yamine 0.9.3 → 0.10.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 02f91bf18a0ae8ed2817f8ab3cb85ee9ff71de3f2e43117dacf77d593c6e348b
-  data.tar.gz: 434f9c5cf274c8da2199e91b9c0596e887b6fcc0a6bac9cd7130cbf6ad146ee8
+  metadata.gz: 73e497200efd0723559dff2f57e920e3d126d3caecf302770c37bec613d7998e
+  data.tar.gz: 2203cabc149df919703fb1182fb9ad76e9c6729d4ed105455c749dbfa7611593
 SHA512:
-  metadata.gz: 9cb727ca21c6461c15ece8c74cfb25f10b18dd9b48e052567803975fb15de152f7ea88bcd149de781004fc0e0601dd3a6c5ee2048f148b72c475d00c4b950f23
-  data.tar.gz: 1f93e9e52fdbcf8087a3d72464ce5de9669db3c720f9ac5bb823f4b85bf71d64651b070c9b118650ab87fbf35e3f2c7d2f456e717f3b81feff435afab53891a0
+  metadata.gz: d30e26aec61c7036e349a84f6f241291756c7ee3207f6e1de210cb47465ccc94279619cc9657d3ecbc477b8983be8027ae2303d43456b4891762f79dec7bd885
+  data.tar.gz: 1a6a7e1b4e402b822a3d6f70ed6b19881c8927563c131875b322a7b750c9ec9368ba8a7f45ff99badfe55d23c54a964f163a80b8d10d6c45aa6a5a3ae5d9abc9

data/CHANGELOG.md

@@ -1,5 +1,50 @@
 # Changelog
 
+## [0.10.1] — 2026-09-10
+
+### Fixed
+
+- **The CA is regenerated before trust is judged, not after.** Both
+  trust paths asked `Certs.trusted?` first, which compares the trust
+  marker against the certificate ON DISK. A proxy regenerates the CA at
+  boot when the on-disk one is missing, expiring, or renamed — so after
+  a rename the marker still matched the OLD certificate, trust was
+  skipped as "already done", and the proxy then came up serving a CA the
+  keychain did not trust: TLS verification fails for every route. The
+  check now brings the CA up to date first (`ca_current_and_trusted?`,
+  used by both paths).
+
+
+## [0.10.0] — 2026-09-10
+
+The ask-local rename is finished: the two user-visible names it left
+behind are now yamine's own, and both migrate existing machines.
+
+### Changed
+
+- **The CA is named "Yamine CA"** (was "Ask Local CA", inherited from
+  the rename). The old name stays in `Certs::LEGACY_CA_COMMON_NAMES`, so
+  a machine carrying a pre-rename CA can still shed it. Because
+  `valid_pair?` requires the on-disk CA to carry the current name, the
+  first run after upgrading generates a new CA and re-trusts it — once,
+  automatically, as part of the normal trust path.
+- **The launchd service is `dev.yamine`** (was `dev.ask.local`). The old
+  plist is booted out and deleted during install and uninstall: a label
+  is how launchctl addresses a service, so leaving the old one loaded
+  would put two root proxies in a race for port 443, the loser
+  crash-looping under `KeepAlive`.
+
+### Fixed
+
+- `prune_stale` protects the CA a running proxy signs with, identified
+  by signature rather than by skipping the prune entirely. A proxy loads
+  its CA once at startup and mints host certs from that in-memory copy,
+  so it keeps signing with its boot-time CA whatever is on disk —
+  removing that certificate would break TLS for every live route until a
+  restart. Since superseded CAs share a name with the live one, only a
+  signature check can tell them apart.
+
+
 ## [0.9.3] — 2026-09-10
 
