vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

agents fetch the hive CA from bao at boot instead of the meta flake embedding it

Browse source
This commit is contained in:
atlas 2026-10-19 18:46:34 +02:00 • committed by mara
commit d547b521f6
12 changed files with 329 additions and 246 deletions
Download patch file Download diff file Expand all files Collapse all files

4
hive-forge/Cargo.toml
View file

@ -26,8 +26,8 @@ reqwest = { workspace = true, features = [
# `rustls` carries the platform verifier, which reads the OS trust store
# (and honours `SSL_CERT_FILE`), so hive-forge validates the hive
# gateway's self-signed leaf once the store's root is in the agent's trust
# store — embedded into agent flakes via `security.pki.certificateFiles`
# — while public CAs still validate.
# store (an agent fetches it from the secret store at boot and points
# `SSL_CERT_FILE` at it) while public CAs still validate.
#
# The separate `rustls-native-certs` / `webpki-roots` features this entry
# used to name were 0.13.1-era and no longer exist; naming a feature that