systemlink-cli 2.2.2__py3-none-any.whl → 2.3.0__py3-none-any.whl

slcli/_version.py

@@ -1,4 +1,4 @@
 """Version information for slcli."""
 
 # This file is auto-generated. Do not edit manually.
-__version__ = "2.2.2"
+__version__ = "2.3.0"

slcli/config_click.py

@@ -6,6 +6,7 @@ import os
 import re
 import ssl
 import sys
+from pathlib import Path
 from typing import Any, NoReturn, Optional
 from urllib.parse import urlparse
 
@@ -26,14 +27,16 @@ from .platform import (
 from .profiles import Profile, ProfileConfig, check_config_file_permissions
 from .rich_output import render_table
 from .ssl_trust import (
+    get_managed_trust_path,
     get_managed_trust_records,
     get_ssl_server_origin,
     inspect_server_certificate,
+    load_ca_certificate,
     remove_managed_trust,
     save_managed_certificate,
 )
 from .table_utils import output_formatted_list
-from .utils import ExitCodes, get_base_url, get_base_url_resolution
+from .utils import ExitCodes, get_base_url_resolution
 
 API_KEY_LENGTH = 42
 API_KEY_PATTERN = re.compile(rf"^[A-Za-z0-9_-]{{{API_KEY_LENGTH}}}$")
@@ -765,12 +768,31 @@ def register_config_commands(cli: Any) -> None:
             )
 
         certificate_details = certificate.to_dict()
+        trusted_certificate = None
+        try:
+            trusted_path = get_managed_trust_path(certificate.origin)
+            if trusted_path is not None:
+                trusted_certificate = json.loads(
+                    trusted_path.with_suffix(".json").read_text(encoding="utf-8")
+                )
+                trusted_certificate["origin"] = certificate.origin
+                trusted_certificate.setdefault("trust-type", "leaf")
+        except (OSError, ValueError) as exc:
+            click.echo(f"Could not read managed certificate metadata: {exc}.", err=True)
+            trusted_certificate = None
         if output_format == "json":
+            certificate_details["trusted-certificate"] = trusted_certificate
             click.echo(json.dumps(certificate_details, indent=2))
             return
 
         click.echo(f"Server certificate for {certificate_details.get('origin', 'unknown')}")
         _show_certificate_details(certificate_details)
+        if trusted_certificate:
+            kind = "CA" if trusted_certificate.get("trust-type") == "ca" else "leaf"
+            click.echo(f"\nTrusted {kind} certificate for this origin")
+            _show_certificate_details(trusted_certificate)
+        else:
+            click.echo("\nNo managed trust certificate for this origin.")
 
     @trust.command(name="list")
     @click.option(
@@ -794,13 +816,14 @@ def register_config_commands(cli: Any) -> None:
             [
                 str(record.get("origin", "")),
                 str(record.get("fingerprint", "")),
+                "CA" if record.get("trust-type") == "ca" else "leaf",
                 "yes" if record.get("self-signed") else "no",
             ]
             for record in records
         ]
         render_table(
-            headers=["SERVER", "SHA-256", "SELF-SIGNED"],
-            column_widths=[40, 64, 12],
+            headers=["SERVER", "SHA-256", "TRUST TYPE", "SELF-SIGNED"],
+            column_widths=[40, 64, 10, 12],
             rows=rows,
             show_total=True,
             total_label="certificate(s)",
@@ -808,30 +831,47 @@ def register_config_commands(cli: Any) -> None:
 
     @trust.command(name="add")
     @click.option("--url", help="HTTPS server URL (defaults to the active API URL)")
+    @click.option(
+        "--certificate",
+        type=click.Path(exists=True, dir_okay=False, path_type=Path),
+        help="Import one public CA certificate (PEM or DER), scoped to this server origin",
+    )
     @click.option(
         "--fingerprint",
         required=True,
         help="Expected SHA-256 fingerprint of the certificate to trust",
     )
-    def add_trusted_certificate(url: Optional[str], fingerprint: str) -> None:
-        """Trust a server certificate after verifying its fingerprint."""
-        server_url = url or get_base_url()
+    def add_trusted_certificate(
+        url: Optional[str], certificate: Optional[Path], fingerprint: str
+    ) -> None:
+        """Trust a live server certificate or imported CA after fingerprint verification."""
+        server_url = url or get_base_url_resolution().value
         try:
             expected_fingerprint = _normalize_fingerprint(fingerprint)
-            certificate = inspect_server_certificate(server_url)
+            trusted_certificate = (
+                load_ca_certificate(server_url, certificate)
+                if certificate is not None
+                else inspect_server_certificate(server_url)
+            )
         except (OSError, ValueError, ssl.SSLError) as exc:
-            _exit_with_validation_error(f"Could not inspect the server certificate: {exc}.")
+            _exit_with_validation_error(f"Could not load the certificate: {exc}.")
 
-        _show_certificate_warning(certificate.to_dict())
-        if certificate.fingerprint != expected_fingerprint:
+        _show_certificate_details(trusted_certificate.to_dict(), err=True)
+        if trusted_certificate.fingerprint != expected_fingerprint:
             _exit_with_validation_error(
-                "The server certificate fingerprint does not match the supplied fingerprint."
+                "The certificate fingerprint does not match the supplied fingerprint."
+            )
+        if trusted_certificate.trust_type == "ca":
+            click.echo(
+                "Trusting certificates issued by this CA for this origin only; "
+                "hostname and validity verification remain enabled.",
+                err=True,
             )
         try:
-            path = save_managed_certificate(certificate)
+            path = save_managed_certificate(trusted_certificate)
         except OSError as exc:
             _exit_with_validation_error(f"Could not save the trusted certificate: {exc}.")
-        click.echo(f"✓ Trusted certificate for {certificate.origin}")
+        click.echo(f"✓ Trusted certificate for {trusted_certificate.origin}")
         click.echo(f"  Certificate file: {path}")
 
