yamine 0.9.2 → 0.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 10912afade2197809c63bc0d6382d754eaa236f5996462a242554775f9e48c1e
-  data.tar.gz: f2100f695bc378b3bf95ad2089907e614eea6deea10cc4f3029a98397439eea0
+  metadata.gz: db8822f4d49064d2cb61c2219c43c7049eafc7e44a2bb4b918981ef7a4bd8d11
+  data.tar.gz: 31c30cc196665056aab7f711c092003f775af0d684fc891adcf039da1603a96b
 SHA512:
-  metadata.gz: abfaa410dd665fb70e0d280b0ba0142607a095fc94ea3c88c5ea213cf32dec415fd0fec6723770a3a346a2b5ce4042d0b23a78d7796bb50e280f11fad7dedb13
-  data.tar.gz: ffef03352feb6c30328769b6e6e5c87705458b711cb0b5cc7a7c0b0b6b9061c06ece931766cbd4c2ec9cf09e397f2fdacaf2ee6fcb87c6e707e9163026457926
+  metadata.gz: 85e04f77e692d458765ef87714bb83dac175f387dec1bba92bb46e4ac405d292d693a0292187bf427b6fc56bbbbf1263635bdcbcbd3426295531235aab51dc67
+  data.tar.gz: 226f812a9accf7265fcae4f1ae74328bb6229ee9199af790e2d744085fed517f7445a6c501c94b6ec188d8f0575677f91753831b9ef502349b4bf2f873b5dbf3

data/CHANGELOG.md

@@ -1,5 +1,70 @@
 # Changelog
 
+## [0.10.0] — 2026-09-10
+
+The ask-local rename is finished: the two user-visible names it left
+behind are now yamine's own, and both migrate existing machines.
+
+### Changed
+
+- **The CA is named "Yamine CA"** (was "Ask Local CA", inherited from
+  the rename). The old name stays in `Certs::LEGACY_CA_COMMON_NAMES`, so
+  a machine carrying a pre-rename CA can still shed it. Because
+  `valid_pair?` requires the on-disk CA to carry the current name, the
+  first run after upgrading generates a new CA and re-trusts it — once,
+  automatically, as part of the normal trust path.
+- **The launchd service is `dev.yamine`** (was `dev.ask.local`). The old
+  plist is booted out and deleted during install and uninstall: a label
+  is how launchctl addresses a service, so leaving the old one loaded
+  would put two root proxies in a race for port 443, the loser
+  crash-looping under `KeepAlive`.
+
+### Fixed
+
+- `prune_stale` protects the CA a running proxy signs with, identified
+  by signature rather than by skipping the prune entirely. A proxy loads
+  its CA once at startup and mints host certs from that in-memory copy,
+  so it keeps signing with its boot-time CA whatever is on disk —
+  removing that certificate would break TLS for every live route until a
+  restart. Since superseded CAs share a name with the live one, only a
+  signature check can tell them apart.
+
+
+## [0.9.3] — 2026-09-10
+
+### Fixed
+
+- **The trust store accumulated duplicate CAs, and cleanup deleted the
+  wrong one.** `trust_macos` never checked whether the certificate was
+  already trusted, so every `setup`/`trust` run added another copy, and
+  nothing ever removed the certificates left behind when a CA was
+  regenerated (missing, expiring, or renamed). One machine had **14
+  distinct trusted roots**, all named "Ask Local CA". Since a superseded
+  CA's private key stays on disk, a trusted root whose key is still
+  recoverable is a real liability. Trust is now idempotent, and
+  `prune_stale` removes trusted certificates under our CA names that are
+  not the CA currently on disk.
+- Cleanup no longer operates by common name. `untrust` ran
+  `delete-certificate -c "Ask Local CA"` up to five times per keychain,
+  which deletes an ARBITRARY certificate with that name — possibly the
+  current CA, or one a sibling checkout still serves — and can leave the
+  target behind. Everything now identifies certificates by SHA-1
+  fingerprint, and pruning additionally verifies the subject before
+  deleting, so an unrelated trusted root can never be touched.
+- `prune_stale` refuses to run while a proxy is serving: a live proxy
+  holds the CA it booted with in memory, so removing that certificate
+  would break TLS for every live route until a restart.
+
+### Changed
+
+- The CA keeps the legacy "Ask Local CA" name. Renaming it would
+  invalidate every existing CA (`valid_pair?` requires the name) and
+  force a regeneration plus re-trust on every machine — a real migration
+  cost for a cosmetic gain, and the name was never the actual problem.
+  `Certs::CA_COMMON_NAMES` lists every name we have generated so a future
+  rename stays prunable.
+
+
 ## [0.9.2] — 2026-09-10
 
