gabriel / muse public
feat minor security task/restore-hub-trust #1 / 1
gabriel · 153 days ago · Apr 9, 2026 · Diff

feat(security): restore hub_trust TOFU pinning module

hub_trust.py was stashed on feat/security-controls and never committed, leaving transport.py's lazy import permanently failing with: ⚠️ Hub trust check failed: No module named 'muse.core.hub_trust'

Restores the module so TOFU certificate pinning works on push/pull. The CLI trust command and its tests remain in the stash for a separate PR.

sha256:11db926a2524e20789897959cc59aed3b80f29771861232ed76db1153f1d5124 sha
sha256:43d80e74d71a31d8a52aa5b9f5f59724095341b145a7a4441997fcf316dd1341 parent
+17 symbols
sha256:8b64d67dbdc1e0e48d702672a2f702e36b5a832c620fa4cd6215ba82bb57c6a5 snapshot
+17
symbols added
0
dead code introduced
Semantic Changes 17 symbols
~ muse/core/hub_trust.py .py 17 symbols added
+ HTTP_NO_TLS_SENTINEL variable variable HTTP_NO_TLS_SENTINEL L55–55
+ HubTrustRecord class class HubTrustRecord L58–64
+ HubTrustStore variable variable HubTrustStore L67–67
+ _HUB_TRUST_FILE variable variable _HUB_TRUST_FILE L52–52
+ _cert_fingerprint_from_response function function _cert_fingerprint_from_response L164–199
+ _normalise_hostname function function _normalise_hostname L70–85
+ _save_hub_trust_store function function _save_hub_trust_store L125–144
+ check_and_pin function function check_and_pin L202–269
+ TypedDict import import TypedDict L48–48
+ annotations import import annotations L42–42
+ logging import import logging L44–44
+ os import import os L45–45
+ pathlib import import pathlib L46–46
+ tomllib import import tomllib L47–47
+ load_hub_trust_store function function load_hub_trust_store L88–122
+ logger variable variable logger L50–50
+ remove_hub_record function function remove_hub_record L147–161
← Older Oldest on task/restore-hub-trust
All commits
Newer → Latest on task/restore-hub-trust

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:11db926a2524e20789897959cc59aed3b80f29771861232ed76db1153f1d5124 --body "your comment"