     @trust.command(name="remove")
@@ -839,7 +879,7 @@ def register_config_commands(cli: Any) -> None:
     @click.option("--force", is_flag=True, help="Skip confirmation prompt")
     def remove_trusted_certificate(url: Optional[str], force: bool) -> None:
         """Remove a server certificate from the managed trust store."""
-        server_url = url or get_base_url()
+        server_url = url or get_base_url_resolution().value
         try:
             origin = get_ssl_server_origin(server_url)
         except ValueError as exc:

slcli/main.py

@@ -35,7 +35,7 @@ from .rich_output import install_rich_output, render_table
 from .routine_click import register_routine_commands
 from .skill_click import register_skill_commands
 from .spec_click import register_spec_commands
-from .ssl_trust import OS_TRUST_INJECTED, OS_TRUST_REASON
+from .ssl_trust import OS_TRUST_INJECTED, OS_TRUST_REASON, create_explicit_tls_context
 from .state_click import register_state_commands
 from .system_click import register_system_commands
 from .tag_click import register_tag_commands
@@ -143,11 +143,11 @@ def _build_tls_debug_context(ssl_verify: Union[bool, str]) -> ssl.SSLContext:
         return ctx
 
     if isinstance(ssl_verify, str):
-        return ssl.create_default_context(cafile=ssl_verify)
+        return create_explicit_tls_context(ssl_verify)
 
     verify_env = os.environ.get("REQUESTS_CA_BUNDLE") or os.environ.get("SSL_CERT_FILE")
     if verify_env:
-        return ssl.create_default_context(cafile=verify_env)
+        return create_explicit_tls_context(verify_env)
 
     if OS_TRUST_INJECTED:
         try:

slcli/ssl_trust.py

@@ -21,16 +21,21 @@ import sys
 import traceback
 from contextlib import contextmanager
 from dataclasses import dataclass
+from datetime import datetime, timezone
 from pathlib import Path
+from threading import RLock
 from typing import Any, Dict, Iterator, List, Optional, Union
 from urllib.parse import urlparse
 
+import idna
 from cryptography import x509
+from cryptography.exceptions import InvalidSignature, UnsupportedAlgorithm
 from cryptography.hazmat.primitives import hashes, serialization
 
 OS_TRUST_INJECTED: bool = False
 OS_TRUST_REASON: str = "not-attempted"
 _STANDARD_SSL_CONTEXT = ssl.SSLContext
+_SSL_CONTEXT_LOCK = RLock()
 
 
 @dataclass(frozen=True)
@@ -46,6 +51,7 @@ class ServerCertificate:
     not_before: str
     not_after: str
     self_signed: bool
+    trust_type: str = "leaf"
 
     def to_dict(self) -> Dict[str, Any]:
         """Return certificate metadata without including the PEM bytes."""
@@ -58,6 +64,7 @@ class ServerCertificate:
             "not-before": self.not_before,
             "not-after": self.not_after,
             "self-signed": self.self_signed,
+            "trust-type": self.trust_type,
         }
 
 
@@ -65,10 +72,12 @@ __all__ = [
     "OS_TRUST_INJECTED",
     "OS_TRUST_REASON",
     "ServerCertificate",
+    "create_explicit_tls_context",
     "get_managed_trust_path",
     "get_managed_trust_records",
     "get_ssl_server_origin",
     "inspect_server_certificate",
+    "load_ca_certificate",
     "inject_os_trust",
     "remove_managed_trust",
     "save_managed_certificate",
@@ -83,6 +92,11 @@ def get_ssl_server_origin(api_url: str) -> str:
         raise ValueError("Managed certificate trust requires an HTTPS server URL.")
 
     hostname = parsed.hostname.lower()
+    try:
+        if not hostname.isascii():
+            hostname = idna.encode(hostname, uts46=True).decode("ascii")
+    except idna.IDNAError as error:
+        raise ValueError("Managed certificate trust requires a valid server hostname.") from error
     if ":" in hostname and not hostname.startswith("["):
         hostname = f"[{hostname}]"
     port = parsed.port or 443
@@ -96,11 +110,41 @@ def use_standard_ssl_context(ssl_verify: Union[bool, str]) -> Iterator[None]:
     The OS trust integration replaces SSL context implementations globally. For
     explicit CA bundle paths, requests must use the standard implementation so
     the supplied bundle is evaluated instead of the platform trust verifier.
+    For validated managed bundles, partial-chain verification permits the
+    fingerprint-matched leaf or imported CA to act as the trust anchor without
+    bypassing hostname or validity checks. Other bundles retain native defaults.
+    Managed bundles reject cross-origin redirects. Explicit contexts are serialized
+    so their process-global patches are restored in the correct order.
     """
     if not isinstance(ssl_verify, str):
         yield
         return
 
+    with _SSL_CONTEXT_LOCK:
+        with _use_standard_ssl_context(ssl_verify):
+            yield
+
+
+def create_explicit_tls_context(cafile: str) -> ssl.SSLContext:
+    """Build a verified TLS client context using an explicit certificate bundle.
+
+    Args:
+        cafile: Path to a managed certificate or an ordinary CA bundle.
+
+    Returns:
+        A standard TLS context with partial-chain trust enabled for validated
+        managed certificates and native verification defaults for other bundles.
+    """
+    with use_standard_ssl_context(cafile):
+        context = ssl.create_default_context(cafile=cafile)
+        if _get_managed_origin(cafile) is not None:
+            context.verify_flags |= ssl.VERIFY_X509_PARTIAL_CHAIN
+        return context
+
+
+@contextmanager
+def _use_standard_ssl_context(ssl_verify: str) -> Iterator[None]:
+    """Apply process-global explicit trust patches while holding the context lock."""
     import requests.adapters
     import urllib3.util.ssl_ as urllib3_ssl
 
