Posts from October 26, 2026

Another little update to Wasat, this time bumping the version to v1.11.0.

After this morning's change, I made a start on the work I wanted to do on Rogallo and quickly realised that most of what I had planned was better done in Wasat itself. The short version is: rather than maintaining a just-this-session ignore list in the application, it made more sense to handle this in Wasat.

So this release adds an ignore_security_error method to the client that lets you -- for the current session -- ignore a particular type of error for a given host/port pair. This makes for a lot less work needing to be done by the application making use of Wasat. Now it's just a case of¹:

from wasat import Client, IgnorableSecurityError

client = Client()
uri = "gemini://expired.example.com/"

try:
    response = await client.request(uri)
except IgnorableSecurityError as error:
    client.ignore_security_error(uri, error)
    response = await client.request(uri)

Obviously, the code in Rogallo is a bit more involved than the above, but that's the gist of it: try the request, if it fails with an error that can be ignored, ignore it and try again.

Since getting into Gemini, one of my daily rituals has been to tend to my plant in AstroBotany. This morning, when trying to visit there with Rogallo, I was greeted with this:

In other words: the certificate has expired¹. At this point, the error dialog isn't that useful. It's pretty much designed for dealing with capsules that are using self-signed certificates -- where TOFU is being used and so it would normally make sense to just forget and re-establish trust. With an expired CA certificate, the act of forgetting does nothing, it'll just fail again.

While it's technically fine to simply refuse to progress, in this case, it's not exactly friendly to the user. What would be sensible would be to allow an "Ignore" option. This would, I imagine, ignore the problem for the current Rogallo session -- ideally with some sort of indication that the capsule is suspicious at the moment. Also, the dialog that gives you this option should show all the certificate details so the user can make an informed decision.

The issue here is that, until now, Wasat has dealt with security-type problems by raising a single SecurityError exception. Aside from dumpster-diving the description in the exception, there's no way of knowing the nature of the security issue. v1.10.0 addresses this by adding and raising many different exceptions:

• CertificateExpiredError
• CertificateNotYetValidError
• CertificateRejectedError
• CertificateRevokedError
• CertificateUntrustedError
• FingerprintMismatchError
• HostnameMismatchError

All of these inherit from SecurityError to maintain backward-compatibility.

While this change doesn't alter the way that Rogallo handles this situation right now, it does at least set me up for tackling the work I have planned.