Repository navigation
SECURITY: deno, claude-code: default to the system trust store (CVE-2026-111943) - #956
Merged
Merged
Conversation
deno 2.9.7 defaults to DENO_TLS_CA_STORE=mozilla: webpki-roots 0.26.1 compiled into the binary, which still trusts emSign ECC Root CA - G3 (anchor of the compromised eMudhra intermediates), with rustls-webpki 0.103.13 (no SPKI blocklist). The fix (denoland/deno#37046) is on main but in no release. The /usr/bin/deno wrapper now defaults DENO_TLS_CA_STORE=system, which reads only the OS store (fixed by the ca-certificates PR), and a caller's own value still wins. ca-certificates becomes a runtime dep so "system" is never empty. A standalone test checks the default and the override. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…1943) Claude Code 2.1.292 runs on Bun 1.4.3, whose compiled-in roots still carry emSign ECC Root CA - G3 (and C1, C3); its default CLAUDE_CODE_CERT_STORE is "bundled,system". No Bun release has oven-sh/bun#46159 yet, so no Claude Code release has fixed roots. The /usr/bin/claude wrapper now defaults CLAUDE_CODE_CERT_STORE=system ("trust only the OS certificate store" per the network-config docs), and a caller's own value still wins. ca-certificates becomes a runtime dep so the store is never empty. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
|
Warning Review limit reached
This review includes 4 billable files and costs up to $1.00.
Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing. Or wait 14 minutes for your next included review. View limit details
Comment |
jtnkminimal
approved these changes
Oct 20, 2026
This was referenced Oct 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
CVE-2026-111943. The private keys of eight eMudhra intermediate CAs are recoverable from their public certificates (Mozilla bug 2083449). In Mozilla-derived stores those intermediates chain to emSign ECC Root CA - G3. NSS 3.131.1 drops it, and so does curl's
cacert-2026-10-20.denoandclaude-codeare prebuilt and carry their own compiled-in root sets, which the ca-certificates fix (#948) doesn't reach. Neither has a fixed upstream release, but both can be told to trust only the OS store. This PR makes that the default in their existing/usr/binwrappers. The wrappers use the house: "${VAR:=default}"pattern (deno'sDENO_INSTALL_ROOT, bun'sBUN_INSTALL_BIN, pnpm'sPNPM_CONFIG_GLOBAL_BIN_DIR), so a caller's own value still wins.DENO_TLS_CA_STORE=mozilla; rustls-webpki 0.103.13 (no SPKI blocklist)9766cc5e, merged 2026-10-20: rustls-webpki 0.103.16, webpki-roots 1.0.10). No release yet; 2.9.7 is the newest tag.DENO_TLS_CA_STORE=systemBun v1.4.3in the binary). The DER of emSign ECC G3, C1 and C3 is each present once (checked by byte search against the pinned binary, shaa967e7b1…). DefaultCLAUDE_CODE_CERT_STORE=bundled,system.CLAUDE_CODE_CERT_STORE=systemWhy "system" drops the bundled roots
cli/lib/args.rsat v2.9.7 uses theDENO_TLS_CA_STORElist in place of the default["mozilla"].systemloads only native certs:SSL_CERT_FILE/SSL_CERT_DIR, else/etc/ssl/certs/ca-certificates.crt.bundled… andsystem…. The default isbundled,system", and describesystemas "trust only the OS certificate store".CA certs: Loaded N bundled root certificates/system CA certificatesper store.caas a replacement for the default store (openssl.c: "An explicit CA replaces the default trust store (Node.js semantics)"). bun 1.3.14 merged it into the defaults instead.NODE_EXTRA_CA_CERTSis still appended, so corporate proxy CAs keep working.Depends on #948 to be effective. The system store is only clean once ca-certificates drops emSign ECC G3 and Sectigo AAA Certificate Services. Merging this first is harmless: the current system store and the bundled sets are equally exposed today. Once both land, the emSign path and the Sectigo AAA cross-sign path both fail.
ca-certificatesbecomes a runtime dep of both packages, as it already is for edgedelta, capy and maki. Withsystem, an absent store would mean no roots: every TLS connection would fail, and Claude Code couldn't reach its API.Tests
tls_ca_store_default. It runsdeno evalthrough the wrapper and checks that the default issystemand that a caller'sDENO_TLS_CA_STORE=mozillais kept.execat a stub: unset →system, and a caller value (bundled,system/mozilla) is kept.deno'sDENO_INSTALL_ROOTdefault is unchanged, including withHOMEunset.nickel formatleaves both build.ncl files unchanged, andsh -n/bash -npass on both scripts.MINIMAL_SCIENCE_MODE=1 mip dump --packages --arch amd64against main changes 4 hashes:deno,claude-code,claude,claude-code-minimal-plugin.Unverified
CLAUDE_CODE_CERT_STORE=systemactually leaves its bundled roots out. That claim rests on the docs plus Bun 1.4.3'scareplacement semantics. Its JS is bytecode, so the code path couldn't be read.systemresolves/etc/ssl/certs/ca-certificates.crtin a session.claude --debugshould logCA certs: stores=systemand nobundledcount.deno evalfetch to a public host should succeed, and one withSSL_CERT_FILE=/dev/nullshould fail.Follow-ups
update --package=deno) as soon as a release containing #37046 is cut. It adds the SPKI blocklist, which removing roots can't provide. Keepsystemas the default after that, or revert tomozilla; either is defensible.stableis already 2.1.304, so we're behind regardless.🤖 Generated with Claude Code