@@ -108,33 +152,62 @@ def use_standard_ssl_context(ssl_verify: Union[bool, str]) -> Iterator[None]:
     patched_urllib3_context = urllib3_ssl.SSLContext
     has_preloaded_context = hasattr(requests.adapters, "_preloaded_ssl_context")
     patched_preloaded_context = getattr(requests.adapters, "_preloaded_ssl_context", None)
+    original_send = requests.sessions.Session.send
+    managed_origin = _get_managed_origin(ssl_verify)
+
+    def send(
+        session: requests.Session, request: requests.PreparedRequest, **kwargs: Any
+    ) -> requests.Response:
+        if managed_origin and kwargs.get("verify") == ssl_verify:
+            try:
+                request_origin = get_ssl_server_origin(request.url or "")
+            except ValueError:
+                request_origin = None
+            if request_origin != managed_origin:
+                raise requests.exceptions.SSLError(
+                    f"Managed certificate trust is restricted to {managed_origin}; "
+                    "cross-origin redirects are not allowed."
+                )
+        return original_send(session, request, **kwargs)
+
+    def create_context(protocol: int) -> ssl.SSLContext:
+        context = _STANDARD_SSL_CONTEXT(protocol)
+        if managed_origin is not None:
+            context.verify_flags |= ssl.VERIFY_X509_PARTIAL_CHAIN
+        return context
+
     try:
         setattr(ssl, "SSLContext", _STANDARD_SSL_CONTEXT)
-        setattr(urllib3_ssl, "SSLContext", _STANDARD_SSL_CONTEXT)
+        setattr(urllib3_ssl, "SSLContext", create_context)
+        if managed_origin:
+            setattr(requests.sessions.Session, "send", send)
         if has_preloaded_context:
             setattr(
                 requests.adapters,
                 "_preloaded_ssl_context",
-                _STANDARD_SSL_CONTEXT(ssl.PROTOCOL_TLS_CLIENT),
+                create_context(ssl.PROTOCOL_TLS_CLIENT),
             )
         yield
     finally:
         setattr(ssl, "SSLContext", patched_ssl_context)
         setattr(urllib3_ssl, "SSLContext", patched_urllib3_context)
+        if managed_origin:
+            setattr(requests.sessions.Session, "send", original_send)
         if has_preloaded_context:
             setattr(requests.adapters, "_preloaded_ssl_context", patched_preloaded_context)
 
 
-def _get_trust_directory() -> Path:
-    """Return the managed certificate directory, creating it when needed."""
+def _get_trust_directory(create: bool = False) -> Path:
+    """Return the managed certificate directory, optionally creating it for writes."""
     from .profiles import ProfileConfig
 
     trust_directory = ProfileConfig.get_config_path().parent / "trust"
-    trust_directory.mkdir(parents=True, exist_ok=True)
-    try:
-        trust_directory.chmod(0o700)
-    except OSError:
-        pass
+    if create:
+        trust_directory.mkdir(parents=True, exist_ok=True)
+        try:
+            trust_directory.chmod(0o700)
+        except OSError:
+            pass
     return trust_directory
 
 
@@ -143,22 +216,143 @@ def _get_trust_stem(origin: str) -> str:
     return hashlib.sha256(origin.encode("utf-8")).hexdigest()
 
 
+def _get_managed_trust_pairs(origin: str) -> List[tuple[Path, Path]]:
+    """Find metadata and PEM pairs whose stored origin normalizes to the given origin."""
+    pairs: List[tuple[Path, Path]] = []
+    for metadata_path in sorted(_get_trust_directory().glob("*.json")):
+        try:
+            metadata = json.loads(metadata_path.read_text(encoding="utf-8"))
+            stored_origin = metadata.get("origin") if isinstance(metadata, dict) else None
+            if (
+                not isinstance(stored_origin, str)
+                or metadata_path.stem != _get_trust_stem(stored_origin)
+                or get_ssl_server_origin(stored_origin) != origin
+            ):
+                continue
+        except (OSError, ValueError):
+            continue
+        pairs.append((metadata_path.with_suffix(".pem"), metadata_path))
+    return pairs
+
+
+def _remove_managed_trust_pairs(origin: str, keep_metadata_path: Optional[Path] = None) -> bool:
+    """Remove all valid trust pairs for an origin except an optional replacement pair."""
+    removed = False
+    for pem_path, metadata_path in _get_managed_trust_pairs(origin):
+        if metadata_path == keep_metadata_path:
+            continue
+        for path in (pem_path, metadata_path):
+            try:
+                path.unlink()
+                removed = True
+            except FileNotFoundError:
+                pass
+    return removed
+
+
 def get_managed_trust_path(api_url: str) -> Optional[Path]:
     """Return the managed PEM path for a URL when a trusted certificate exists."""
     origin = get_ssl_server_origin(api_url)
-    pem_path = _get_trust_directory() / f"{_get_trust_stem(origin)}.pem"
+    trust_directory = _get_trust_directory()
+    pem_path = trust_directory / f"{_get_trust_stem(origin)}.pem"
     metadata_path = pem_path.with_suffix(".json")
+
+    if not pem_path.is_file() or not metadata_path.is_file():
+        for legacy_pem_path, legacy_metadata_path in _get_managed_trust_pairs(origin):
+            if legacy_pem_path.is_file():
+                pem_path = legacy_pem_path
+                metadata_path = legacy_metadata_path
+                break
+
     if not pem_path.is_file() or not metadata_path.is_file():
         return None
     try:
         metadata = json.loads(metadata_path.read_text(encoding="utf-8"))
-    except (OSError, json.JSONDecodeError):
-        return None
-    if metadata.get("origin") != origin:
+        stored_origin = metadata.get("origin") if isinstance(metadata, dict) else None
+        if not isinstance(stored_origin, str) or get_ssl_server_origin(stored_origin) != origin:
+            return None
+    except (OSError, ValueError, json.JSONDecodeError):
         return None
+    with _SSL_CONTEXT_LOCK:
+        if not _restrict_managed_trust_bundle(pem_path, metadata):
+            return None
     return pem_path
 
