nix-cacert-scan

Finds packages that carry their own CA trust store instead of using nixpkgs cacert.

Usage

Scan the closure of your running system:

nix run github:zimbatm/nix-cacert-scan -- /run/current-system

Any store path or result link works, and you can give more than one. Each output line is one embedded trust store:

osquery-5.23.1   /share/osquery/certs/certs.pem   135 roots   ECC G3,AAA

"ECC G3" means the store trusts emSign ECC Root CA - G3, the root on the compromised eMudhra path.
"AAA" means it trusts Sectigo AAA Certificate Services, which cross-signs the same intermediates.
Copies of the nixpkgs cacert bundle are left out.
A hit means the bundle is in the package, not that the program uses it. For example, nixpkgs nodejs embeds roots but uses the system store by default.

Add --json for the raw scanner output (one JSON object per file). To scan a directory without its closure, use nix shell github:zimbatm/nix-cacert-scan -c cacert-scan --path DIR.

On 2026-10-18/19, eMudhra and Sectigo revoked the certificates of eight eMudhra intermediates as compromised (cACompromise in CCADB). A package with its own trust store does not get root-store updates from cacert. Each package below must be patched to use cacert, or rebuilt.

The scan covers all 209,053 NARs of NixOS 26.05 (nixos-26.05.12250.f3a73bcf5d1c) from cache.nixos.org. 828 packages need a fix. Some need more than one, so the list has 882 entries. See RESULTS.md for the analysis and DETECTION.md for the method.

"ECC G3" marks a store that holds emSign ECC Root CA - G3, the root on the compromised path. "Stale bundle" marks a store older than the emSign roots; it is out of date for other reasons too. "Trusts AAA" marks a store that trusts Sectigo AAA Certificate Services as a root. AAA cross-signed the eight compromised intermediates (valid until 2028), so such a store is affected even when it is stale and has no ECC G3.

Use

nix build                                   # or: cargo build --release
./result/bin/cacert-scan --roots patterns/roots.pem --watch patterns/watch.pem --path /nix/store/...-foo
nix develop -c scripts/run.sh out nixos-26.05   # whole release; needs about 2 h on 48 cores
python3 scripts/analyze.py out report
python3 tools/package-list.py report/findings.tsv

scripts/run.sh expects the scanner at target/release/cacert-scan (cargo build --release).

Packages to patch

Generated by tools/package-list.py from report/findings.tsv. Python and Ruby packages are listed once for all interpreter versions.

Vendored PEM bundle (95)

Fix: Replace the file with a symlink to ${cacert}/etc/ssl/certs/ca-bundle.crt, or point the program at it.

Bundle inside a wheel, jar or zip (88)

Fix: Patch the bundle inside the archive at build time, or patch the code to use the system store.

Java keystore (37)

Fix: Generate the keystore from ${cacert}/etc/ssl/certs/ca-bundle.crt at build time with jre-generate-cacerts, as openjdk does. cacert has no Java keystore output.

Compiled into a binary (662)

Fix: Rebuild with a system-store option (rustls-native-certs, --use-system-ca, NSS from cacert), or bump the embedded root crate.

