vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(forge): trust the system CA store in the hive-forge client

Browse source 
Enable reqwest's rustls-tls-native-roots feature for hive-forge so its
HTTP client validates against the OS/system CA store (rustls-native-certs)
in addition to the bundled webpki roots. Once the hive CA is embedded into
agent system trust stores (via the meta flake's security.pki.certificateFiles
wiring), hive-forge validates the gateway's self-signed leaf with no extra
env plumbing.

Additive: the bundled webpki roots stay enabled, so public CAs still
validate; the native store adds the hive CA. On NixOS the system store
already includes the Mozilla bundle, so the effective trust set is a
superset. Cargo unifies features across the build, so native-root loading
is enabled for every reqwest client — harmless, since it only widens the
root set.

Final piece of the self-signed agent-trust chain (host CA + gateway leaf,
then CA embedded into agent flakes, now the forge client honouring it).
This commit is contained in:
atlas 2026-06-17 20:06:40 +02:00 • committed by mara
commit 1e39a6c12b
2 changed files with 72 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
hive-forge/Cargo.toml
View file

@ -12,6 +12,16 @@ anyhow = { workspace = true }
clap = { workspace = true }
reqwest = { workspace = true, features = [
"json",
# Trust the OS/system CA store (rustls-native-certs), not only the
# bundled webpki roots, so hive-forge validates the hive gateway's
# self-signed leaf once the hive CA is in the agent's trust store
# (embedded into agent flakes via security.pki.certificateFiles). The
# bundled webpki roots stay enabled (workspace `rustls-tls`), so this is
# additive — public CAs still validate; the native store adds the hive
# CA. Cargo unifies features across the build, so native-root loading is
# enabled for every reqwest client; harmless (a superset of roots, and
# on NixOS the system store already includes the Mozilla bundle).
"rustls-tls-native-roots",
"rustls-tls",
"blocking",
"multipart",