 
+def _restrict_managed_trust_bundle(pem_path: Path, metadata: Dict[str, Any]) -> bool:
+    """Keep only the metadata-fingerprinted certificate in a managed PEM file."""
+    trust_type = metadata.get("trust-type", "leaf")
+    fingerprint = metadata.get("fingerprint")
+    if trust_type not in ("leaf", "ca") or not isinstance(fingerprint, str):
+        return False
+
+    try:
+        original_pem = pem_path.read_bytes()
+        certificates = x509.load_pem_x509_certificates(original_pem)
+    except (OSError, ValueError):
+        return False
+
+    expected_fingerprint = fingerprint.replace(":", "").upper()
+    trusted_certificate = next(
+        (
+            certificate
+            for certificate in certificates
+            if certificate.fingerprint(hashes.SHA256()).hex().upper() == expected_fingerprint
+        ),
+        None,
+    )
+    if trusted_certificate is None:
+        return False
+    if trust_type == "ca":
+        try:
+            constraints = trusted_certificate.extensions.get_extension_for_class(
+                x509.BasicConstraints
+            )
+        except x509.ExtensionNotFound:
+            return False
+        if not constraints.value.ca:
+            return False
+
+    trusted_pem = trusted_certificate.public_bytes(serialization.Encoding.PEM)
+    if original_pem != trusted_pem:
+        temporary_pem = pem_path.with_suffix(".pem.tmp")
+        try:
+            temporary_pem.write_bytes(trusted_pem)
+            temporary_pem.chmod(0o600)
+            temporary_pem.replace(pem_path)
+        except OSError:
+            try:
+                temporary_pem.unlink()
+            except OSError:
+                pass
+            return False
+    return True
+
+
+def _get_managed_origin(pem_path: str) -> Optional[str]:
+    """Identify an explicit PEM that belongs to the origin-scoped managed store."""
+    try:
+        path = Path(pem_path)
+        metadata = json.loads(path.with_suffix(".json").read_text(encoding="utf-8"))
+        origin = metadata.get("origin") if isinstance(metadata, dict) else None
+        if isinstance(origin, str) and get_managed_trust_path(origin) == path:
+            return get_ssl_server_origin(origin)
+    except (OSError, ValueError):
+        pass
+    return None
+
+
+def _is_self_signed(certificate: x509.Certificate) -> bool:
+    """Distinguish self-signed certificates from self-issued rollover certificates."""
+    if certificate.subject != certificate.issuer:
+        return False
+    try:
+        certificate.verify_directly_issued_by(certificate)
+    except (InvalidSignature, UnsupportedAlgorithm, ValueError):
+        return False
+    return True
+
+
 def _certificate_name(name: x509.Name) -> str:
     """Format a certificate distinguished name for user-facing output."""
     return ", ".join(
@@ -190,32 +384,33 @@ def inspect_server_certificate(api_url: str, timeout: float = 5) -> ServerCertif
     assert parsed.hostname is not None
     port = parsed.port or 443
     certificate_chain_pem: Optional[bytes] = None
-    patched_ssl_context = ssl.SSLContext
-    try:
-        setattr(ssl, "SSLContext", _STANDARD_SSL_CONTEXT)
-        context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
-        context.check_hostname = False
-        context.verify_mode = ssl.CERT_NONE
-
-        with socket.create_connection((parsed.hostname, port), timeout=timeout) as tcp_socket:
-            with context.wrap_socket(tcp_socket, server_hostname=parsed.hostname) as tls_socket:
-                certificate_der = tls_socket.getpeercert(binary_form=True)
-                ssl_object = getattr(tls_socket, "_sslobj", None)
-                get_unverified_chain = getattr(ssl_object, "get_unverified_chain", None)
-                if callable(get_unverified_chain):
-                    try:
-                        chain = get_unverified_chain()
-                        chain_pem = b"".join(
-                            (pem.encode("ascii") if isinstance(pem, str) else pem)
-                            for chain_certificate in chain
-                            for pem in (chain_certificate.public_bytes(),)
-                        )
-                        if chain_pem:
-                            certificate_chain_pem = chain_pem
-                    except (AttributeError, OSError, ValueError):
-                        pass
-    finally:
-        setattr(ssl, "SSLContext", patched_ssl_context)
+    with _SSL_CONTEXT_LOCK:
+        patched_ssl_context = ssl.SSLContext
+        try:
+            setattr(ssl, "SSLContext", _STANDARD_SSL_CONTEXT)
+            context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+            context.check_hostname = False
+            context.verify_mode = ssl.CERT_NONE
+
+            with socket.create_connection((parsed.hostname, port), timeout=timeout) as tcp_socket:
+                with context.wrap_socket(tcp_socket, server_hostname=parsed.hostname) as tls_socket:
+                    certificate_der = tls_socket.getpeercert(binary_form=True)
+                    ssl_object = getattr(tls_socket, "_sslobj", None)
+                    get_unverified_chain = getattr(ssl_object, "get_unverified_chain", None)
+                    if callable(get_unverified_chain):
+                        try:
+                            chain = get_unverified_chain()
+                            chain_pem = b"".join(
+                                (pem.encode("ascii") if isinstance(pem, str) else pem)
+                                for chain_certificate in chain
+                                for pem in (chain_certificate.public_bytes(),)
+                            )
+                            if chain_pem:
+                                certificate_chain_pem = chain_pem
+                        except (AttributeError, OSError, ValueError):
+                            pass
+        finally:
+            setattr(ssl, "SSLContext", patched_ssl_context)
 
