mirror of
https://github.com/NixOS/nixpkgs.git
synced 2025-04-28 03:41:24 +00:00
2e7853293d
Mozilla set "Distrust After" for the three TrustCor Root CAs¹, so new certificates issued would not be trusted after 2022/11/30, while older enduser certificates would continue working until they expire. This is a fine-grained policy option available to consumers of the NSS library, such as Firefox or Thunderbird. For Linux systems we generally export the Mozilla trust store into our own CA bundle that ultimately lacks that metadata, because there is no standardized way to parse it in the first place. That means that as long as Mozilla keeps the certificate in their CA program, even with time-based "Distrust" configured, we would keep trusting it fully². That is completely unreasonable and that is why we reject these CAs here for all users of nixpkgs. The TrustCor CAs were primarily used to sign certificates for dynamic hosts for domains provided through no-ip.com, so we expect the fallout from this to be minimal. [1] https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ [2] https://utcc.utoronto.ca/~cks/space/blog/linux/CARootStoreTrustProblem |
||
|---|---|---|
| .. | ||
| applications | ||
| build-support | ||
| common-updater | ||
| data | ||
| desktops | ||
| development | ||
| games | ||
| misc | ||
| os-specific | ||
| pkgs-lib | ||
| servers | ||
| shells | ||
| stdenv | ||
| test | ||
| tools | ||
| top-level | ||