Repository navigation
[PR] fix: keep only CA certificates in combined-ca.pem (#5802) - #5809
Conversation
darwin's 'security find-certificate -a -p' keychain export includes non-CA leaf identities (e.g. com.apple.kerberos.kdc, which also carries a duplicate EKU extension in violation of RFC 5280 4.2). Strict replace-semantics clients such as codex's rustls HTTP stack parse every entry of SSL_CERT_FILE and refuse to build their client when any entry fails, so a single such cert broke every connection through bili codex. writeCombinedBundle now keeps only entries that parse as X509 certificates AND carry basicConstraints CA:TRUE or the keyCertSign key-usage bit (legacy pre-basicConstraints anchors), applied to ALL sources (system bundle, OS store, Mozilla roots, MITM root). The bundle gains a leading marker comment; a fresh file missing it (pre-upgrade bundle) is rebuilt once so the fix takes effect immediately instead of waiting out the 24 h freshness gate. If the filter ever drops everything (broken certificate parsing), it falls back to the unfiltered bundle with a loud error log rather than shipping an empty trust store.
ranxianglei
changed the title
📦 Built Package ArtifactBranch: Latest build — install this exact versionnpm install -g billion-context@0.0.8916-pr.5809.177af75This exact version is immutable and reproducible. The rolling Recent builds (commit → version)
Download artifact
tar xzf billion-context-pr5809.tgz
npm install -g packageInstall instructions are refreshed on each push. |
(ai: vllm-qwen/qwen3.8-27b) 查重: 不重复。 全部开放 [PR] 行中只有本线程针对 combined-ca.pem 过滤(#5802);相关但机制不同的已有条目:#5739(zcode 车道 CA 路径指向 combined-ca.pem)、#5740(node-forge/undici 依赖升级)——均非同一机制,不冲突。 开始审核:① 原 issue #5802 方向已核对(报告者带完整复现 + 二分证据:bisect 钉死 |
Review finding on PR #5809: the raw-DER KeyUsage scan expected the extnValue OCTET STRING immediately after OID 2.5.29.15, but per RFC 5280 s4.1 a critical-marked extension carries a BOOLEAN between the two. KeyUsage is RFC-recommended critical on CA certificates, so exactly the legacy pre-basicConstraints anchors the fallback branch exists for were silently dropped whenever they carried the marking. Empirically verified: a forged keyCertSign-only cert with the critical flag parsed isCaLike=false before this change, true after. Adds the matching regression row with ground-truth assertions.
(ai: vllm-qwen/qwen3.8-27b) Review 完成:发现并直接修复 1 处真实缺陷(已推 labeled commit 审核中发现的缺陷(已修,commit
|
(ai: vllm-qwen/qwen3.8-27b) CI 自动修复车道(attempt 1/3)收工:零代码改动、零推送,重跑后全矩阵转绿。 分支 head 保持 ad4a97a 不变。 七问:
终态:镜像缓存确认 30 checks failed=0 / pending=0,全矩阵绿。PR 可进入评审/合并(合并动作归 owner)。备注:若 :197 或 closed=0 签名在干净 runner 再复发,按在档口径升档(settle() 收紧属 owner 拍板项,#5791 线已有测试侧修复 e278f03 待合);诊断已同步至 #4599。 |
ranxianglei
added
the
ci:full
(ai: vllm-qwen/qwen3.8-27b) CI 补充: |
master moved CONFIGURATION{,.zh-CN}.md to docs/configuration{,.zh-CN}.md
(docs layout ruling #5920; root keeps redirect stubs). Resolution: keep
master's stubs at the root and relocate this PR's one-line CA-bundle
note (#5802 CA-only narrowing of combined-ca.pem) onto the same
paragraph in its new home, en+zh. Code commits (ad4a97a, d72c1f2)
are untouched.
[bot] 🏷 (ai: vllm-qwen/qwen3.8-27b) Merge-conflict resolution — done, full CI green. New head: What happened & why it conflicted. Master's docs reorganization (#5920 ruling) moved How it was resolved. Chose merge over rebase deliberately: the concurrent second commit meant rebasing would have rewritten someone else's work; merging preserves both commits untouched. Exactly 2 files conflicted ( Verification (all live, this run). On merged head 七问
判定:冲突已解、CI 全绿、mergeable_state=clean —— PR #5809 ready for review/merge(合并动作归 owner)。 |
📦 Merged Build PublishedThis merge to master was published as npm install -g billion-context@0.0.1169-master.01725f8 # this exact build
npm install -g billion-context@master # always the newest merged build
|
Closes #5802
What was broken
On macOS,
bili codexfailed on every connection: Codex refused to build its HTTP client againstSSL_CERT_FILE(~/.local/share/billion-context/ca/combined-ca.pem). The darwin OS-store export (security find-certificate -a -pover System + login keychains) copies every keychain entry into the bundle — including non-CA leaf identities such ascom.apple.kerberos.kdc(which also carries a duplicate EKU extension, violating RFC 5280 §4.2). Clients with replace-semantics trust stores (codex's rustls stack) parse every entry of the file and refuse to start when any single one fails. Net effect: model transport + all MCP clients dead, bili tools never appear.Fix
writeCombinedBundle()keeps only entries that parse as X509 certificates AND carrybasicConstraints CA:TRUEor thekeyCertSignkey-usage bit (legacy pre-basicConstraints anchors). Applied at the single merge choke point to ALL sources: system bundle, OS store, Mozilla roots, MITM root.The keyUsage check scans raw DER for OID 2.5.29.15 because Node's
X509Certificate.keyUsagegetter returnsundefinedon current runtimes (v22) and node-forge cannot parse non-RSA subjects (using it would silently drop ECDSA anchors).Behavior changes (old → new)
Residual: a self-signed NON-CA cert someone relies on via OpenSSL's lenient anchor quirk loses its anchor (rare; such certs are misissued). Windows/Linux exports were already CA stores in practice; the filter is a uniform safety net there too and also covers user-set
SSL_CERT_FILEoverrides.No config surface change (no new config/env vars).
Tests
tests/ca-combined.test.ts([Bug][codex][macOS]bili codexfails on every connection: combined-ca.pem includes non-CA keychain certs, andcom.apple.kerberos.kdcmakes Codex reject the whole bundle #5802 rows): predicate keeps real roots + legacy keyCertSign anchors + ECDSA roots, drops serverAuth leaves / unparseable entries (both gate directions); written bundle contains only CAs + marker; missing-marker fresh file force-rebuilt; marked+rooted fresh file untouched (steady state).tests/ca-combined.test.ts19/19 locally; the othersrc/ca.tssuites (graceful-close, mitm, issue3776-tls-mitm-diagnostics) 32/32; typecheck clean. Full-suite verdict = CI on this head.com.apple.kerberos.kdc), keeps 184 CAs incl. login-keychain user installs; Codex then builds its client cleanly.Touches CA/trust territory → human review per §7.4 (not auto-merge eligible).