feat(forge): trust the system CA store in the hive-forge client
Enable reqwest's rustls-tls-native-roots feature for hive-forge so its HTTP client validates against the OS/system CA store (rustls-native-certs) in addition to the bundled webpki roots. Once the hive CA is embedded into agent system trust stores (via the meta flake's security.pki.certificateFiles wiring), hive-forge validates the gateway's self-signed leaf with no extra env plumbing. Additive: the bundled webpki roots stay enabled, so public CAs still validate; the native store adds the hive CA. On NixOS the system store already includes the Mozilla bundle, so the effective trust set is a superset. Cargo unifies features across the build, so native-root loading is enabled for every reqwest client — harmless, since it only widens the root set. Final piece of the self-signed agent-trust chain (host CA + gateway leaf, then CA embedded into agent flakes, now the forge client honouring it).
This commit is contained in:
atlas
mara
parent
9b54eff5d1
commit
1e39a6c12b
2 changed files with 72 additions and 0 deletions
62
Cargo.lock
generated
62
Cargo.lock
generated
|
|
@ -610,6 +610,16 @@ version = "0.4.2"
|
|||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "3d52eff69cd5e647efe296129160853a42795992097e8af39800e1060caeea9b"
|
||||
|
||||
[[package]]
|
||||
name = "core-foundation"
|
||||
version = "0.10.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
|
||||
dependencies = [
|
||||
"core-foundation-sys",
|
||||
"libc",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "core-foundation-sys"
|
||||
version = "0.8.7"
|
||||
|
|
@ -1541,6 +1551,7 @@ dependencies = [
|
|||
"hyper",
|
||||
"hyper-util",
|
||||
"rustls",
|
||||
"rustls-native-certs",
|
||||
"tokio",
|
||||
"tokio-rustls",
|
||||
"tower-service",
|
||||
|
|
@ -2438,6 +2449,12 @@ version = "0.3.1"
|
|||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
|
||||
|
||||
[[package]]
|
||||
name = "openssl-probe"
|
||||
version = "0.2.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
|
||||
|
||||
[[package]]
|
||||
name = "parking"
|
||||
version = "2.2.1"
|
||||
|
|
@ -2922,6 +2939,7 @@ dependencies = [
|
|||
"pin-project-lite",
|
||||
"quinn",
|
||||
"rustls",
|
||||
"rustls-native-certs",
|
||||
"rustls-pki-types",
|
||||
"serde",
|
||||
"serde_json",
|
||||
|
|
@ -3241,6 +3259,18 @@ dependencies = [
|
|||
"zeroize",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "rustls-native-certs"
|
||||
version = "0.8.4"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "dab5152771c58876a2146916e53e35057e1a4dfa2b9df0f0305b07f611fdea4d"
|
||||
dependencies = [
|
||||
"openssl-probe",
|
||||
"rustls-pki-types",
|
||||
"schannel",
|
||||
"security-framework",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "rustls-pki-types"
|
||||
version = "1.14.1"
|
||||
|
|
@ -3274,6 +3304,15 @@ version = "1.0.23"
|
|||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
|
||||
|
||||
[[package]]
|
||||
name = "schannel"
|
||||
version = "0.1.29"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
|
||||
dependencies = [
|
||||
"windows-sys 0.61.2",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "schemars"
|
||||
version = "1.2.1"
|
||||
|
|
@ -3306,6 +3345,29 @@ version = "1.2.0"
|
|||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
|
||||
|
||||
[[package]]
|
||||
name = "security-framework"
|
||||
version = "3.7.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
|
||||
dependencies = [
|
||||
"bitflags",
|
||||
"core-foundation",
|
||||
"core-foundation-sys",
|
||||
"libc",
|
||||
"security-framework-sys",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "security-framework-sys"
|
||||
version = "2.17.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
|
||||
dependencies = [
|
||||
"core-foundation-sys",
|
||||
"libc",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "semver"
|
||||
version = "1.0.28"
|
||||
|
|
|
|||
|
|
@ -12,6 +12,16 @@ anyhow = { workspace = true }
|
|||
clap = { workspace = true }
|
||||
reqwest = { workspace = true, features = [
|
||||
"json",
|
||||
# Trust the OS/system CA store (rustls-native-certs), not only the
|
||||
# bundled webpki roots, so hive-forge validates the hive gateway's
|
||||
# self-signed leaf once the hive CA is in the agent's trust store
|
||||
# (embedded into agent flakes via security.pki.certificateFiles). The
|
||||
# bundled webpki roots stay enabled (workspace `rustls-tls`), so this is
|
||||
# additive — public CAs still validate; the native store adds the hive
|
||||
# CA. Cargo unifies features across the build, so native-root loading is
|
||||
# enabled for every reqwest client; harmless (a superset of roots, and
|
||||
# on NixOS the system store already includes the Mozilla bundle).
|
||||
"rustls-tls-native-roots",
|
||||
"rustls-tls",
|
||||
"blocking",
|
||||
"multipart",
|
||||
|
|
|
|||
Loading…
Reference in a new issue