Repository navigation
<
8000
link rel="modulepreload" href="https://github.githubassets.com/assets/fhi-7a633016e960b921.js" crossorigin="anonymous" />
T3 — Issue leaf certificates under a name-constrained root and a keychain-held signing CA #2265
Description
Task
| slice | size | difficulty | model | who | estimated lines |
|---|---|---|---|---|---|
| Clone, push and gh from a box with no token in it | M | needs care | standard | an agent | 490 (350 code, 140 tests) |
A leaf for each GitHub host validates against the root alone, and a leaf for any other name does not.
Covers:
- BEP-013
Layers:
- ca:
- crates/bep/src/ca.rs (new): the three-layer CA of BEP-013: constrained self-signed root, keychain signing CA, leaves for the union alone, re-issue under the same key
- crates/bep/src/lib.rs: module line
- crates/bep/Cargo.toml: the certificate dependency
- Cargo.lock: the certificate dependency
cargo nextest run -p bep prop_root_constraints_equal_registered_unioncargo nextest run -p bep root_recertified_under_same_key_and_subject
Waits on:
- T2 — Hold the proxy's keys non-exportable in the host keychain and publish their public halves #2259
Plan block
### T3 — Issue leaf certificates under a name-constrained root and a keychain-held signing CA
slice: S0
kind: task
covers: BEP-013
size: M
est: 350 code, 140 tests
executor: agent
difficulty: needs care
model: standard
diagnostics: a leaf request for a name outside the union is refused with a log line naming the name and the union it fell outside
observability: one debug log line per leaf issued with the hostname, and one info line per root re-issue naming the changed constraints
layers:
- ca:
- crates/bep/src/ca.rs (new): the three-layer CA of BEP-013: constrained self-signed root, keychain signing CA, leaves for the union alone, re-issue under the same key
- crates/bep/src/lib.rs: module line
- crates/bep/Cargo.toml: the certificate dependency
- Cargo.lock: the certificate dependency
test: cargo nextest run -p bep prop_root_constraints_equal_registered_union
test: cargo nextest run -p bep root_recertified_under_same_key_and_subject
produces:
- crates/bep/src/ca.rs
consumes:
- crates/bep/src/keys.rs
proof: A leaf for each GitHub host validates against the root alone, and a leaf for any other name does not.
depends on:
- blocked by #2259
Reacted by minimal-foundry
Activity
< 922A li class="parentIssueItem__p1smwV">S0 — Clone, push and gh from a box with no token in it #2248
minimal-foundry commentedon Oct 20, 2026
Done. #2438 merged.
branch
agent/2265-issue-leaf-certificates-under-a-name-constrained· epic #1501 · PR #2438611d62d8d693072704e6ac8a242e02b67c1767e987f8e961d27148fd14a50b897bdeb38398f43714Updated 2026-10-20T04:58:57.699Z.