Repository navigation
SECURITY: varlock: distrust emSign G3 (CVE-2026-111943) - #1117
Conversation
CVE-2026-111943) The release binary is a bun --compile executable around Bun 1.4.2, whose compiled-in root store still holds emSign ECC Root CA - G3; no system-CA switch removes it (they only add the system store). Bun 1.4.4 has the fix, but varlock has not shipped a binary built with it. Lay out upstream's npm package (dependency-free) plus this arch's native-helper package and run it on node-lts 24.22.1. A new test checks varlock runs on the node runtime dep and that its default store holds none of the removed emSign roots. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Warning Review limit reached
This review includes 2 billable files and costs up to $0.50.
Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing. Or wait 59 minutes for your next included review. View limit details
Comment |
There was a problem hiding this comment.
Verified the three npm tarball sha256s (varlock 1.23.0 and both native-helper packages) against registry.npmjs.org. varlock 1.23.0 has no dependencies and bin/cli.js starts with #!/usr/bin/env node. The emSign fingerprints in the new test match node-lts's existing test. The layout follows the node-lts conventions in AGENTS.md (private usr/libexec prefix, subsetOf node-lts ["node"] at runtime), and CI is green.
Why
CVE-2026-111943 (eMudhra intermediate key compromise, Mozilla bug 2083449). The varlock 1.23.0 release binary is a
bun build --compileexecutable around Bun 1.4.2, not 1.3.14 as pkgmgr-rs#1017 says. Its compiled-in root store still holds emSign ECC Root CA - G3.The store matters here. varlock downloads
@plugincode from registry.npmjs.org over HTTPS and runs it, and it sends telemetry. The truststore audit (pkgmgr-rs#1091, fleet run e75e32d0) lists it asshipped.Why not a wrapper
Checked in a min box against the 1.23.0 binary.
BUN_BE_BUN=1makes the binary act as the bun CLI, so the probe runs on varlock's own runtime. The binary still connects to the emSign hosts with each of these:NODE_USE_SYSTEM_CA=1BUN_OPTIONS=--use-system-caNODE_OPTIONS=--use-openssl-ca--use-system-caon argv--use-openssl-caon argvThe bundled roots stay trusted.
Bun fixed its store in 1.4.4 (oven-sh/bun#46300: NSS 3.131.1 plus the 8 blocked keys; both merges are ancestors of
bun-v1.4.4). But varlock hasn't released a binary built with it: the latest release is 1.23.0 from 2026-10-14. The upstream ask is a varlock release built with Bun 1.4.4 or later.What
npm i varlock; enginesnode >=22.3), which has no dependencies.@varlock/native-helper-linux-*package providesvarlock-local-encrypt. It's byte-identical to the one in the release tarball (checked on arm64) and statically linked on both arches, so the glibc runtime dep is gone.node_modulesunder the private prefixusr/libexec/varlock.usr/bin/varlockandusr/bin/varlock-local-encryptare relative symlinks. The varlock tarball is the first Source, so it's the primary source.coreutils(for/usr/bin/env) andsubsetOf node-lts ["node"].trust_store_without_emsign./usr/bin/varlockmust be a#!/usr/bin/env nodescript, and the default CA list of the node it runs on must have none of the 3 removed emSign roots. The smoke test also checks that the helper is executable.Evidence
The TLS trust harness from #976 was extended with vendor rows. The varlock row runs the probe on the runtime the installed CLI really uses: the shebang interpreter for a script, or
BUN_BE_BUN=1for the bun ELF. Live mode, 12 eMudhra hosts plus 2 positives, on arm64.Before: pkgs main 44a31a3
After: this PR's head 4ecf8f0
Other checks:
varlock loadresolves a schema.VARLOCK_DEBUG=1 varlock encryptresolves the helper (resolved via SEA sibling: /usr/bin/varlock-local-encrypt), generates a key and encrypts a value.node_moduleslookup, then the npm-download path, as the binary.min package build --rebuild varlock, thenmin check. Everything passes, standalone tests included.amd64 is covered only by the build-bot build. The harness here runs on arm64.
🤖 Generated with Claude Code