[her-cat]

English Version

Summary

Fixes the 404 returned for /.well-known/dsh-desktop-ca.crt during LAN HTTPS trust bootstrap.

Previously, the HTTPS ingress proxied this request to the loopback Host. The Host does not expose the CA download route, so the request completed the TLS handshake but still returned 404.

Changes

• Serve the exact CA download path locally in both Next and Beta LAN HTTPS ingress implementations, after the existing Host allowlist and Sec-Fetch-Site: cross-site checks.
• Return the public CA PEM for GET; support HEAD with identical headers and no response body.
• Reject other methods with 405, Allow: GET, HEAD, an empty body, and Content-Length: 0.
• Pass and defensively copy only caCertificate; do not read or expose CA private material, sealed state, or leaf certificate chains.
• Keep query-string, encoded-path, and trailing-slash variants on the existing loopback proxy path.
• Add regression coverage for GET, HEAD, POST, response headers, zero backend hits, Host/cross-site rejection, and near-path proxying.

Impact

• Affected modules: LAN HTTPS ingress/runtime and ingress tests in dsh-desktop-next and dsh-plugin-desktop-beta.
• No breaking change.
• Next and Beta currently use runtime 0.2.2-rc.1; their shared sources remain mirrored and are covered by the variant-layout check.

Verification

• corepack yarn check:layout
• corepack yarn typecheck
• corepack yarn test
• corepack yarn check
• corepack yarn check:next
• Targeted Next and Beta LAN HTTPS tests: 18 tests passed for each package.
• Manually launched and inspected an isolated Next Desktop instance:
  • Host reached process.ready
  • Office runtime mounted successfully
  • Renderer reported UI ready
  • Manual verification completed successfully

Packaging Note

corepack yarn workspace dsh-desktop-next dist:mac-smoke was run on macOS Apple Silicon.

The arm64 and Rosetta x64 primary-runtime smokes, frontend build, payload materialization, and sealing passed. The final DMG was not produced because Electron Builder requires Xcode 26+ actool at the macOS icon step. Signing and notarization were not run in this environment.

Release Notes

The LAN HTTPS trust-bootstrap CA download now returns the correct CA PEM instead of 404.

---

中文版本

变更摘要

修复局域网 HTTPS 信任引导中 /.well-known/dsh-desktop-ca.crt 返回 404 的问题。

此前 HTTPS ingress 会将该请求代理到 loopback Host。Host 未注册 CA 下载路由，因此请求虽然完成 TLS 握手，最终仍返回 404。

变更内容

• 在 Next 与 Beta 的 LAN HTTPS ingress 中，保留既有 Host allowlist 和 Sec-Fetch-Site: cross-site 防护，并在防护通过后仅对精确的 CA 下载路径本地响应。
• GET 返回公开 CA PEM；HEAD 返回相同响应头但不返回正文。
• 其他 HTTP 方法返回 405、Allow: GET, HEAD、空正文和 Content-Length: 0。
• 仅传递并防御性复制 caCertificate；不会读取或暴露 CA 私钥、sealed state 或 leaf 证书链。
• 含 query、编码路径或尾斜杠的近似路径继续使用既有 loopback 代理行为。
• 新增回归测试，覆盖 GET、HEAD、POST、响应头、零后端命中、Host/cross-site 拒绝，以及近似路径继续代理。

影响范围

• 受影响模块：dsh-desktop-next 和 dsh-plugin-desktop-beta 的 LAN HTTPS ingress/runtime 与 ingress tests。
• 无 Breaking Change。
• Next 与 Beta 当前均使用 0.2.2-rc.1 runtime；共享源保持镜像一致，并通过变体布局检查验证。

验证

• corepack yarn check:layout
• corepack yarn typecheck
• corepack yarn test
• corepack yarn check
• corepack yarn check:next
• Next 与 Beta 的 LAN HTTPS 定向测试：两个包各通过 18 条测试。
• 已人工启动并检查隔离的 Next Desktop 实例：
  • Host 到达 process.ready
  • Office runtime 挂载成功
  • renderer 报告 UI ready
  • 人工验证运行正常

打包说明

已在 macOS Apple Silicon 上执行：

corepack yarn workspace dsh-desktop-next dist:mac-smoke

arm64 和 Rosetta x64 primary runtime smoke、前端构建、payload materialization 与 sealing 均通过。最终 DMG 未生成：Electron Builder 在 macOS 图标步骤要求 Xcode 26+ 的 actool，当前机器工具链不满足。签名与 notarization 未在当前环境执行。

发布说明

局域网 HTTPS 信任引导中的 CA 下载地址现在会返回正确的 CA PEM，不再返回 404。