 ### Fixed

data/lib/yamine/certs.rb

@@ -11,23 +11,15 @@ module Yamine
   # through the SNI callback and held in an in-memory LRU
   # (puma-dev ssl.go does the same; portless caches on disk instead).
   module Certs
-    # The name is inherited from the rename (ask-local → yamine) and is
-    # kept deliberately: `valid_pair?` below requires the on-disk CA to
-    # carry this name, so changing it would mark every existing CA
-    # invalid, forcing a regeneration and a re-trust (elevation / GUI
-    # auth) on every machine — a real migration cost for a cosmetic gain.
-    #
-    # The name was ALSO never the actual problem: cleanup used to delete
-    # by common name, which is ambiguous when several CAs share it. That
-    # is fixed by operating on fingerprints (see Trust), so names no
-    # longer decide what gets removed.
-    #
-    # CA_COMMON_NAMES is the list of names we have ever generated. Add to
-    # it on any future rename so old certificates stay prunable —
-    # Trust.prune_stale only ever removes certificates whose subject is
-    # one of these.
-    CA_COMMON_NAME = "Ask Local CA"
-    CA_COMMON_NAMES = [CA_COMMON_NAME].freeze
+    # The CA's name is user-visible in the trust store and is what a
+    # cleanup keys off, so it belongs to this gem alone. It was inherited
+    # from the ask-local rename and had said "Ask Local CA" ever since.
+    CA_COMMON_NAME = "Yamine CA"
+    # Every name we have ever generated a CA under. Stale certificates
+    # under these are prunable (Trust.prune_stale); anything else in the
+    # trust store is none of our business. The pre-rename name stays here
+    # so machines that trusted an ask-local CA can still shed it.
+    LEGACY_CA_COMMON_NAMES = ["Ask Local CA"].freeze
     CA_VALIDITY_DAYS = 3650
     HOST_VALIDITY_DAYS = 825
     CACHE_SIZE = 1024
@@ -35,7 +27,7 @@ module Yamine
     module_function
 
     def ca_common_names
-      CA_COMMON_NAMES
+      [CA_COMMON_NAME, *LEGACY_CA_COMMON_NAMES].uniq
     end
 
     def state_dir

data/lib/yamine/cli/system.rb

@@ -4,6 +4,13 @@ module Yamine
   class CLI
     # System commands: proxy, service, hosts, trust, clean, doctor, kamal.
     module SystemCommand
+      # The launchd label: the service's identity, and what `launchctl
+      # enable/kickstart/bootout` address it by. Renamed from "dev.ask.local"
+      # (an ask-local leftover); the old label is cleared on install so the
+      # two never coexist and fight over port 443.
+      LAUNCHD_LABEL = "dev.yamine"
+      LEGACY_LAUNCHD_LABELS = %w[dev.ask.local].freeze
+
       module_function
 
       def doctor(ctx, args)
@@ -291,7 +298,7 @@ module Yamine
           <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
           <plist version="1.0">
           <dict>
-            <key>Label</key><string>dev.ask.local</string>
+            <key>Label</key><string>#{LAUNCHD_LABEL}</string>
             <key>ProgramArguments</key>
             <array>
               <string>#{RbConfig.ruby}</string>
@@ -309,7 +316,8 @@ module Yamine
           </dict>
           </plist>
         PLIST
-        path = File.join(dir, "dev.ask.local.plist")
+        remove_legacy_launchd(dir)
+        path = File.join(dir, "#{LAUNCHD_LABEL}.plist")
         File.write(path, plist)
         File.chmod(0o644, path)
         # launchd requires /Library/LaunchDaemons plists to be
@@ -326,13 +334,29 @@ module Yamine
         puts "Installed root LaunchDaemon on port 443 (state: #{state_dir})."
       end
 
+      # True when the trust store covers the CA this machine should be
+      # serving with — regenerating the CA first if it is missing,
+      # expiring, or renamed.
+      #
+      # The ordering is the whole point, so it lives in one place rather
+      # than at each call site. `trusted?` compares a marker against the
+      # fingerprint of the certificate ON DISK, and a proxy regenerates
+      # the CA at boot when the name changes. Checking the marker before
+      # the CA is current therefore reads a stale match, skips trust, and
+      # lets the proxy come up serving a CA the keychain does not trust —
+      # breaking TLS for every route.
+      def ca_current_and_trusted?(dir = Certs.state_dir)
+        Certs.ensure_ca(dir)
+        Certs.trusted?(dir)
+      end
+
       # Root-only CA trust: the System keychain (all users, no prompt).
       # Safe to call repeatedly — once the marker is set it is a no-op.
       # Prints before doing work: the System keychain add can take a few
       # seconds, and this runs in the root half of setup where silence
       # reads as a hang.
       def ensure_system_ca_trust
-        return if Certs.trusted?(Certs.state_dir)
+        return if ca_current_and_trusted?(Certs.state_dir)
 
