dns: trust the registry's root, in dns enable and a new dns ca verb - #520
Merged
Merged
Conversation
…nable and a new dns ca verb The registry now signs a certificate for every name it holds (#519), so a machine that trusts its root once trusts every Moshpit name over https: curl, Firefox, Chromium, git. dns enable fetches /api/moshpit/ca and /api/moshpit/ca.crt, checks the served root is a self-signed CA:TRUE certificate whose fingerprint matches what the registry reports, keeps it at ~/.moshpit/ca/registry-root.crt, and installs it into the NSS store (no root) and the system store (as root) under the nickname Moshpit Root CA, the same nickname TronBrowser's launcher uses so neither imports the other's work twice. dns disable takes it out. moshcode dns ca does only that half, for a machine whose resolution comes from elsewhere; --remove undoes it. trustStores/untrustPlan take the nickname and system file as parameters, defaults unchanged. The root carries no name constraints, since X.509 cannot say everything except the ICANN root across seventeen thousand endings; the signer is the bound, and installing it stays an explicit act. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| }); | ||
|
|
||
| test("trustStores takes a nickname and a system file, and defaults to the local CA's", () => { | ||
| const local = trustStores({ platform: "linux", home: "/home/x", caFile: "/tmp/a.crt" }); |
| assert.ok(local.find((s) => s.id === "nss").args.includes("Moshpit Local CA")); | ||
| assert.equal(local.find((s) => s.id === "system").copyTo, "/usr/local/share/ca-certificates/moshpit-local-ca.crt"); | ||
|
|
||
| const registry = trustStores({ platform: "linux", home: "/home/x", caFile: "/tmp/r.crt", |
ThreatCrush Security Scan10 finding(s) in the 4 file(s) this pull request changes. HIGH/CRITICAL: 1 | MEDIUM: 9
91 pre-existing finding(s) elsewhere in the repository — **HIGH/CRITICAL**: 7 | **MEDIUM**: 73 | **LOW**: 11Not introduced by this pull request. The full set is in the Security tab.
…and 71 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
This was referenced Sep 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
moshcode dns enablenow installs the registry's root, and a newmoshcode dns cadoes only that. With #519 the registry signs a certificate for every name it holds, so a machine that trusts that root once trusts every Moshpit name over https: curl, Firefox, Chromium, git, all of it. The per-machine local CA anddns trust <name>stay as the fallbacks.How
dns enable(unless--no-trust): fetch/api/moshpit/caand/api/moshpit/ca.crt, check the served root is a self-signedCA:TRUEcertificate whose SHA-256 fingerprint matches what the registry reports for it (two fetches that must agree, so a truncated or substituted download is refused rather than installed), keep it at~/.moshpit/ca/registry-root.crt, install into the NSS store (no root needed) and the system store (as root), nicknameMoshpit Root CA. That nickname is what TronBrowser's launcher uses, so neither imports the other's work twice. Operator home and ownership handling are the same as the local CA path.dns disable(unless--keep-trust) takes it back out of both stores and removes the file.dns cainstalls just the root;dns ca --removeremoves it. For a machine whose resolution comes from elsewhere (a router running the bridge, DoH, TronBrowser's own resolver) but whose clients still refuse the certificates.trustStores()/untrustPlan()takenicknameandsystemFileparameters; defaults unchanged, so the local-CA path is byte-for-byte what it was.enabled: false) or an unreachable one is reported and skipped; nothing about resolution changes.The root carries no name constraints. X.509 cannot express "everything except the ICANN root" across seventeen thousand endings; what bounds it is the signer, which refuses real TLDs, signs only for the account that controls a name, and issues 30-day leaves. That is why installing it stays an explicit act (
dns enable,dns ca) and never something a resolver does on its own.Verified
test/trust-registry.test.mjs(11): accepts a matching self-signed CA root, refuses a fingerprint mismatch, a leaf, and garbage; store plans carry the registry nickname and file; NSS without root, system only as root, neither without certutil; apply writes the root, imports, copies, refreshes, and hands the database back to the operator; a mismatched root installs nothing; no-CA and unreachable registries are reported; remove takes both stores and the file.test/trust.test.mjsunchanged and green; full root suite 3282 pass, 0 fail.node bin/moshcode.mjs dns cafetched the production root (fingerprint4A:57:66:EC:…), imported it into~/.pki/nssdbasMoshpit Root CA C,,, and reported the system store as needing root.🤖 Generated with Claude Code