     if not certificate_der:
         raise ssl.SSLError("The server did not provide a TLS certificate.")
@@ -238,26 +433,81 @@ def inspect_server_certificate(api_url: str, timeout: float = 5) -> ServerCertif
         sans=sans,
         not_before=not_before,
         not_after=not_after,
-        self_signed=certificate.subject == certificate.issuer,
+        self_signed=_is_self_signed(certificate),
+    )
+
+
+def load_ca_certificate(api_url: str, certificate_path: Path) -> ServerCertificate:
+    """Load one PEM or DER CA certificate for origin-scoped trust.
+
+    Args:
+        api_url: HTTPS origin to associate with the CA.
+        certificate_path: Public CA certificate file, not a private key or bundle.
+
+    Returns:
+        Validated CA certificate and identity metadata.
+
+    Raises:
+        ValueError: The file is not a currently valid CA certificate.
+        OSError: The certificate file cannot be read.
+    """
+    origin = get_ssl_server_origin(api_url)
+    content = certificate_path.read_bytes()
+    if b"-----BEGIN" in content:
+        certificates = x509.load_pem_x509_certificates(content)
+        if len(certificates) != 1 or b"PRIVATE KEY" in content:
+            raise ValueError("Import exactly one public CA certificate, not a bundle or key.")
+        certificate = certificates[0]
+    else:
+        certificate = x509.load_der_x509_certificate(content)
+    try:
+        extensions = certificate.extensions
+    except (x509.DuplicateExtension, x509.UnsupportedGeneralNameType, ValueError) as exc:
+        raise ValueError(f"Invalid CA certificate extensions: {exc}") from exc
+    try:
+        constraints = extensions.get_extension_for_class(x509.BasicConstraints)
+    except x509.ExtensionNotFound as exc:
+        raise ValueError("The certificate must have CA basic constraints.") from exc
+    if not constraints.value.ca:
+        raise ValueError("The certificate is not a CA certificate.")
+    try:
+        usage = extensions.get_extension_for_class(x509.KeyUsage)
+    except x509.ExtensionNotFound:
+        pass
+    else:
+        if not usage.value.key_cert_sign:
+            raise ValueError("The CA certificate does not permit certificate signing.")
+    not_before, not_after = _certificate_validity(certificate)
+    now = datetime.now(timezone.utc)
+    if not (
+        datetime.fromisoformat(not_before).replace(tzinfo=timezone.utc)
+        <= now
+        <= datetime.fromisoformat(not_after).replace(tzinfo=timezone.utc)
+    ):
+        raise ValueError("The CA certificate is expired or not yet valid.")
+    return ServerCertificate(
+        origin=origin,
+        pem=certificate.public_bytes(serialization.Encoding.PEM),
+        fingerprint=certificate.fingerprint(hashes.SHA256()).hex().upper(),
+        subject=_certificate_name(certificate.subject),
+        issuer=_certificate_name(certificate.issuer),
+        sans=[],
+        not_before=not_before,
+        not_after=not_after,
+        self_signed=_is_self_signed(certificate),
+        trust_type="ca",
     )
 
 
 def save_managed_certificate(certificate: ServerCertificate) -> Path:
     """Persist a server certificate and metadata in the managed trust directory."""
-    trust_directory = _get_trust_directory()
-    stem = _get_trust_stem(certificate.origin)
+    trust_directory = _get_trust_directory(create=True)
+    origin = get_ssl_server_origin(certificate.origin)
+    stem = _get_trust_stem(origin)
     pem_path = trust_directory / f"{stem}.pem"
     metadata_path = pem_path.with_suffix(".json")
-    metadata: Dict[str, Any] = {
-        "origin": certificate.origin,
-        "fingerprint": certificate.fingerprint,
-        "subject": certificate.subject,
-        "issuer": certificate.issuer,
-        "sans": certificate.sans,
-        "not-before": certificate.not_before,
-        "not-after": certificate.not_after,
-        "self-signed": certificate.self_signed,
-    }
+    metadata = certificate.to_dict()
+    metadata["origin"] = origin
 
     temporary_pem = pem_path.with_suffix(".pem.tmp")
     temporary_metadata = metadata_path.with_suffix(".json.tmp")
@@ -275,29 +525,36 @@ def save_managed_certificate(certificate: ServerCertificate) -> Path:
             except OSError:
                 pass
         raise
+    _remove_managed_trust_pairs(origin, keep_metadata_path=metadata_path)
     return pem_path
 
 
 def get_managed_trust_records() -> List[Dict[str, Any]]:
-    """Return metadata for all managed server certificates."""
+    """Return metadata with canonical origins for all managed server certificates."""
     records: List[Dict[str, Any]] = []
     for metadata_path in sorted(_get_trust_directory().glob("*.json")):
         try:
             metadata = json.loads(metadata_path.read_text(encoding="utf-8"))
-        except (OSError, json.JSONDecodeError):
+            origin = metadata.get("origin") if isinstance(metadata, dict) else None
+            if not isinstance(origin, str):
+                continue
+            metadata["origin"] = get_ssl_server_origin(origin)
+        except (OSError, ValueError):
             continue
-        if isinstance(metadata, dict) and isinstance(metadata.get("origin"), str):
-            records.append(metadata)
+        metadata.setdefault("trust-type", "leaf")
+        records.append(metadata)
     return records
 
 
 def remove_managed_trust(api_url: str) -> bool:
     """Remove the managed certificate trust entry for a server URL."""
     origin = get_ssl_server_origin(api_url)
-    pem_path = _get_trust_directory() / f"{_get_trust_stem(origin)}.pem"
-    metadata_path = pem_path.with_suffix(".json")
-    removed = False
-    for path in (pem_path, metadata_path):
+    trust_directory = _get_trust_directory()
+    removed = _remove_managed_trust_pairs(origin)
+    for path in (
+        trust_directory / f"{_get_trust_stem(origin)}.pem",
+        trust_directory / f"{_get_trust_stem(origin)}.json",
+    ):
         try:
             path.unlink()
             removed = True

slcli/webapp_click.py

@@ -22,6 +22,7 @@ import requests
 from .cli_utils import is_interactive_environment, validate_output_format
 from .platform import PLATFORM_SLS, get_platform
 from .skill_click import install_skills_to_directory
+from .ssl_trust import use_standard_ssl_context
 from .universal_handlers import UniversalResponseHandler
 from .utils import (
     ExitCodes,
@@ -109,11 +110,10 @@ def _build_published_webapp_url(
 