         puts "    Trusting the CA into the System keychain..."
         result = Trust.trust
@@ -354,14 +378,34 @@ module Yamine
         unless Command.run("launchctl", "bootstrap", "system", path)
           raise Error, "launchctl bootstrap failed — check the plist at #{path}"
         end
-        Command.run("launchctl", "enable", "system/dev.ask.local")
-        Command.run("launchctl", "kickstart", "-k", "system/dev.ask.local")
+        Command.run("launchctl", "enable", "system/#{LAUNCHD_LABEL}")
+        Command.run("launchctl", "kickstart", "-k", "system/#{LAUNCHD_LABEL}")
       end
 
       def launchctl_bootout(path)
         Command.run("launchctl", "bootout", "system", path)
       end
 
+      # The launchd label, and the pre-rename one that must be cleared.
+      # A label is the service's identity: installing the new one while
+      # the old plist is still loaded would leave TWO root proxies
+      # fighting over port 443 (whichever booted last wins, and the loser
+      # crash-loops under KeepAlive).
+      #
+      # Boot out and delete any plist from a previous label. Idempotent:
+      # bootout on a service that was never loaded prints an error and
+      # exits non-zero, which is expected and quiet.
+      def remove_legacy_launchd(dir = "/Library/LaunchDaemons")
+        LEGACY_LAUNCHD_LABELS.each do |label|
+          path = File.join(dir, "#{label}.plist")
+          next unless File.file?(path)
+
+          Command.run("launchctl", "bootout", "system", path, out: File::NULL, err: File::NULL)
+          FileUtils.rm_f(path)
+          puts "    Removed legacy launchd service #{label}."
+        end
+      end
+
       # Pure unit-file builder (testable without root). Binds 80/443 at
       # boot; the proxy runs with the invoking user's state dir.
       def systemd_unit
@@ -406,9 +450,12 @@ module Yamine
         end
         case RUBY_PLATFORM
         when /darwin/
-          path = "/Library/LaunchDaemons/dev.ask.local.plist"
-          launchctl_bootout(path)
+          path = "/Library/LaunchDaemons/#{LAUNCHD_LABEL}.plist"
+          launchctl_bootout(path) if File.file?(path)
           FileUtils.rm_f(path)
+          # Also clear any pre-rename service, so uninstall leaves no root
+          # proxy behind on a machine upgraded from an older yamine.
+          remove_legacy_launchd
           puts "Removed root LaunchDaemon."
         when /linux/
           Command.run("systemctl", "disable", "--now", "yamine")
@@ -729,7 +776,7 @@ module Yamine
       # those users had already chosen to avoid.
       def ensure_workstation!(ctx)
         # 1. CA
-        unless Yamine::Certs.trusted?(ctx.store.dir)
+        unless ca_current_and_trusted?(ctx.store.dir)
           result = Yamine::Trust.trust
           unless result[:trusted]
             abort_setup("CA trust failed: #{result[:error]}",

data/lib/yamine/trust.rb

@@ -32,8 +32,8 @@ module Yamine
     end
 
     # The fingerprint `security -Z` prints: uppercase hex, no colons.
-    # Certificates are identified by THIS, never by common name — every
-    # CA yamine has ever generated is called "Ask Local CA", so a
+    # Certificates are identified by THIS, never by common name: every CA
+    # this project has generated shares a name with the others, so a
     # by-name lookup or delete cannot tell the current CA from a stale
     # one and may remove the wrong certificate.
     def fingerprint_of(cert_path)
@@ -44,93 +44,155 @@ module Yamine
       nil
     end
 
-    # Fingerprints of certificates already in a keychain, optionally
-    # limited to one common name. Empty when the keychain (or `security`)
-    # is unavailable — callers treat that as "cannot tell".
-    def keychain_fingerprints(keychain, common_name: nil)
-      args = ["security", "find-certificate", "-a", "-Z"]
-      args += ["-c", common_name] if common_name
-      args << keychain
-      out, status = Command.capture2(*args)
+    # Certificates in a keychain as { fingerprint:, subject:, cert: }.
+    # Parsed in ONE call; empty when the keychain (or `security`) is
+    # unavailable, which callers treat as "cannot tell".
+    #
+    # -a is required: without it `security find-certificate` returns a
+    # single certificate, so any scan silently sees one entry and every
+    # comparison against it is wrong.
+    def keychain_certs(keychain)
+      out, status = Command.capture2("security", "find-certificate", "-a", "-Z", "-p", keychain)
       return [] unless status.success?
 
