Repository navigation
fix(darwin): leave the blacklisted roots out of the CA store entirely - #282
Merged
Merged
Conversation
nix-darwin's default ca-bundle.crt keeps blacklisted roots as OpenSSL TRUSTED CERTIFICATE blocks marked as rejected. OpenSSL honours the mark, but codex's rustls client normalises those blocks and still trusts the compromised eMudhra chain. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
3 tasks
statix flags security assigned three times. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
概要
#274 の
security.pki.caCertificateBlacklistは，除外した root を消さず，「拒否」印付きの OpenSSLTRUSTED CERTIFICATE形式で/etc/ssl/certs/ca-certificates.crtに残していた．OpenSSL を使う curl・Python・Node は印を守るが，codex（rustls）はこの形式を通常の証明書に変換して信頼してしまい，SSL_CERT_FILEを渡しても侵害チェーンの検査ホストに接続できた（status=200）．root を含まないca-no-trust-rules-bundle.crtから CA ストアを作る．ca-bundle.crt（通常 120 件＋TRUSTED CERTIFICATE172 件．除外した root も拒否印付きで残る）ca-no-trust-rules-bundle.crt（通常 120 件のみ．除外した root は含まない）certificate rejectedunable to get local issuer certificate（root がない）SSL_CERT_FILEあり）で検査ホスト受け入れ条件
TRUSTED CERTIFICATE形式がなく，除外した root の PEM がないapi.github.comには接続できるnix flake checkが通るswitch後，SSL_CERT_FILEを設定した codex が検査ホストに接続できない補足
ca-no-trust-rules-bundle.crtの通常の証明書 120 件は，ca-bundle.crtのサーバー認証用の 120 件と同じ集合．SSL_CERT_FILE，REQUESTS_CA_BUNDLE，NIX_SSL_CERT_FILEはどれも同じ/etc/ssl/certs/ca-certificates.crtを指すので，変数の変更はない．/etc/zshenvは親プロセスが環境を読み込み済みだと読み直さないため，switch後は Ghostty と herdr を一度終了して起動し直さないと，新しい環境変数がペインに入らない．🤖 Generated with Claude Code