64gram — /bin/.Telegram-wrapped · stale bundle, no ECC G3 · trusts AAA
BoilR — /bin/boilr · trusts AAA
MozWire — /bin/mozwire · trusts AAA
adguardian — /bin/adguardian · trusts AAA
agent-browser — /bin/agent-browser
agnos — /bin/agnos · trusts AAA
aichat — /bin/aichat
airgorah — /bin/.airgorah-wrapped
airshipper — /bin/.airshipper-wrapped
alfis — /bin/alfis (+1 more)
alistral — /bin/alistral
alvr — /bin/alvr_launcher (+4 more) · trusts AAA
amazon-q-cli — /bin/amazon-q · trusts AAA
anchor — /bin/anchor
anda — /bin/anda
anki — /lib/python3.13/site-packages/anki/_rsbridge.so
ansible-language-server — /lib/node_modules/ansible-language-server/node_modules/@vscode/vsce-sign-linux-x64/bin/vsce-sign (+4 more) · trusts AAA
anup — /bin/anup · trusts AAA
anyrun — /lib/librink.so (+3 more) · trusts AAA
aphorme — /bin/aphorme
apt-swarm — /bin/apt-swarm
argon — /bin/argon · trusts AAA
artem — /bin/artem · trusts AAA
astro-language-server — /lib/node_modules/astro-language-server/node_modules/.pnpm/turbo-linux-64@2.8.15/node_modules/turbo-linux-64/bin/turbo (+1 more)
attic — /bin/attic (+1 more)
atuin — /bin/atuin-server
atuin-desktop — /bin/.atuin-desktop-wrapped
aube — /bin/aube (+2 more)
autocorrect — /bin/autocorrect · trusts AAA
autopush — /bin/autoconnect (+1 more)
ayugram-desktop — /bin/.AyuGram-wrapped · stale bundle, no ECC G3 · trusts AAA
babashka-unwrapped — /bin/bb · trusts AAA
basedpyright — /lib/node_modules/pyright-root/node_modules/@vscode/vsce-sign/bin/vsce-sign (+2 more) · trusts AAA
beekeeper-studio — /opt/beekeeper-studio/beekeeper-studio-bin · trusts AAA
bencher-cli — /bin/bencher
bibiman — /bin/bibiman
biliup-rs — /bin/biliup (+1 more) · trusts AAA
bleep — /bin/bleep · trusts AAA
blightmud — /bin/blightmud
blocky — /bin/blocky
bloop — /.bloop-wrapped · stale bundle, no ECC G3 · trusts AAA
bmputil — /bin/bmputil-cli
brave — /opt/brave.com/brave/brave · trusts AAA
brave-search-cli — /bin/bx
brush-splat — /bin/brush_app
buck2-unstable — /bin/buck2
buckle — /bin/buckle · trusts AAA
buildkite-test-collector-rust — /bin/buildkite-test-collector · trusts AAA
bun — /bin/bun
buttplug-lite — /bin/.buttplug-lite-wrapped
c2patool — /bin/c2patool (+3 more)
caddy — /bin/caddy
cantus — /bin/cantus
cargo-aoc — /bin/cargo-aoc · trusts AAA
cargo-component — /bin/cargo-component · trusts AAA
cargo-deadlinks — /bin/deadlinks (+1 more) · trusts AAA
cargo-edit — /bin/cargo-upgrade
cargo-lambda — /bin/.cargo-lambda-wrapped · trusts AAA
cargo-make — /bin/makers (+1 more) · trusts AAA
cargo-mobile2 — /bin/.cargo-mobile-wrapped (+1 more) · trusts AAA
cargo-msrv — /bin/.cargo-msrv-wrapped
cargo-nextest — /bin/cargo-nextest
cargo-pgrx — /bin/cargo-pgrx · trusts AAA
cargo-pio — /bin/cargo-pio · trusts AAA
cargo-release — /bin/cargo-release
cargo-risczero — /bin/cargo-risczero · trusts AAA
cargo-shuttle — /bin/shuttle (+1 more)
cargo-v5 — /bin/cargo-v5
cargo-vet — /bin/cargo-vet · trusts AAA
cargo-wasi — /bin/cargo-wasi · trusts AAA
cargo-workspaces — /bin/cargo-ws (+1 more) · trusts AAA
cargo-xwin — /bin/cargo-xwin
cef-binary — /Release/libcef.so · trusts AAA
certificate-ripper — /bin/crip · trusts AAA
cfspeedtest — /bin/cfspeedtest
checkpwn — /bin/checkpwn
cherrybomb — /bin/cherrybomb · trusts AAA
chiptrack — /bin/.chiptrack-wrapped
chromedriver-unwrapped — /bin/chromedriver
ciel — /bin/ciel
cilium-cli — /bin/cilium · trusts AAA
cirrus-cli — /bin/cirrus
clash-rs — /bin/clash-rs (+2 more)
clash-verge-rev — /bin/.clash-verge-wrapped
clashtui — /bin/clashtui · trusts AAA
click — /bin/click · trusts AAA
cliflux — /bin/cliflux · trusts AAA
clj-kondo — /bin/clj-kondo · trusts AAA
clojure-lsp — /bin/clojure-lsp · trusts AAA
code — /bin/code (+2 more)
code-server — /libexec/code-server/lib/node
codeberg-cli — /bin/berg
codebook — /bin/codebook-lsp
codex — /bin/.codex-wrapped
coinlive — /bin/coinlive
comet-gog — /bin/comet · trusts AAA
comigo — /bin/comigo · stale bundle, no ECC G3
commet-chat — /app/commet-chat/lib/libwebrtc.so · stale bundle, no ECC G3 · trusts AAA
commitlint — /lib/node_modules/@commitlint/root/node_modules/@nx/nx-linux-x64-gnu/nx.linux-x64-gnu.node (+3 more) · trusts AAA
convoyeur — /bin/convoyeur
cook-cli — /bin/cook
cosmic-ext-applet-sysinfo — /bin/.cosmic-ext-applet-sysinfo-wrapped
couchbase-shell — /bin/cbsh
crates-lsp — /bin/crates-lsp
css-variables-language-server — /lib/node_modules/turbo-linux-64/bin/turbo (+4 more) · trusts AAA
cup-docker — /bin/cup · trusts AAA
cyberia — /bin/.cyberia-wrapped
cypress — /opt/cypress/Cypress · trusts AAA
