feat(install): install the pinned-TLS proxy, so https:// works without a manual step - #464
Merged
Conversation
…t a manual step `moshcode dns enable` can finish perfectly and every https:// URL still fails. No public CA will ever sign for `.eggs`, so a name answers its origin's own self-signed leaf and a stock client refuses it — correctly. The fix was documented as a separate install of moshpit-proxy, which meant the supported path ended one step short of working and the alternative was trusting certificates one name at a time. install.sh now installs it, and `moshcode update` re-runs install.sh, so an existing install picks it up too. One local root covers every ending instead of per-name trust. MOSHCODE_NO_PROXY=1 skips it: this is the only part of the install that touches the system trust store, so it is the only part with an opt-out. MOSHCODE_PROXY_INSTALLER overrides the source, which is also how the failure paths are tested. No DNS routing is installed and no resolver is started — `dns enable` stays something a person types deliberately. Downloaded first and run second, rather than `curl … | sh`. A pipeline reports the status of its last command, and a `sh` handed empty stdin by a 404 exits 0, so the piped form printed "✓ pinned-TLS proxy installed, local root trusted" for a script that never arrived. Caught by pointing it at a missing URL. Never fatal: a machine that cannot reach GitHub for an optional component still wants the CLI it asked for. Adds warn(), which unlike fail() does not exit. Verified across all five branches — success, installer exits non-zero, 404, unreachable host, and MOSHCODE_NO_PROXY — each reporting honestly and none aborting the install. Suite: 2726 tests, 0 failures. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ThnQwoieWt8VR6N7gtgnhp
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| if ! curl -fsSL "$PROXY_INSTALLER" -o "$_proxy_sh" 2>/dev/null; then | ||
| rm -f "$_proxy_sh" | ||
| warn "could not download the pinned-TLS proxy — moshcode is fine, but https:// on a Moshpit name will not verify" | ||
| warn " retry: curl -fsSL $PROXY_INSTALLER | sh" |
| ok "pinned-TLS proxy installed, local root trusted" | ||
| info " it covers .moshpit by default — for other endings:" | ||
| info " MOSHPIT_PROXY_TLDS=moshpit,eggs,hacker,2600" | ||
| info " undo just this: curl -fsSL $PROXY_INSTALLER | sh -s -- --uninstall" |
| # finish an optional component still wants the CLI it asked for. Said out | ||
| # loud so it is not discovered later as a TLS error with no explanation. | ||
| warn "the pinned-TLS proxy did not install — moshcode is fine, but https:// on a Moshpit name will not verify" | ||
| warn " retry: curl -fsSL $PROXY_INSTALLER | sh" |
ThreatCrush Security Scan5 finding(s) in the 1 file(s) this pull request changes. HIGH/CRITICAL: 5
86 pre-existing finding(s) elsewhere in the repository — **HIGH/CRITICAL**: 3 | **MEDIUM**: 73 | **LOW**: 10Not introduced by this pull request. The full set is in the Security tab.
…and 66 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
moshcode dns enablecan finish perfectly and everyhttps://URL still fails. No public CA will ever sign for.eggs, so a name answers its origin's own self-signed leaf and a stock client refuses it — correctly. The documented fix was a separate install of moshpit-proxy, which meant the supported path ended one step short of working, and the alternative wasdns trustper name.install.shnow installs it, andmoshcode updatere-runsinstall.sh, so existing installs pick it up. One local root covers every ending instead of per-name trust.MOSHCODE_NO_PROXY=1skips it — this is the only part of the install that touches the system trust store, so it's the only part with an opt-outMOSHCODE_PROXY_INSTALLERoverrides the source (also how the failure paths are tested)dns enablestays deliberateThe bug testing caught
Downloaded first, run second, rather than
curl … | sh. A pipeline reports its last command's status, and ashhanded empty stdin by a 404 exits 0 — so the piped form printed✓ pinned-TLS proxy installed, local root trustedfor a script that never arrived.Never fatal either: a machine that can't reach GitHub for an optional component still wants the CLI. Adds
warn(), which unlikefail()doesn't exit.Verified
All five branches, each reporting honestly, none aborting the install: success · installer exits non-zero · 404 · unreachable host ·
MOSHCODE_NO_PROXY=1.Suite: 2726 tests, 0 failures.
🤖 Generated with Claude Code
https://claude.ai/code/session_01ThnQwoieWt8VR6N7gtgnhp