gabriel / muse public
fix transport task/mkcert-tls-strategy #1 / 1
AI Agent gabriel · 143 days ago · Apr 29, 2026 · Diff

fix(transport): use mkcert root CA for localhost TLS verification

Drop the self-signed localhost.crt approach — the server cert is signed by the mkcert CA, not self-signed, so loading it as cafile doesn't work.

_httpx_verify now calls `mkcert -CAROOT` to locate rootCA.pem, with fallbacks to the well-known macOS and Linux paths. This fixes muse pull from freshly init'd repos and from any subprocess that doesn't inherit a pre-configured SSL context.

sha256:a122df6fb14ea15df98d1d777de416c9f579fa973cd8d817c2d62827b8f74af4 sha
sha256:5225b803760927257bacd2c81ba5eeae7db8fcdfebbf07d07545264e25fcf25f parent
+1 ~1 −1 symbols
sha256:964c356425821effe6e3f723e30d19eac14d342b47cb2d4e577aab59f39ac58d snapshot
+1
symbol added
~1
symbol modified
−1
symbol removed
0
dead code introduced
Semantic Changes 3 symbols
~ muse/core/transport.py .py 1 symbol added, 1 symbol removed, 1 symbol modified
− _LOCAL_TLS_CERT variable variable _LOCAL_TLS_CERT L157–158
+ _mkcert_ca function function _mkcert_ca L153–176
~ _httpx_verify
← Older Oldest on task/mkcert-tls-strategy
All commits
Newer → Latest on task/mkcert-tls-strategy

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:a122df6fb14ea15df98d1d777de416c9f579fa973cd8d817c2d62827b8f74af4 --body "your comment"