Repository navigation
cacert: 3.111 -> 3.131.1; distrust Comodo AAA Services root in nixos/security/pki - #11
Merged
Merged
Conversation
…vices root Backport of NixOS#576347 (NSS 3.131.1 removes the emSign roots whose intermediates were compromised) and NixOS#576390 as reduced by NixOS#576347 (distrust Comodo AAA Services root in the NixOS module). Refs SEC-2613 Co-authored-by: Stephen Judkins <stephen@mercury.com> Co-authored-by: mercury-atlas-agent[bot] <274372067+mercury-atlas-agent[bot]@users.noreply.github.com>
hdgarrood
marked this pull request as ready for review
October 22, 2026 15:17
hdgarrood
approved these changes
Oct 22, 2026
Author
|
The
|
phubars-mercury
approved these changes
Oct 22, 2026
|
This is ready to go from my perspective - I'm just going to wait until I see MWB CI pass with this before merging |
lf-
reviewed
Oct 22, 2026
Comment on lines
+11
to
+14
| blacklist = cfg.caCertificateBlacklist ++ [ | ||
| # CVE-2026-111943 (backport of NixOS/nixpkgs#576390) | ||
| "Comodo AAA Services root" | ||
| ]; |
There was a problem hiding this comment.
why does this forbid list a comodo CA? the one that issued emudhra?
also this only affects nixos. not nixpkgs. which may also be a problem?
lf-
approved these changes
Oct 22, 2026
lf-
left a comment
lf-
left a comment
There was a problem hiding this comment.
ok i have looked around. aiui major distros have distrusted the comodo aaa services CA so we're probably not going to blow up everything by killing it.
but again remember that this config only affects nixos
|
|
yes but the blocklist of the comodo AAA whatever is in the nixos tree so only affects nixos |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Compromised eMudhra intermediates chain to emSign roots that the fork's cacert (NSS 3.111) still trusts for server auth. These intermediates can impersonate public TLS endpoints. Any consumer of raw pkgs.cacert from this fork, including container builds that skip the NixOS module, trusts them. Refs SEC-2613.
What changes
Backports NixOS#576347 (bumps cacert to NSS 3.131.1, which drops the emSign roots) into the fork's older package layout. Also backports the remaining part of NixOS#576390: the NixOS module now always blacklists "Comodo AAA Services root".
Decisions
Validation
I built the edited package.nix via callPackage on nixpkgs a831408. The bundle has 118 certs (old: 121). emSign ECC G3 (86A1ECBA…) is absent. AAA (D7A7A0FB…) is emailProtection-only, so it is missing from the no-trust-rules bundle. openssl verify -purpose sslserver on the incident chains.zip: the 6 G3 chains go from ACCEPT to reject, and the 6 AAA chains are rejected before and after. github.com and google.com still verify. Not verified: a full fork build, module VM tests, and rollout.
Atlas agent session link