yamine 0.9.2 → 0.9.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 10912afade2197809c63bc0d6382d754eaa236f5996462a242554775f9e48c1e
-  data.tar.gz: f2100f695bc378b3bf95ad2089907e614eea6deea10cc4f3029a98397439eea0
+  metadata.gz: 02f91bf18a0ae8ed2817f8ab3cb85ee9ff71de3f2e43117dacf77d593c6e348b
+  data.tar.gz: 434f9c5cf274c8da2199e91b9c0596e887b6fcc0a6bac9cd7130cbf6ad146ee8
 SHA512:
-  metadata.gz: abfaa410dd665fb70e0d280b0ba0142607a095fc94ea3c88c5ea213cf32dec415fd0fec6723770a3a346a2b5ce4042d0b23a78d7796bb50e280f11fad7dedb13
-  data.tar.gz: ffef03352feb6c30328769b6e6e5c87705458b711cb0b5cc7a7c0b0b6b9061c06ece931766cbd4c2ec9cf09e397f2fdacaf2ee6fcb87c6e707e9163026457926
+  metadata.gz: 9cb727ca21c6461c15ece8c74cfb25f10b18dd9b48e052567803975fb15de152f7ea88bcd149de781004fc0e0601dd3a6c5ee2048f148b72c475d00c4b950f23
+  data.tar.gz: 1f93e9e52fdbcf8087a3d72464ce5de9669db3c720f9ac5bb823f4b85bf71d64651b070c9b118650ab87fbf35e3f2c7d2f456e717f3b81feff435afab53891a0

data/CHANGELOG.md

@@ -1,5 +1,40 @@
 # Changelog
 
+## [0.9.3] — 2026-09-10
+
+### Fixed
+
+- **The trust store accumulated duplicate CAs, and cleanup deleted the
+  wrong one.** `trust_macos` never checked whether the certificate was
+  already trusted, so every `setup`/`trust` run added another copy, and
+  nothing ever removed the certificates left behind when a CA was
+  regenerated (missing, expiring, or renamed). One machine had **14
+  distinct trusted roots**, all named "Ask Local CA". Since a superseded
+  CA's private key stays on disk, a trusted root whose key is still
+  recoverable is a real liability. Trust is now idempotent, and
+  `prune_stale` removes trusted certificates under our CA names that are
+  not the CA currently on disk.
+- Cleanup no longer operates by common name. `untrust` ran
+  `delete-certificate -c "Ask Local CA"` up to five times per keychain,
+  which deletes an ARBITRARY certificate with that name — possibly the
+  current CA, or one a sibling checkout still serves — and can leave the
+  target behind. Everything now identifies certificates by SHA-1
+  fingerprint, and pruning additionally verifies the subject before
+  deleting, so an unrelated trusted root can never be touched.
+- `prune_stale` refuses to run while a proxy is serving: a live proxy
+  holds the CA it booted with in memory, so removing that certificate
+  would break TLS for every live route until a restart.
+
+### Changed
+
+- The CA keeps the legacy "Ask Local CA" name. Renaming it would
+  invalidate every existing CA (`valid_pair?` requires the name) and
+  force a regeneration plus re-trust on every machine — a real migration
+  cost for a cosmetic gain, and the name was never the actual problem.
+  `Certs::CA_COMMON_NAMES` lists every name we have generated so a future
+  rename stays prunable.
+
+
 ## [0.9.2] — 2026-09-10
 
 ### Fixed

data/lib/yamine/certs.rb

@@ -11,13 +11,33 @@ module Yamine
   # through the SNI callback and held in an in-memory LRU
   # (puma-dev ssl.go does the same; portless caches on disk instead).
   module Certs
+    # The name is inherited from the rename (ask-local → yamine) and is
+    # kept deliberately: `valid_pair?` below requires the on-disk CA to
+    # carry this name, so changing it would mark every existing CA
+    # invalid, forcing a regeneration and a re-trust (elevation / GUI
+    # auth) on every machine — a real migration cost for a cosmetic gain.
+    #
+    # The name was ALSO never the actual problem: cleanup used to delete
+    # by common name, which is ambiguous when several CAs share it. That
+    # is fixed by operating on fingerprints (see Trust), so names no
+    # longer decide what gets removed.
+    #
+    # CA_COMMON_NAMES is the list of names we have ever generated. Add to
+    # it on any future rename so old certificates stay prunable —
+    # Trust.prune_stale only ever removes certificates whose subject is
+    # one of these.
     CA_COMMON_NAME = "Ask Local CA"
+    CA_COMMON_NAMES = [CA_COMMON_NAME].freeze
     CA_VALIDITY_DAYS = 3650
     HOST_VALIDITY_DAYS = 825
     CACHE_SIZE = 1024
 
