upvote

points

by okr12 hours ago |
comments
upvoteby Zambyte11 hours ago|
next
[-]
Exactly, so the title wrongly frames git as trusting certs that it shouldn't, when it's correctly trusting the system certs, and MacOS is wrongly trusting certs.
reply
upvoteby RetroTechie10 hours ago|
prev|
next
[-]
> Is using the system CA not the way to go?

Yes, and that makes not dealing with this issue worse on Apple's part. If MacOS' setup somehow doesn't allow untangling a (still deemed trustworthy?!?) root certificate issued by eMudhra from the broken intermediate certificates, then revoke that whole chain including the root & accept collateral damage.

Failing that just provides an incentive for apps to do their own chain-of-trust implementations. Which like you said is not the way to go.

reply
upvoteby mschuster9111 hours ago|
prev|
[-]
The problem is macOS has two system CA stores, keychain and /etc/ssl/cert.pem.

That is unequivocally bad, similar to Java which ships its own keystore.jks and many applications shipping its own copy on top of that. True nightmare fodder.

reply
upvoteby krackers2 hours ago|
parent|
next
[-]
The thing is Apple used to do this correctly. Back when they still shipped OpenSSL (albeit some ancient version), they had actually patched OpenSSL to do cert validation against the native keychain and only ever had Keychain as the source of truth. You can see this in https://github.com/apple-oss-distributions/OpenSSL098/blob/O...

And curl was patched to use the native TLS implementation (SecureTransport) which obviously used Keychain as well.

For some reason when they switched to LibreSSL everywhere they decided to ship their own copy? I don't know what they were thinking.

reply
upvoteby kbolino9 hours ago|
parent|
prev|
next
[-]
It's also an indictment of Apple's relationship to open source software. Never mind contributing back to upstream, they haven't even made the change in their own fork to support their own keychain.
reply
upvoteby WesolyKubeczek11 hours ago|
parent|
prev|
[-]
Also certifi in every Python venv, keystores in every single container, nested keystores within that, it’s certificate matryoshkas all the way down!
reply
upvoteby mschuster9111 hours ago|
parent|
[-]
> keystores in every single container, nested keystores within that

At least for that, in $OLDJOB I went and created a new keystore.jks myself to account for an internal CA, so my successors can just update that file, restart the containers and that's it...

reply