alioth/nixpkgs
3
0
Fork 0
forked from mirrors/nixpkgs
Code Releases Activity

Merge pull request #204795 from mweinelt/cacert-distrust-trustcore

Browse source 
cacert: Distrust TrustCor root certificates
This commit is contained in:
Linus Heckemann 2022-12-07 11:37:47 +01:00 committed by GitHub
parent 446ce471e0 2e7853293d
commit 36cec7c971
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 11 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
pkgs/data/misc/cacert/default.nix
View file

@ -17,7 +17,17 @@
}:
let
blocklist = writeText "cacert-blocklist.txt" (lib.concatStringsSep "\n" blacklist);
blocklist = writeText "cacert-blocklist.txt" (lib.concatStringsSep "\n" (blacklist ++ [
# Mozilla does not trust new certificates issued by these CAs after 2022/11/30¹
# in their products, but unfortunately we don't have such a fine-grained
# solution for most system packages², so we decided to eject these.
#
# [1] https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ
# [2] https://utcc.utoronto.ca/~cks/space/blog/linux/CARootStoreTrustProblem
"TrustCor ECA-1"
"TrustCor RootCert CA-1"
"TrustCor RootCert CA-2"
]));
extraCertificatesBundle = writeText "cacert-extra-certificates-bundle.crt" (lib.concatStringsSep "\n\n" extraCertificateStrings);
srcVersion = "3.83";