Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ship root SSL certificates along with ziglang.org-vendored tarballs #14168

Open
Tracked by #14178
andrewrk opened this issue Jan 3, 2023 · 4 comments
Open
Tracked by #14178

ship root SSL certificates along with ziglang.org-vendored tarballs #14168

andrewrk opened this issue Jan 3, 2023 · 4 comments
Labels
enhancement Solving this issue will likely involve adding new logic or components to the codebase. proposal This issue suggests modifications. If it also has the "accepted" label then it is planned. standard library This issue involves writing Zig code for the standard library.
Milestone
0.14.0

Comments

@andrewrk
Copy link
Member

andrewrk commented Jan 3, 2023

Normally, it is best for applications to rely on their system for providing root SSL certificates. However, Zig is a bit of a special case because it aims to be "Dependency Zero" - a self-contained binary that one can use to build & install other things.

In order to do this consistently across the many different platforms that Zig aims to target, dependencies must be eliminated. There are environments where we want the zig package manager to work, for example, that will not necessarily have any root certificates installed.

Other notable applications that ship their own certificates:

  • curl (as with Zig, curl is often "dependency zero")
  • Firefox, Chromium (as with Zig, they want the user experience to be consistent across operating systems)

These certificates would be file(s) inside of a sub-directory in lib. Any std lib code that needs a std.Certificate.Bundle would use @embedFile to obtain this set, and then at runtime augment it with the ones found locally on the OS, if any.

Open questions:

  • where to get the set of root certificates for distribution?
@andrewrk andrewrk added enhancement Solving this issue will likely involve adding new logic or components to the codebase. standard library This issue involves writing Zig code for the standard library. proposal This issue suggests modifications. If it also has the "accepted" label then it is planned. labels Jan 3, 2023
@andrewrk andrewrk added this to the 0.11.0 milestone Jan 3, 2023
This was referenced Jan 3, 2023
Closed
Closed
Merged
Open
@Ristovski
Copy link
Contributor

Ristovski commented Jan 3, 2023 •
edited
Loading

where to get the set of root certificates for distribution?

Curl seems to host a CA bundle (~221K) extracted from Mozilla: https://curl.se/docs/caextract.html

Direct link: https://curl.se/ca/cacert.pem

##
## Bundle of CA Root Certificates
##
## Certificate data from Mozilla as of: Tue Oct 11 03:12:05 2022 GMT
##
## This is a bundle of X.509 certificates of public Certificate Authorities
## (CA). These were automatically extracted from Mozilla's root certificates
## file (certdata.txt).  This file can be found in the mozilla source tree:
## https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt
##
## It contains the certificates in PEM format and therefore
## can be directly used with curl / libcurl / php_curl, or with
## an Apache+mod_ssl webserver for SSL client authentication.
## Just configure this file as the SSLCACertificateFile.
##
## Conversion done with mk-ca-bundle.pl version 1.29.
## SHA256: 3ff8bd209b5f2e739b9f2b96eacb694a774114685b02978257824f37ff528f71
##

The upstream sources for this are over at Mozillas VCS: https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt

