Hi,
With the recent eMudhra compromise, CA trust stores need to be updated
to stop trusting the affected certificates. Ideally this would just be
the ca-certificates-mozilla package and browsers that maintain their own
root programs, but as already pointed out [1], some packages contain
vendored trust stores.
I saw that nixpkgs has a tracking issue [2] for such packages based on a
scanner, so I created a fork [3] with support for scanning Arch Linux
packages. Results for all packages in the core, extra and multilib
repositories are updated daily through GitHub Actions and can be found
at [4] with more details in [5].
In total, the scanner currently finds 218 packages that embed trust
stores. This is relevant to the existing TODO list [6] from 2022 about
switching packages to the system CA store, which currently lists 9
packages as incomplete. Note that not all packages found by the scanner
contain an affected root (some are already updated), and those that do
don't necessarily trust it (e.g. Firefox). It is also possible that some
trust stores are not detected by the scanner.
I have started looking at some of the identified packages and may submit
merge requests to fix them. Hopefully this scan can also be useful to
others looking into this issue.
[1]
https://lists.archlinux.org/archives/list/[email protected]/message/YCJG7KLXYWDHGIOAIKC4U53B6B2L7YDH/
[2] https://github.com/NixOS/nixpkgs/issues/576475
[3] https://github.com/0x9fff00/cacert-scan
[4] https://github.com/0x9fff00/cacert-scan/blob/archlinux/PACKAGES.md
[5] https://github.com/0x9fff00/cacert-scan/tree/archlinux/report-arch
[6] https://archlinux.org/todo/use-system-ca-store/
