPayload.bin_path
-        plist = <<~PLIST
+        log_path = File.join(state_dir, "proxy.log")
+        <<~PLIST
           <?xml version="1.0" encoding="UTF-8"?>
           <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
           <plist version="1.0">
@@ -489,27 +523,11 @@ module Yamine
             </dict>
             <key>KeepAlive</key><true/>
             <key>RunAtLoad</key><true/>
+            <key>StandardOutPath</key><string>#{log_path}</string>
+            <key>StandardErrorPath</key><string>#{log_path}</string>
           </dict>
           </plist>
         PLIST
-        remove_legacy_launchd(dir)
-        FileUtils.mkdir_p(dir)
-        path = File.join(dir, "#{LAUNCHD_LABEL}.plist")
-        File.write(path, plist)
-        File.chmod(0o644, path)
-        # launchd requires /Library/LaunchDaemons plists to be
-        # root-owned; we are root here (sudo re-exec). Enforce it
-        # explicitly: File.write keeps an existing file's owner, so a
-        # stale user-owned plist from an older version would otherwise
-        # survive the overwrite and bootstrap fails with error 5.
-        # Trust the CA into the System keychain while elevated: silent
-        # (no GUI popup) and trusted for every user on the machine.
-        File.chown(0, 0, path) if Process.uid.zero?
-        ensure_system_ca_trust
-        puts "    Registering the launchd service on port 443..."
-        launchctl_bootstrap(path)
-        puts "Installed root LaunchDaemon on port 443 (state: #{state_dir})."
-        puts "    Payload: #{payload_bin} (root-owned, version-independent)."
       end
 
       # True when the trust store covers the CA this machine should be
@@ -517,15 +535,15 @@ module Yamine
       # expiring, or renamed.
       #
       # The ordering is the whole point, so it lives in one place rather
-      # than at each call site. `trusted?` compares a marker against the
-      # fingerprint of the certificate ON DISK, and a proxy regenerates
-      # the CA at boot when the name changes. Checking the marker before
-      # the CA is current therefore reads a stale match, skips trust, and
-      # lets the proxy come up serving a CA the keychain does not trust —
-      # breaking TLS for every route.
+      # than at each call site. The state-dir marker is only half of it
+      # (`Trust.trusted?` also asks the OS): a marker that says "we
+      # trusted this" survives a keychain that never took the setting,
+      # so checking it before the CA is current — or on its own — reads
+      # a stale match, skips trust, and lets the proxy come up serving a
+      # CA no browser trusts.
       def ca_current_and_trusted?(dir = Certs.state_dir)
         Certs.ensure_ca(dir)
-        Certs.trusted?(dir)
+        Trust.trusted?(dir)
       end
 
       # Root-only CA trust: the System keychain (all users, no prompt).
@@ -587,9 +605,12 @@ module Yamine
       # Pure unit-file builder (testable without root). Binds 80/443 at
       # boot; the proxy runs with the invoking user's state dir. The
       # payload is the root-owned staged path — never the gem directory.
-      def systemd_unit
-        home = user_home_for_service
-        state_dir = ENV["YAMINE_STATE_DIR"] || File.join(home, ".yamine")
+      # Both output streams append to the state dir's proxy.log, matching
+      # the launchd unit, so a daemon that misbehaves can be read.
+      def systemd_unit(state_dir: nil, home: nil)
+        home ||= user_home_for_service
+        state_dir ||= ENV["YAMINE_STATE_DIR"] || File.join(home, ".yamine")
+        log_path = File.join(state_dir, "proxy.log")
         <<~UNIT
           # /etc/systemd/system/yamine.service  (binds 80/443 at boot)
           [Unit]
@@ -599,6 +620,8 @@ module Yamine
           ExecStart=#{RbConfig.ruby} #{PrivilegedPayload.bin_path} proxy start --foreground --port #{ProxyControl::DEFAULT_TLS_PORT}
           Environment=YAMINE_STATE_DIR=#{state_dir}
           Environment=HOME=#{home}
+          StandardOutput=append:#{log_path}
+          StandardError=append:#{log_path}
 
           [Install]
           WantedBy=multi-user.target

data/lib/yamine/doctor.rb

@@ -192,6 +192,15 @@ module Yamine
       unless Certs.trusted?(dir)
         return Check.new(name: "ca", ok: false, message: "CA not trusted — run: yamine trust")
       end
+      # The marker says WE trusted this certificate; it says nothing about
+      # whether the OS recorded a trust setting for it. A CA sitting in
+      # the keychain with no trust setting is the state that produced
+      # ERR_CERT_AUTHORITY_INVALID on every route, with the marker
+      # cheerfully reporting success.
+      unless Trust.trusted?(dir)
+        return Check.new(name: "ca", ok: false,
+          message: "CA is installed but macOS does not trust it — run: yamine trust")
+      end
 
