Skip to content

Refuse to serve the Halibut identity committed to this repository

Placeholder ppxd requested to merge feat/selfcert-enforcement into main

Summary

  • appsettings.json ships a real, working PKCS#12 under SelfCert:Base64 with its password beside it. That certificate is the Halibut server identity — the thumbprint every Tentacle pins for mTLS. A deployment is expected to override it, but nothing enforced that, so a deploy that forgot silently served the public identity: anyone with repository read access could impersonate the server to every agent trusting that thumbprint and dispatch scripts across the fleet.
  • SelfCertValidator rejects it at startup. An absent identity is refused unconditionally (no mode substitutes for a missing one, and this beats an opaque FormatException from inside the loader). A known-published thumbprint follows SQUID_SELFCERT_ENFORCEMENT: off allows silently, warn allows and logs, strict refuses. Any other certificate is allowed in every mode.
  • The default is strict, not the shared warn — a warning about a published server identity is easy to miss and the consequence is fleet-wide impersonation. Same call the master-key guard made.

Operational consequence

A server whose config still carries the committed certificate will now refuse to start, naming the thumbprint and the env var that overrides the decision. Deployments that template their own appsettings are unaffected. Rotating the committed certificate must add its old thumbprint to KnownPublishedThumbprints, never replace it, so operators still running the previous one keep being told.

Test plan

  • Unit: full (certificate × mode) matrix, including that a deployment-specific certificate is allowed in every mode
  • Unit: drift guard recomputes the thumbprint from the real appsettings.json rather than trusting the pinned constant
  • Unit: wiring tests resolve HalibutRuntime from a real Autofac container, so the guard being on the identity path is pinned, not just the guard itself
  • Mutation: deleting either call site from HalibutModule left the whole suite green before those wiring tests; each of the three mutants now fails
  • Hermetic under SQUID_SELFCERT_ENFORCEMENT unset, off and warn — 17/17 in all three
  • Full unit suite green

Merge request reports