 ### Fixed

data/lib/yamine/certs.rb

@@ -11,13 +11,25 @@ module Yamine
   # through the SNI callback and held in an in-memory LRU
   # (puma-dev ssl.go does the same; portless caches on disk instead).
   module Certs
-    CA_COMMON_NAME = "Ask Local CA"
+    # The CA's name is user-visible in the trust store and is what a
+    # cleanup keys off, so it belongs to this gem alone. It was inherited
+    # from the ask-local rename and had said "Ask Local CA" ever since.
+    CA_COMMON_NAME = "Yamine CA"
+    # Every name we have ever generated a CA under. Stale certificates
+    # under these are prunable (Trust.prune_stale); anything else in the
+    # trust store is none of our business. The pre-rename name stays here
+    # so machines that trusted an ask-local CA can still shed it.
+    LEGACY_CA_COMMON_NAMES = ["Ask Local CA"].freeze
     CA_VALIDITY_DAYS = 3650
     HOST_VALIDITY_DAYS = 825
     CACHE_SIZE = 1024
 
     module_function
 
+    def ca_common_names
+      [CA_COMMON_NAME, *LEGACY_CA_COMMON_NAMES].uniq
+    end
+
     def state_dir
       ENV["YAMINE_STATE_DIR"] || File.join(home, ".yamine")
     end

data/lib/yamine/cli/system.rb

@@ -4,6 +4,13 @@ module Yamine
   class CLI
     # System commands: proxy, service, hosts, trust, clean, doctor, kamal.
     module SystemCommand
+      # The launchd label: the service's identity, and what `launchctl
+      # enable/kickstart/bootout` address it by. Renamed from "dev.ask.local"
+      # (an ask-local leftover); the old label is cleared on install so the
+      # two never coexist and fight over port 443.
+      LAUNCHD_LABEL = "dev.yamine"
+      LEGACY_LAUNCHD_LABELS = %w[dev.ask.local].freeze
+
       module_function
 
       def doctor(ctx, args)
@@ -291,7 +298,7 @@ module Yamine
           <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
           <plist version="1.0">
           <dict>
-            <key>Label</key><string>dev.ask.local</string>
+            <key>Label</key><string>#{LAUNCHD_LABEL}</string>
             <key>ProgramArguments</key>
             <array>
               <string>#{RbConfig.ruby}</string>
@@ -309,7 +316,8 @@ module Yamine
           </dict>
           </plist>
         PLIST
-        path = File.join(dir, "dev.ask.local.plist")
+        remove_legacy_launchd(dir)
+        path = File.join(dir, "#{LAUNCHD_LABEL}.plist")
         File.write(path, plist)
         File.chmod(0o644, path)
         # launchd requires /Library/LaunchDaemons plists to be
@@ -354,14 +362,34 @@ module Yamine
         unless Command.run("launchctl", "bootstrap", "system", path)
           raise Error, "launchctl bootstrap failed — check the plist at #{path}"
         end
-        Command.run("launchctl", "enable", "system/dev.ask.local")
-        Command.run("launchctl", "kickstart", "-k", "system/dev.ask.local")
+        Command.run("launchctl", "enable", "system/#{LAUNCHD_LABEL}")
+        Command.run("launchctl", "kickstart", "-k", "system/#{LAUNCHD_LABEL}")
       end
 
       def launchctl_bootout(path)
         Command.run("launchctl", "bootout", "system", path)
       end
 