       # Trusted CAs that are not the one now on disk. They accumulate from
       # CA regeneration (missing, expiring, or renamed — the ask-local

data/lib/yamine/proxy.rb

@@ -107,7 +107,7 @@ module Yamine
       servers.each { |s| s.listen(@port) }
       @port = servers.first.addr[1]
       Ownership.chown_state_dir(@store.dir)
-      ensure_system_ca_trust if Process.uid.zero?
+      ensure_ca_trust
       trap("INT") { stop(servers) }
       trap("TERM") do
         @supervisor&.shutdown
@@ -188,14 +188,30 @@ module Yamine
 
     private
 
-    # A root proxy (launchd service or sudo daemon) is the one process
-    # that can trust the CA into the System keychain silently — no GUI
-    # popup. Idempotent: the state-dir marker makes repeat boots a no-op.
-    def ensure_system_ca_trust
-      return if Certs.trusted?(@state_dir)
+    # The proxy is the process the browser's TLS stack actually talks to,
+    # so it is where the CA has to be trusted — as root, into the System
+    # keychain silently, and as a normal user, into the login keychain.
+    # A non-elevated proxy used to skip this entirely, which is how a
+    # first run as an ordinary user installed a CA that could not work.
+    #
+    # `Trust.trusted?` asks the trust store, not just the state-dir
+    # marker, so a CA that is present but untrusted is repaired instead
+    # of being short-circuited. Trust.trust only writes the marker once
+    # the trust setting is confirmed, so a failure is retried (and
+    # reported) on the next boot rather than cached as a success.
+    #
+    # YAMINE_SKIP_CA_TRUST is for machines whose CA arrives some other
+    # way — an MDM profile, a hand-run `security add-trusted-cert` — and
+    # for the suite, which spawns real proxies and must never reach a real
+    # keychain.
+    def ensure_ca_trust
+      return if ENV["YAMINE_SKIP_CA_TRUST"]
+      return if Trust.trusted?(@state_dir)
 
       result = Trust.trust(@state_dir)
-      @on_error.call("CA trust warning: #{result[:error]}") unless result[:trusted]
+      return if result[:trusted]
+
+      @on_error.call("CA trust warning: #{result[:error]}")
     end
 
     def admit?
@@ -313,6 +329,13 @@ module Yamine
           keep, reason = forward(sock, entry, method, target, headers, buf)
         end
 
+        if reason == :body_lost
+          # The response head already reached the client; there is no
+          # answer left to give, only a connection to close. A 502 here
+          # would be garbage appended to a live response.
+          break
+        end
+
         if reason
           render_bad_gateway(sock, entry, host, reason)
           break
@@ -328,7 +351,7 @@ module Yamine
 
     # One attempt at the backend: dial, forward the request, relay the
     # response. Returns [keep_alive?, reason], where reason is nil on
-    # success and otherwise names which backend failure this was. That one
+    # success and otherwise names which failure this was. That one
     # value decides both whether a retry is safe and what the 502 says, so
     # "refused" and "silent" can never drift apart again.
     #
@@ -339,8 +362,8 @@ module Yamine
       begin
         backend = dial(entry)
       rescue SystemCallError => e
-        @on_error.call("dial failed for #{entry["hostname"]}: #{e.message}")
-        return [:close, :refused]
+        @on_error.call("dial failed for #{entry["hostname"]}: #{e.class}: #{e.message}")
+        return [:close, failure_reason(e)]
       end
 
