Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[Bug]: herd secure requires admin on every call because the leaf certificate is added to the System keychain

Aperta
  • Qualcosa non va?
#1,752 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
63/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
macos, php, shell
Ambito
cli, security

Direzione di ricerca

Start by reading Site.php around lines 741 and 751, then trace secure() into unsecure() around lines 859–862. Reproduce the two administrator prompts on a managed macOS account and verify whether securing a new site can complete without elevation when the CA is already trusted; done means the documented expected behavior is confirmed and covered by an appropriate regression check.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

macOS
Platform

macOS

Operating system version

macOS 27

System architecture

ARM64 (M1, M2, etc)

Herd Version

1.30.1

PHP Version

PHP 8.2.8 (built: Jul 7 2023)

Bug description

herd secure prompts for an administrator password every time it is run, not only the first time. The 1.11.0 changelog states the CA only needs to be trusted once, which matches the CA handling, but securing an individual site still requires elevation on every call.

This blocks managed estates where developers are not local administrators. Ours is a Cyber Essentials Plus requirement, and the developer has 116 secured sites, so every one needs IT involvement.

What we verified:

  • The CA is present and correctly trusted. security verify-cert -c on the Valet CA returns "certificate verification successful".
  • Site certificates are signed by that CA. Across 116 secured sites, every certificate's issuer exactly matches the CA's subject.
  • Site.php line 741 adds the CA to the System keychain with trustRoot. This is the one-off operation described in the changelog and it works as documented.
  • Site.php line 751 additionally adds each individual site certificate to the System keychain with trustAsRoot, through sudo. This runs on every herd secure and is what forces the prompt.

Question: given each site certificate already chains to a CA installed as a trusted root at line 741, is adding the leaf certificate at line 751 necessary? If it could be skipped when the CA is already trusted, herd secure would work for a standard user with no elevation at all.

Contributing to this, secure() reaches unsecure(), which makes unconditional sudo calls to security delete-certificate at lines 859 to 862, outside the check for whether a certificate exists. Securing a brand new site with no existing certificate therefore produces two prompts rather than one.

Steps to reproduce
  1. On a managed Mac, have the developer account be a standard user with no sudo entitlement.
  2. Install Herd and authorise the privileged helper.
  3. Secure any site once while an administrator, so the CA is created and trusted.
  4. Confirm the CA is trusted:
    security verify-cert -c "$HOME/Library/Application Support/Herd/config/valet/CA/LaravelValetCASelfSigned.pem"
    Returns "certificate verification successful".
  5. As the standard user, create a new empty site folder in a parked directory.
  6. Run herd secure in it.

Expected: the site is secured without elevation, since the CA is already trusted.
Actual: two administrator password prompts, and the command cannot complete because the account has no sudo rights.

Relevant log output
Site.php:741
  sudo /usr/bin/security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain "$caPemPath"

Site.php:751
  sudo /usr/bin/security add-trusted-cert -d -r trustAsRoot -k /Library/Keychains/System.keychain "$crtPath"

Site.php:859-862 (inside unsecure, called from secure)
  sudo /usr/bin/security delete-certificate -c "%s" /Library/Keychains/System.keychain
  sudo /usr/bin/security delete-certificate -c "*.%s" /Library/Keychains/System.keychain
  sudo /usr/bin/security find-certificate -e "%[email protected]" -a -Z | ...

Certificate chain confirmation:
  site cert issuer=  /O=Laravel Valet CA Self Signed Organization/CN=Laravel Valet CA Self Signed CN/OU=Developers
  CA         subject= /O=Laravel Valet CA Self Signed Organization/CN=Laravel Valet CA Self Signed CN/OU=Developers
Lingua principale
Nessun dato sulla lingua
Stelle
124
Fork
1
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di beyondcode/herd-community

Tutte le issue di beyondcode/herd-community

Issue simili

Altre issue su CLI

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.