Repository navigation
Verify the FOG server's TLS certificate instead of curl -k - #196
Merged
Merged
Conversation
Every FOS call to the server passed curl -k, so FOS never checked who answered for $web (fos#102). All ten call sites now go through bin/fog.curl, which picks one of three modes: - pinned: fogpin= on the kernel command line. The server's public key must hash to it (-k --pinnedpubkey); a mismatch is curl exit 90. - verified: no pin. The chain is checked against the CA bundle the init now carries (BR2_PACKAGE_CA_CERTIFICATES on all three arches). - insecure: no pin, and the chain does not verify. Warn once per boot, then -k, as before. The pin travels on the command line, not in a file injected into init.xz: iPXE delivers both over the same channel, and an injected pin goes stale when the certificate rotates. ADR-0020 records the reasoning. tests/checks/tls-trust.sh runs the shipped fog.curl against real curl and a local HTTPS server; each case was made to fail by reintroducing its defect. The six harnesses that stub curl now stage fog.curl too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The server half (FOGProject/fogproject feat/fos-tls-pin) sends fogpin= on its own under https, so the warning names the cause rather than an admin step that has no setting. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
FOS called the FOG server with
curl -kon every request (#102). All ten call sites now go throughbin/fog.curl:fogpin=on the kernel command line. The server key must hash to it (-k --pinnedpubkey). A mismatch is curl exit 90, and the call fails.BR2_PACKAGE_CA_CERTIFICATESon all three arches).-kas before.The pin travels on the command line, not in a file injected into
init.xz. ADR-0020 records why.Server half, to land first: FOGProject/fogproject
feat/fos-tls-pin(working-1.6) andfeat/fos-tls-pin-rc(rc-1.6.0).Verification
tests/checks/tls-trust.sh(new) runs the shippedfog.curlagainst real curl and a local HTTPS server. 14/14 pass. Each case failed when its defect was reintroduced.tests/run-all.sh: 30 passed, 0 failed./bin/fog.curland/etc/ssl/certs/ca-certificates.crt(150 certs). The compressed init grew by 272 KB.Closes #102
🤖 Generated with Claude Code