       begin
@@ -354,15 +377,29 @@ module Yamine
       end
     end
 
+    # What a failed dial means. ECONNREFUSED is the one failure that
+    # indicts the backend; the rest indict the path or the proxy itself,
+    # and reporting them as "Nothing is listening" sends the reader off to
+    # restart an app that is perfectly fine — an fd-exhausted proxy spent
+    # one whole debugging evening dressed as a dead backend.
+    def failure_reason(error)
+      case error
+      when Errno::ECONNREFUSED then :refused
+      when Errno::EMFILE, Errno::ENFILE then :exhausted
+      else :unreachable
+      end
+    end
+
     # A refused dial never reached the app, so any method replays safely —
     # the request body is still unread on the client socket. A head
-    # timeout means the head DID reach the app, so the only safe replays
-    # are the bodiless methods: the body has already been consumed off the
-    # client socket and cannot be faithfully resent, and a duplicated
-    # message is a worse outcome than a slow page.
+    # timeout or an exhausted proxy means the attempt died on our side of
+    # the wire, so the only safe replays are the bodiless methods: the
+    # body has already been consumed off the client socket and cannot be
+    # faithfully resent, and a duplicated message is a worse outcome than
+    # a slow page.
     def retriable?(reason, method, headers)
       return true if reason == :refused
-      return false unless reason == :silent
+      return false unless [:silent, :exhausted].include?(reason)
       return false unless %w[GET HEAD OPTIONS].include?(method.to_s.upcase)
 
       request_body_length(headers) == 0
@@ -397,17 +434,43 @@ module Yamine
       return [:close, :gone] if rhead.nil?
 
       _rm, _rt, rheaders = parse_head(rhead)
-      write_all(sock, rhead)
-      write_all(sock, rbuf) unless rbuf.empty?
-
-      rlen = content_length(rheaders)
-      if rlen.nil?
-        # No Content-Length: close-delimited response.
-        copy_stream(backend, sock)
-        return [:close, nil]
+      relay_after_head(sock, backend, rhead, rbuf, rheaders, headers, target)
+    end
+
+    # Everything from the response head onward. Once the head is on the
+    # wire the 502 vocabulary is spent: a failure here can only end the
+    # connection, never answer it, and rendering a 502 into the middle of
+    # a live 200 corrupts the stream the browser is already reading (the
+    # second head arrives as body bytes; the page dies of it with no
+    # error naming anything). [:close, :body_lost] tells handle to close
+    # quietly instead — the stall itself is logged with the request that
+    # died, since a relay that goes quiet mid-body is exactly the failure
+    # that is otherwise invisible.
+    def relay_after_head(sock, backend, rhead, rbuf, rheaders, headers, target)
+      begin
+        write_all(sock, rhead)
+        write_all(sock, rbuf) unless rbuf.empty?
+
+        rlen = content_length(rheaders)
+        if rlen.nil?
+          # No Content-Length: close-delimited response.
+          copy_stream(backend, sock)
+          return [:close, nil]
+        end
+        remaining = rlen - rbuf.bytesize
+        copy_stream(backend, sock, remaining) if remaining > 0
+      rescue EOFError
+        @on_error.call("backend for #{headers["host"]}#{target} closed mid-body, " \
+                       "before its Content-Length of #{rheaders["content-length"]} was met")
+        return [:close, :body_lost]
+      rescue IdleTimeout => e
+        @on_error.call("response for #{headers["host"]}#{target} died mid-body: #{e.message}")
+        return [:close, :body_lost]
+      rescue IOError, SystemCallError
+        # The client or the backend hung up mid-relay — ordinary web
+        # traffic (a cancelled fetch, a departed tab), not a failure.
+        return [:close, :body_lost]
       end
-      remaining = rlen - rbuf.bytesize
-      copy_stream(backend, sock, remaining) if remaining > 0
 
       if keep_alive?(headers) && keep_alive?(rheaders)
         # Any bytes beyond Content-Length on the backend are a second
@@ -767,8 +830,7 @@ module Yamine
     # command to run. Modeled on render_not_found, which already answers
     # "nobody knows what this hostname is" properly.
     def render_bad_gateway(sock, entry, host, reason = :refused)
-      kind = reason == :silent ? "backend-silent" : "backend-refused"
-      headers = { ERROR_HEADER => kind }
+      headers = { ERROR_HEADER => error_kind(reason) }
       bare = Hostname.strip_port(host)
       # Same DNS-rebinding boundary as render_not_found: a Host outside our
       # TLDs is a website that got us to answer, not the local developer
@@ -777,16 +839,31 @@ module Yamine
 
       target = entry ? entry["target"].to_s : ""
       body = "<h1>Bad Gateway</h1><p>#{what_happened(reason, target)}</p>" \
-             "#{bad_gateway_owner(entry, bare)}#{bad_gateway_fix(entry)}"
+             "#{bad_gateway_owner(entry, bare)}#{bad_gateway_fix(entry, reason)}"
       respond(sock, 502, body, headers: headers)
     rescue IOError, SystemCallError
       nil
     end
 
