From de7e9f06a4d6c8a6b1fb86e0c0d7887e5f76f275 Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Wed, 28 Oct 2026 09:47:08 -0700
Subject: [PATCH] chore(tls): drop the CA distrust step from the Bun services
 now that Bun ships the blocklist

---
 apps/realtime/src/bootstrap.ts     | 9 ---------
 apps/sim/bootstrap.ts              | 9 ---------
 packages/security/src/tls-trust.ts | 8 +++++---
 3 files changed, 5 insertions(+), 21 deletions(-)

diff --git a/apps/realtime/src/bootstrap.ts b/apps/realtime/src/bootstrap.ts
index 8f11614412a..bf0840fb05f 100644
--- a/apps/realtime/src/bootstrap.ts
+++ b/apps/realtime/src/bootstrap.ts
@@ -3,18 +3,9 @@
  * loading the Socket.IO server, whose modules (`@/env`, DB preflight) read env
  * at import time. See `@sim/runtime-secrets`.
  */
-import { createLogger } from '@sim/logger'
 import { loadRuntimeSecrets } from '@sim/runtime-secrets'
-import { distrustCompromisedRoots } from '@sim/security/tls-trust'
 
-const tlsTrust = distrustCompromisedRoots()
 await loadRuntimeSecrets()
-const logger = createLogger('Bootstrap')
-if (tlsTrust.unsupported || tlsTrust.error) {
-  logger.error('Could not distrust compromised CA roots', tlsTrust)
-} else if (tlsTrust.removed.length > 0) {
-  logger.info('Distrusted compromised CA roots', { removed: tlsTrust.removed })
-}
 /**
  * Pin this process to the `realtime` DB role — covering both the realtime
  * `socketDb` pool and the shared `@sim/db` client used by handlers, preflight,
diff --git a/apps/sim/bootstrap.ts b/apps/sim/bootstrap.ts
index 8342d1cba5b..bc2e92b882c 100644
--- a/apps/sim/bootstrap.ts
+++ b/apps/sim/bootstrap.ts
@@ -3,18 +3,9 @@
  * loading the Next.js standalone server, so application modules that read env at
  * import time see the full configuration. See `@sim/runtime-secrets`.
  */
-import { createLogger } from '@sim/logger'
 import { loadRuntimeSecrets } from '@sim/runtime-secrets'
-import { distrustCompromisedRoots } from '@sim/security/tls-trust'
 
-const tlsTrust = distrustCompromisedRoots()
 await loadRuntimeSecrets()
-const logger = createLogger('Bootstrap')
-if (tlsTrust.unsupported || tlsTrust.error) {
-  logger.error('Could not distrust compromised CA roots', tlsTrust)
-} else if (tlsTrust.removed.length > 0) {
-  logger.info('Distrusted compromised CA roots', { removed: tlsTrust.removed })
-}
 // `server.js` is the Next standalone build artifact, a sibling of this file in
 // the image; it does not exist at type-check time, so the specifier is held in a
 // variable to keep it out of static module resolution.
diff --git a/packages/security/src/tls-trust.ts b/packages/security/src/tls-trust.ts
index 1ebfef4c772..7e413634445 100644
--- a/packages/security/src/tls-trust.ts
+++ b/packages/security/src/tls-trust.ts
@@ -6,9 +6,11 @@ import tls from 'node:tls'
  * eMudhra intermediates whose private keys were reported compromised in October
  * 2026 (https://emudhra.we-have-a-problem.com/roots.json). Mozilla's root store
  * already excludes all four, so dropping them leaves the process trusting what
- * Firefox trusts. Upstream runtimes are fixing this with their own blocklists
- * (Node.js #66871, Bun #46159); once a deployed runtime ships one, these roots
- * are absent from its store and {@link distrustCompromisedRoots} changes nothing.
+ * Firefox trusts. Upstream runtimes ship their own blocklists (Node.js #66871,
+ * Bun #46159); once a deployed runtime has one, these roots are absent from its
+ * store and {@link distrustCompromisedRoots} changes nothing. The Bun services
+ * run a Bun that has it, so only the Trigger.dev task runtime, whose Node build
+ * the platform chooses, still calls this.
  */
 const COMPROMISED_ROOT_SPKI_SHA256 = new Set([
   '8d417db2dd8bf5e3084d1e3f196d583849d81bdd4c00c70b9d39369e96b8c782', // emSign ECC Root CA - G3