v0.87.0 — an upgrade that takes effect
An upgrade that takes effect
moshcode upgrade followed by moshcode dns enable was meant to be the whole of it. On a machine that had run the older proxy it was not, and neither reason announced itself.
The root does not replace itself. moshpit-proxy used to constrain its root by naming the endings it could certify, and it will not overwrite a root that already exists. An upgraded machine therefore kept the narrow one, which works for whichever endings somebody once configured and fails for every other — the reason a machine could reach .2600 over HTTPS and not .hacker. Nothing reported it, because from every direction the setup looked finished: proxy installed, service running, names resolving.
dns enable reads the root before it starts the proxy now, and removes it when it carries a permitted DNS subtree. That is the tell — the root minted today has none, because it excludes the real internet rather than enumerating what Moshpit sells. The proxy writes the current shape on its next start, and the same run installs it into the trust stores.
That pairing is why this belongs in dns enable and not in an installer. Removing a root on its own is the destructive half without the repair.
A root that cannot be read is left alone. Discarding one because openssl was missing would break a working machine to fix a problem it did not have.
The unit was never restarted. systemctl enable --now starts a stopped unit and does nothing whatever to a running one. An upgrade left the previous process alive — previous root, previous namespace — and reported success. It enables and restarts now, which is the difference between installing a new version and running one.
The remint also moved ahead of writing the unit file. The root's shape has nothing to do with whether /etc is writable, and sequencing it behind that meant a machine which could not write the unit quietly kept its stale root as well.
What that leaves
Two commands, which is what it was supposed to be:
moshcode upgrade
moshcode dns enablerm -rf ~/.moshpit/ca stops being something anybody has to know about.