Skip to content

crypto: fix CA trust block parsing - #64753

Merged
nodejs-github-bot merged 2 commits into
nodejs:mainfrom
Archkon:cert
Aug 5, 2026
Merged

crypto: fix CA trust block parsing #64753
nodejs-github-bot merged 2 commits into
nodejs:mainfrom
Archkon:cert

Conversation

@Archkon

@Archkon Archkon commented Jul 26, 2026

Copy link
Copy Markdown
Contributor

Fixes: #64752

@nodejs-github-bot

nodejs-github-bot commented Jul 26, 2026

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/crypto

@Archkon
Archkon marked this pull request as draft July 26, 2026 05:51
@nodejs-github-bot nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. labels Jul 26, 2026
@Archkon Archkon changed the title stage crypto: honor NSS distrust-after dates Jul 26, 2026
@Archkon

Archkon commented Jul 26, 2026

Copy link
Copy Markdown
Contributor Author

ping @bnoordhuis

@codecov

codecov Bot commented Jul 26, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.25%. Comparing base (d2e4682) to head (5e9a2a6).
⚠️ Report is 57 commits behind head on main.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main   #64753      +/-   ##
==========================================
- Coverage   90.28%   90.25%   -0.03%     
==========================================
  Files         762      762              
  Lines      247520   247524       +4     
  Branches    46692    46688       -4     
==========================================
- Hits       223468   223409      -59     
- Misses      15483    15534      +51     
- Partials     8569     8581      +12

see 32 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@Archkon Archkon changed the title crypto: honor NSS distrust-after dates crypto: fix CA trust block parsing Jul 26, 2026
@Archkon
Archkon marked this pull request as ready for review July 26, 2026 10:21
@Archkon

Archkon commented Jul 28, 2026

Copy link
Copy Markdown
Contributor Author

@nodejs/security-wg
Could you take a look at this?

pimterry
pimterry approved these changes Jul 29, 2026
View reviewed changes

@pimterry pimterry left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@pimterry pimterry added the request-ci Add this label to start a Jenkins CI on a PR. label Jul 29, 2026
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jul 29, 2026
@nodejs-github-bot

nodejs-github-bot commented Jul 29, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/75286/

@Archkon

Archkon commented Jul 31, 2026

Copy link
Copy Markdown
Contributor Author

@pimterry Should we ship this or wait another collaborator to approve as this pr open for one week?

@Archkon

Archkon commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

@Renegade334 @avivkeller Could you consider to land this ?

Renegade334
Renegade334 requested changes Aug 3, 2026
View reviewed changes

@Renegade334 Renegade334 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This diverges from upstream and has the potential to be brittle. We should be re-synchronising this script with curl, as 5be9efc did (minus our own modifications).

@Renegade334

Renegade334 commented Aug 3, 2026

Copy link
Copy Markdown
Member

eg. 6c96168

@Archkon

Archkon commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

eg. 6c96168

@Renegade334 Thanks for your work on this and I'm not verry familiar with perl so I just keep the minimum code change for fix.I check your code change and that look good to me so would you mind me adding you as co-author?

Archkon and others added 2 commits August 3, 2026 22:26
@Archkon
tools: sync mk-ca-bundle.pl with curl
0ca0b06 
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.

Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
@Archkon @Renegade334
tools: reapply Node.js mk-ca-bundle customizations on top of curl 1.33
5e9a2a6 
Regenerate node_root_certs.h with the updated parser, restoring the
Izenpe.com root certificate whose SERVER_AUTH trust attribute follows
CKA_NSS_SERVER_DISTRUST_AFTER metadata.

Co-authored-by: Renegade334 <contact.9a5d6388@renegade334.me.uk>
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
@Archkon
Archkon requested a review from Renegade334 August 3, 2026 14:33
Renegade334
Renegade334 approved these changes Aug 3, 2026
View reviewed changes

@Renegade334 Renegade334 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

Verified output with tools/mk-ca-bundle.pl -i and with a test run of the root-certs updater.

@Renegade334 Renegade334 added commit-queue-squash Add this label to instruct the Commit Queue to squash all the PR commits into the first one. lts-watch-v22.x PRs that may need to be released in v22.x author ready PRs that have at least one approval, no pending requests for changes, and a CI started. labels Aug 3, 2026
@Renegade334 Renegade334 added the request-ci Add this label to start a Jenkins CI on a PR. label Aug 3, 2026
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Aug 3, 2026
@nodejs-github-bot

nodejs-github-bot commented Aug 3, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/75437/

@Archkon

Archkon commented Aug 4, 2026

Copy link
Copy Markdown
Contributor Author

@Renegade334 seems all ci check happy and should we land this ?

@avivkeller avivkeller added the commit-queue Add this label to land a pull request using GitHub Actions. label Aug 5, 2026
@nodejs-github-bot nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Aug 5, 2026
@nodejs-github-bot
nodejs-github-bot merged commit 579fb17 into nodejs:main Aug 5, 2026
90 of 92 checks passed
@nodejs-github-bot

nodejs-github-bot commented Aug 5, 2026

Copy link
Copy Markdown
Collaborator

Landed in 579fb17

@Renegade334 Renegade334 mentioned this pull request Aug 5, 2026
Open
@Archkon
Archkon deleted the cert branch August 5, 2026 03:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jasnell jasnell jasnell approved these changes
@pimterry pimterry pimterry approved these changes
@Renegade334 Renegade334 Renegade334 approved these changes

Assignees

No one assigned

Labels

author ready PRs that have at least one approval, no pending requests for changes, and a CI started. c++ Issues and PRs that require attention from people who are familiar with C++. commit-queue-squash Add this label to instruct the Commit Queue to squash all the PR commits into the first one. lib / src Issues and PRs related to general changes in the lib or src directory. lts-watch-v22.x PRs that may need to be released in v22.x needs-ci PRs that need a full CI run.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

crypto: mk-ca-bundle.pl drops Izenpe.com and loses NSS SERVER_DISTRUST_AFTER semantics

6 participants

@Archkon @nodejs-github-bot @Renegade334 @jasnell @pimterry @avivkeller