Repository navigation
Update CA certificate handling to stop trusting emSign ECC Root CA - … - #1
Merged
Merged
Conversation
…G3 and add related tests The system CA store (what server.py's TLS uses) no longer trusts emSign ECC Root CA G3: intermediates under it had their keys compromised (GHSA-6q48-6c7w-9gw2; certifi and NSS dropped it).
Contributor
|
Thanks! Great Work! |
rexmhall09
added a commit
to tuff-app/TUFF
that referenced
this pull request
Nov 1, 2026
- One private host per user serves the app, tuff serve and the Background API, with a session per chat or request; chats can answer at once. - Workspace coding tools: file writes, sandboxed commands and command networking, each off by default; clearer tool activity and prompts. - Recursive Flint 40B A2.5B OptiQ (flint-affine engine) and Bonsai 2 2B/27B. - Pin sandbox-v3, which stops trusting emSign ECC Root CA G3 (GHSA-6q48-6c7w-9gw2, tuff-app/sandbox#1). - Settings > Search is now Settings > Tools.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The system CA store (what server.py's TLS uses) no longer trusts emSign ECC Root CA - G3: intermediates under it had their keys compromised (GHSA-6q48-6c7w-9gw2; certifi and NSS dropped it).
I updated certifi 2026.7.22 to 2026.10.19.
The build now fails if the root is still trusted or the store is empty.
There are 2 new tests.
157:mozilla/emSign_ECC_Root_CA_-_G3.crt157:!mozilla/emSign_ECC_Root_CA_-_G3.crt2026.07.222026.10.19Please update the provided image for TUFF: a new image (sandbox-v3), then a new pin in TUFF.