From dc5c8fd40b4084ee9a0ae938a102dd9a78fa0874 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Mon, 2 Nov 2026 20:40:45 -0800 Subject: [PATCH 1/3] chore(quest): claim quest/m0/host-land/fixer-tls.md Quest-Claim: 1775bfc1ddb15e44 From ccaa28be5a5afcd2339663d52479e49ff604a851 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Mon, 2 Nov 2026 20:50:49 -0800 Subject: [PATCH 2/3] quest: fix the fixer's TLS trust in kixelated/nixos#21, leaving its deploy Co-Authored-By: Claude Opus 5.5 --- quest/m0/host-land/fixer-tls.md | 28 ++++++++++++++++++++-------- 1 file changed, 20 insertions(+), 8 deletions(-) diff --git a/quest/m0/host-land/fixer-tls.md b/quest/m0/host-land/fixer-tls.md index 2095801d..d3973f85 100644 --- a/quest/m0/host-land/fixer-tls.md +++ b/quest/m0/host-land/fixer-tls.md @@ -1,4 +1,4 @@ -# [S] The fixer's container trusts public TLS certificates +# [XS] The fixer's container trusts public TLS certificates ## Goal @@ -20,10 +20,22 @@ Decided 2026-11-01 (user, /quest-plan of the follow-ups from the ([handback](https://github.com/moq-dev/quest/pull/331#issuecomment-6563898322)): its resolution of `test/land.test.ts` was right, but it could not run the Worker suite, so it could not report the fix as tested. -- The fix lands in [kixelated/nixos](https://github.com/kixelated/nixos), in - `modules/quest-land.nix`, which builds the fixer container. A likely - cause is a missing CA bundle at the standard path, or - `SSL_CERT_FILE`/`NIX_SSL_CERT_FILE` not reaching the fixer's dev shell. - Confirm the cause before changing anything. -- Check the land check containers for the same gap, since they run the same - suites. + +Fixed in [kixelated/nixos#21](https://github.com/kixelated/nixos/pull/21) +([moq-dev/quest#440](https://github.com/moq-dev/quest/pull/440)). The cause: +workerd's bundled BoringSSL trusts only `SSL_CERT_FILE` or its default +`/etc/ssl/cert.pem`, while the land image shipped only +`/etc/ssl/certs/ca-certificates.crt` and `NIX_SSL_CERT_FILE`. The check and +fixer containers boot the same image, so both had the gap. The fix links +`/etc/ssl/cert.pem` to the bundle. Run against the built image's `/etc/ssl`, +workerd's outbound `fetch` succeeds. + +What remains is deploying it and checking it on the live host. + +## Waiting + +- Maintainer: deploy [kixelated/nixos#21](https://github.com/kixelated/nixos/pull/21) + through `deploy/quest-land`, since only the maintainer activates the live + host. Then check that a fixer job on a moq-dev/quest PR that touches + `cloudflare/` runs `cd cloudflare && bun run test` without the TLS error, + or run the Worker tests by hand in a fixer container. From 855e7b177f073435f30ccd1090e7945d00337d4a Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Wed, 4 Nov 2026 21:49:47 -0800 Subject: [PATCH 3/3] quest: delete the fixer TLS quest, verified on the live host kixelated/nixos#21 is deployed (generation 80). In the deployed quest fixer image, workerd's outbound fetch returns 200 and the Worker tests pass; removing /etc/ssl/cert.pem reproduces the handback's TLS error. The host-land epic has no children left, so its README takes a size. Co-Authored-By: Claude Opus 5.5 --- quest/m0/host-land/README.md | 6 +---- quest/m0/host-land/fixer-tls.md | 41 --------------------------------- 2 files changed, 1 insertion(+), 46 deletions(-) delete mode 100644 quest/m0/host-land/fixer-tls.md diff --git a/quest/m0/host-land/README.md b/quest/m0/host-land/README.md index 867dbc9a..c271d8e1 100644 --- a/quest/m0/host-land/README.md +++ b/quest/m0/host-land/README.md @@ -1,4 +1,4 @@ -# Merge through a host gate until the merge queue replaces it +# [XS] Merge through a host gate until the merge queue replaces it ## Goal @@ -119,7 +119,3 @@ exactly the tested tree. - Move that branch to GitHub's merge queue instead The exception covers only that work; the rest of the freeze stands. - -## Required - -- [Fixer TLS](/quest/m0/host-land/fixer-tls.md) - the fixer's container trusts public certificates, so workerd and the Worker tests run there diff --git a/quest/m0/host-land/fixer-tls.md b/quest/m0/host-land/fixer-tls.md deleted file mode 100644 index d3973f85..00000000 --- a/quest/m0/host-land/fixer-tls.md +++ /dev/null @@ -1,41 +0,0 @@ -# [XS] The fixer's container trusts public TLS certificates - -## Goal - -The land fixer's nspawn container validates TLS like a normal host, so -workerd and the Cloudflare Worker tests run there. A fixer job on -moq-dev/quest builds and tests the Worker (`cd cloudflare && bun run test`) -without workerd's "TLS peer's certificate is not trusted; reason = unable to -get local issuer certificate". Check it by re-running the fixer on a PR that -touches the Worker, or by running the Worker tests by hand in a fixer -container. - -## Plan - -Decided 2026-11-01 (user, /quest-plan of the follow-ups from the -2026-11-01 `/quest-complete` sessions): ✅ plan it, [S], in this epic. - -- The fixer handed back - [moq-dev/quest#331](https://github.com/moq-dev/quest/pull/331) for this - ([handback](https://github.com/moq-dev/quest/pull/331#issuecomment-6563898322)): - its resolution of `test/land.test.ts` was right, but it could not run the - Worker suite, so it could not report the fix as tested. - -Fixed in [kixelated/nixos#21](https://github.com/kixelated/nixos/pull/21) -([moq-dev/quest#440](https://github.com/moq-dev/quest/pull/440)). The cause: -workerd's bundled BoringSSL trusts only `SSL_CERT_FILE` or its default -`/etc/ssl/cert.pem`, while the land image shipped only -`/etc/ssl/certs/ca-certificates.crt` and `NIX_SSL_CERT_FILE`. The check and -fixer containers boot the same image, so both had the gap. The fix links -`/etc/ssl/cert.pem` to the bundle. Run against the built image's `/etc/ssl`, -workerd's outbound `fetch` succeeds. - -What remains is deploying it and checking it on the live host. - -## Waiting - -- Maintainer: deploy [kixelated/nixos#21](https://github.com/kixelated/nixos/pull/21) - through `deploy/quest-land`, since only the maintainer activates the live - host. Then check that a fixer job on a moq-dev/quest PR that touches - `cloudflare/` runs `cd cloudflare && bun run test` without the TLS error, - or run the Worker tests by hand in a fixer container.