security(mesh): verify_record and verify_cert derive their CA anchor from different operator inputs — under-documented fail-closed footgun #106
Labels
No labels
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
femboy/yip#106
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
verify_record derives its CA set from self.roots (the root-node pubkey entries) while verify_cert/ingest_record use the separately-configured ca_public (bin/yipd/src/membership.rs:220 vs :240). These only agree if the operator also places the CA's Ed25519 key as a root entry (as every test fixture does). The natural reading of 'root set = bootstrap nodes' lists node keys — then verify_record fails closed and mesh registration/roaming silently never verifies. Fail-closed (availability, not a break) but no load-time check and no test can catch a divergence (fixtures make them equal). Fix: assert the CA key is among the roots at load; document the relationship.
See docs/2026-07-25-project-review-and-roadmap.md for the full review synthesis.