+      # The launchd label, and the pre-rename one that must be cleared.
+      # A label is the service's identity: installing the new one while
+      # the old plist is still loaded would leave TWO root proxies
+      # fighting over port 443 (whichever booted last wins, and the loser
+      # crash-loops under KeepAlive).
+      #
+      # Boot out and delete any plist from a previous label. Idempotent:
+      # bootout on a service that was never loaded prints an error and
+      # exits non-zero, which is expected and quiet.
+      def remove_legacy_launchd(dir = "/Library/LaunchDaemons")
+        LEGACY_LAUNCHD_LABELS.each do |label|
+          path = File.join(dir, "#{label}.plist")
+          next unless File.file?(path)
+
+          Command.run("launchctl", "bootout", "system", path, out: File::NULL, err: File::NULL)
+          FileUtils.rm_f(path)
+          puts "    Removed legacy launchd service #{label}."
+        end
+      end
+
       # Pure unit-file builder (testable without root). Binds 80/443 at
       # boot; the proxy runs with the invoking user's state dir.
       def systemd_unit
@@ -406,9 +434,12 @@ module Yamine
         end
         case RUBY_PLATFORM
         when /darwin/
-          path = "/Library/LaunchDaemons/dev.ask.local.plist"
-          launchctl_bootout(path)
+          path = "/Library/LaunchDaemons/#{LAUNCHD_LABEL}.plist"
+          launchctl_bootout(path) if File.file?(path)
           FileUtils.rm_f(path)
+          # Also clear any pre-rename service, so uninstall leaves no root
+          # proxy behind on a machine upgraded from an older yamine.
+          remove_legacy_launchd
           puts "Removed root LaunchDaemon."
         when /linux/
           Command.run("systemctl", "disable", "--now", "yamine")

data/lib/yamine/trust.rb

@@ -18,6 +18,7 @@ module Yamine
 
     def trust(dir = Certs.state_dir)
       paths = Certs.ensure_ca(dir)
+      prune_stale(dir)
       case platform
       when :macos then trust_macos(paths[:cert])
       when :linux then trust_linux(paths[:cert])
@@ -30,23 +31,202 @@ module Yamine
       { trusted: false, error: e.message }
     end
 