-    # Which of the two failures this was, said the way each one has to be
-    # read: not listening means start the app, silent means go find out why
-    # an app that is up is not answering. One "not responding" for both
-    # sends the reader to the wrong place either way.
+    # The machine-readable failure class. Agents branch on this without
+    # parsing the page, so each failure must carry its own name — a closed
+    # connection labeled "refused", or a proxy out of file descriptors
+    # labeled "refused", points the reader at the app when the app is fine.
+    def error_kind(reason)
+      case reason
+      when :silent then "backend-silent"
+      when :gone then "backend-gone"
+      when :exhausted then "proxy-exhausted"
+      when :unreachable then "proxy-unreachable"
+      else "backend-refused"
+      end
+    end
+
+    # Which of the failures this was, said the way each one has to be
+    # read: not listening means start the app, silent means go find out
+    # why an app that is up is not answering, exhausted means the trouble
+    # is the proxy's own resource limit. One "not responding" for all of
+    # them sends the reader to the wrong place every time.
     def what_happened(reason, target)
       at = target.empty? ? "" : " at <code>#{escape(target)}</code>"
       case reason
@@ -796,6 +873,12 @@ module Yamine
       when :gone
         "The backend#{at} accepted the connection, then closed it without " \
           "sending a response."
+      when :exhausted
+        "The proxy ran out of file descriptors dialing#{at} — the limit is the " \
+          "proxy process's own, not the app's, and the backend may be perfectly fine."
+      when :unreachable
+        "The proxy could not reach the backend#{at} — the address is wrong or the " \
+          "path there failed, which is not the same as nothing listening."
       else
         "Nothing is listening#{at}."
       end
@@ -816,7 +899,14 @@ module Yamine
       "<p>The backend for <strong>#{escape(host)}</strong> is registered#{by}#{where}.</p>"
     end
 
-    def bad_gateway_fix(entry)
+    def bad_gateway_fix(entry, reason)
+      if [:exhausted, :unreachable].include?(reason)
+        # The app is not the suspect here, so the start command would be
+        # the wrong advice on a page that already says so.
+        return "<p>The backend looks up — check the proxy's own log: " \
+               "<code>proxy.log</code> in the yamine state dir.</p>"
+      end
+
       dir = entry&.dig("spec", "dir")
       return "<p>Start it with <code>yamine start</code> in that app's directory.</p>" unless dir
 

data/lib/yamine/trust.rb

@@ -1,10 +1,41 @@
 # frozen_string_literal: true
 
 require "open3"
+require "tmpdir"
 
 module Yamine
   # Install the local CA into the OS trust store.
   module Trust
+    SYSTEM_KEYCHAIN = "/Library/Keychains/System.keychain"
+
+    # The policies a browser's TLS stack evaluates a leaf under: SSL
+    # server (the hostname check) and X.509 basic (the chain build).
+    #
+    # They have to be named, and this is measured, not assumed.
+    # `add-trusted-cert -r trustRoot` with no `-p` exits 0 and records
+    # the certificate in the trust store with NO `trustSettings` array at
+    # all: `security dump-trust-settings` reports "Number of trust
+    # settings : 0", and `security trust-settings-export` shows a
+    # trustList entry holding only issuerName/modDate/serialNumber. What
+    # the CA is trusted FOR is then unstated, and whether such an entry
+    # is honoured at all depends on the certificate also being installed
+    # in a keychain the evaluator searches — on the machine this was
+    # fixed on, it was not, and every browser answered
+    # ERR_CERT_AUTHORITY_INVALID.
+    #
+    # With `-p ssl -p basic` the same call records
+    # kSecTrustSettingsPolicyName sslServer + basicX509, and per
+    # SecTrustSettings.h a settings entry with no explicit
+    # kSecTrustSettingsResult defaults to kSecTrustSettingsResultTrustRoot
+    # ("trust this root cert"). That is also what Keychain Access writes
+    # for a certificate set to Secure Sockets Layer + X.509 Basic.
+    MACOS_TRUST_POLICIES = %w[-p ssl -p basic].freeze
+
+    # SecTrustSettingsResult (Security/SecTrustSettings.h). Only these
+    # two grant trust; 3 is Deny and 4 is Unspecified, so a CA whose only
+    # setting is one of those is explicitly NOT trusted.
+    TRUST_RESULTS = [1, 2].freeze
+
     module_function
 
     def platform
@@ -31,6 +62,33 @@ module Yamine
       { trusted: false, error: e.message }
     end
 
