feat(installer): wire the corporate CA into cosign/helm/git, not just curl (#583)

[shujaatTracebloc]

What & why

Closes#583 (child 2/4 of #578, network resilience — the single biggest lever for enterprise networks).

A TLS-inspecting corporate proxy re-signs HTTPS with a corporate root CA. Tools that don't trust that root fail x509 — the class behind both field failures (the k3d-checksum failure and the cosign/sigstore verification failure). curl already honored CURL_CA_BUNDLE, and the k3d nodes got the CA at cluster-create (#424), but cosign, helm, and git got nothing. This PR extends the same resolved CA to every host tool that doesn't inherit the system trust store on its own.

Changes

Bootstrap — cosign (install.sh, install.ps1; not manifested — the trust root)

• Before cosign runs, export SSL_CERT_FILE from TRACEBLOC_CA_BUNDLE / CURL_CA_BUNDLE. cosign's Go HTTPS client reads SSL_CERT_FILE (added to the roots on modern Go, incl. Windows), so keyless verification's calls trust the corporate CA instead of failing x509. No-op when unset.

Main installer — helm / git / curl (cluster.shwire_ca_trust, install-k8s.ps1Set-ToolTrust)

• Export SSL_CERT_FILE + GIT_SSL_CAINFO (+ CURL_CA_BUNDLE) from the resolved bundle, before preflight's HTTPS probes and any tool download, so helm, git and curl all trust it end-to-end.
• One plain-language line: Trusting your company's certificate for cosign, helm, git and downloads.
• Idempotent; no-op when unconfigured; fails fast (before any privileged step) on a set-but-unreadable bundle — reusing the existing _resolve_ca_bundle / Resolve-CaBundle contract.

On the acceptance criteria

• Inspected-but-not-blocked networks complete, verified: when a CA is provided it's trusted by every tool; when it isn't, tools fall back to the system store (which enterprise IT usually populates) — so the common case needs no user knowledge of CAs.
• Cross-platform, one-to-one:wire_ca_trust ↔ Set-ToolTrust, bootstrap wiring on both.
• PII-free output: the announce names no paths or secrets.
• The k3d nodes remain trusted separately at cluster-create (fix(installer): corporate MITM CA never reaches the k3d nodes — in-cluster pulls x509-fail on TLS-inspecting networks #424, unchanged).

Tests

• bash:wire_ca_trust exports the three vars / no-ops when unset / hard-fails on an unreadable bundle (cluster.bats); the bootstrap integration test runs the real bootstrap with TRACEBLOC_CA_BUNDLE set and a recording mock cosign, asserting cosign saw SSL_CERT_FILE (install-bootstrap.bats).
• PowerShell:Set-ToolTrust exports SSL_CERT_FILE/GIT_SSL_CAINFO / no-ops when unset (install-k8s.Tests.ps1); the bootstrap sets SSL_CERT_FILE from the CA env (install.Tests.ps1).
• Full Pester 436/0/9; cluster.bats 78/0; manifest --check, check-facts, check-style clean. (cluster.sh / install-k8s.* are manifested — manifest.sha256 regenerated; the bootstrap scripts are the trust root and stay unmanifested.)

Notes

• Builds on Network resilience (1/4): preflight network probe + plain-language network profile #582's detection (child 1/4) but ships independently — this is the acting layer.
• The offline-Rekor / expired-cert cosign case (no live sigstore) is the separate Network resilience (3/4): offline Sigstore bundle — verify --offline, no live Rekor (cross-repo: signing + release) #584 offline-bundle track.
• The one local test failure anywhere is the pre-existing macOS-only install-bootstrap "early bailout" flake (passes on CI Linux; untouched here).

---

Note

Medium Risk
Changes installer TLS trust wiring across bootstrap and main install paths on all platforms; behavior is platform-gated and fail-fast, but mistakes could still affect cosign/git/helm behind corporate proxies.

Overview
Corporate CA trust is applied earlier and more honestly across the installer stack (#583), so TLS-inspecting proxies fail at setup with clear errors instead of mid-download x509 failures.

On Linux, wire_ca_trust (bash) sets SSL_CERT_FILE and GIT_SSL_CAINFO from TRACEBLOC_CA_BUNDLE / CURL_CA_BUNDLE only when those vars are unset; it does not overwrite CURL_CA_BUNDLE. The main install-k8s flow calls this before preflight and tool downloads. Bootstrap install.sh adds _bootstrap_wire_ca so cosign sees SSL_CERT_FILE on Linux before manifest verification.

On macOS, the same helpers validate the bundle path but export nothing—Go tools use Keychain, and exporting could shrink curl trust—users get Keychain/offline hints instead.

On Windows, Set-ToolTrust sets onlyGIT_SSL_CAINFO (not SSL_CERT_FILE); install.ps1 validates CA readability before cosign but likewise does not wire PEM into Go tools, with hints to use the certificate store or offline installer.

User messaging distinguishes what was wired vs pre-set bundles kept (replace-not-augment), avoiding false “Trusting…” success when nothing changed. Tests cover Linux/macOS bootstrap behavior, wire_ca_trust edge cases, and PowerShell Set-ToolTrust.

^{Reviewed by Cursor Bugbot for commit 1b40cbe. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

Taking this over from @shujaatTracebloc at Lukas's request (assignee updated per the handover rule — author unchanged).

Review verdict on the CA wiring itself: sound. All six earlier Bugbot findings are fixed at head (only-if-unset augment-safe exports, no CURL_CA_BUNDLE clobber, honest per-platform announce — Go ignores SSL_CERT_FILE on Windows/macOS so it isn't claimed there, fail-fast on unreadable bundles incl. the PS OpenRead probe). manifest.sha256 recomputed clean. No #591-class encoding risk — the PS side never reads file contents (zero-byte readability probe only) and bash only tests -f/-r.

One gap, now fixed in the pushed commit: the 20 new bats assertions were written without || return 1, so under bats they were advisory — a CA-wiring regression would have passed silently, and #527's incoming bats-hygiene gate would fail on exactly these lines. Hardened all 20 (cluster.bats ×15, install-bootstrap.bats ×5); both suites pass with enforcement on. The Pester additions are fine as-is (Should throws).

bugbot run

[LukasWodka]

Fixed both Bugbot findings — same root, same resolution as the PR's own Windows decision: on macOS, wire nothing.SSL_CERT_FILE helped neither cosign nor helm there (Go reads the Keychain) while shrinking OpenSSL-curl's download trust to the corp root; and the git success claim was false — Apple's SecureTransport git ignores GIT_SSL_CAINFO, including during Homebrew's own bootstrap clone. Darwin now exports neither var and prints one honest Keychain hint covering git/cosign/helm. Readability fail-fast unchanged on every platform. Tests pinned at both layers (lib + bootstrap, with a stubbed uname so they don't flip by host OS); manifest regenerated; suites green.

bugbot run

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 33d6744. Configure here.}

[LukasWodka]

Fixed: both wire_ca_trust and Set-ToolTrust now track wired-vs-kept per variable — the green success names only what was actually exported, and a kept pre-set bundle gets an explicit "make sure that bundle includes your company's CA" hint instead of a false claim. Pinned at both layers: both-kept → no claim + hint (bats + Pester), partial pre-set → success names only the wired half (bats). Manifest regenerated; cluster.bats 85/85, Pester Set-ToolTrust 4/4.

bugbot run