dart — /bin/dart (+5 more) · trusts AAA
dart-sass — /bin/sass · trusts AAA
ddns-updater — /bin/.ddns-updater-wrapped
deadlock-mod-manager — /bin/.deadlock-mod-manager-wrapped
deezer-enhanced — /lib/deezer-enhanced/deezer-enhanced · trusts AAA
deltachat-repl — /bin/deltachat-repl · trusts AAA
deltachat-rpc-server — /bin/deltachat-rpc-server · trusts AAA
deltachat-tauri — /bin/.deltachat-tauri-wrapped
deno — /bin/deno · trusts AAA
devpod-desktop — /bin/.DevPod Desktop-wrapped
dim — /bin/.dim-wrapped · trusts AAA
dioxus-cli — /bin/.dx-wrapped
diswall — /bin/diswall · trusts AAA
dness — /bin/dness · trusts AAA
domine-nightly — /bin/domine · trusts AAA
dotenv-linter — /bin/dotenv-linter
dotnet-repl — /lib/dotnet-repl/.store/dotnet-repl/0.3.250/dotnet-repl/0.3.250/tools/net9.0/any/.playwright/node/linux-x64/node (+1 more) · trusts AAA
dprint — /bin/dprint · trusts AAA
dsq — /bin/dsq · trusts AAA
dtop — /bin/dtop
ducker — /bin/ducker
duckscript_cli — /bin/duck · trusts AAA
dumbpipe — /bin/dumbpipe
dump_syms — /bin/dump_syms
easytier — /bin/easytier-web (+1 more) · trusts AAA
eigenwallet — /bin/unstoppableswap-gui-rs · trusts AAA
electron — /libexec/electron/electron · trusts AAA
electron-chromedriver — /bin/chromedriver
elm-test-rs — /bin/elm-test-rs
eludris — /bin/eludris · trusts AAA
emuflight-configurator — /share/emuflight-configurator/lib/libnw.so (+1 more) · trusts AAA
en-croissant — /bin/.en-croissant-wrapped · trusts AAA
equibop — /opt/Equibop/resources/arrpc/arrpc
esp-generate — /bin/esp-generate
espanso — /bin/.espanso-wrapped · trusts AAA
espflash — /bin/espflash (+1 more)
espup — /bin/espup
evcc — /bin/evcc
evebox — /bin/evebox · trusts AAA
everest — /lib/Celeste/MiniInstaller-osx (+15 more) · trusts AAA
fedigroups — /bin/fedigroups
fedistar — /bin/.fedistar-wrapped
ferium — /bin/ferium · trusts AAA
fermyon-spin — /bin/spin · trusts AAA
ferretdb — /bin/ferretdb · trusts AAA
ferron — /bin/ferron
ffizer — /bin/ffizer
ffsend — /bin/ffsend · trusts AAA
filen-cli — /bin/.filen-wrapped
fim-rs — /bin/fim
findomain — /bin/findomain
firefox-beta-unwrapped — /lib/firefox-beta/libxul.so · trusts AAA
firefox-devedition-unwrapped — /lib/firefox-devedition/libxul.so · trusts AAA
firefox-unwrapped — /lib/firefox/libxul.so · trusts AAA
firefoxpwa-unwrapped — /share/firefoxpwa/runtime/libxul.so · trusts AAA
firezone-gateway — /bin/firezone-gateway
firezone-gui-client — /bin/.firezone-client-gui-wrapped (+1 more)
firezone-headless-client — /bin/firezone-headless-client
firezone-relay — /bin/firezone-relay · trusts AAA
firmware-manager — /lib/libfirmware_manager.so (+2 more) · trusts AAA
fishnet — /bin/fishnet
flake-edit — /bin/flake-edit
fldigi — /bin/fldigi · stale bundle, no ECC G3 · trusts AAA
fleet — /bin/fleet
fleetctl — /bin/fleetctl
fluffychat-linux — /app/fluffychat-linux/lib/libwebrtc.so · stale bundle, no ECC G3 · trusts AAA
flux9s — /bin/flux9s
fnm — /bin/fnm · trusts AAA
folo — /share/follow/node_modules/.pnpm/@next+swc-linux-x64-gnu@16.0.11/node_modules/@next/swc-linux-x64-gnu/next-swc.linux-x64-gnu.node (+6 more) · trusts AAA
foundry — /bin/cast (+3 more)
frankenphp — /bin/.frankenphp-wrapped
fresh — /bin/.fresh-wrapped
fselect — /bin/fselect
fvm — /bin/fvm · trusts AAA
fzf-make — /bin/.fzf-make-wrapped
g3proxy — /bin/g3proxy
gale — /bin/.gale-wrapped
game-rs — /bin/game-rs · trusts AAA
gel — /bin/gel
gen-license — /bin/gen-license · trusts AAA
geph5 — /bin/.geph5-exit-wrapped (+3 more) · trusts AAA
gephgui-wry — /bin/.gephgui-wry-wrapped · trusts AAA
gg — /bin/.gg-wrapped
ghdump — /bin/ghdump
git-cliff — /bin/git-cliff
git-ignore — /bin/git-ignore · trusts AAA
git-ps-rs — /bin/gps · trusts AAA
gitbeaker-cli — /lib/node_modules/@nx/nx-linux-x64-gnu/nx.linux-x64-gnu.node · trusts AAA
gitlab-duo — /bin/.duo-wrapped
gitlab-workhorse — /bin/gitlab-zip-cat (+2 more) · trusts AAA
go-migrate — /bin/migrate · trusts AAA
gokrazy — /bin/gok
golem — /bin/golem (+2 more) · trusts AAA
goose-cli — /bin/goosed (+1 more)
gotify-desktop — /bin/gotify-desktop
goupile — /bin/goupile
goxlr-utility — /bin/goxlr-client (+2 more)
gptcommit — /bin/gptcommit · trusts AAA
graaljs — /lib/libjsvm.so · trusts AAA
graalnodejs — /bin/node (+1 more) · trusts AAA
graalpy — /lib/libpythonvm.so · trusts AAA
graalvm-ce — /lib/svm/bin/native-image (+1 more) · trusts AAA
grafana-alloy — /bin/alloy · trusts AAA
gst-plugins-rs — /lib/gstreamer-1.0/libgstreqwest.so (+2 more)
habitat — /bin/hab · trusts AAA
hakuneko — /lib/hakuneko-desktop/hakuneko · trusts AAA
halp — /bin/halp · trusts AAA