+    # True when the OS trust store will honour the CA in `dir`.
+    #
+    # The state-dir marker is only half the answer, and the half that
+    # lies: it records that WE trusted this exact certificate at some
+    # point, so it survives a keychain that never took the setting, a
+    # trust run that recorded nothing, and a CA that was regenerated
+    # under it. Treating the marker as "trusted" is how a machine kept a
+    # CA in its keychain that no browser would accept.
+    def trusted?(dir = Certs.state_dir)
+      return false unless Certs.trusted?(dir)
+      return true unless platform == :macos
+
+      paths = Certs.ca_paths(dir)
+      return false unless File.file?(paths[:cert])
+
+      macos_keychains.any? { |keychain| already_trusted?(paths[:cert], keychain) }
+    end
+
+    # The keychains a CA can be trusted into: the user's own, and — for
+    # an elevated run — the System one, which every user on the machine
+    # reads. Both are checked because the certificate on disk may have
+    # been trusted into either, and a CA trusted only as root is not
+    # trusted for a later unprivileged run (or the reverse).
+    def macos_keychains
+      [login_keychain, SYSTEM_KEYCHAIN].uniq
+    end
+
     # The fingerprint `security -Z` prints: uppercase hex, no colons.
     # Certificates are identified by THIS, never by common name: every CA
     # this project has generated shares a name with the others, so a
@@ -81,7 +139,7 @@ module Yamine
     end
 
     def keychains
-      [login_keychain, "/Library/Keychains/System.keychain"]
+      [login_keychain, SYSTEM_KEYCHAIN]
     end
 
     # Remove trusted certificates that carry one of our CA names but are
@@ -206,25 +264,142 @@ module Yamine
         return if already_trusted?(cert_path, keychain)
 
         _out, status = Command.capture2("security", "add-trusted-cert",
-          "-d", "-r", "trustRoot", "-k", keychain, cert_path)
-        raise CertError, "security add-trusted-cert (system) failed" unless status.success?
+          "-d", "-r", "trustRoot", *MACOS_TRUST_POLICIES, "-k", keychain, cert_path)
+        raise CertError, macos_trust_error(cert_path, keychain) unless status.success?
       else
+        # Not elevated: the user's own keychain, with the trust policies
+        # named. The certificate still has to be in a keychain — macOS
+        # builds the chain by searching keychains for the issuer, so a
+        # trust setting for a certificate that is not installed anywhere
+        # is dead weight. Measured: CA trusted but absent from every
+        # keychain => "unable to get local issuer certificate".
         keychain = login_keychain
         return if already_trusted?(cert_path, keychain)
 
         _out, status = Command.capture2("security", "add-trusted-cert",
-          "-r", "trustRoot", "-k", keychain, cert_path)
-        raise CertError, "security add-trusted-cert failed" unless status.success?
+          "-r", "trustRoot", *MACOS_TRUST_POLICIES, "-k", keychain, cert_path)
+        raise CertError, macos_trust_error(cert_path, keychain) unless status.success?
       end
+
+      # `add-trusted-cert` exits 0 for a certificate it merely filed —
+      # which is exactly what the policy-less invocation did on every
+      # non-elevated install. The exit status is not evidence of trust,
+      # only the trust store is: re-read it here, or the state-dir marker
+      # records a success no browser will ever agree with.
+      return if already_trusted?(cert_path, keychain)
+
+      raise CertError, macos_trust_error(cert_path, keychain)
     end
 
-    # Adding the same certificate twice is not harmless: it is how the
-    # trust store accumulated duplicates across repeated setup runs.
+    def macos_trust_error(cert_path, keychain)
+      domain = (keychain == "/Library/Keychains/System.keychain") ? ["-d"] : []
+      command = (["security", "add-trusted-cert", *domain, "-r", "trustRoot",
+        *MACOS_TRUST_POLICIES, "-k", keychain, cert_path]).join(" ")
+      "macOS recorded no trust setting for the CA in #{keychain}. " \
+        "Writing user trust settings needs authorization, which a detached " \
+        "or headless run cannot grant — run this in a terminal, then retry: " \
+        "#{command}"
+    end
+
+    # True when macOS will actually honour this certificate as a CA.
+    #
+    # BOTH halves are required, and the second one is the one that used
+    # to be missing:
+    #
+    #   1. the certificate is in the keychain, so the trust evaluator can
+    #      find the issuer when it builds the chain; and
+    #   2. the trust store records a trust SETTING for its fingerprint.
+    #
+    # Presence alone is not trust: a certificate in a keychain with no
+    # trust setting fails with CSSMERR_TP_NOT_TRUSTED. Neither is a bare
+    # trust-list entry — the key with no `trustSettings` array that
+    # `add-trusted-cert` without `-p` leaves behind, which
+    # `security dump-trust-settings` counts as zero settings. Requiring
+    # a real setting costs one corrective add on a machine that has the
+    # bare kind (the add upgrades it in place, without duplicating the
+    # certificate) and nothing thereafter, so the stricter reading
+    # converges rather than looping.
+    #
+    # The fingerprint comparison stays: adding a certificate twice is not
+    # harmless, and it is how the trust store filled up with duplicates.
+    # It is now a necessary condition rather than the whole answer.
     def already_trusted?(cert_path, keychain)
       fp = fingerprint_of(cert_path)
       return false unless fp
+      return false unless keychain_fingerprints(keychain, common_name: nil).include?(fp)
 
