therealaleph
ae948f4075
mhrv-rs --remove-cert (CLI) and Remove CA button (UI) for verified clean-slate revocation. Clears OS trust store, NSS browser stores (Linux Firefox/Chrome), and the on-disk ca/ directory. config.json and the Apps Script deployment are untouched. By-name trust verification runs before browser-state mutation; OS removal failures return RemovalIncomplete with browser state intact so retries are idempotent. Sudo-aware on Unix (re-roots HOME to the real user). 29 new unit tests on the pure logic (Firefox user.js marker handling, getent passwd parsing, NSS stderr classification, NssReport state rules). Tested end-to-end on Windows by the contributor; macOS verified at merge time on real hardware (login keychain delete + NSS-missing fallback). Linux paths await user testing. Closes #121. Thanks @dazzling-no-more. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2.5 KiB
• امکان حذف CA بهصورت verified (#121): فلگ جدید mhrv-rs --remove-cert (CLI) و دکمهٔ Remove CA در UI دسکتاپ. CA رو از trust store سیستمعامل (Keychain مک، anchor dirs لینوکس، Trusted Root ویندوز)، NSS مرورگرها (Firefox/Chrome در لینوکس)، و فولدر ca/ روی دیسک پاک میکنه. config.json و deployment Apps Script شما دست نمیخوره — نیاز به redeploy نیست. قبل از هر کاری با store، یه trust verification by-name انجام میشه؛ اگه remove از سیستمعامل fail بشه، browser state دست نمیخوره و حالت RemovalIncomplete گزارش میشه (retry idempotent). در Unix، اگه با sudo اجرا بشه، HOME رو به user واقعی re-root میکنه تا pathهای user-scoped (NSS profile، login keychain) به /root نرن. ۲۹ unit test جدید پوششدهی pure logic. تست شده end-to-end در ویندوز، و در v1.7.1 من مسیر macOS رو هم با hardware واقعی verify کردم (login keychain delete کار میکنه، NSS certutil-missing graceful fallback میده). مسیر Linux منتظر تست از کاربرها. ممنون از @dazzling-no-more
• Verified CA removal (#121): new mhrv-rs --remove-cert flag (CLI) and a Remove CA button in the desktop UI. Clears the CA from the OS trust store (macOS Keychain, Linux anchor dirs, Windows Trusted Root), NSS browser stores (Firefox/Chrome on Linux), and the on-disk ca/ directory. config.json and your Apps Script deployment are never touched — no redeploy needed. A by-name trust verification runs before any browser-state mutation; if the OS removal fails, browser state is left alone and the call returns RemovalIncomplete (idempotent retries). On Unix, if invoked under sudo, HOME is re-rooted to the real user so user-scoped paths (NSS profile, login keychain) target the user, not root. 29 new unit tests covering the pure logic. Tested end-to-end on Windows by the contributor, and the macOS path was verified on real hardware during merge (login-keychain delete works; NSS-certutil-missing path falls back cleanly). Linux paths await user testing. Thanks @dazzling-no-more