-      out.scan(/SHA-1 hash:\s*([0-9A-Fa-f]+)/).flatten.map(&:upcase)
+      require "digest"
+      out.split("-----BEGIN CERTIFICATE-----").filter_map do |block|
+        next unless block.include?("-----END CERTIFICATE-----")
+
+        cert = begin
+          OpenSSL::X509::Certificate.new("-----BEGIN CERTIFICATE-----" + block)
+        rescue OpenSSL::OpenSSLError
+          next
+        end
+        { fingerprint: Digest::SHA1.hexdigest(cert.to_der).upcase,
+          subject: cert.subject.to_s,
+          cert: cert }
+      end
     rescue SystemCallError
       []
     end
 
+    # Fingerprints of certificates in a keychain, optionally limited to
+    # one common name.
+    def keychain_fingerprints(keychain, common_name: nil)
+      certs = keychain_certs(keychain)
+      certs = certs.select { |c| c[:subject].include?(common_name) } if common_name
+      certs.map { |c| c[:fingerprint] }
+    end
+
     def keychains
       [login_keychain, "/Library/Keychains/System.keychain"]
     end
 
     # Remove trusted certificates that carry one of our CA names but are
-    # not the CA currently on disk.
+    # neither the CA on disk nor the one a live proxy is signing with.
     #
-    # Regeneration is normal (the CA is rebuilt when it is missing, when
-    # it is expiring, or when its name changes), and each rebuild
-    # produced a new certificate that was trusted and NEVER removed: one
-    # machine accumulated 14 distinct trusted roots, all named
-    # "Ask Local CA". Apple's keychain keeps its own copy, so deleting
-    # the state dir does not untrust anything, and a trusted root whose
-    # superseded private key is still on disk (or in a backup) is a real
-    # liability.
+    # Regeneration is normal (the CA is rebuilt when it is missing,
+    # expiring, or renamed), and each rebuild produced a new certificate
+    # that was trusted and NEVER removed: one machine accumulated 14
+    # distinct trusted roots, all named "Ask Local CA". Apple's keychain
+    # keeps its own copy, so deleting the state dir does not untrust
+    # anything, and a trusted root whose superseded private key is still
+    # on disk (or in a backup) is a real liability.
     #
-    # Never runs while a proxy is serving. A running proxy holds the CA
-    # it booted with in memory, so removing that certificate from the
-    # trust store would break TLS for every live route until a restart —
-    # worse than the cruft. It is deferred to the next trust/setup with
-    # no proxy running, which is also when a superseded CA is genuinely
-    # idle.
-    def prune_stale(dir = Certs.state_dir, keychains: nil, force: false)
-      return 0 if !force && serving_proxy?
-
+    # The running proxy's CA is protected by SIGNATURE, not by name:
+    # `server_context` loads the CA once at startup and the SNI callback
+    # mints host certs from that in-memory copy, so a live proxy keeps
+    # using its boot-time CA whatever is on disk. Deleting that
+    # certificate would break TLS for every live route until a restart,
+    # and since superseded CAs share a name with the live one, only a
+    # signature check can tell them apart.
+    def prune_stale(dir = Certs.state_dir, keychains: nil)
       current = fingerprint_of(Certs.ca_paths(dir)[:cert])
       return 0 unless current
 
       names = Certs.ca_common_names
+      leaf = live_proxy_cert
       (keychains || self.keychains).sum do |keychain|
-        keychain_fingerprints(keychain)
-          .select { |fp| fp != current && our_cert?(keychain, fp, names) }
-          .count do |fp|
-            Command.capture2("security", "delete-certificate", "-Z", fp, keychain)
-            true
-          end
+        keychain_certs(keychain).count do |entry|
+          next false if entry[:fingerprint] == current
+          next false unless names.any? { |n| entry[:subject].include?(n) }
+          next false if leaf && signed_by?(leaf, entry[:cert])
+
+          Command.capture2("security", "delete-certificate", "-Z", entry[:fingerprint], keychain)
+          true
+        end
       end
     rescue SystemCallError
       0
     end
 
