Keep the iroh relay TLS hotfix on main

Closed
AU
4d ago
+128-3

Summary

v0.65.2.1 and v0.65.2.2 stopped cmux-tui from trusting the leaked emSign roots, but those commits exist only on release/v0.65.2.*. Main still has the old iroh config. The default cmux-tui build doesn't compile iroh (iroh-transport is off) and the macOS app's own iroh library already uses the system verifier, so this doesn't change that shipped binary. It keeps main matching the hotfix for anything built with iroh-transport, such as cmux-terminal-client.

This brings over the same change: iroh's platform-verifier feature, CaTlsConfig::system() on the endpoint builder, and the guard test. The version bump and changelog edits from the hotfix are left out.

Related: https://github.com/manaflow-ai/cmux/issues/25452 stays open. iOS packages still pin an xcframework without this change (Packages/Shared/CmuxTerminalClient/Package.swift) until it's rebuilt and re-pinned, and coderouter deliberately uses bundled webpki roots.

Testing

python3 tests/test_cmux_tui_no_bundled_webpki_roots.py: 5 tests pass, but it doesn't check the ca_tls_config line and still passes without it. Rust CI is the compile check.

Changelog

No entry: 0.65.2.1 already announced this.

Base 21dcc2b27b2ed014d723067ed253702e914d97ca, head 18397e3684d038c1077b9008a5da5a0d1879e986. Agent: Claude Code.

馃 Generated with Claude Code

Autofix with [code]smith
Open in [code]smith 路 Need help on this PR? Tag @codesmith-bot with what you need.

Summary by cubic

Forward-ports the emSign TLS fix from the v0.65.2.x hotfix branches to main, so a release cut from main won't go back to trusting the leaked emSign (eMudhra) root certificates.

  • Enables iroh's platform-verifier feature and sets CaTlsConfig::system() on the relay endpoint, so relay TLS is verified against the OS trust store instead of iroh's compiled-in root list.
  • Adds and registers a Python guard test that fails if a bundled webpki root list is reintroduced or if the CaTlsConfig::system() call is removed.
  • Leaves out the version bump and changelog edits from the hotfix.

Related: https://github.com/manaflow-ai/cmux/issues/25452 (stays open).

Summary by CodeRabbit

  • Improvements
    • Relay connections now verify TLS certificates using the operating system鈥檚 trust store instead of a bundled root certificate list.
  • Tests
    • Added checks that relay TLS verification uses the platform verifier and that bundled WebPKI roots are not used. The checks cover dependency configuration, manifests, and source code to help catch future changes that could reintroduce bundled roots.