Envd certs support

[sitole]

No description provided.

[cursor]

PR Summary

Medium Risk
Touches sandbox initialization and executes OS-level trust-store updates (update-ca-certificates) based on remote input; while names are sanitized, bad PEM or missing tooling/permissions could break TLS or slow init.

Overview
Adds end-to-end support for injecting custom CA certificates into sandboxes: the orchestrator’s egress proxy can now expose CACertificates() which are carried on Sandbox and sent in the /init payload, and envd writes the provided PEM certs into the system CA directory (with filename validation) before running update-ca-certificates so sandbox TLS can trust the proxy/extra roots.

^{Written by Cursor Bugbot for commit 377807f. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

Autofix Details

Bugbot Autofix prepared fixes for both issues found in the latest run.

• ✅ Fixed: CA cert installation is async causing a race condition
  • SetData now schedules CA certificate installation in the same WaitGroup as volume mounts and waits before returning so /init only responds after cert setup completes.
• ✅ Fixed: Missing compile-time interface check for NoopEgressProxy
  • Added var _ EgressProxy = (*NoopEgressProxy)(nil) to enforce compile-time interface conformance for NoopEgressProxy.

Or push these changes by commenting:

@cursor push 130914f64c

Preview (130914f64c)

diff --git a/packages/envd/internal/api/init.go b/packages/envd/internal/api/init.go
--- a/packages/envd/internal/api/init.go
+++ b/packages/envd/internal/api/init.go
@@ -217,12 +217,15 @@
 		a.defaults.Workdir = data.DefaultWorkdir
 	}
 
+	var wg sync.WaitGroup
 	if data.CaCertificates != nil && len(*data.CaCertificates) > 0 {
-		go a.installCACerts(context.WithoutCancel(ctx), *data.CaCertificates)
+		certs := *data.CaCertificates
+		wg.Go(func() {
+			a.installCACerts(context.WithoutCancel(ctx), certs)
+		})
 	}
 
 	if data.VolumeMounts != nil {
-		var wg sync.WaitGroup
 		for _, volume := range *data.VolumeMounts {
 			logger.Debug().Msgf("Mounting %s at %q", volume.NfsTarget, volume.Path)
 
@@ -230,9 +233,8 @@
 				a.setupNfs(context.WithoutCancel(ctx), volume.NfsTarget, volume.Path)
 			})
 		}
-
-		wg.Wait()
 	}
+	wg.Wait()
 
 	return nil
 }

diff --git a/packages/orchestrator/pkg/sandbox/network/egressproxy.go b/packages/orchestrator/pkg/sandbox/network/egressproxy.go
--- a/packages/orchestrator/pkg/sandbox/network/egressproxy.go
+++ b/packages/orchestrator/pkg/sandbox/network/egressproxy.go
@@ -22,6 +22,8 @@
 // NoopEgressProxy is a no-op implementation of EgressProxy.
 type NoopEgressProxy struct{}
 
+var _ EgressProxy = (*NoopEgressProxy)(nil)
+
 func NewNoopEgressProxy() NoopEgressProxy {
 	return NoopEgressProxy{}
 }

_{This Bugbot Autofix run was free. To enable autofix for future PRs, go to the Cursor dashboard.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}