-    def serving_proxy?
-      return false unless defined?(ProxyControl)
-
-      !ProxyControl.serving_port(RouteStore.new(Certs.state_dir)).nil?
+    # True when `cert` is the issuer of `leaf` — i.e. that CA signed it.
+    # This is what identifies the live proxy's CA exactly.
+    def signed_by?(leaf, cert)
+      leaf.verify(cert.public_key)
     rescue StandardError
       false
     end
 
-    # Is the certificate with this fingerprint one of ours? Decided by
-    # reading its subject, so pruning only ever removes certificates
-    # under a name we generated — never an unrelated trusted root.
-    #
-    # -a is required: without it `security` returns a single certificate,
-    # so the subject check silently answered "not ours" for every
-    # certificate but one.
-    def our_cert?(keychain, fingerprint, names)
-      out, status = Command.capture2("security", "find-certificate", "-a", "-Z", "-p", keychain)
-      return false unless status.success?
+    # A certificate minted by the running proxy, whose issuer is the CA it
+    # is signing with, or nil when no proxy is serving.
+    def live_proxy_cert(store = nil)
+      return nil unless defined?(ProxyControl)
 
-      require "digest"
-      out.split("-----BEGIN CERTIFICATE-----").any? do |block|
-        next false unless block.include?("-----END CERTIFICATE-----")
+      store ||= RouteStore.new(Certs.state_dir)
+      port = ProxyControl.serving_port(store)
+      return nil unless port
 
-        cert = begin
-          OpenSSL::X509::Certificate.new("-----BEGIN CERTIFICATE-----" + block)
-        rescue OpenSSL::OpenSSLError
-          next false
-        end
-        next false unless Digest::SHA1.hexdigest(cert.to_der).upcase == fingerprint
+      proxy_peer_cert(port)
+    rescue StandardError
+      nil
+    end
 
-        names.any? { |n| cert.subject.to_s.include?(n) }
+    def proxy_peer_cert(port, host = "yamine-ca-probe.localhost")
+      sock = TCPSocket.new("127.0.0.1", port)
+      ctx = OpenSSL::SSL::SSLContext.new
+      ctx.verify_mode = OpenSSL::SSL::VERIFY_NONE
+      ssl = OpenSSL::SSL::SSLSocket.new(sock, ctx)
+      ssl.hostname = host if ssl.respond_to?(:hostname=)
+      ssl.connect
+      ssl.peer_cert
+    ensure
+      begin
+        ssl&.close
+      rescue StandardError
+        nil
+      end
+      begin
+        sock&.close unless sock.nil? || sock.closed?
+      rescue StandardError
+        nil
+      end
+    end
+
+    # The common name of the CA a running proxy actually signs with,
+    # read from the issuer of a certificate it mints, or nil when no
+    # proxy is serving or the name cannot be determined.
+    def serving_ca_common_name(store = nil)
+      leaf = live_proxy_cert(store)
+      return nil unless leaf
+
+      leaf.issuer.to_s[/CN=([^\/,]+)/, 1]
+    end
+
+    def proxy_peer_cert(port, host = "yamine-ca-probe.localhost")
+      sock = TCPSocket.new("127.0.0.1", port)
+      ctx = OpenSSL::SSL::SSLContext.new
+      ctx.verify_mode = OpenSSL::SSL::VERIFY_NONE
+      ssl = OpenSSL::SSL::SSLSocket.new(sock, ctx)
+      ssl.hostname = host if ssl.respond_to?(:hostname=)
+      ssl.connect
+      ssl.peer_cert
+    ensure
+      begin
+        ssl&.close
+      rescue StandardError
+        nil
+      end
+      begin
+        sock&.close unless sock.nil? || sock.closed?
+      rescue StandardError
+        nil
       end
     end
 

data/lib/yamine/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Yamine
-  VERSION = "0.9.3"
+  VERSION = "0.10.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: yamine
 version: !ruby/object:Gem::Version
-  version: 0.9.3
+  version: 0.10.1
 platform: ruby
 authors:
 - Kaka Ruto