Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

process upstream February root updates #60

Merged
merged 2 commits into from Feb 2, 2024
Merged

Conversation

cpu
Copy link
Member

@cpu cpu commented Feb 1, 2024

See https://bugzilla.mozilla.org/show_bug.cgi?id=1870673

Removals:

  1. SECOM Trust.net - Security Communication RootCA1

    This expired root CA was removed upstream.
    See https://bugzilla.mozilla.org/show_bug.cgi?id=1865450

Additions:

  1. Telekom Security TLS ECC Root 2020
    See https://bugzilla.mozilla.org/show_bug.cgi?id=1820592

  2. Telekom Security TLS RSA Root 2023
    See https://bugzilla.mozilla.org/show_bug.cgi?id=1820592

@cpu cpu self-assigned this Feb 1, 2024
@cpu
Copy link
Member Author

cpu commented Feb 1, 2024

https://bugzilla.mozilla.org/show_bug.cgi?id=1870673 mentions two additions:

Additions
Add D-Trust S/MIME Roots - TBD (CA Program Bug # 1781510)
Add Deutsche Telekom Roots - TBD (CA Program Bug # 1820592)

The D-Trust additions are for SMIME trust bit roots and so wouldn't be relevant here. The Telekom additions include some TLS roots that I would expect to show up in the CCADB report since they've already been included into NSS, however the CCADB CSV we process doesn't include any rows for these new roots. Not sure what to make of that.

Copy link
Member

@djc djc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Version bump? Should we backport this given that there's still quite a bit of old rustls in the wild? File a Mozilla issue about the lack of new roots in the CCADB report?

@cpu
Copy link
Member Author

cpu commented Feb 1, 2024

File a Mozilla issue about the lack of new roots in the CCADB report?

https://bugzilla.mozilla.org/show_bug.cgi?id=1878122

@ctz
Copy link
Member

ctz commented Feb 1, 2024

I'm going to guess there are a couple of batch processing pipelines between the mozilla sources and CCADB; maybe they'll appear after one or two 24 hour periods?

@djc
Copy link
Member

djc commented Feb 1, 2024

Well, if Mozilla batches up the changes it seems weird that they end up in the CCADB in multiple batches, right?

@cpu cpu changed the title process upstream removal of expired SECOM RootCA1 process upstream February root updates Feb 1, 2024
@cpu cpu marked this pull request as draft February 1, 2024 22:52
webpki-roots/src/lib.rs Outdated Show resolved Hide resolved
See https://bugzilla.mozilla.org/show_bug.cgi?id=1870673

Removals:

1. SECOM Trust.net - Security Communication RootCA1

   This expired root CA was removed upstream.
   See https://bugzilla.mozilla.org/show_bug.cgi?id=1865450

Additions:

1. Telekom Security TLS ECC Root 2020
   See https://bugzilla.mozilla.org/show_bug.cgi?id=1820592

2. Telekom Security SMIME RSA Root 2023
   See https://bugzilla.mozilla.org/show_bug.cgi?id=1820592
@cpu cpu marked this pull request as ready for review February 1, 2024 23:06
@cpu
Copy link
Member Author

cpu commented Feb 1, 2024

cpu wants to merge 2 commits into rustls:main from cpu:cpu-secom-removal

branch name is stale now that the additions are here, but it isn't possible to fix that without creating a new PR. The PR description and commit messages have been updated.

Version bump?

Version bump added.

Should we backport this given that there's still quite a bit of old rustls in the wild?

Yeah I think that's worthwhile. I can do that tomorrow.

@cpu cpu merged commit 0ffea70 into rustls:main Feb 2, 2024
1 check passed
@cpu cpu deleted the cpu-secom-removal branch February 2, 2024 14:41
@cpu
Copy link
Member Author

cpu commented Feb 2, 2024

  • Pushed tag v/0.26.1
  • Published webpki-roots v0.26.1 at registry crates-io
  • Created 0.26.1 GitHub release.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants