fix(compat): skip dev-*.pem roots in production builds (PILOT-284)

internal/transport/compat/roots.go

@@ -33,6 +33,11 @@ import (
 //go:embed roots/*.pem
 var rootsFS embed.FS
 
+// skipDevPems controls whether development root certs (files starting
+// with "dev-") are excluded from the trust pool. Default true;
+// roots_dev.go (compiled with -tags dev) sets it to false via init().
+var skipDevPems = true
+
 // PinnedRoots returns a CertPool containing every root cert embedded
 // in the daemon binary. Used when -tls-trust=pinned (the default).
 //
@@ -50,6 +55,11 @@ func PinnedRoots() (*x509.CertPool, error) {
 		if e.IsDir() || !strings.HasSuffix(e.Name(), ".pem") {
 			continue
 		}
+		// Skip development root certs in production builds;
+		// roots_dev.go (//go:build dev) disables this guard.
+		if skipDevPems && strings.HasPrefix(e.Name(), "dev-") {
+			continue
+		}
 		body, err := rootsFS.ReadFile("roots/" + e.Name())
 		if err != nil {
 			return nil, fmt.Errorf("read embedded root %s: %w", e.Name(), err)

internal/transport/compat/roots_dev.go

@@ -0,0 +1,9 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+//go:build dev
+
+package compat
+
+// In dev builds, development root certs (dev-*.pem) are trusted
+// alongside production roots. Production builds skip them.
+func init() { skipDevPems = false }

internal/transport/compat/zz_roots_test.go

@@ -22,6 +22,13 @@ import (
 func TestPinnedRoots_LoadsEmbeddedRoots(t *testing.T) {
 	pool, err := PinnedRoots()
 	if err != nil {
+		// In production builds, dev-* roots are excluded. If no
+		// production root has been minted yet, PinnedRoots returns
+		// "no embedded Pilot Protocol roots found". Skip the test
+		// until a prod root is added.
+		if strings.Contains(err.Error(), "no embedded") && skipDevPems {
+			t.Skipf("no production roots embedded yet: %v", err)
+		}
 		t.Fatalf("PinnedRoots() error: %v", err)
 	}
 	if pool == nil {