fix: address post-merge trust anchor follow-ups - #172
Conversation
0926c1e to
2b9c333
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2b9c333cea
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The [#172] reference was used in the changelog entry but the corresponding URL definition was missing from the links section. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR follows up on #171 by refining trust-anchor behavior during verify and connect, and aligning docs/examples with the updated JSON fields.
Changes:
- Prevents
verify’s pre-verification AIA/intermediate assembly pass from loading system roots by forcing a non-system trust store during that bundle walk. - Updates
connecttrust-anchor computation to include intermediates from all verified chains (not just the first). - Updates docs and examples to mention
trust_anchors/trust_warningsin JSON output and records the behavior fix in the changelog.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
internal/verify.go |
Forces pre-verification bundle walk to avoid system-root loading; adds a test hook for bundling. |
internal/verify_test.go |
Adds coverage ensuring the pre-verification bundle call doesn’t verify and doesn’t select system roots. |
cmd/certkit/connect.go |
Aggregates intermediates from every verified chain when computing trust anchors/warnings. |
cmd/certkit/connect_test.go |
Adds coverage for trust-intermediate aggregation across multiple verified chains. |
README.md |
Documents trust_anchors / trust_warnings presence in JSON output. |
EXAMPLES.md |
Mirrors JSON trust-field documentation in example usage. |
CHANGELOG.md |
Notes the fixed trust-anchor follow-ups under Unreleased. |
.claude/docs/architecture.md |
Updates architecture notes to reflect current trust-anchor computation behavior. |
…verification walk The pre-verification bundle walk uses TrustStore="custom" with no roots to gather intermediates without requiring system root availability. However, Bundle() recomputes AIAUnresolvedCount against that empty pool, marking issuers as unresolved even when AIA fetching succeeded. This caused verifyTrustAnchors to misreport "AIA resolution incomplete" when the actual failure was a trust source mismatch. Now clear AIAIncomplete only when there are no genuine AIA fetch warnings (HTTP failures, URL rejections), preserving the signal for real AIA problems while eliminating the false positive from root pool matching. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: df6cd47d24
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 455859425a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d0eae15b29
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Summary
Context
Follow-up for after-merge review comments on #171:
Testing