Repository navigation
app-misc/ca-certificates: Only bundle roots trusted for TLS - #4333
Open
sayanchowdhury wants to merge 1 commit into
Open
sayanchowdhury wants to merge 1 commit into
sayanchowdhury wants to merge 1 commit into
Conversation
sayanchowdhury
had a problem deploying
to
development
October 22, 2026 09:01 — with 
GitHub Actions
Error
GitHub Actions
Error
There was a problem hiding this comment.
🟡 Changes recommended
The duplicate-filename fallback can still overwrite an existing certificate and silently omit a trusted root from the bundle.
1 open issue
What changed in this PR
Restricts Flatcar’s CA bundle to roots Mozilla trusts for TLS, preventing email-only roots from becoming TLS trust anchors.
Changes:
- Filters roots by server-authentication trust and removes legacy Netscape trust checks.
- Adds a duplicate-filename fallback to the certificate converter.
- Adds an ebuild revision to ship the updated bundle generation.
| File | Description |
|---|---|
| sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/files/certdata2pem.py | Restricts trust selection to TLS and adds filename collision handling. |
| sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.131.1-r1.ebuild | Introduces the package revision using the updated converter. |
Review effort: Balanced
sayanchowdhury
had a problem deploying
to
development
October 22, 2026 11:26 — with
GitHub Actions
Error
GitHub Actions
Error
certdata2pem.py was ported from Debian in 2014 and still included roots that Mozilla trusts only for S/MIME. The ebuild puts every root into ca-certificates.crt, and OpenSSL, curl and Go use that bundle for TLS without checking the trust purpose, so email-only roots became TLS roots. That is why the compromised eMudhra intermediates still validate on Flatcar after ca-certificates 3.131.1. emSign ECC Root CA - G3 were removed, but the intermediates were also cross-signed by AAA Certificate Services, which is email-only in Mozilla's data and was never removed. It was bundled anyway. Signed-off-by: Sayan Chowdhury <sayan.chowdhury2012@gmail.com>
sayanchowdhury
force-pushed
the
sayan/fix-tls-certdata2pem-script
branch
from
October 22, 2026 11:27
a21a85a to
c34d984
Compare
sayanchowdhury
requested a deployment
to
development
October 22, 2026 11:27 — with
GitHub Actions
Waiting
GitHub Actions
Waiting
Comment on lines
+131
to
+134
| while os.path.exists(fname): | ||
| print("Found duplicate certificate name %s, renaming." % fname) | ||
| fname = basename + '_%d.pem' % suffix | ||
| suffix += 1 |
Contributor
|
I would feel safer taking Debian's version as-is. It includes these changes and some others. Unfortunately, the file handling is a bit different, so the ebuild becomes slightly awkward, but it's not that bad. @@ -72,10 +72,14 @@ gen_tmpfiles() {
}
src_compile() {
- local certdata="${MY_P}/nss/lib/ckfw/builtins/certdata.txt"
- ${PYTHON} "${FILESDIR}/certdata2pem.py" "${certdata}" certs || die
-
+ mkdir certs || die
cd certs || die
+
+ ln -s "../${MY_P}/nss/lib/ckfw/builtins/certdata.txt" . || die
+ ${PYTHON} "${FILESDIR}/certdata2pem.py" || die
+ rm certdata.txt || die
+ rename .crt .pem *.crt || die
+
gen_hash_links *.pem
cat *.pem > ca-certificates.crt || die
gen_tmpfiles * > "${S}/${PN}.conf" || die |
Contributor
|
Forgot to add that I compared the results of the two different versions and they are the same. |
chewi
approved these changes
Oct 22, 2026
chewi
left a comment
chewi
left a comment
Contributor
There was a problem hiding this comment.
I'll approve this for now, but we should look into switching to Gentoo's package, as we don't seem to know why we're not using it.
This branch is waiting to be deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
certdata2pem.py was ported from Debian in 2014 and still included roots that Mozilla trusts only for S/MIME. The ebuild puts every root into ca-certificates.crt, and OpenSSL, curl and Go use that bundle for TLS without checking the trust purpose, so email-only roots became TLS roots.
That is why the compromised eMudhra intermediates still validate on Flatcar after ca-certificates 3.131.1. emSign ECC Root CA - G3 were removed, but the intermediates were also cross-signed by AAA Certificate Services, which is email-only in Mozilla's data and was never removed. It was bundled anyway.
Port the relevant Debian changes to certdata2pem.py:
email-only? roots for us (167 -> 118 certs on NSS 3.131.1), AAA included.
so this does not change the output.
already taken, instead of overwriting the first. No duplicate labels
exist in current NSS data.
AI was used to identify the missing ports from Debian script to Flatcar and generate the changes.
CI Running https://jenkins.flatcar.org/job/container/job/packages_all_arches/890/cldsv/
Testing done
[Describe the testing you have done before submitting this PR. Please include both the commands you issued as well as the output you got.]
changelog/directory (user-facing change, bug fix, security fix, update)/bootand/usrsize, packages, list files for any missing binaries, kernel modules, config files, kernel modules, etc.