 hath-rust — /bin/hath-rust
 hatsu — /bin/hatsu · trusts AAA
 hayabusa-sec — /share/hayabusa-sec/hayabusa
 haylxon — /bin/hxn
 health — /bin/.dev.Cogitri.Health-wrapped · trusts AAA
 helix-db — /bin/helix
 heroku — /share/heroku/bin/node
 hex — /lib/erlang/lib/hex/ebin/Elixir.Hex.HTTP.Certs.beam
 hieroglyphic — /bin/.hieroglyphic-wrapped
 himalaya — /bin/himalaya
 hoard — /bin/hoard · trusts AAA
 http-nu — /bin/http-nu
 httpx — /bin/httpx · trusts AAA
 hydrasect — /bin/hydrascrape
 hygg — /bin/hygg (+1 more)
 hyprviz — /bin/.hyprviz-wrapped · trusts AAA
 hyprwhspr-rs — /bin/.hyprwhspr-rs-wrapped
 iamb — /bin/iamb
 icm — /bin/icm
 inav-configurator — /opt/inav-configurator/inav-configurator · trusts AAA
 influxdb — /bin/influxd (+1 more) · trusts AAA
 influxdb3 — /bin/.influxdb3-wrapped
 inlyne — /bin/inlyne · trusts AAA
 intiface-central — /app/intiface-central/lib/librust_lib_intiface_central.so
 iroh-dns-server — /bin/iroh-dns-server
 iroh-relay — /bin/iroh-relay
 iroh-ssh — /bin/iroh-ssh
 is-fast — /bin/is-fast
 ivm — /bin/.ivm-wrapped · trusts AAA
 jcef-jetbrains — /cef_server/libcef.so · trusts AAA
 jellyfin-rpc — /bin/jellyfin-rpc
 jellytui — /bin/.jellytui-wrapped · trusts AAA
 jetbrains-jdk-jcef — /lib/openjdk/lib/libcef.so · trusts AAA
 jikken — /bin/jk · trusts AAA
 jogger — /bin/.jogger-wrapped · trusts AAA
 jolt-tui — /bin/jolt
 joplin-desktop — /share/joplin-desktop/joplin · trusts AAA
 jsonwatch — /bin/jsonwatch
 k6 — /bin/k6
 kanha — /bin/kanha · trusts AAA
 karakeep — /lib/karakeep/node_modules/turbo-linux-64/bin/turbo (+1 more) · trusts AAA
 karlender — /bin/.karlender-wrapped · trusts AAA
 kcl — /bin/kcl
 kclvm — /lib/libkclvm_cli_cdylib.a (+1 more)
 kdash — /bin/kdash
 keeweb — /share/keeweb-desktop/keeweb · trusts AAA
 keybase-gui — /share/keybase/Keybase · trusts AAA
 kittycad-kcl-lsp — /bin/kcl-language-server · trusts AAA
 klipper-estimator — /bin/klipper_estimator · trusts AAA
 knope — /bin/knope
 korrect — /bin/korrect-shim
 kotatogram-desktop — /bin/.Kotatogram-wrapped · stale bundle, no ECC G3 · trusts AAA
 krankerl — /bin/krankerl · trusts AAA
 kubectl-view-allocations — /bin/kubectl-view-allocations
 lact — /bin/.lact-wrapped
 legba — /bin/legba · trusts AAA
 lemmy-server — /bin/lemmy_server · trusts AAA
 leo-lang — /bin/leo
 liana — /bin/.liana-gui-wrapped · trusts AAA
 lianad — /bin/lianad · trusts AAA
 libdeltachat — /lib/libdeltachat.so · trusts AAA
 librespeed-rust — /bin/librespeed-rs
 librewolf-unwrapped — /lib/librewolf/libxul.so · trusts AAA
 licensure — /bin/licensure · trusts AAA
 lighthouse — /bin/lighthouse
 links2 — /bin/links · trusts AAA
 linkwarden — /share/linkwarden/node_modules/.prisma/client/query-engine
 linux-wallpaperengine — /share/linux-wallpaperengine/libcef.so · trusts AAA
 litestream — /bin/litestream
 livekit-libwebrtc — /lib/libwebrtc.so · stale bundle, no ECC G3 · trusts AAA
 lla — /lib/libnpm.so (+6 more) · trusts AAA
 lldap — /bin/.lldap-wrapped (+2 more) · trusts AAA
 llm-ls — /bin/llm-ls · trusts AAA
 llmfit — /bin/llmfit
 llmserve — /bin/llmserve
 lobtui — /bin/lobtui
 localsend — /app/localsend/lib/librhttp.so · trusts AAA
 lockbook — /bin/.lockbook-wrapped · trusts AAA
 lockbook-desktop — /bin/lockbook-desktop · trusts AAA
 lon — /bin/.lon-wrapped · trusts AAA
 losange — /bin/.losange-wrapped
 lsp-ai — /bin/lsp-ai · trusts AAA
 ludusavi — /bin/.ludusavi-wrapped · trusts AAA
 luminous-ttv — /bin/luminous-ttv
 lune — /bin/lune
 lutgen-studio — /bin/.lutgen-studio-wrapped
 mago — /bin/mago
 mailspring — /share/mailspring/mailspring · trusts AAA
 mangayomi — /app/mangayomi/lib/librust_lib_mangayomi.so · trusts AAA
 marmite — /bin/marmite
 matrix-authentication-service — /bin/mas-cli
 matrix-commander-rs — /bin/matrix-commander-rs
 matrix-continuwuity — /bin/conduwuit
 maturin — /bin/maturin
 mbtileserver — /bin/mbtileserver · trusts AAA
 mcat-unwrapped — /bin/mcat
 md-tui — /bin/mdt
 mdbook-epub — /bin/mdbook-epub · trusts AAA
 mdbook-kroki-preprocessor — /bin/mdbook-kroki-preprocessor
 mdbook-plantuml-v2.0.0 — /bin/mdbook-plantuml
 mdfried — /bin/mdfried · trusts AAA
 mdsf — /bin/mdsf-codegen
 mdterm — /bin/mdterm
 meilisearch — /bin/meilisearch
 melos — /bin/melos · trusts AAA
 mercure — /bin/mercure
