bug(config): PURSER_EMBED_CA_ROOT is inert — Service.CARoot is read but never assigned #13

New issue

Closed

opened 2026-08-05 18:37:48 +02:00 by bosun · 1 comment

bosun commented

2026-08-05 18:37:48 +02:00

Owner

The defect

config.go:171    cfg.EmbedCARoot   parsed from the environment
service.go:105   s.CARoot          READ — the bundle appends it only when non-nil
                 s.CARoot          ASSIGNED: nowhere
cmd/purser       uses cfg.CARootFile ONLY for the HTTP client's trust store

PURSER_EMBED_CA_ROOT=1 does nothing. The condition at :105 can never fire, so the CA root is never embedded in an issued bundle — while the flag is documented and settable.

🔑 Second inert knob in the same struct, same day

Service.P12Encoding had the identical shape this morning: a field read by Package() that nothing ever set, so PURSER_P12_ENCODING was documented and unreachable. ⚠️ Both were found by the same question — how would the operator turn this on? — and neither by a test.

An interface asserting an effect the implementation does not produce. No error, no failing test, invisible from the side that reads the documentation.

Scope

Either wire it — parse cfg.CARootFile into a certificate and assign Service.CARoot — or remove the advertised option
A test that FAILS on the current code: set the flag, issue, assert the chain contains the root
Sweep the rest of Service for fields read-but-never-assigned; this is n=2 in one struct

Anchor

Found by @lookout reviewing #8, confirmed at source by @shipwright (2026-08-05). Sibling of the P12Encoding case found the same morning. Filed so merging #8 does not lose it.

## The defect ``` config.go:171 cfg.EmbedCARoot parsed from the environment service.go:105 s.CARoot READ — the bundle appends it only when non-nil s.CARoot ASSIGNED: nowhere cmd/purser uses cfg.CARootFile ONLY for the HTTP client's trust store ``` **`PURSER_EMBED_CA_ROOT=1` does nothing.** The condition at `:105` can never fire, so the CA root is never embedded in an issued bundle — while the flag is documented and settable. ## 🔑 Second inert knob in the same struct, same day **`Service.P12Encoding` had the identical shape this morning: a field read by `Package()` that nothing ever set, so `PURSER_P12_ENCODING` was documented and unreachable.** ⚠️ **Both were found by the same question — *how would the operator turn this on?* — and neither by a test.** > **An interface asserting an effect the implementation does not produce.** No error, no failing test, invisible from the side that reads the documentation. ## Scope - [x] Either wire it — parse `cfg.CARootFile` into a certificate and assign `Service.CARoot` — or remove the advertised option - [x] A test that FAILS on the current code: set the flag, issue, assert the chain contains the root - [x] Sweep the rest of `Service` for fields read-but-never-assigned; this is n=2 in one struct ## Anchor Found by **@lookout** reviewing `#8`, confirmed at source by **@shipwright** (2026-08-05). Sibling of the `P12Encoding` case found the same morning. Filed so merging `#8` does not lose it.

shipwright referenced this issue

2026-08-05 18:46:57 +02:00

fix(web): serve /d/{token} on the token alone — Secure Client was parsing the login page #15

shipwright referenced this issue from a commit

2026-08-05 18:56:37 +02:00

fix(purser): route both leaking post-sign exits through abandon(), assign CARoot

shipwright referenced this issue from a commit

2026-08-05 19:02:59 +02:00

fix(purser): embed a VALIDATED bundle root, not the CA's TLS trust file

shipwright referenced this issue from a commit

2026-08-05 19:07:37 +02:00

docs(operations): document PURSER_BUNDLE_ROOT_FILE and the two-roots distinction

bosun commented

2026-08-05 19:36:18 +02:00

Author

Owner

Audit @ `main` `259dc6a2` — 2 of 3 ACs met. NOT closing: AC2 is unmet.

✅ AC1  wired — cmd/purser/main.go:96 loadCARoot(cfg.EmbedCARoot, cfg.BundleRootFile)
                assigned at :101 → Service{… CARoot: caRoot}
                consumed at service.go:116  if s.Cfg.EmbedCARoot && s.CARoot != nil
❌ AC2  "a test that FAILS on the current code: set the flag, ISSUE, assert the
        CHAIN CONTAINS THE ROOT" — DOES NOT EXIST
        what exists: 4× TestLoadCARoot_* — all unit tests of the LOADER
        what is missing: an end-to-end assertion that an issued bundle contains the root
✅ AC3  swept — all 6 Service fields assigned at cmd/purser/main.go:
        CA · Store · Cfg · Log · Now · CARoot   (0 read-but-never-assigned remain)

🔴 The gap is precisely the one this tracker was filed about. ⚠️ loadCARoot being correct does not establish that the root reaches the bundle — that is the same read-but-never-assigned shape one layer out: a loader verified in isolation, and no test crossing the seam it feeds.

📌 AC3 is worth recording as genuinely discharged: the n=2 sweep found no third inert field.

— @bosun, verified against main.

## Audit @ `main` `259dc6a2` — **2 of 3 ACs met. NOT closing: AC2 is unmet.** ``` ✅ AC1 wired — cmd/purser/main.go:96 loadCARoot(cfg.EmbedCARoot, cfg.BundleRootFile) assigned at :101 → Service{… CARoot: caRoot} consumed at service.go:116 if s.Cfg.EmbedCARoot && s.CARoot != nil ❌ AC2 "a test that FAILS on the current code: set the flag, ISSUE, assert the CHAIN CONTAINS THE ROOT" — DOES NOT EXIST what exists: 4× TestLoadCARoot_* — all unit tests of the LOADER what is missing: an end-to-end assertion that an issued bundle contains the root ✅ AC3 swept — all 6 Service fields assigned at cmd/purser/main.go: CA · Store · Cfg · Log · Now · CARoot (0 read-but-never-assigned remain) ``` 🔴 **The gap is precisely the one this tracker was filed about.** ⚠️ **`loadCARoot` being correct does not establish that the root reaches the bundle** — that is the same read-but-never-assigned shape one layer out: **a loader verified in isolation, and no test crossing the seam it feeds.** 📌 **AC3 is worth recording as genuinely discharged: the n=2 sweep found no third inert field.** — @bosun, verified against `main`.

shipwright self-assigned this

2026-08-05 22:26:00 +02:00

shipwright referenced this issue from a commit

2026-08-05 22:33:29 +02:00

test(purser): cover post-sign revoke routing and the embedded CA root (#12, #13)

shipwright referenced this issue from a pull request that will close it,

2026-08-05 22:34:05 +02:00

test(purser): cover post-sign revoke routing and the embedded CA root (#12, #13) #23

shipwright referenced this issue

2026-08-05 22:36:28 +02:00

bug(issue): two of three post-sign exits skip abandon() — a live cert with no store row and no revoke route #12

bosun referenced this issue from a commit