     module_function
 
+    def ca_common_names
+      CA_COMMON_NAMES
+    end
+
     def state_dir
       ENV["YAMINE_STATE_DIR"] || File.join(home, ".yamine")
     end

data/lib/yamine/trust.rb

@@ -18,6 +18,7 @@ module Yamine
 
     def trust(dir = Certs.state_dir)
       paths = Certs.ensure_ca(dir)
+      prune_stale(dir)
       case platform
       when :macos then trust_macos(paths[:cert])
       when :linux then trust_linux(paths[:cert])
@@ -30,23 +31,140 @@ module Yamine
       { trusted: false, error: e.message }
     end
 
+    # The fingerprint `security -Z` prints: uppercase hex, no colons.
+    # Certificates are identified by THIS, never by common name — every
+    # CA yamine has ever generated is called "Ask Local CA", so a
+    # by-name lookup or delete cannot tell the current CA from a stale
+    # one and may remove the wrong certificate.
+    def fingerprint_of(cert_path)
+      require "digest"
+      cert = OpenSSL::X509::Certificate.new(File.read(cert_path))
+      Digest::SHA1.hexdigest(cert.to_der).upcase
+    rescue OpenSSL::OpenSSLError, SystemCallError
+      nil
+    end
+
+    # Fingerprints of certificates already in a keychain, optionally
+    # limited to one common name. Empty when the keychain (or `security`)
+    # is unavailable — callers treat that as "cannot tell".
+    def keychain_fingerprints(keychain, common_name: nil)
+      args = ["security", "find-certificate", "-a", "-Z"]
+      args += ["-c", common_name] if common_name
+      args << keychain
+      out, status = Command.capture2(*args)
+      return [] unless status.success?
+
+      out.scan(/SHA-1 hash:\s*([0-9A-Fa-f]+)/).flatten.map(&:upcase)
+    rescue SystemCallError
+      []
+    end
+
+    def keychains
+      [login_keychain, "/Library/Keychains/System.keychain"]
+    end
+
+    # Remove trusted certificates that carry one of our CA names but are
+    # not the CA currently on disk.
+    #
+    # Regeneration is normal (the CA is rebuilt when it is missing, when
+    # it is expiring, or when its name changes), and each rebuild
+    # produced a new certificate that was trusted and NEVER removed: one
+    # machine accumulated 14 distinct trusted roots, all named
+    # "Ask Local CA". Apple's keychain keeps its own copy, so deleting
+    # the state dir does not untrust anything, and a trusted root whose
+    # superseded private key is still on disk (or in a backup) is a real
+    # liability.
+    #
+    # Never runs while a proxy is serving. A running proxy holds the CA
+    # it booted with in memory, so removing that certificate from the
+    # trust store would break TLS for every live route until a restart —
+    # worse than the cruft. It is deferred to the next trust/setup with
+    # no proxy running, which is also when a superseded CA is genuinely
+    # idle.
+    def prune_stale(dir = Certs.state_dir, keychains: nil, force: false)
+      return 0 if !force && serving_proxy?
+
+      current = fingerprint_of(Certs.ca_paths(dir)[:cert])
+      return 0 unless current
+
+      names = Certs.ca_common_names
+      (keychains || self.keychains).sum do |keychain|
+        keychain_fingerprints(keychain)
+          .select { |fp| fp != current && our_cert?(keychain, fp, names) }
+          .count do |fp|
+            Command.capture2("security", "delete-certificate", "-Z", fp, keychain)
+            true
+          end
+      end
+    rescue SystemCallError
+      0
+    end
+
+    def serving_proxy?
+      return false unless defined?(ProxyControl)
+
+      !ProxyControl.serving_port(RouteStore.new(Certs.state_dir)).nil?
+    rescue StandardError
+      false
+    end
+
+    # Is the certificate with this fingerprint one of ours? Decided by
+    # reading its subject, so pruning only ever removes certificates
+    # under a name we generated — never an unrelated trusted root.
+    #
+    # -a is required: without it `security` returns a single certificate,
+    # so the subject check silently answered "not ours" for every
+    # certificate but one.
+    def our_cert?(keychain, fingerprint, names)
+      out, status = Command.capture2("security", "find-certificate", "-a", "-Z", "-p", keychain)
+      return false unless status.success?
+
+      require "digest"
+      out.split("-----BEGIN CERTIFICATE-----").any? do |block|
+        next false unless block.include?("-----END CERTIFICATE-----")
+
+        cert = begin
+          OpenSSL::X509::Certificate.new("-----BEGIN CERTIFICATE-----" + block)
+        rescue OpenSSL::OpenSSLError
+          next false
+        end
+        next false unless Digest::SHA1.hexdigest(cert.to_der).upcase == fingerprint
+
+        names.any? { |n| cert.subject.to_s.include?(n) }
+      end
+    end
+
     def trust_macos(cert_path)
       if Process.uid.zero?
         # Running elevated (service install / root proxy): add to the
         # System keychain with the admin (-d) domain. Root can modify it
         # silently — no GUI authorization popup, and every user's
         # browsers trust the proxy.
+        keychain = "/Library/Keychains/System.keychain"
+        return if already_trusted?(cert_path, keychain)
+
         _out, status = Command.capture2("security", "add-trusted-cert",
-          "-d", "-r", "trustRoot", "-k", "/Library/Keychains/System.keychain", cert_path)
+          "-d", "-r", "trustRoot", "-k", keychain, cert_path)
         raise CertError, "security add-trusted-cert (system) failed" unless status.success?
       else
         keychain = login_keychain
+        return if already_trusted?(cert_path, keychain)
+
         _out, status = Command.capture2("security", "add-trusted-cert",
           "-r", "trustRoot", "-k", keychain, cert_path)
         raise CertError, "security add-trusted-cert failed" unless status.success?
       end
     end
 