-      keychain_fingerprints(keychain, common_name: nil).include?(fp)
+      trust_setting?(fp, keychain)
+    end
+
+    # The trust settings the OS records, as plist XML, or nil when macOS
+    # cannot be asked at all.
+    #
+    # The trust store is keyed by the certificate's SHA-1 fingerprint —
+    # the same identity `security -Z` prints — so this never has to match
+    # on a common name, which every yamine CA shares.
+    #
+    # `security trust-settings-export` is the only `security` subcommand
+    # that reports the SETTING rather than the presence:
+    # `dump-trust-settings` lists certificates and a count of their
+    # settings, `find-certificate` lists certificates. The admin domain
+    # needs `-d`; without it only the user's own settings are exported,
+    # so a root install would look untrusted forever.
+    #
+    # The certificate's own key is looked up by the caller, so a store
+    # that holds no entry for it comes back as XML WITHOUT it — that is a
+    # definite answer (never trusted), not an unreadable one.
+    def trust_settings(keychain)
+      file = File.join(Dir.tmpdir, "yamine-trust-#{Process.pid}-#{rand(1 << 32)}.plist")
+      _out, status = Command.capture2("security", "trust-settings-export",
+        *("-d" if keychain == SYSTEM_KEYCHAIN), file)
+      return nil unless status.success?
+
+      # Read back through plutil rather than parsing the plist here: it
+      # is Apple's own reader, and it keeps this file free of a plist
+      # parser (rexml is a bundled gem, unavailable under bundler).
+      xml, converted = Command.capture2("plutil", "-convert", "xml1", "-o", "-", file)
+      converted.success? ? xml : nil
+    rescue SystemCallError
+      nil
+    ensure
+      File.unlink(file) if file && File.file?(file)
+    end
+
+    # True when the trust store records a trust SETTING that grants
+    # trust for this certificate.
+    #
+    # Returns TRUE when the trust store cannot be read. That direction
+    # is deliberate: a check that always answers "not trusted" turns
+    # every boot into a re-add, and a re-add in the user domain can
+    # raise a GUI authorization prompt — a worse failure than the one
+    # this fixes.
+    def trust_setting?(fingerprint, keychain)
+      settings = trust_settings(keychain)
+      return true if settings.nil?
+
+      entry = plist_dict_after(settings, fingerprint)
+      return false unless entry&.include?("<key>trustSettings</key>")
+
+      granted = entry.scan(%r{<key>kSecTrustSettingsResult</key>\s*<integer>(\d+)</integer>}).flatten
+      return true if granted.empty? # policies only: defaults to trustRoot
+
+      granted.any? { |result| TRUST_RESULTS.include?(result.to_i) }
+    end
+
+    # The `<dict>` that follows `key`, nested dicts included. A
+    # trustSettings array is a list of dicts, so a lazy `.*?</dict>`
+    # would stop in the middle of the very array being read.
+    def plist_dict_after(xml, key)
+      at = xml.index("<key>#{key}</key>")
+      return nil unless at
+
+      rest = xml[(at + 1)..]
+      depth = 0
+      rest.scan(/<dict>|<\/dict>/) do
+        depth += ($~[0] == "<dict>" ? 1 : -1)
+        return rest[0...$~.end(0)] if depth.zero?
+      end
+      nil
     end
 
     def login_keychain

data/lib/yamine/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Yamine
-  VERSION = "0.22.0"
+  VERSION = "0.23.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: yamine
 version: !ruby/object:Gem::Version
-  version: 0.22.0
+  version: 0.23.0
 platform: ruby
 authors:
 - Kaka Ruto