fix(trust): a refusal that says what to do about it (v0.19.1) - #278
Merged
Conversation
The name-constraints gate refused correctly and then left you there. Both
refusals printed the same line -- "moshcode will not put an unconstrained
root in your trust store" -- with no next step, and for one of them that
sentence was not even true.
They are nothing alike. A root permitting endings other than the ones
claimed today is *stale*, not dangerous: it was generated when a different
set was claimed, and regenerating it costs one command. A root with no
permitted DNS subtree can vouch for any name on the internet.
Collapsing those into one dead end is how a safety gate ends up being
worked around with --no-trust rather than satisfied -- the operator has
no way to tell "this is a real hole" from "this is out of date", so the
opt-out becomes the obvious move.
So each refusal now carries its own remedy, and only one of them has a
way forward:
STOP the root does not permit rank
the root is older than the endings claimed now — regenerating it is enough:
rm -rf /home/anthony/.moshpit/ca && moshpit-proxy # writes a fresh root
then re-run `moshcode dns enable`.
STOP the root permits no DNS subtree, so every name it does not exclude is allowed
moshcode will not put a root that can vouch for names outside Moshpit
into your trust store. ... This is not overridable.
The dangerous case is deliberately offered nothing, and a test asserts it
never advertises --no-trust as the fix.
This is the strictness note from #275 answered: the rule stays, because it
is the actual guarantee, but it is no longer a dead end when a root is
simply out of step.
1351 tests, 1348 pass, 0 fail.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ThreatCrush Security Scan88 finding(s) HIGH/CRITICAL: 50 | MEDIUM: 38
…and 38 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Answers the strictness note left open in #275.
The problem
The gate refused correctly and then left you there. Both refusals printed the same line — "moshcode will not put an unconstrained root in your trust store" — with no next step. For one of them that sentence was not even true.
The two cases are nothing alike:
Collapsing them into one dead end is how a safety gate gets worked around with
--no-trustrather than satisfied: the operator cannot tell a real hole from an out-of-date file, so the opt-out becomes the obvious move.Now
The dangerous case is deliberately offered no way forward, and a test asserts it never advertises
--no-trustas the fix.On the rule itself
Keeping it. It is the actual guarantee the feature rests on — one
DNS:.comin a permitted subtree and the root reaches the clearnet. What was wrong was not the strictness but that being strict was a dead end. It no longer is.1351 tests, 1348 pass, 0 fail, 3 skipped. Bundled as v0.19.1.🤖 Generated with Claude Code