v0.86.0 — a root that scales

The trust gate learns the shape that scales

moshpit-proxy no longer mints a root that lists the endings it may certify. It excludes the real internet instead — all 1438 delegated top-level domains, and nothing permitted — which covers every Moshpit ending that exists or ever will, with nothing to configure.

That change was forced by arithmetic. Permitting each ending individually means 18224 permitted subtrees, roughly 214 KB of name constraints in a certificate sent on every handshake, and a list that is stale the next time the registry sells one. In practice it meant a machine served whichever endings someone had thought to name: .2600 worked over HTTPS and .hacker did not, each broken in whichever half it had not been configured for.

This gate refused the new root. It required a permitted DNS subtree, and the new shape has none by design, so dns enable's trust step would have refused every root the proxy minted from today onward.

The difficulty is real rather than cosmetic. No permitted subtree is also exactly what an unconstrained root looks like: RFC 5280 §4.2.1.10 leaves a name type unrestricted when nothing permits it, which is what makes the new shape cover the whole namespace — and what would let a root with no constraints at all pass a check that merely noticed a permitted list was absent. Installing that root would be a genuine hole dressed as a convenience, which is the one thing this gate exists to prevent.

So the difference is established rather than assumed, against the same IANA list this tool has refused to sell endings from since v0.80.0. A root that excludes the internet cannot forge your bank, which is the property the old shape bought by enumeration. Below a thousand excluded top-level domains it is not that shape at all — it is an unconstrained root with a few names crossed out, and it is refused.

Checked against real certificates rather than fixtures: a root minted by the new proxy is accepted and reports excludes all 1438 real top-level domains; a root carrying no constraints is refused; a root excluding only .com and .net is refused for excluding two.

A root minted before a top-level domain was delegated does not exclude it. That is a real gap and a small one, so it is reported rather than made fatal — refusing there would mean refusing every root on the day IANA adds a name.

One less thing in the unit

dns service no longer writes MOSHPIT_PROXY_TLDS. It had been set from the registry's ending list, which would have put a roughly 150 KB environment variable into a unit file for a list stale the next time an ending was sold. The proxy reads an unset value as every Moshpit ending now, so there is nothing to pass. A test asserts the unit does not grow when handed 18224 endings, because the failure it guards against is silent: a unit too large to execute, written successfully.

Upgrading

The root changed shape, so it has to be regenerated and trusted once:

rm -rf ~/.moshpit/ca
curl -fsSL https://raw.githubusercontent.com/profullstack/moshpit-proxy/main/install.sh | sh
moshcode dns disable && moshcode dns enable

Both http:// and https:// should then work on every Moshpit ending, including ones sold after this release.