Repository navigation
uv: ship /etc/uv/uv.toml with system-certs = true (trust the system CA store) - #1130
Conversation
uv trusts the bundled Mozilla roots unless system-certs is on, so a CA removed from ca-certificates (CVE-2026-111943) stays trusted until uv is rebuilt. The system-level uv.toml is uv's lowest-precedence config, so --no-system-certs, a user or project system-certs = false, and UV_NO_SYSTEM_CONFIG=1 still opt out. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 7721460)
|
Warning Review limit reached
This review includes 2 billable files and costs up to $0.50.
Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing. Or wait 39 minutes for your next included review. View limit details
Comment |
There was a problem hiding this comment.
uv reads /etc/uv/uv.toml as its lowest-precedence config, and system-certs routes verification through rustls-platform-verifier, which on Linux reads /etc/ssl/certs. uv declares needs.internet, so ca-certificates is injected into its closure. The test reads --show-settings offline and covers the default and all three opt-outs, and it passes on both arches.
…t (review) The patched PREK_NATIVE_TLS default reads /etc/ssl/certs/ca-certificates.crt, so the store has to be in prek's closure, as #1130/#1133/#1134/#1135 do. Without it a session with prek and no store silently uses the compiled-in roots. ca-certificates leaves system_ca_default's test_deps (base and git do not bring it), so the test's `test -s` line now proves the runtime edge. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Part of gominimal/pkgmgr-rs#1026 (prefer the system trust store), following the CVE-2026-111943 (eMudhra) response.
Why: uv trusts the Mozilla roots compiled into the binary unless
system-certsis on. So a CA removed fromca-certificatesstays trusted by uv until uv itself is rebuilt. The Cargo.lock floors on main keep the bundled list current only as of the last rebuild.Change:
/etc/uv/uv.tomlwithsystem-certs = true. That's uv's lowest-precedence config file, below the user's~/.config/uv/uv.tomland the project'suv.toml./etc/ssl/certs.needs.internetbringsca-certificatesinto every environment uv lands in.--no-system-certs,system-certs = falsein a user or projectuv.toml, orUV_NO_SYSTEM_CONFIG=1.UV_SYSTEM_CERTS=falseis not an opt-out, because uv only lets that variable turn the setting on. Both points are documented in build.sh.system-certsis still the setting's name in uv 0.13.5 (crates/uv-settings/src/settings.rs;native-tlsis the deprecated alias).Test: the standalone
system_certstest readsuv cache dir --show-settings, which needs no network. It checks that the setting is on by default, then each of the three opt-outs as negative controls.This was the
sysca/uvbranch from 10-20, cherry-picked onto current main with no conflicts. deno and claude-code were done separately in #956.🤖 Generated with Claude Code