Repository navigation
fix: distrust the compromised eMudhra CA; 6.4.1:1 → 6.4.1:2 - #7
Merged
Merged
Conversation
Deno 2.9.7 in ghcr.io/hzrd149/blossom-server:6.4.1 verifies TLS against its compiled-in webpki-roots, which still trust emSign ECC Root CA - G3. A temporary layer installs Debian trixie's fixed ca-certificates (20250419+deb13u1), sets DENO_TLS_CA_STORE=system, and fails the build if the bundle still contains G3. Blossom makes outbound public TLS for BUD-04 mirroring and the admin dashboard's relay profile lookups. start-sdk 3.0.4 → 3.1.0, which requires launchable on action results. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
eMudhra's intermediates chaining to emSign ECC Root CA - G3 have compromised keys.
ghcr.io/hzrd149/blossom-server:6.4.1(Debian 13, built 2026-10-07, still upstream's latest) runs Deno 2.9.7 with no system CA store andDENO_TLS_CA_STOREunset, so Deno verifies TLS against its compiled-in webpki-roots 0.26.1, which still include G3 (grep -c -a "emSign ECC Root CA - G3" /usr/bin/denoprints 3). Deno 2.9.8 drops it (denoland/deno#37046, webpki-roots 1.0.10), but no upstream image ships it yet.Why it matters here: BUD-04 mirroring is on by default and fetches the blob from any public URL. The admin dashboard looks up profiles on three public relays over
wss://. Both use Deno's TLS.Change:
Dockerfiletakes the upstream image as theIMAGEbuild arg, installs Debian'sca-certificates, and setsDENO_TLS_CA_STORE=systemso Deno trusts that store in place of its built-in roots. The build fails if the bundle is missing or still contains G3. Upstream'sENTRYPOINTandWORKDIRare inherited; the image sets noUSER.dockerTag→dockerBuildwith the same image named. The layer is temporary; Remove the eMudhra CA-store layer once upstream ships a fixed image #8 tracks removing it once upstream ships an image on Deno 2.9.8 or later.launchableon action result values (falseon the admin credentials).Evidence the fix lands: the packed aarch64 image carries
ca-certificates 20250419+deb13u1, the G3 grep against/etc/ssl/certs/ca-certificates.crtprints 0, and its env hasDENO_TLS_CA_STORE=system. In the layered imagefetch("https://github.com")returns 200, and with that bundle emptied it fails certificate verification, so Deno is reading the system store and not its built-in roots.tscis clean.