Skip to content

chore(tls): drop the CA distrust step from the Bun services now that Bun ships the blocklist #9413

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
waleedlatif1 merged 1 commit into from
Oct 28, 2026
Merged

chore(tls): drop the CA distrust step from the Bun services now that Bun ships the blocklist #9413

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 0 additions & 9 deletions apps/realtime/src/bootstrap.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,18 +3,9 @@
* loading the Socket.IO server, whose modules (`@/env`, DB preflight) read env
* at import time. See `@sim/runtime-secrets`.
*/
import { createLogger } from '@sim/logger'
import { loadRuntimeSecrets } from '@sim/runtime-secrets'
import { distrustCompromisedRoots } from '@sim/security/tls-trust'

const tlsTrust = distrustCompromisedRoots()
await loadRuntimeSecrets()
const logger = createLogger('Bootstrap')
if (tlsTrust.unsupported || tlsTrust.error) {
logger.error('Could not distrust compromised CA roots', tlsTrust)
} else if (tlsTrust.removed.length > 0) {
logger.info('Distrusted compromised CA roots', { removed: tlsTrust.removed })
}
/**
* Pin this process to the `realtime` DB role — covering both the realtime
* `socketDb` pool and the shared `@sim/db` client used by handlers, preflight,
Expand Down
9 changes: 0 additions & 9 deletions apps/sim/bootstrap.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,18 +3,9 @@
* loading the Next.js standalone server, so application modules that read env at
* import time see the full configuration. See `@sim/runtime-secrets`.
*/
import { createLogger } from '@sim/logger'
import { loadRuntimeSecrets } from '@sim/runtime-secrets'
import { distrustCompromisedRoots } from '@sim/security/tls-trust'

const tlsTrust = distrustCompromisedRoots()
await loadRuntimeSecrets()
const logger = createLogger('Bootstrap')
if (tlsTrust.unsupported || tlsTrust.error) {
logger.error('Could not distrust compromised CA roots', tlsTrust)
} else if (tlsTrust.removed.length > 0) {
logger.info('Distrusted compromised CA roots', { removed: tlsTrust.removed })
}
// `server.js` is the Next standalone build artifact, a sibling of this file in
// the image; it does not exist at type-check time, so the specifier is held in a
// variable to keep it out of static module resolution.
Expand Down
8 changes: 5 additions & 3 deletions packages/security/src/tls-trust.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,11 @@ import tls from 'node:tls'
* eMudhra intermediates whose private keys were reported compromised in October
* 2026 (https://emudhra.we-have-a-problem.com/roots.json). Mozilla's root store
* already excludes all four, so dropping them leaves the process trusting what
* Firefox trusts. Upstream runtimes are fixing this with their own blocklists
* (Node.js #66871, Bun #46159); once a deployed runtime ships one, these roots
* are absent from its store and {@link distrustCompromisedRoots} changes nothing.
* Firefox trusts. Upstream runtimes ship their own blocklists (Node.js #66871,
* Bun #46159); once a deployed runtime has one, these roots are absent from its
* store and {@link distrustCompromisedRoots} changes nothing. The Bun services
* run a Bun that has it, so only the Trigger.dev task runtime, whose Node build
* the platform chooses, still calls this.
*/
const COMPROMISED_ROOT_SPKI_SHA256 = new Set([
'8d417db2dd8bf5e3084d1e3f196d583849d81bdd4c00c70b9d39369e96b8c782', // emSign ECC Root CA - G3
Expand Down
Loading