 meteor — /packages/meteor-tool/.3.4.0.vgryhtnbe6++os.linux.x86_64+web.browser+web.browser.legacy+web.cordova/mt-os.linux.x86_64/dev_bundle/bin/node
 mill — /bin/.mill-wrapped · trusts AAA
 mise — /bin/mise
 mistral-rs — /bin/mistralrs (+4 more)
 mitm-cache — /bin/mitm-cache · trusts AAA
 monocle — /bin/monocle
 moshi — /bin/moshi-server · trusts AAA
 motrix-next — /bin/.motrix-next-wrapped
 mpris-notifier — /bin/mpris-notifier
 muffet — /bin/muffet
 mujmap — /bin/mujmap · trusts AAA
 mullvad — /bin/mullvad-daemon
 mullvad-browser — /share/mullvad-browser/libxul.so · trusts AAA
 mullvad-vpn — /share/mullvad/mullvad-gui (+1 more) · trusts AAA
 music-assistant-desktop — /bin/.music-assistant-companion-wrapped
 mycelium — /bin/mycelium
 mystmd — /lib/node_modules/turbo-linux-64/bin/turbo (+1 more) · trusts AAA
 narrowlink — /bin/narrowlink (+1 more) · trusts AAA
 nextcloud-talk-desktop — /opt/Nextcloud Talk-linux-x64/Nextcloud Talk · trusts AAA
 nimlangserver — /bin/nimlangserver · trusts AAA
 nix-forecast — /bin/.nix-forecast-wrapped · trusts AAA
 nixmate — /bin/nixmate
 nnd-x86_64-unknown-linux-musl — /bin/nnd
 nodejs-slim — /bin/node
 noip — /bin/noip-duc · trusts AAA
 nono — /bin/nono
 noriskclient-launcher-unwrapped — /bin/noriskclient-launcher-v3
 nostr-rs-relay — /bin/nostr-rs-relay · trusts AAA
 nostui — /bin/nostui
 notify-client — /bin/.notify-wrapped · trusts AAA
 notify_push — /bin/notify_push
 novops — /bin/novops · trusts AAA
 nu-lint — /bin/nu-lint
 nuclei — /bin/nuclei · trusts AAA
 numbat — /bin/numbat
 nurl — /bin/.nurl-wrapped
 nushell — /bin/nu
 nwjs — /share/nwjs/chromedriver (+2 more) · trusts AAA
 nxv — /bin/nxv
 nyaa — /bin/nyaa · trusts AAA
 nym — /bin/nym-api (+12 more) · trusts AAA
 ocrs — /bin/ocrs
 oculante — /bin/..oculante-wrapped-wrapped · trusts AAA
 oku — /bin/.oku-wrapped · trusts AAA
 omnigres — /lib/omni_httpc--0.1.9.so · trusts AAA
 ooniprobe-cli — /bin/ooniprobe
 opencode — /bin/.opencode-wrapped
 openobserve — /bin/openobserve
 opensrc — /bin/opensrc
 oranda — /bin/oranda · trusts AAA
 ord — /bin/ord
 ownserver — /bin/ownserver · trusts AAA
 oxicloud — /bin/.oxicloud-wrapped
 oxigraph — /bin/oxigraph
 pana — /bin/.pana-wrapped · trusts AAA
 pandora-launcher-unwrapped — /bin/pandora_launcher
 pangolin — /share/pangolin/node_modules/@next/swc-linux-x64-gnu/next-swc.linux-x64-gnu.node (+3 more)
 parrot — /bin/.parrot-wrapped · trusts AAA
 parseable — /bin/parseable
 patchy — /bin/patchy · trusts AAA
 pawn-appetit — /bin/.pawn-appetit-wrapped · trusts AAA
 pay-respects — /bin/_pay-respects-fallback-100-request-ai
 pdfcpu — /bin/pdfcpu · stale bundle, no ECC G3
 peertube — /node_modules/.pnpm/sass-embedded-linux-x64@1.99.0/node_modules/sass-embedded-linux-x64/dart-sass/src/dart (+3 more) · trusts AAA
 peertube-viewer — /bin/peertube-viewer-rs · trusts AAA
 pencil — /opt/pencil/.pencil-wrapped · trusts AAA
 perkeep — /bin/perkeepd · stale bundle, no ECC G3 · trusts AAA
 pest-ide-tools — /bin/pest-language-server · trusts AAA
 pff-tools — /bin/pff-cli (+1 more)
 pgcat — /bin/pgcat · trusts AAA
 pgtui — /bin/pgtui
 pict-rs — /bin/.pict-rs-wrapped
 pinchflat — /lib/certifi-2.15.0/ebin/certifi.beam
 pineflash — /bin/pineflash · trusts AAA
 pixi — /bin/pixi
 pixi-pack — /bin/pixi-pack (+1 more)
 pizauth — /bin/pizauth
 platformsh — /bin/platform · trusts AAA
 pnpm — /bin/pnpm
 polar-bookshelf — /share/polar-bookshelf/polar-desktop-app.bin · trusts AAA
 polar-bookshelf1 — /share/polar-bookshelf/polar-bookshelf.bin · trusts AAA
 polaris — /bin/polaris · trusts AAA
 polkadot — /bin/polkadot · trusts AAA
 pop-launcher — /bin/pop-launcher
 popcorntime — /opt/popcorntime/chromedriver (+2 more) · trusts AAA
 portfolio_rs — /bin/portfolio_rs
 porxie — /bin/porxie
 postgres-language-server — /bin/postgrestools (+1 more)
 prek — /bin/prek
 prisma-engines_6 — /bin/query-engine (+2 more)
 prisma-engines_7 — /bin/schema-engine
 proksi — /bin/proksi · trusts AAA
 proto — /bin/.proto-wrapped
 protoc-gen-dart — /bin/protoc-gen-dart · trusts AAA
 protoc-gen-es — /lib/node_modules/protobuf-es/node_modules/turbo-linux-64/bin/turbo (+1 more) · trusts AAA
 proton-pass-cli — /bin/pass-cli
 proxelar — /bin/proxelar
 proxyauth — /bin/proxyauth · trusts AAA
 psst — /bin/psst-gui · trusts AAA
 publii — /opt/Publii/Publii · trusts AAA
