Open the origin directly, and trust the store curl actually reads

[ralyodio]

Two defects found by installing this on a real machine rather than by reading it.

1. Every connection went through a gateway that terminates TLS

The proxy relayed to pit.moshcode.sh:443, which only works if the gateway passes the connection through by SNI (ssl_preread). It terminates instead — so every name presented the gateway's own certificate and the proxy refused all of them. Correctly, and uselessly:

refuse alt.2600:     key mismatch, presented ErIMn03cxhS+PK7UKUcSOY5pqegEhCn8Xvw4k3LqAnw=
refuse chovy.hacker: key mismatch, presented ErIMn03cxhS+PK7UKUcSOY5pqegEhCn8Xvw4k3LqAnw=
refuse seo.rank:     key mismatch, presented ErIMn03cxhS+PK7UKUcSOY5pqegEhCn8Xvw4k3LqAnw=

Three different names, one identical key. Anyone following the README hit this — the proxy looked broken while it was in fact doing its job.

The registry already publishes each name's target, so the proxy now dials the origin and falls back to the gateway only when there is no target.

This changes nothing about trust. The pin still decides whether the connection lives, so a target pointed somewhere hostile fails exactly the same check. It removes a hop that has to be configured precisely right to work at all.

Target parsing handles host, host:port, [v6]:port and bare IPv6 — 2604:a880::1 has plenty of colons and no port, so splitting on the first one would be wrong.

2. moshpit-trust never touched the store curl reads

It covered NSS and the macOS keychain. curl, wget, git and Node read /etc/ssl/certs, which it left alone — so curl <name> still failed with a self-signed certificate error on a machine that had been "set up". On a headless box it reported 0 of 1 set up and there was nothing it could do.

It now installs into the distribution's anchor directory (Debian, RHEL and Arch layouts, first match only) and runs the matching refresh.

The read-back checks the bundle contains the root, not merely that a file landed in a directory. That is the failure worth catching: update-ca-certificates ignores any file not ending in .crt — silently, exiting zero.

Verified

On the box, all four live names over stock configuration — no MOSHPIT_GATEWAY_HOST, no local pin file:

ok alt.2600     (registry) TLSv1.3 hybrid-pq
ok auto.hacker  (registry) TLSv1.3 hybrid-pq
ok seo.rank     (registry) TLSv1.3 hybrid-pq
ok chovy.hacker (registry) TLSv1.3 hybrid-pq

curl returns 200 for each with no -k. Suite: 61 pass, 0 fail (was 51).

Known limitation

An override supplies pins and no target, so an override-pinned name still relays through the gateway. Overrides exist for private grids that may have no registry at all, so skipping it is deliberate — letting an override carry its own target is the follow-up, not something to bolt on here.

🤖 Generated with Claude Code

[github-actions]

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.