User-Agent: Cyrus-JMAP/3.1.7-1104-g203475c-fmstable-20200408v2
Mime-Version: 1.0
Message-Id: <f17a2a73-020a-46d0-bc45-1ddc261f8e7e@www.fastmail.com>
Date: Sun, 12 Apr 2020 17:00:43 -0400
From: "Filippo Valsorda" <filippo@ml.filippo.io>
To: ~alpine/devel@lists.alpinelinux.org
Cc: "Natanael Copa" <ncopa@alpinelinux.org>
Subject: Extraneous roots in current ca-certificates package
Content-Type: text/plain

Hello,

I recently ran a comparison of the root stores of Linux distributions
with the Mozilla store, and found a couple issues:

    1. There are a dozen or so certificates in ca-certificates 20191127
(latest) that shouldn't be there. I think this was due to an issue in
the Python script that was used to extract them. The new perl script
from curl in git.alpinelinux.org/ca-certificates master is doing the
right thing, so the fix should simply be to make a new release of the
package.

        a. By the way, I would suggest adding a line to the "update"
make target to download the latest version of mk-ca-bundle.pl as well,
as the certdata.txt format changes over time and new distrust settings
might get added. I can send a patch, but it's trivial enough that it
might just cause you more work.

    2. The Alpine branches that are still receiving security fixes
only, v3.8-v3.10, have out of date ca-certificates packages which
include roots distrusted due to severe security issues like Certinomis
<https://wiki.mozilla.org/CA/Certinomis_Issues> and TurkTrust
<https://blog.mozilla.org/security/2013/01/03/revoking-trust-in-two-turktrust-certficates/>.
I think changes in the CA root store easily qualify as security fixes,
and updates to ca-certificates should be propagated to all supported
versions.

By the way, I would have cc'd a security contact, but I could not
find one on the website and it looks like the team might not have one
<https://gitlab.alpinelinux.org/alpine/infra/infra/issues/9698>, which
is a bit concerning.

Thanks for your work on Alpine,
Filippo