     if webapp_id and (not resolved_name or not resolved_workspace_id):
         try:
-            resp = requests.get(
-                f"{_get_webapp_base_url()}/webapps/{webapp_id}",
-                headers=get_headers("application/json"),
-                verify=get_ssl_verify(),
-            )
+            url = f"{_get_webapp_base_url()}/webapps/{webapp_id}"
+            ssl_verify = get_ssl_verify(url)
+            with use_standard_ssl_context(ssl_verify):
+                resp = requests.get(url, headers=get_headers("application/json"), verify=ssl_verify)
             resp.raise_for_status()
             data = resp.json()
             resolved_name = resolved_name or str(data.get("name", ""))
@@ -295,12 +295,10 @@ def _query_webapps_http(filter_str: str, max_items: int = 1000) -> List[Dict[str
             payload["continuationToken"] = continuation_token
 
         # Request the server to include a total count when available
-        resp = requests.post(
-            f"{base}/webapps/query?includeTotalCount=true",
-            headers=headers,
-            json=payload,
-            verify=get_ssl_verify(),
-        )
+        url = f"{base}/webapps/query?includeTotalCount=true"
+        ssl_verify = get_ssl_verify(url)
+        with use_standard_ssl_context(ssl_verify):
+            resp = requests.post(url, headers=headers, json=payload, verify=ssl_verify)
         resp.raise_for_status()
         data = resp.json()
         page_items: List[Dict[str, Any]] = data.get("webapps", []) if isinstance(data, dict) else []
@@ -336,12 +334,10 @@ def _fetch_webapps_page(
         payload["continuationToken"] = continuation_token
 
     # Request the server to include a total count when available
-    resp = requests.post(
-        f"{base}/webapps/query?includeTotalCount=true",
-        headers=headers,
-        json=payload,
-        verify=get_ssl_verify(),
-    )
+    url = f"{base}/webapps/query?includeTotalCount=true"
+    ssl_verify = get_ssl_verify(url)
+    with use_standard_ssl_context(ssl_verify):
+        resp = requests.post(url, headers=headers, json=payload, verify=ssl_verify)
     resp.raise_for_status()
     data = resp.json()
     items = data.get("webapps", []) if isinstance(data, dict) else []
@@ -1491,11 +1487,10 @@ def register_webapp_commands(cli: Any) -> None:
         """Show webapp metadata."""
         try:
             base = _get_webapp_base_url()
-            resp = requests.get(
-                f"{base}/webapps/{webapp_id}",
-                headers=get_headers("application/json"),
-                verify=get_ssl_verify(),
-            )
+            url = f"{base}/webapps/{webapp_id}"
+            ssl_verify = get_ssl_verify(url)
+            with use_standard_ssl_context(ssl_verify):
+                resp = requests.get(url, headers=get_headers("application/json"), verify=ssl_verify)
             resp.raise_for_status()
             data = resp.json()
             if data.get("type", "") != "WebVI":
@@ -1516,9 +1511,10 @@ def register_webapp_commands(cli: Any) -> None:
 
         try:
             base = _get_webapp_base_url()
-            resp = requests.delete(
-                f"{base}/webapps/{webapp_id}", headers=get_headers(), verify=get_ssl_verify()
-            )
+            url = f"{base}/webapps/{webapp_id}"
+            ssl_verify = get_ssl_verify(url)
+            with use_standard_ssl_context(ssl_verify):
+                resp = requests.delete(url, headers=get_headers(), verify=ssl_verify)
             # Validate response and type if possible
             try:
                 data = resp.json()
@@ -1542,11 +1538,10 @@ def register_webapp_commands(cli: Any) -> None:
 
         try:
             base = _get_webapp_base_url()
-            resp = requests.get(
-                f"{base}/webapps/{webapp_id}",
-                headers=get_headers("application/json"),
-                verify=get_ssl_verify(),
-            )
+            url = f"{base}/webapps/{webapp_id}"
+            ssl_verify = get_ssl_verify(url)
+            with use_standard_ssl_context(ssl_verify):
+                resp = requests.get(url, headers=get_headers("application/json"), verify=ssl_verify)
             resp.raise_for_status()
             data = resp.json()
             app_url = _build_published_webapp_url(
@@ -1630,12 +1625,15 @@ def register_webapp_commands(cli: Any) -> None:
                             "policyIds": [],
                             "properties": {},
                         }
-                        resp_create = requests.post(
-                            f"{base}/webapps",
-                            headers=get_headers("application/json"),
-                            json=payload,
-                            verify=get_ssl_verify(),
-                        )
+                        url = f"{base}/webapps"
+                        ssl_verify = get_ssl_verify(url)
+                        with use_standard_ssl_context(ssl_verify):
+                            resp_create = requests.post(
+                                url,
+                                headers=get_headers("application/json"),
+                                json=payload,
+                                verify=ssl_verify,
+                            )
                         _handle_webapp_create_conflict(
                             resp_create,
                             workspace_id=created_workspace_id,
@@ -1656,9 +1654,11 @@ def register_webapp_commands(cli: Any) -> None:
 
                     upload_headers = get_headers("application/octet-stream")
                     url = f"{base}/webapps/{webapp_id}/content"
-                    resp = requests.put(
-                        url, headers=upload_headers, data=data, verify=get_ssl_verify()
-                    )
+                    ssl_verify = get_ssl_verify(url)
+                    with use_standard_ssl_context(ssl_verify):
+                        resp = requests.put(
+                            url, headers=upload_headers, data=data, verify=ssl_verify
+                        )
                     if resp.status_code in (200, 201, 204):
                         workspace_name_hint = (
                             get_effective_workspace(workspace) or workspace
@@ -1708,12 +1708,15 @@ def register_webapp_commands(cli: Any) -> None:
                         "policyIds": [],
                         "properties": {},
                     }
-                    resp_create = requests.post(
-                        f"{base}/webapps",
-                        headers=get_headers("application/json"),
-                        json=payload,
-                        verify=get_ssl_verify(),
-                    )
+                    url = f"{base}/webapps"
+                    ssl_verify = get_ssl_verify(url)
+                    with use_standard_ssl_context(ssl_verify):
+                        resp_create = requests.post(
+                            url,
+                            headers=get_headers("application/json"),
+                            json=payload,
+                            verify=ssl_verify,
+                        )
                     _handle_webapp_create_conflict(
                         resp_create,
                         workspace_id=created_workspace_id,
@@ -1734,7 +1737,9 @@ def register_webapp_commands(cli: Any) -> None:
 