+    # The fingerprint `security -Z` prints: uppercase hex, no colons.
+    # Certificates are identified by THIS, never by common name: every CA
+    # this project has generated shares a name with the others, so a
+    # by-name lookup or delete cannot tell the current CA from a stale
+    # one and may remove the wrong certificate.
+    def fingerprint_of(cert_path)
+      require "digest"
+      cert = OpenSSL::X509::Certificate.new(File.read(cert_path))
+      Digest::SHA1.hexdigest(cert.to_der).upcase
+    rescue OpenSSL::OpenSSLError, SystemCallError
+      nil
+    end
+
+    # Certificates in a keychain as { fingerprint:, subject:, cert: }.
+    # Parsed in ONE call; empty when the keychain (or `security`) is
+    # unavailable, which callers treat as "cannot tell".
+    #
+    # -a is required: without it `security find-certificate` returns a
+    # single certificate, so any scan silently sees one entry and every
+    # comparison against it is wrong.
+    def keychain_certs(keychain)
+      out, status = Command.capture2("security", "find-certificate", "-a", "-Z", "-p", keychain)
+      return [] unless status.success?
+
+      require "digest"
+      out.split("-----BEGIN CERTIFICATE-----").filter_map do |block|
+        next unless block.include?("-----END CERTIFICATE-----")
+
+        cert = begin
+          OpenSSL::X509::Certificate.new("-----BEGIN CERTIFICATE-----" + block)
+        rescue OpenSSL::OpenSSLError
+          next
+        end
+        { fingerprint: Digest::SHA1.hexdigest(cert.to_der).upcase,
+          subject: cert.subject.to_s,
+          cert: cert }
+      end
+    rescue SystemCallError
+      []
+    end
+
+    # Fingerprints of certificates in a keychain, optionally limited to
+    # one common name.
+    def keychain_fingerprints(keychain, common_name: nil)
+      certs = keychain_certs(keychain)
+      certs = certs.select { |c| c[:subject].include?(common_name) } if common_name
+      certs.map { |c| c[:fingerprint] }
+    end
+
+    def keychains
+      [login_keychain, "/Library/Keychains/System.keychain"]
+    end
+
+    # Remove trusted certificates that carry one of our CA names but are
+    # neither the CA on disk nor the one a live proxy is signing with.
+    #
+    # Regeneration is normal (the CA is rebuilt when it is missing,
+    # expiring, or renamed), and each rebuild produced a new certificate
+    # that was trusted and NEVER removed: one machine accumulated 14
+    # distinct trusted roots, all named "Ask Local CA". Apple's keychain
+    # keeps its own copy, so deleting the state dir does not untrust
+    # anything, and a trusted root whose superseded private key is still
+    # on disk (or in a backup) is a real liability.
+    #
+    # The running proxy's CA is protected by SIGNATURE, not by name:
+    # `server_context` loads the CA once at startup and the SNI callback
+    # mints host certs from that in-memory copy, so a live proxy keeps
+    # using its boot-time CA whatever is on disk. Deleting that
+    # certificate would break TLS for every live route until a restart,
+    # and since superseded CAs share a name with the live one, only a
+    # signature check can tell them apart.
+    def prune_stale(dir = Certs.state_dir, keychains: nil)
+      current = fingerprint_of(Certs.ca_paths(dir)[:cert])
+      return 0 unless current
+
+      names = Certs.ca_common_names
+      leaf = live_proxy_cert
+      (keychains || self.keychains).sum do |keychain|
+        keychain_certs(keychain).count do |entry|
+          next false if entry[:fingerprint] == current
+          next false unless names.any? { |n| entry[:subject].include?(n) }
+          next false if leaf && signed_by?(leaf, entry[:cert])
+
+          Command.capture2("security", "delete-certificate", "-Z", entry[:fingerprint], keychain)
+          true
+        end
+      end
+    rescue SystemCallError
+      0
+    end
+
+    # True when `cert` is the issuer of `leaf` — i.e. that CA signed it.
+    # This is what identifies the live proxy's CA exactly.
+    def signed_by?(leaf, cert)
+      leaf.verify(cert.public_key)
+    rescue StandardError
+      false
+    end
+
+    # A certificate minted by the running proxy, whose issuer is the CA it
+    # is signing with, or nil when no proxy is serving.
+    def live_proxy_cert(store = nil)
+      return nil unless defined?(ProxyControl)
+
+      store ||= RouteStore.new(Certs.state_dir)
+      port = ProxyControl.serving_port(store)
+      return nil unless port
+
+      proxy_peer_cert(port)
+    rescue StandardError
+      nil
+    end
+
+    def proxy_peer_cert(port, host = "yamine-ca-probe.localhost")
+      sock = TCPSocket.new("127.0.0.1", port)
+      ctx = OpenSSL::SSL::SSLContext.new
+      ctx.verify_mode = OpenSSL::SSL::VERIFY_NONE
+      ssl = OpenSSL::SSL::SSLSocket.new(sock, ctx)
+      ssl.hostname = host if ssl.respond_to?(:hostname=)
+      ssl.connect
+      ssl.peer_cert
+    ensure
+      begin
+        ssl&.close
+      rescue StandardError
+        nil
+      end
+      begin
+        sock&.close unless sock.nil? || sock.closed?
+      rescue StandardError
+        nil
+      end
+    end
+
+    # The common name of the CA a running proxy actually signs with,
+    # read from the issuer of a certificate it mints, or nil when no
+    # proxy is serving or the name cannot be determined.
+    def serving_ca_common_name(store = nil)
+      leaf = live_proxy_cert(store)
+      return nil unless leaf
+
+      leaf.issuer.to_s[/CN=([^\/,]+)/, 1]
+    end
+
+    def proxy_peer_cert(port, host = "yamine-ca-probe.localhost")
+      sock = TCPSocket.new("127.0.0.1", port)
+      ctx = OpenSSL::SSL::SSLContext.new
+      ctx.verify_mode = OpenSSL::SSL::VERIFY_NONE
+      ssl = OpenSSL::SSL::SSLSocket.new(sock, ctx)
+      ssl.hostname = host if ssl.respond_to?(:hostname=)
+      ssl.connect
+      ssl.peer_cert
+    ensure
+      begin
+        ssl&.close
+      rescue StandardError
+        nil
+      end
+      begin
+        sock&.close unless sock.nil? || sock.closed?
+      rescue StandardError
+        nil
+      end
+    end
+
     def trust_macos(cert_path)
       if Process.uid.zero?
         # Running elevated (service install / root proxy): add to the
         # System keychain with the admin (-d) domain. Root can modify it
         # silently — no GUI authorization popup, and every user's
         # browsers trust the proxy.
+        keychain = "/Library/Keychains/System.keychain"
+        return if already_trusted?(cert_path, keychain)
+
         _out, status = Command.capture2("security", "add-trusted-cert",
-          "-d", "-r", "trustRoot", "-k", "/Library/Keychains/System.keychain", cert_path)
+          "-d", "-r", "trustRoot", "-k", keychain, cert_path)
         raise CertError, "security add-trusted-cert (system) failed" unless status.success?
       else
         keychain = login_keychain
+        return if already_trusted?(cert_path, keychain)
+
         _out, status = Command.capture2("security", "add-trusted-cert",
           "-r", "trustRoot", "-k", keychain, cert_path)
         raise CertError, "security add-trusted-cert failed" unless status.success?
       end
     end
 
