Ship the Moshpit Root CA: fetched on install and upgrade, trusted by the launcher on every start - #109
Merged
Conversation
…the launcher on every start The registry now signs a certificate for every name it holds (moshcoder/moshcode#519), so one root makes every Moshpit name trusted over https. install.sh ensure_moshpit_root fetches /api/moshpit/ca and /api/moshpit/ca.crt on install and on tron upgrade, refuses a root whose fingerprint does not match what the registry reports or that is not CA:TRUE, and keeps it next to the launcher as moshpit-root-ca.crt. The launcher's sync_moshpit_trust imports it into every browser trust store it writes under the nickname Moshpit Root CA, the one moshcode dns enable uses, so neither imports the other's work twice. certutil is now installed on machines that have the shipped root, not only ones with moshcode's certificates. Verified against the live registry: fetch, no-op on rerun, skip switch, a tampered answer refused, and the launcher importing it as C,,. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
ThreatCrush Security Scan56 finding(s) HIGH/CRITICAL: 3 | MEDIUM: 33 | LOW: 20
…and 6 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
TronBrowser ships the Moshpit Root CA. The registry now signs a certificate for every name it holds (moshcoder/moshcode#519), so one root, installed once, makes every Moshpit name trusted over https. No per-name imports, no pins to check, no flags.
How
install.sh ensure_moshpit_root: on install and on everytron upgrade, fetchGET /api/moshpit/caandGET /api/moshpit/ca.crtfrom the registry. Two answers that must agree: the SHA-256 fingerprint the registry reports for its root, and the certificate itself. A mismatch, or a certificate not markedCA:TRUE, is refused with a warning and nothing is installed. Unchanged root: no-op. Kept next to the launcher asmoshpit-root-ca.crt. Skip withTB_NO_MOSHPIT_ROOT=1; another registry withTRONBROWSER_MOSHPIT_REGISTRY.ensure-moshpit-rootsubcommand for retries.launcher/tronbrowser sync_moshpit_trust: the shipped root (and~/.moshpit/ca/registry-root.crt, wheremoshcode dns cakeeps its copy) is imported first into every browser trust database the launcher writes, as an anchor (C,,), under the nicknameMoshpit Root CA, the same onemoshcode dns enableuses, so neither imports the other's work twice.ensure_certutilnow also runs on machines that have only the shipped root, not just ones with moshcode's certificates, since the root ships with TronBrowser itself.Verified
Against the live registry, in a fake app dir and a fake
$HOME:CN=Moshpit Root CA, O=Moshpit, fingerprint4A:57:66:EC:8C:1F:10:F8:…(matches the generated root in the vault);TB_NO_MOSHPIT_ROOT=1skips;Moshpit Root CA C,,.sh -non both scripts.Both halves must land: the tag carries the launcher;
install.shdeploys from main to tronbrowser.dev and is whattron upgraderuns. Origins serving registry-signed chains is the moshpit-proxy PR that follows; until an origin renews, its self-signed leaf still goes through the per-name path.🤖 Generated with Claude Code