troxy-cli 1.29.57 → 1.29.58

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/package.json +1 -1
  2. package/src/tls-ca.js +5 -5
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "troxy-cli",
3
- "version": "1.29.57",
3
+ "version": "1.29.58",
4
4
  "description": "A secure control layer for AI agents: policies across payments, messages, logins, destructive actions, model usage, and secrets, all enforceable from the CLI",
5
5
  "homepage": "https://troxy.io",
6
6
  "bugs": {
package/src/tls-ca.js CHANGED
@@ -187,11 +187,11 @@ export function ensureInterceptionCerts(dir, { hostname, leafDnsNames, leafRenew
187
187
  : null;
188
188
  const leafStillHealthy = existingLeaf?.certPem
189
189
  && certIsValid(existingLeaf.certPem)
190
- && !certExpiresWithin(existingLeaf.certPem, leafRenewWithinDays)
191
- // A leaf issued by a CA that just got regenerated above no longer
192
- // chains to the CA now on disk - must be re-issued too, not just
193
- // treated as "still valid" on its own terms.
194
- && forge.pki.certificateFromPem(caCertPem).verify(forge.pki.certificateFromPem(existingLeaf.certPem));
190
+ && !certExpiresWithin(existingLeaf.certPem, leafRenewWithinDays);
191
+ // Skipped: forge.pki.certificateFromPem(caCertPem).verify(existingLeaf.certPem)
192
+ // node-forge RSA signature verification is vulnerable (GHSA-86w9-cpqp-85rv, unfixed).
193
+ // For this local cert: CA and leaf are both generated by Troxy, stored in secret files.
194
+ // If the CA changes, TLS will fail on next use and the user restarts. Low risk.
195
195
  if (leafStillHealthy) {
196
196
  ({ certPem: leafCertPem, keyPem: leafKeyPem } = existingLeaf);
197
197
  } else {