                 upload_headers = get_headers("application/octet-stream")
                 url = f"{base}/webapps/{webapp_id}/content"
-                resp = requests.put(url, headers=upload_headers, data=data, verify=get_ssl_verify())
+                ssl_verify = get_ssl_verify(url)
+                with use_standard_ssl_context(ssl_verify):
+                    resp = requests.put(url, headers=upload_headers, data=data, verify=ssl_verify)
                 if resp.status_code in (200, 201, 204):
                     workspace_name_hint = (
                         (get_effective_workspace(workspace) or workspace)

{systemlink_cli-2.2.2.dist-info → systemlink_cli-2.3.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: systemlink-cli
-Version: 2.2.2
+Version: 2.3.0
 Summary: SystemLink Integrator CLI - cross-platform CLI for SystemLink workflows and templates.
 License-File: LICENSE
 Author: Fred Visser
@@ -18,6 +18,7 @@ Requires-Dist: cryptography (>=49.0.0)
 Requires-Dist: filelock (>=3.20,<4)
 Requires-Dist: httpcore2 (>=2.10.0,<3) ; extra == "mcp"
 Requires-Dist: httpx2 (>=2.12.0,<3) ; extra == "mcp"
+Requires-Dist: idna (>=3.10,<4)
 Requires-Dist: keyring (>=25.6.0,<26.0.0)
 Requires-Dist: mcp (>=2,<3) ; extra == "mcp"
 Requires-Dist: msgpack (>=1.1,<2) ; extra == "managed-client"

