[tech] Pre-generated trust stores for various Gemini clients

[panda-roux]

*Look at me.  I am the CA now.*

Jokes aside, I have some questions:

- What's your process for requesting the removal of a domain's certificate from this list?

- Does the software you're using to generate this list respond to any robots.txt directives (i.e. "don't index me" or "expire after x days")?

- Does this break if I arbitrarily decide to change my a cert on my domain, or is it regularly kept up-to-date?  If so, how often?

- Why circumvent TOFU?  I don't mean for this to come across as antagonistic, but doesn't this defeat the purpose of having a decentralized protocol in the first place?

Thanks!

panda-roux

On 6/4/2021 9:48 AM, nervuri wrote:
> Update:
>
> The trust stores [1] are now being generated using Lupa's list of
> capsules [2], merged with the list from geminispace.info [3].  The
> resulting hosts file contains 1124 capsules, 231 more than it did at the
> end of April, when this project started.  The certificates directory
> currently contains 1100 certs.
>
> [1] https://tildegit.org/nervuri/trust-stores
> [2] gemini://gemini.bortzmeyer.org/software/lupa/lupa-capsules.txt
> [3] gemini://geminispace.info/known-hosts