Repository navigation
fix: update webpki roots - #14
Conversation
Signed-off-by: Yaroslav Bolyukin <iam@lach.pw>
| rayon = "1.11.0" | ||
| regex = "^1.7.0" | ||
| reqwest = { version = "0.12.5", default-features = false, features = ["rustls-tls", "stream", "gzip", "brotli", "socks", "json", "http2"] } # pinned because of https://github.com/seanmonstar/reqwest/pull/1955 | ||
| reqwest = { version = "0.13.5", default-features = false, features = ["rustls", "stream", "gzip", "brotli", "socks", "json", "http2"] } |
There was a problem hiding this comment.
Unpinned, as this fix from @littledivy (seanmonstar/reqwest#2080) was merged in seanmonstar/reqwest#2185
| "dlopen2_derive", | ||
| "once_cell", | ||
| "rustls-native-certs", | ||
| "rustls-native-certs 0.7.3", |
There was a problem hiding this comment.
https://github.com/denoland/deno_native_certs pins the old version of rustls-native-certs
We might want to either merge deno_native_certs into this codebase, or drop it until further profiling, as it carries unnecessary security risk, and it might not even be required after 2 years
The purpose of this crate is to improve Deno's startup time on MacOS.
On macOS, certificates are loaded from the system keychain. The user, admin and system trust settings are merged together as documented by Apple. The Security framework is dynamically loaded using dlopen to avoid initial dyld overhead.
On Linux and Windows, the rustls-native-certs crate is used.
There was a problem hiding this comment.
So basically it has the same purpose as https://github.com/denoland/lzld, to delay the system frameworks load until they are requested
There was a problem hiding this comment.
Considering dropping deno_native_certs in #15
|
Upstream implementation: denoland/deno#37046 |
|
This upstream change
Was not included here, as it was already implemented before. |
https://emudhra.we-have-a-problem.com
eMudhra Intermediate CA is compromised, and as deno is using webpki-roots, it embeds the CA list into the binary
This PR updates PKI roots and related cryptographic libraries which had a transitive dependency on outdated version of webpki roots