+    # Adding the same certificate twice is not harmless: it is how the
+    # trust store accumulated duplicates across repeated setup runs.
+    def already_trusted?(cert_path, keychain)
+      fp = fingerprint_of(cert_path)
+      return false unless fp
+
+      keychain_fingerprints(keychain, common_name: nil).include?(fp)
+    end
+
     def login_keychain
       out, status = Command.capture2("security", "default-keychain")
       if status.success? && (m = out.match(/"(.+)"/))
@@ -92,18 +272,21 @@ module Yamine
       return { removed: true } unless Certs.trusted?(dir)
 
       paths = Certs.ca_paths(dir)
+      fp = fingerprint_of(paths[:cert])
       errors = []
       case platform
       when :macos
         Command.capture2("security", "remove-trusted-cert", paths[:cert])
-        # delete-certificate fails silently when no match remains; loop
-        # to clear duplicate CN entries from each keychain.
-        [login_keychain, "/Library/Keychains/System.keychain"].each do |kc|
-          5.times do
-            Command.capture2("security", "delete-certificate", "-c", Certs::CA_COMMON_NAME, kc)
-          end
-        rescue SystemCallError
-          nil
+        # Delete by FINGERPRINT, never by common name. Every yamine CA is
+        # named "Ask Local CA", so `delete-certificate -c` removes an
+        # arbitrary one of them — possibly the CURRENT CA, or one a
+        # sibling checkout still serves — and leaves the target behind.
+        # The old by-name loop here deleted up to five certificates per
+        # keychain for that reason.
+        keychains.each do |kc|
+          next unless fp && keychain_fingerprints(kc).include?(fp)
+
+          Command.capture2("security", "delete-certificate", "-Z", fp, kc)
         end
       when :linux
         dest_dir, update_cmd = linux_ca_config

data/lib/yamine/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Yamine
-  VERSION = "0.9.2"
+  VERSION = "0.10.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: yamine
 version: !ruby/object:Gem::Version
-  version: 0.9.2
+  version: 0.10.0
 platform: ruby
 authors:
 - Kaka Ruto