a73x/eitri
Watch
1
0
Fork
You've already forked eitri
 0
Code Issues 52 Pull requests Projects Releases 1 Packages Wiki Activity Actions

vmssh: the CA set is only blamed when the row proves it #118

Merged
a73x merged 2 commits from fix/vmssh-refusal into main 2026-09-02 14:12:03 +00:00
Conversation 0 Commits 2 Files changed 4 +276 -16
a73x commented 2026-09-02 08:56:03 +00:00 (Migrated from git.a73x.sh)
Copy link

[claude 2026-09-02] handshakeError now takes the delegating CA's fingerprint (read off the offered certificate) and the VM's frozen trusted_cas (threaded through vmLookup). The mismatch message is claimed only when the set is known, readable whole, and excludes the delegating CA; otherwise the refusal says the set does include it (or that nothing here can compare) and names the four guest-side causes — trust file/drop-in overwritten (agents older than v0.0.8 with BYO write_files), clock outside the cert window, principal mismatch — and points at the console. Eight vmssh tests plus one boot lookup test.

Migrated from git-collab patche 3497ecbd3bcf2ed748d09b0f7285cb1044d9c5b5.

Original author: a73x dev@a73x.sh.

Fixes #115

Revision 1: 82e03a851104ed960ec28ee3f6054e6cc4904de2; base 81b4b6c1ca2b07794222ef7cd452e02d7dec46b4

[claude 2026-09-02] handshakeError now takes the delegating CA's fingerprint (read off the offered certificate) and the VM's frozen trusted_cas (threaded through vmLookup). The mismatch message is claimed only when the set is known, readable whole, and excludes the delegating CA; otherwise the refusal says the set does include it (or that nothing here can compare) and names the four guest-side causes — trust file/drop-in overwritten (agents older than v0.0.8 with BYO write_files), clock outside the cert window, principal mismatch — and points at the console. Eight vmssh tests plus one boot lookup test. --- Migrated from git-collab patche `3497ecbd3bcf2ed748d09b0f7285cb1044d9c5b5`. Original author: a73x <dev@a73x.sh>. Fixes #115 Revision 1: `82e03a851104ed960ec28ee3f6054e6cc4904de2`; base `81b4b6c1ca2b07794222ef7cd452e02d7dec46b4`
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
backlog

   
dev

   
legacy-patch
Historical git-collab patch state

  
merged
Historical git-collab patch state

  
planning

   
review
No labels
backlog
dev
legacy-patch
merged
planning
review
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
a73x/eitri!118
No description provided.