nixpkgs/pkgs/data
Martin Weinelt 2e7853293d
cacert: Distrust TrustCor root certificates
Mozilla set "Distrust After" for the three TrustCor Root CAs¹, so new
certificates issued would not be trusted after 2022/11/30, while older
enduser certificates would continue working until they expire. This is a
fine-grained policy option available to consumers of the NSS library,
such as Firefox or Thunderbird.

For Linux systems we generally export the Mozilla trust store into our
own CA bundle that ultimately lacks that metadata, because there is no
standardized way to parse it in the first place.

That means that as long as Mozilla keeps the certificate in their CA
program, even with time-based "Distrust" configured, we would keep
trusting it fully². That is completely unreasonable and that is why we
reject these CAs here for all users of nixpkgs.

The TrustCor CAs were primarily used to sign certificates for dynamic
hosts for domains provided through no-ip.com, so we expect the fallout
from this to be minimal.

[1] https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ
[2] https://utcc.utoronto.ca/~cks/space/blog/linux/CARootStoreTrustProblem
2022-12-06 19:12:53 +01:00
..
documentation zeal: unstable-2021-12-25 → unstable-2022-10-02 2022-11-22 09:12:33 +08:00
fonts Merge master into staging-next 2022-11-28 12:01:29 +00:00
icons papirus-icon-theme: 20221101 -> 20221201 2022-12-01 17:51:39 +01:00
machine-learning/mnist
misc cacert: Distrust TrustCor root certificates 2022-12-06 19:12:53 +01:00
sgml+xml
soundfonts
themes marwaita: 16.0 -> 16.1 2022-12-02 20:43:27 +00:00