Repository navigation
Distrust compromised eMudhra certificate paths in the Ruby image - #17
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Plex and TMDB clients use standard TLS validation, but an older/cached Ruby image can retain roots that permit the compromised eMudhra intermediates. Normal TLS verification alone does not address stale CA trust.
Refresh CA packages in the shared base, disable the eMudhra G3 and retired AAA alternate trust anchors by exact fingerprint, then regenerate the bundle and hashed directory before Bundler installs. The final Rails runtime inherits the filtered trust store. Preserve unrelated roots and keep TLS verification enabled.
Add two regression tests with public CA fixtures and CI validation of the actual shared base used by build and runtime stages. Local CA tests and shell syntax checks passed. Docker image validation is pending CI because the local daemon is unavailable. Rails application behavior is unchanged; the full Rails suite was not run.
Deployment: rebuild and redeploy the image. Valid endpoints still using the distrusted hierarchy need new chains; do not bypass certificate errors. See docs/ca-trust-incident.md for scope and fingerprint sources.
Incident: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449