 python3Packages.css-inline — /lib/python3.13/site-packages/css_inline/css_inline.abi3.so (+1 more)
 python3Packages.deltalake — /lib/python3.13/site-packages/deltalake/_internal.abi3.so (+1 more)
 python3Packages.kaleido — /lib/python3.13/site-packages/kaleido/executable/bin/kaleido (+1 more) · stale bundle, no ECC G3 · trusts AAA
 python3Packages.lancedb — /lib/python3.13/site-packages/lancedb/_lancedb.abi3.so (+1 more)
 python3Packages.onepassword-sdk — /lib/python3.13/site-packages/onepassword/lib/x86_64/libop_uniffi_core.so (+3 more)
 python3Packages.openai-harmony — /lib/python3.13/site-packages/openai_harmony/openai_harmony.abi3.so (+1 more) · trusts AAA
 python3Packages.opendal — /lib/python3.13/site-packages/opendal/_opendal.cpython-313-x86_64-linux-gnu.so (+3 more)
 python3Packages.outlines-core — /lib/python3.13/site-packages/outlines_core/outlines_core.cpython-313-x86_64-linux-gnu.so (+3 more)
 python3Packages.pdf-oxide — /lib/python3.13/site-packages/pdf_oxide/pdf_oxide.abi3.so (+1 more)
 python3Packages.primp — /lib/python3.13/site-packages/primp/primp.abi3.so (+1 more)
 python3Packages.pyiceberg-core — /lib/python3.13/site-packages/pyiceberg_core/pyiceberg_core_rust.abi3.so (+1 more)
 python3Packages.pylance — /lib/python3.13/site-packages/lance/lance.abi3.so (+1 more)
 python3Packages.pywebtransport — /lib/python3.13/site-packages/pywebtransport/_wtransport.abi3.so (+1 more)
 python3Packages.qcs-api-client-common — /lib/python3.13/site-packages/qcs_api_client_common/_qcs_api_client_common.cpython-313-x86_64-linux-gnu.so (+3 more)
 python3Packages.qcs-sdk-python — /lib/python3.13/site-packages/qcs_sdk/_qcs_sdk.cpython-313-x86_64-linux-gnu.so (+3 more)
 python3Packages.rerun-sdk — /lib/python3.13/site-packages/rerun_bindings/rerun_bindings.abi3.so (+1 more)
 python3Packages.solders — /lib/python3.13/site-packages/solders/solders.abi3.so (+1 more)
 python3Packages.tree-sitter-language-pack — /lib/python3.13/site-packages/tree_sitter_language_pack/_native.abi3.so (+1 more)
 python3Packages.vegafusion — /lib/python3.13/site-packages/vegafusion/_vegafusion.abi3.so (+1 more)
 python3Packages.vl-convert-python — /lib/python3.13/site-packages/vl_convert/vl_convert.abi3.so (+1 more) · trusts AAA
 python3Packages.zenoh — /lib/python3.13/site-packages/zenoh/zenoh.abi3.so (+1 more)
 qbz — /bin/.qbz-wrapped
 qobuz-player — /bin/qobuz-player
 qtwebengine — /libexec/webenginedriver (+1 more) · trusts AAA
 quantframe — /bin/.Quantframe-wrapped
 r2modman — /share/r2modman/node_modules/sass-embedded-linux-x64/dart-sass/src/dart (+3 more) · trusts AAA
 raccoin — /bin/raccoin · trusts AAA
 radicle-artifact — /bin/rad-artifact-node
 radicle-httpd — /bin/.radicle-httpd-wrapped (+1 more)
 radioboat — /bin/.radioboat-wrapped
 raffi — /bin/.raffi-wrapped
 railway — /bin/railway · trusts AAA
 rainfrog — /bin/rainfrog
 rates — /bin/rates · trusts AAA
 rattler-build — /bin/rattler-build
 rauthy — /bin/rauthy
 rawst — /bin/rawst · trusts AAA
 rclone-ui — /bin/.rclone-ui-wrapped
 rcodesign — /bin/rcodesign · trusts AAA
 react-native-debugger — /share/.react-native-debugger-wrapped · trusts AAA
 readest — /bin/.readest-wrapped
 realm — /bin/realm
 reddix — /bin/reddix
 repak — /bin/repak
 rerun — /bin/rerun
 reth — /bin/reth
 retroarch-bare — /bin/...retroarch-wrapped-wrapped-wrapped · stale bundle, no ECC G3 · trusts AAA
 rfc-reader — /bin/rfc_reader
 roc — /bin/roc-docs (+2 more) · trusts AAA
 rojo — /bin/rojo · trusts AAA
 routinator — /bin/routinator
 rsrpc — /bin/rsrpc-cli
 rtrtr — /bin/rtrtr
 rune — /bin/rune
 rune-languageserver — /bin/rune-languageserver
 runpodctl — /bin/runpodctl
 russ — /bin/russ · trusts AAA
 rust-motd — /bin/rust-motd
 rust-rpxy — /bin/rpxy
 rustdesk — /app/rustdesk/lib/librustdesk.so · trusts AAA
 rustdesk-server — /bin/hbbs · trusts AAA
 rustdress — /bin/rustdress · trusts AAA
 rustfinity — /bin/rustfinity · trusts AAA
 rustic — /bin/rustic
 rustical — /bin/rustical
 rustmission — /bin/rustmission · trusts AAA
 rustpython — /bin/rustpython
 rusty-psn — /bin/rusty-psn (+1 more)
 rustycli — /bin/rustycli · trusts AAA
 rustypaste — /bin/rustypaste
 rustypaste-cli — /bin/rpaste · trusts AAA
 rustywind — /bin/rustywind
 sagoin — /bin/sagoin · trusts AAA
 sail — /bin/sail
 samply — /bin/samply · trusts AAA
 sampo — /bin/sampo