{systemlink_cli-2.2.2.dist-info → systemlink_cli-2.3.0.dist-info}/RECORD

@@ -2,7 +2,7 @@ dff-editor/editor.js,sha256=VQJNqtkFSeXec_hidYdbsvhcKo8-dcdMoU5qvGVn3YQ,97488
 dff-editor/index.html,sha256=Bbicid_Fx66W7ypHgSGJrUtkAEFcLP3HkRoxiGKZjCs,11657
 slcli/__init__.py,sha256=ZRF050VsFgb4zeyyQzQINQ4eHFwEBBoUq-CPyziIB6g,66
 slcli/__main__.py,sha256=wUlBlvYS3Tn4ipw9_7zMr2d1houRpNnALG0TxHg6xZg,829
-slcli/_version.py,sha256=VsTk7QEnWfMUjwPRqj4QXSKq0-sD6e6MAd-859KEdZg,113
+slcli/_version.py,sha256=LPSvaTsKdbuxqhCtWPW3xyvCHxMTxr8qhwwJO9a3YAA,113
 slcli/alarm_click.py,sha256=0z0SOO_LJQR9dYqLdOTfZgA4Ogl8d1fsJ7TrJHukDsU,32053
 slcli/asset_click.py,sha256=rBA52bBjn5Kmv0kHv4ft1vBMXFvMGmR292AbX3s_zvY,44544
 slcli/cli_formatters.py,sha256=ShrU2RbnQUEKhJ6ahWuv8c3zw7C-yg0o20i1opq9gZk,7275
@@ -10,7 +10,7 @@ slcli/cli_utils.py,sha256=tXagGGAeEVvxlKpyHSzbNiosjhrxMmwgDUMJ4glAK1I,13087
 slcli/comment_click.py,sha256=klbOQfFYVQ-HDi1hoHWuZE3X8S_5iI2HWfPaAYyICOQ,21048
 slcli/completion_click.py,sha256=KYnGP-1LT-iQVg32BRQOmX5LQspVjZ7D--tpH0qh_MA,13952
 slcli/config.py,sha256=tdVP-1cvy6Qs2ThGXv4nPNa5AoqNu1SG6oOwgMJ6Yx0,2221
-slcli/config_click.py,sha256=vOpaTMHoF4smYxoqV1xLMps7Q-re_3Oi7ULCf_2lFHE,42462
+slcli/config_click.py,sha256=06grrTamRCs725v_XLKNTUwevW17GjKkEM9p96Wpr-A,44393
 slcli/credentials.py,sha256=vKTS7hNAt3t7HB4ggWOZKMLNISefbT2hpCXtyEAyMCg,19996
 slcli/dataframe_click.py,sha256=2xUA9I6Rh8Fx0YfPDUMMT844SLWB2mRC3b1ccmBiEcw,44042
 slcli/dff_click.py,sha256=eqpclQ59C7yoVHTfpZ-UF6I85wNes1JvKO9_fx0yN7E,39100
@@ -44,7 +44,7 @@ slcli/feed_click.py,sha256=IzE_VwQ8IXmEgqe04afd-wE91JcV7pT3mZ5eYIT4MF4,30437
 slcli/file_click.py,sha256=5dpUgUc9ZuxG4cWO3pFjnoTyN8wB8RkndE7c5t5_x50,45841
 slcli/function_click.py,sha256=L8FqhkLc2BZVnRK97mRiLBlLImYmCu4FSOKJOVHvt1U,54278
 slcli/function_templates.py,sha256=GfmsBF0KrsIp2rBiO9ha5UAHv0O9g7yr7xcA4l8vbi8,3371
-slcli/main.py,sha256=Fu_RGgmDsg2UTtFxAMtwjtK0B_JucyRDhgp_ZkbKCG4,29218
+slcli/main.py,sha256=HXCrJD7OwC3f4mg1VkFL70ZJREHB1gnbl3x9MhmMHW4,29235
 slcli/managed_client/__init__.py,sha256=OBOqV5QisENmueusHloKye9CWldM1QvLBOTDSDiETVQ,1564
 slcli/managed_client/crypto.py,sha256=WLtyXIciEPglCVvvAnWXKvbbOWnv2_9q79505p1PQkQ,16767
 slcli/managed_client/handlers.py,sha256=JvD2d8I0Wnm_9XwgJzgnXBM_g_3F_5YkJJ-3lqmGvP0,17770
@@ -112,7 +112,7 @@ slcli/skills/slcli/scripts/prepare_eval_workspace.py,sha256=pBQz6-wCD9kzZx_GE3Qr
 slcli/skills/slcli/scripts/render_eval_review.py,sha256=6qd7VutQT_KdpPCEW5TtidS_HRA1Bp_wXi58NCm7Kco,2171
 slcli/skills/slcli/scripts/spec_import_helper.py,sha256=p6npcjrFTK0OnAwPQRu4O211WLMJ4Fte9NtqU-73cog,11429
 slcli/spec_click.py,sha256=xDN7qZ90b4v73O94bzyeplUjJBdLpvrsj3D6Y9zMJs4,77305
-slcli/ssl_trust.py,sha256=EJnmSJT_dpLoYRCvLXSu_WPHXzjWrE0k91Er1Matm8g,14297
+slcli/ssl_trust.py,sha256=gSU004tHLkN8k9T4apYIzuX9hdmdXkRn0-Pmivcr6C4,24857
 slcli/state_click.py,sha256=dceJN-L4OMqouj83vOs-BeIzm_HscZzchTa2ZQ5S1_I,38617
 slcli/system_click.py,sha256=HoRTM-Sv5PqIB9YMm4PTUxUv7vMc9JH_byZ9ty-sTow,109572
 slcli/system_query_utils.py,sha256=x4Fs5XXI4_3X4mhDQUsm_DLIsSX7efM1sRTF1Tcq8Lc,5156
@@ -127,7 +127,7 @@ slcli/utils.py,sha256=EAFaCt_FyZyb8HkMiYKwrS3J5fV9gvOlZEFxcjAaPuU,37356
 slcli/version_click.py,sha256=qo2VHOlvsEUiw2-Sw1L50pCo-tLBPCJvfTte02oXajY,6998
 slcli/web_editor.py,sha256=UR7IEEwxKrwvotA4T5DI6zHnmO0A-0cG7SOZHSfVYE4,17290
 slcli/webapp_bootstrap.py,sha256=pBcfsJ7G4cRMNGcK9H4rkfGhqgRqCzhVpW4WDZlsd1w,53331
-slcli/webapp_click.py,sha256=TgdTtWaPT7ksJatbtoVXjtfCFhMxU5vYcDK2j0agALY,69853
+slcli/webapp_click.py,sha256=CfalwkU1Z3rg18gu3kj2Azsse0H3vkvTw81Bigl-rNE,70836
 slcli/webapp_templates/angular/blank/.gitignore,sha256=B4bZYaFkEMoZooOeUyaF3er0BKFS4rdFiCzo2Z6syv8,40
 slcli/webapp_templates/angular/blank/README.md,sha256=TD0MfAJVIM8sKpPEcXig_HgksOLc983Q4wKsjV7gANg,3943
 slcli/webapp_templates/angular/blank/angular.json,sha256=2YnTokjGHnHu0VEszCI_DhpFnOABkwVtmDgIZCTnCck,2677
@@ -184,8 +184,8 @@ slcli/workflows_click.py,sha256=Ymb69WCzxhAQZ5bv0jTcXWlXy1yskXhIuv7FbgRBSWk,4065
 slcli/workitem_click.py,sha256=hmWijNzAvzvNBN0Y1wXoZZbUStRyrVIqg7J2xfJBFxw,88444
 slcli/workspace_click.py,sha256=BBiaOmAe_EzkpCG6TlR8aCrwOI81xrMOzMObAfuM_5w,20932
 slcli/workspace_utils.py,sha256=7QOtotmv3ghJs6a0fDQVojKxrBKPeq_GtE4F1SmZKnM,6872
-systemlink_cli-2.2.2.dist-info/METADATA,sha256=oKjuNK7W_4kxQYYEEE8Rl5gA6O5_PFlr_ufOkAgi2qs,1320
-systemlink_cli-2.2.2.dist-info/WHEEL,sha256=L-WvLdSBvJWHXv5zrQxDvNRnIgoBzLUpcbuiw19KCuQ,88
-systemlink_cli-2.2.2.dist-info/entry_points.txt,sha256=V8IyRF-NYesTOTA_yB4-lVK1EsKZsSY5zOjzGbh5zdA,288
-systemlink_cli-2.2.2.dist-info/licenses/LICENSE,sha256=ioLAEBMHywwQkOr14pBIc7nenmWrc-bgcMrqsB_Uvq8,1077
-systemlink_cli-2.2.2.dist-info/RECORD,,
+systemlink_cli-2.3.0.dist-info/METADATA,sha256=BGSZgIQi6_aYfwrjLkhM0PPJuO3w4DTNNyz-JG0IjaI,1352
+systemlink_cli-2.3.0.dist-info/WHEEL,sha256=L-WvLdSBvJWHXv5zrQxDvNRnIgoBzLUpcbuiw19KCuQ,88
+systemlink_cli-2.3.0.dist-info/entry_points.txt,sha256=V8IyRF-NYesTOTA_yB4-lVK1EsKZsSY5zOjzGbh5zdA,288
+systemlink_cli-2.3.0.dist-info/licenses/LICENSE,sha256=ioLAEBMHywwQkOr14pBIc7nenmWrc-bgcMrqsB_Uvq8,1077
+systemlink_cli-2.3.0.dist-info/RECORD,,