Repository navigation
build(nix): update llm-agents for Claude Code 2.1.306 - #281
Merged
Merged
Conversation
Claude Code 2.1.306 drops the roots behind the compromised eMudhra intermediates from its bundled CA store; 2.1.302 still trusts them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2 of 3 tasks
furedea
added a commit
that referenced
this pull request
Oct 22, 2026
## 概要 `switch` と herdr の再起動で `SSL_CERT_FILE` などが入った新しいシェルでは，Claude Code の `/login` が `UNABLE_TO_GET_ISSUER_CERT_LOCALLY` で失敗した．既定の `CLAUDE_CODE_CERT_STORE=bundled,system` のうち OS 側の読み込みで失敗しており，`CLAUDE_CODE_CERT_STORE=bundled` ではログインできた．Claude Code 2.1.306 の内蔵 CA には侵害された eMudhra の root がないため，内蔵だけを使う． | | 変更前 | 変更後 | |---|---|---| | `CLAUDE_CODE_CERT_STORE` | 未設定（`bundled,system`） | `bundled` | | 新しいシェルでの `/login` | 証明書エラーで失敗 | 成功（手元で確認） | ## 受け入れ条件 - [x] `CLAUDE_CODE_CERT_STORE=bundled claude` で `/login` が成功する - [x] `nix flake check` が通る - [ ] `switch` 後，環境変数を付けずに起動した Claude Code でログインと API 呼び出しができる <details> <summary>補足</summary> - `CLAUDE_CODE_CERT_STORE` は settings の専用キーがなく，`env` ブロックで設定する（公式ドキュメント「Enterprise network configuration」）． - 内蔵だけにすると，OS の証明書ストアにだけ入れた社内 CA（TLS を復号するプロキシなど）は使えない．今の環境にはない． - Claude Code 2.1.302 以前の内蔵 CA は侵害された root を含むため，この設定は 2.1.306 以上（#281）を前提とする． </details> 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: furedea <132188853+furedea@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
概要
Claude Code 2.1.302 は内蔵の CA に侵害された eMudhra の root を含み，WebFetch で検査ホストを取得できてしまう．2.1.306 ではその root が消えている．llm-agents だけを更新して 2.1.306 にする．
emSignを含む証明書名 17 か所）emSign ECC Root CA - G3とAAA Certificate Servicesなし）受け入れ条件
claude -p "say ok"が成功する．2.1.304 で起きたUNABLE_TO_GET_ISSUER_CERT_LOCALLYは出ないnix flake checkが通るswitch後，claude --versionが 2.1.306 になる補足
UNABLE_TO_GET_ISSUER_CERT_LOCALLYで失敗したため，llm-agents の更新を止めていた．2.1.306 で実際に API 呼び出しが成功することを確かめた．🤖 Generated with Claude Code