Tool in question is here: https://curl.se/docs/mk-ca-bundle.html

Click to expand CA list 

$ awk '/===/ {print line} {line = $0}' /tmp/cacert.pem 
GlobalSign Root CA
Entrust.net Premium 2048 Secure Server CA
Baltimore CyberTrust Root
Entrust Root Certification Authority
Comodo AAA Services root
QuoVadis Root CA 2
QuoVadis Root CA 3
Security Communication Root CA
XRamp Global CA Root
Go Daddy Class 2 CA
Starfield Class 2 CA
DigiCert Assured ID Root CA
DigiCert Global Root CA
DigiCert High Assurance EV Root CA
SwissSign Gold CA - G2
SwissSign Silver CA - G2
SecureTrust CA
Secure Global CA
COMODO Certification Authority
Network Solutions Certificate Authority
COMODO ECC Certification Authority
Certigna
ePKI Root Certification Authority
certSIGN ROOT CA
NetLock Arany (Class Gold) Főtanúsítvány
Hongkong Post Root CA 1
SecureSign RootCA11
Microsec e-Szigno Root CA 2009
GlobalSign Root CA - R3
Autoridad de Certificacion Firmaprofesional CIF A62634068
Izenpe.com
Go Daddy Root Certificate Authority - G2
Starfield Root Certificate Authority - G2
Starfield Services Root Certificate Authority - G2
AffirmTrust Commercial
AffirmTrust Networking
AffirmTrust Premium
AffirmTrust Premium ECC
Certum Trusted Network CA
TWCA Root Certification Authority
Security Communication RootCA2
Actalis Authentication Root CA
Buypass Class 2 Root CA
Buypass Class 3 Root CA
T-TeleSec GlobalRoot Class 3
D-TRUST Root Class 3 CA 2 2009
D-TRUST Root Class 3 CA 2 EV 2009
CA Disig Root R2
ACCVRAIZ1
TWCA Global Root CA
TeliaSonera Root CA v1
E-Tugra Certification Authority
T-TeleSec GlobalRoot Class 2
Atos TrustedRoot 2011
QuoVadis Root CA 1 G3
QuoVadis Root CA 2 G3
QuoVadis Root CA 3 G3
DigiCert Assured ID Root G2
DigiCert Assured ID Root G3
DigiCert Global Root G2
DigiCert Global Root G3
DigiCert Trusted Root G4
COMODO RSA Certification Authority
USERTrust RSA Certification Authority
USERTrust ECC Certification Authority
GlobalSign ECC Root CA - R5
Staat der Nederlanden EV Root CA
IdenTrust Commercial Root CA 1
IdenTrust Public Sector Root CA 1
Entrust Root Certification Authority - G2
Entrust Root Certification Authority - EC1
CFCA EV ROOT
OISTE WISeKey Global Root GB CA
SZAFIR ROOT CA2
Certum Trusted Network CA 2
Hellenic Academic and Research Institutions RootCA 2015
Hellenic Academic and Research Institutions ECC RootCA 2015
ISRG Root X1
AC RAIZ FNMT-RCM
Amazon Root CA 1
Amazon Root CA 2
Amazon Root CA 3
Amazon Root CA 4
TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1
GDCA TrustAUTH R5 ROOT
TrustCor RootCert CA-1
TrustCor RootCert CA-2
TrustCor ECA-1
SSL.com Root Certification Authority RSA
SSL.com Root Certification Authority ECC
SSL.com EV Root Certification Authority RSA R2
SSL.com EV Root Certification Authority ECC
GlobalSign Root CA - R6
OISTE WISeKey Global Root GC CA
UCA Global G2 Root
UCA Extended Validation Root
Certigna Root CA
emSign Root CA - G1
emSign ECC Root CA - G3
emSign Root CA - C1
emSign ECC Root CA - C3
Hongkong Post Root CA 3
Entrust Root Certification Authority - G4
Microsoft ECC Root Certificate Authority 2017
Microsoft RSA Root Certificate Authority 2017
e-Szigno Root CA 2017
certSIGN Root CA G2
Trustwave Global Certification Authority
Trustwave Global ECC P256 Certification Authority
Trustwave Global ECC P384 Certification Authority
NAVER Global Root Certification Authority
AC RAIZ FNMT-RCM SERVIDORES SEGUROS
GlobalSign Root R46
GlobalSign Root E46
GLOBALTRUST 2020
ANF Secure Server Root CA
Certum EC-384 CA
Certum Trusted Root CA
TunTrust Root CA
HARICA TLS RSA Root CA 2021
HARICA TLS ECC Root CA 2021
Autoridad de Certificacion Firmaprofesional CIF A62634068
vTrus ECC Root CA
vTrus Root CA
ISRG Root X2
HiPKI Root CA - G1
GlobalSign ECC Root CA - R4
GTS Root R1
GTS Root R2
GTS Root R3
GTS Root R4
Telia Root CA v2
D-TRUST BR Root CA 1 2020
D-TRUST EV Root CA 1 2020
DigiCert TLS ECC P384 Root G5
DigiCert TLS RSA4096 Root G5
Certainly Root R1
Certainly Root E1
E-Tugra Global Root CA RSA v3
E-Tugra Global Root CA ECC v3
Security Communication RootCA3
Security Communication ECC RootCA1

@andrewrk andrewrk modified the milestones: 0.11.0, 0.12.0 Feb 2, 2023
@iacore
Copy link
Contributor

iacore commented Mar 12, 2023 •
edited
Loading

Does it even matter? If the hash is correct, we don't care about the identity of the domain in valid.

TLS certificates also need to be checked for update regularly, due to potential CA security breach.

@mateusz834
Copy link
Contributor

Normally, it is best for applications to rely on their system for providing root SSL certificates. However, Zig is a bit of a special case because it aims to be "Dependency Zero" - a self-contained binary that one can use to build & install other things.

Wouldn't it be better to try to use the system root CAs, but when they are unavail fallback to the embeded roots?

@andrewrk andrewrk modified the milestones: 0.13.0, 0.12.0 Jul 9, 2023
@clickingbuttons clickingbuttons mentioned this issue Apr 5, 2024
Closed
@notcancername
Copy link
Contributor

Wouldn't it be better to try to use the system root CAs, but when they are unavail fallback to the embeded roots?

In my opinion, this should be a compile-time option, to avoid bloating the binary in cases where it would be harmful.

@cixel cixel mentioned this issue Aug 17, 2024
Open
@mlugg mlugg moved this to Proposals in Package Manager Aug 22, 2024
@ianprime0509 ianprime0509 mentioned this issue Oct 19, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement Solving this issue will likely involve adding new logic or components to the codebase. proposal This issue suggests modifications. If it also has the "accepted" label then it is planned. standard library This issue involves writing Zig code for the standard library.
Projects
Package Manager
Status: Proposals
Milestone
0.14.0
Development

No branches or pull requests
5 participants
@andrewrk @Ristovski @mateusz834 @iacore @notcancername