 sandhole — /bin/sandhole
 scala-cli — /bin/.scala-cli-wrapped · stale bundle, no ECC G3 · trusts AAA
 scala-update — /bin/scala-update · trusts AAA
 sccache — /bin/sccache
 see-cat — /bin/see · trusts AAA
 seerr — /share/node_modules/.pnpm/@next+swc-linux-x64-gnu@14.2.33/node_modules/@next/swc-linux-x64-gnu/next-swc.linux-x64-gnu.node (+3 more) · trusts AAA
 selene — /bin/selene · trusts AAA
 selenium-manager — /bin/selenium-manager
 semtools — /bin/semtools
 sendme — /bin/sendme
 serverpod_cli — /bin/serverpod · trusts AAA
 servo — /bin/.servoshell-wrapped
 sftool-gui — /bin/.sftool-wrapped
 shadow-tls — /bin/shadow-tls · trusts AAA
 shadowsocks-qtun-plugin — /bin/qtun-client
 shadowsocks-rust — /bin/sslocal (+3 more)
 sif — /bin/sif · trusts AAA
 sing-box — /bin/sing-box · trusts AAA
 single-file-cli — /lib/node_modules/single-file-cli/node_modules/selenium-webdriver/bin/linux/selenium-manager (+2 more) · trusts AAA
 sitespeed-io — /lib/node_modules/sitespeed.io/node_modules/selenium-webdriver/bin/linux/selenium-manager (+2 more)
 skyemu — /bin/SkyEmu · trusts AAA
 slumber — /bin/slumber
 smartcat — /bin/sc · trusts AAA
 sn0int — /bin/sn0int · trusts AAA
 solana-agave — /bin/solana (+18 more) · trusts AAA
 solana-cli — /bin/solana (+11 more) · trusts AAA
 solo2-cli — /bin/solo2 · trusts AAA
 spacedrive — /bin/spacedrive · trusts AAA
 spicedb — /bin/spicedb · trusts AAA
 spot — /bin/.spot-wrapped · trusts AAA
 spotatui — /bin/spotatui
 sql-studio — /bin/sql-studio · trusts AAA
 sql_exporter — /bin/sql_exporter · trusts AAA
 sqld — /bin/sqld · trusts AAA
 sqlpage — /bin/sqlpage
 sshx — /bin/sshx · trusts AAA
 sshx-server — /bin/sshx-server · trusts AAA
 stackql — /bin/stackql · trusts AAA
 stalwart — /bin/stalwart (+1 more)
 stalwart-cli — /bin/stalwart-cli
 stax — /bin/st (+1 more)
 steamguard-cli — /bin/steamguard · trusts AAA
 steel — /bin/.forge-wrapped (+2 more)
 stirling-pdf-desktop — /bin/.Stirling-PDF-wrapped
 streamlink-twitch-gui-bin — /opt/streamlink-twitch-gui/lib/libnw.so (+1 more) · trusts AAA
 supercronic — /bin/supercronic · trusts AAA
 surfpool-cli — /bin/surfpool · trusts AAA
 surrealdb-migrations — /bin/surrealdb-migrations · trusts AAA
 surrealist — /bin/.surrealist-wrapped · trusts AAA
 svix-server — /bin/svix-server
 synapse-bt-unstable — /bin/sycli (+1 more) · trusts AAA
 tabiew — /bin/tw
 tack — /bin/tack
 tailwindcss_3 — /bin/tailwindcss · trusts AAA
 tailwindcss_4 — /bin/.tailwindcss-wrapped
 taler-depolymerization — /bin/instrumentation · trusts AAA
 taplo — /bin/taplo
 task-keeper — /bin/tk
 taskwarrior — /bin/task · trusts AAA
 tauri — /bin/cargo-tauri · trusts AAA
 tealdeer — /bin/tldr
 teamtype — /bin/teamtype
 telegram-desktop — /bin/.Telegram-wrapped · stale bundle, no ECC G3 · trusts AAA
 telemt — /bin/telemt
 television — /bin/tv
 teller — /bin/teller · trusts AAA
 tenere — /bin/tenere
 terminalmap — /bin/terminalmap
 termscp — /bin/termscp
 terracotta — /bin/terracotta
 terraform-provider-snowflake — /libexec/terraform-providers/registry.terraform.io/Snowflake-Labs/snowflake/1.0.5/linux_amd64/terraform-provider-snowflake_1.0.5 (+1 more) · trusts AAA
 tesla_auth — /bin/.tesla_auth-wrapped
 the-way — /bin/the-way · trusts AAA
 thedesk — /libexec/thedesk/thedesk-next (+2 more) · trusts AAA
 threadcat — /bin/threadcat · trusts AAA
 thumper — /bin/thumper
 thunderbird-unwrapped — /lib/thunderbird/libxul.so · trusts AAA
 tinymist — /bin/crityp (+2 more)
 tirith — /bin/tirith
 tlsx — /bin/tlsx · trusts AAA
 tmc-cli — /bin/tmc · trusts AAA
 topiary — /bin/topiary
 tor-browser — /share/tor-browser/libxul.so · trusts AAA
 tpi — /bin/tpi · trusts AAA
 transmission-rss — /bin/transmission-rss · trusts AAA
 trojan-rs — /bin/trojan · trusts AAA
 truffleruby — /lib/librubyvm.so · trusts AAA
 trunk — /bin/trunk · trusts AAA
 trunk-ng — /bin/trunk-ng · trusts AAA
 tsukimi — /bin/.tsukimi-wrapped · trusts AAA
 ttfb — /bin/ttfb
 tuifeed — /bin/tuifeed · trusts AAA
 tuistash — /bin/tuistash · trusts AAA
 tuliprox — /bin/tuliprox
 tunnelto-unstable — /bin/tunnelto (+1 more) · trusts AAA
 turbo-unwrapped — /bin/turbo
 tzupdate — /bin/tzupdate · trusts AAA
 uiua — /bin/uiua
 ukmm — /bin/.ukmm-wrapped · trusts AAA
 undetected-chromedriver — /bin/undetected-chromedriver
 unftp — /bin/unftp
