fix(guard): require the END marker to end its own line

A review pass died mid-response, but its last line named the gap: the
guard never validated what followed the END marker. Measured, and it was
two more false accepts.

`indexOf("\n-----END <label>-----")` matches a prefix, so it treated
`-----END CERTIFICATE-----garbage` and `-----END CERTIFICATE-------` as
terminators. Both make openssl reject the block: guard=accept while node
loaded zero extra CAs, on a bundle whose remaining entries were healthy.

Only whitespace may follow — 13/13 agreement with a real handshake on
what a tail may contain (space, tab, nothing: loads; any other character,
including a further dash run: does not). The END search now skips
candidates whose line does not end there, rather than taking the first
textual match.

Three rows added, including the positive one: a trailing space must keep
being ACCEPTED, or the fix trades two false accepts for a false reject.
Mutation-verified — reverting to the bare indexOf fails exactly one test.

Re-measured across all four sweeps at 164 shapes: 0 false accepts, no
regression in either direction.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: codeslake

bin/ca-trust.mjs

@@ -76,9 +76,21 @@ export function bundleCarriesOurCA(text, ourCaPem) {
     // Bounded by the NEXT marker, not by a search to end-of-file. An unbounded
     // indexOf lets a torn block borrow the END line of a later one, so the
     // unterminated check never fires and the slice spans two entries.
+    // The END marker must also END ITS LINE, bar trailing whitespace. indexOf
+    // alone ignored whatever followed it, so `-----END CERTIFICATE-----garbage`
+    // and `-----END CERTIFICATE-------` both read as terminators here while
+    // openssl rejected the block and node loaded zero CAs — measured, both as
+    // false accepts on an otherwise healthy bundle. Whitespace is fine (13/13
+    // agreement with a real handshake on what may follow), anything else is not.
     const endMarker = `\n-----END ${label}-----`;
     const nextBegin = text.indexOf("\n-----BEGIN ", m.index + 1);
-    let end = text.indexOf(endMarker, m.index);
+    let end = -1;
+    for (let at = text.indexOf(endMarker, m.index); at !== -1;
+         at = text.indexOf(endMarker, at + 1)) {
+      const lineEnd = text.indexOf("\n", at + 1);
+      const tail = text.slice(at + endMarker.length, lineEnd === -1 ? undefined : lineEnd);
+      if (/^[ \t\r]*$/.test(tail)) { end = at; break; }
+    }
     if (end !== -1 && nextBegin !== -1 && end > nextBegin) end = -1;
     // Unterminated, or closed by a different label. Fatal whatever the label
     // is, and deliberately not analyzed further: openssl's base64 decoder

test/proxy-forward-ca.test.mjs

@@ -403,6 +403,13 @@ test("ca-trust: the bundle guard never accepts a bundle NODE_EXTRA_CA_CERTS cann
       // to end-of-file let the torn block borrow it, so the unterminated check
       // never fired and the slice spanned two entries.
       ["torn block borrowing a later END", `-----BEGIN CERTIFICATE-----\n${body}\n${other}${ours}`, false],
+      // The END marker must end its own line. `indexOf` alone ignored whatever
+      // followed it, so a block openssl rejects read as terminated here — both
+      // of these were measured as false accepts on an otherwise healthy bundle.
+      ["END marker with trailing garbage", ours.replace("-----END CERTIFICATE-----", "-----END CERTIFICATE-----garbage"), false],
+      ["END marker with extra dashes", ours.replace("-----END CERTIFICATE-----", "-----END CERTIFICATE-------"), false],
+      // ...but trailing whitespace is fine, and must stay fine: node loads it.
+      ["END marker with a trailing space", ours.replace("-----END CERTIFICATE-----", "-----END CERTIFICATE----- "), true],
       // Real cert, just not ours: the stale-builder case.
       ["stale: a real cert that is not ours", other, false],
       ["empty bundle", "", false],