+    # Adding the same certificate twice is not harmless: it is how the
+    # trust store accumulated duplicates across repeated setup runs.
+    def already_trusted?(cert_path, keychain)
+      fp = fingerprint_of(cert_path)
+      return false unless fp
+
+      keychain_fingerprints(keychain, common_name: nil).include?(fp)
+    end
+
     def login_keychain
       out, status = Command.capture2("security", "default-keychain")
       if status.success? && (m = out.match(/"(.+)"/))
@@ -92,18 +210,21 @@ module Yamine
       return { removed: true } unless Certs.trusted?(dir)
 
       paths = Certs.ca_paths(dir)
+      fp = fingerprint_of(paths[:cert])
       errors = []
       case platform
       when :macos
         Command.capture2("security", "remove-trusted-cert", paths[:cert])
-        # delete-certificate fails silently when no match remains; loop
-        # to clear duplicate CN entries from each keychain.
-        [login_keychain, "/Library/Keychains/System.keychain"].each do |kc|
-          5.times do
-            Command.capture2("security", "delete-certificate", "-c", Certs::CA_COMMON_NAME, kc)
-          end
-        rescue SystemCallError
-          nil
+        # Delete by FINGERPRINT, never by common name. Every yamine CA is
+        # named "Ask Local CA", so `delete-certificate -c` removes an
+        # arbitrary one of them — possibly the CURRENT CA, or one a
+        # sibling checkout still serves — and leaves the target behind.
+        # The old by-name loop here deleted up to five certificates per
+        # keychain for that reason.
+        keychains.each do |kc|
+          next unless fp && keychain_fingerprints(kc).include?(fp)
+
+          Command.capture2("security", "delete-certificate", "-Z", fp, kc)
         end
       when :linux
         dest_dir, update_cmd = linux_ca_config

data/lib/yamine/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Yamine
-  VERSION = "0.9.2"
+  VERSION = "0.9.3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: yamine
 version: !ruby/object:Gem::Version
-  version: 0.9.2
+  version: 0.9.3
 platform: ruby
 authors:
 - Kaka Ruto