 universal-android-debloater — /bin/.uad-ng-wrapped
 unsure — /bin/unsure · trusts AAA
 upsun — /bin/upsun
 urbit — /bin/urbit · trusts AAA
 urdf-viz — /bin/urdf-viz
 uv — /bin/uv
 vacuum-tube — /opt/VacuumTube/vacuumtube · trusts AAA
 vector — /bin/vector · trusts AAA
 vega-cli — /lib/node_modules/vega-cli/node_modules/@nx/nx-linux-x64-gnu/nx.linux-x64-gnu.node (+3 more) · trusts AAA
 veila — /bin/.veilad-wrapped
 venera — /app/venera/lib/librhttp.so
 vitejs — /lib/vite/node_modules/.pnpm/sass-embedded-linux-x64@1.93.3/node_modules/sass-embedded-linux-x64/dart-sass/src/dart (+1 more) · trusts AAA
 vivify — /bin/vivify-server
 voxtype — /bin/.voxtype-wrapped
 vsce — /lib/node_modules/@vscode/vsce/node_modules/@vscode/vsce-sign/bin/vsce-sign (+2 more) · trusts AAA
 vscode-extension-Continue-continue — /share/vscode/extensions/Continue.continue/out/node_modules/@lancedb/vectordb-linux-arm64-gnu/index.node
 vscode-extension-contextmapper-context-mapper-vscode-extension — /share/vscode/extensions/contextmapper.context-mapper-vscode-extension/node_modules/@vscode/vsce-sign/bin/vsce-sign (+1 more) · trusts AAA
 vscode-extension-kilocode-Kilo-Code — /share/vscode/extensions/kilocode.Kilo-Code/bin/kilo
 vscode-extension-redhat-vscode-xml — /share/vscode/extensions/redhat.vscode-xml/server/lemminx-linux-x86_64 · stale bundle, no ECC G3 · trusts AAA
 vscode-runner — /bin/.vscode_runner-wrapped · trusts AAA
 vscodium — /lib/vscode/codium · trusts AAA
 vultisig-cli — /lib/vultisig-cli/node_modules/syncpack-linux-x64/bin/syncpack (+3 more)
 wac-cli — /bin/wac · trusts AAA
 wally — /bin/wally (+1 more) · trusts AAA
 warpgate — /bin/warpgate
 wash-cli — /bin/wash
 wasm-bindgen-cli — /bin/wasm-bindgen-test-runner · trusts AAA
 wasm-pack — /bin/wasm-pack
 wasmtime — /bin/wasmtime (+1 more) · trusts AAA
 waveterm — /app/waveterm/waveterm · trusts AAA
 wayvr — /bin/uidev (+1 more)
 wealthfolio — /bin/.Wealthfolio-wrapped
 weaver — /bin/weaver
 webdav — /bin/webdav
 websurfx — /bin/websurfx
 windmill — /bin/.windmill-wrapped
 wkg — /bin/wkg
 worker-build — /bin/worker-build
 wrangler — /lib/node_modules/.pnpm/turbo-linux-64@2.2.3/node_modules/turbo-linux-64/bin/turbo (+3 more) · trusts AAA
 wrkflw — /bin/wrkflw · trusts AAA
 xfr — /bin/xfr
 xh — /bin/xh
 xwin — /bin/xwin
 yaak — /bin/.yaak-app-wrapped (+1 more)
 yamlscript — /bin/ys · trusts AAA
 yarn-zpm — /bin/yarn
 yaydl — /bin/.yaydl-wrapped
 you-have-mail-cli — /bin/you-have-mail-cli · trusts AAA
 ytermusic — /bin/ytermusic · trusts AAA
 zap-chip — /lib/node_modules/zap/dist/linux-unpacked/zap (+1 more) · trusts AAA
 zed — /bin/zed · trusts AAA
 zed-editor — /libexec/.zed-editor-wrapped · trusts AAA
 zeno — /bin/Zeno · stale bundle, no ECC G3
 zenoh — /bin/z_get (+20 more)
 zenoh-backend-influxdb — /lib/libzenoh_backend_influxdb.so (+1 more) · trusts AAA
 zenoh-c — /lib/libzenohc.a (+1 more)
 zenoh-plugin-dds — /bin/zenoh-bridge-dds
 zenoh-plugin-mqtt — /bin/zenoh-bridge-mqtt
 zeroclaw — /bin/zeroclaw (+1 more)
 zigbee2mqtt — /lib/node_modules/zigbee2mqtt/node_modules/.pnpm/@biomejs+cli-linux-x64@2.5.11/node_modules/@biomejs/cli-linux-x64/biome (+1 more)
 zola — /bin/zola
 zotero — /lib/libxul.so · trusts AAA
 zprint — /bin/zprint · trusts AAA
 zrok — /bin/zrok · trusts AAA

Name		Name	Last commit message	Last commit date
data		data
patterns		patterns
report		report
scripts		scripts
src		src
tools		tools
.gitignore		.gitignore
Cargo.lock		Cargo.lock
Cargo.toml		Cargo.toml
DETECTION.md		DETECTION.md
LICENSE		LICENSE
README.md		README.md
RESULTS.md		RESULTS.md
flake.lock		flake.lock
flake.nix		flake.nix

Navigation Menu

Repository navigation

About

Repository files navigation

nix-cacert-scan

Usage

Use

Packages to patch

Vendored PEM bundle (95)

Bundle inside a wheel, jar or zip (88)

Java keystore (37)

Compiled into a binary (662)

`About`

`Releases`

`Packages`

`Contributors`

`Languages`

Latest commit

History

Folders and files

Repository files navigation

nix-cacert-scan

Usage

Use

Packages to patch

Vendored PEM bundle (95)

Bundle inside a wheel, jar or zip (88)

Java keystore (37)

Compiled into a binary (662)

About

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages

`About`

`Resources`

`Stars`

`Watchers`

`Forks`

`Releases`

`Packages`

`Contributors`

`Languages`