tls: remove trustcor root ca certificates #45776

bnoordhuis · 2022-12-07T19:59:01Z

Follow what Ubuntu did and simply remove the CA certificates altogether.

Fixes: #45762
Refs: https://ubuntu.com/security/notices/USN-5761-2

src/node_root_certs.h was regenerated with perl tools/mk-ca-bundle.pl.

Follow what Ubuntu did and simply remove the CA certificates altogether. Fixes: nodejs#45762 Refs: https://ubuntu.com/security/notices/USN-5761-2

nodejs-github-bot · 2022-12-07T20:56:41Z

CI: https://ci.nodejs.org/job/node-test-pull-request/48334/

nodejs-github-bot · 2022-12-09T12:12:25Z

CI: https://ci.nodejs.org/job/node-test-pull-request/48364/

bnoordhuis · 2022-12-10T11:22:33Z

smartos build failure:

07:19:07 80 | extern "C" int madvise(caddr_t, size_t, int); 07:19:07 | ^~~~~~~ 07:19:07 In file included from ../deps/v8/src/base/platform/platform-posix.cc:18: 07:19:07 /usr/include/sys/mman.h:268:12: note: previous declaration 'int madvise(void*, std::size_t, int)' 07:19:07 268 | extern int madvise(void *, size_t, int);

I don't even... calling it unrelated is understating it. How did it even build before? Did it build before?

targos · 2022-12-10T12:29:12Z

@bnoordhuis this is discussed in nodejs/build#3108

nodejs-github-bot · 2022-12-10T13:50:27Z

CI: https://ci.nodejs.org/job/node-test-pull-request/48384/

nodejs-github-bot · 2022-12-10T15:57:03Z

Landed in 3ff724d

Follow what Ubuntu did and simply remove the CA certificates altogether. Fixes: nodejs#45762 Refs: https://ubuntu.com/security/notices/USN-5761-2 PR-URL: nodejs#45776 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Richard Lau <rlau@redhat.com>

Follow what Ubuntu did and simply remove the CA certificates altogether. Fixes: #45762 Refs: https://ubuntu.com/security/notices/USN-5761-2 PR-URL: #45776 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Richard Lau <rlau@redhat.com>

Notable changes: build: * disable v8 snapshot compression by default (Joyee Cheung) #45716 deps: * upgrade npm to 9.1.3 (npm team) #45693 doc: * add doc-only deprecation for headers/trailers setters (Rich Trott) #45697 * add Rafael to the tsc (Michael Dawson) #45691 net: * (SEMVER-MINOR) add autoSelectFamily and autoSelectFamilyAttemptTimeout options (Paolo Insogna) #44731 src: * (SEMVER-MINOR) add uvwasi version (Jithil P Ponnan) #45639 test_runner: * (SEMVER-MINOR) add t.after() hook (Colin Ihrig) #45792 * (SEMVER-MINOR) don't use a symbol for runHook() (Colin Ihrig) #45792 tls: * remove trustcor root ca certificates (Ben Noordhuis) #45776 PR-URL: TODO

Notable changes: build: * disable v8 snapshot compression by default (Joyee Cheung) #45716 deps: * upgrade npm to 9.2.0 (npm team) #45780 doc: * add doc-only deprecation for headers/trailers setters (Rich Trott) #45697 * add Rafael Gonzaga to the TSC (Michael Dawson) #45691 net: * (SEMVER-MINOR) add autoSelectFamily and autoSelectFamilyAttemptTimeout options (Paolo Insogna) #44731 src: * (SEMVER-MINOR) add uvwasi version (Jithil P Ponnan) #45639 test_runner: * (SEMVER-MINOR) add t.after() hook (Colin Ihrig) #45792 * (SEMVER-MINOR) don't use a symbol for runHook() (Colin Ihrig) #45792 tls: * remove trustcor root ca certificates (Ben Noordhuis) #45776 PR-URL: #45831

Notable changes: build: * disable v8 snapshot compression by default (Joyee Cheung) #45716 deps: * upgrade npm to 9.3.0 (npm team) #45780 doc: * add doc-only deprecation for headers/trailers setters (Rich Trott) #45697 * add Rafael Gonzaga to the TSC (Michael Dawson) #45691 net: * (SEMVER-MINOR) add autoSelectFamily and autoSelectFamilyAttemptTimeout options (Paolo Insogna) #44731 src: * (SEMVER-MINOR) add uvwasi version (Jithil P Ponnan) #45639 test_runner: * (SEMVER-MINOR) add t.after() hook (Colin Ihrig) #45792 * (SEMVER-MINOR) don't use a symbol for runHook() (Colin Ihrig) #45792 tls: * remove trustcor root ca certificates (Ben Noordhuis) #45776 PR-URL: #45831

Follow what Ubuntu did and simply remove the CA certificates altogether. Fixes: #45762 Refs: https://ubuntu.com/security/notices/USN-5761-2 PR-URL: #45776 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Richard Lau <rlau@redhat.com>

Notable changes: build: * disable v8 snapshot compression by default (Joyee Cheung) #45716 deps: * upgrade npm to 9.3.0 (npm team) #45780 doc: * add doc-only deprecation for headers/trailers setters (Rich Trott) #45697 * add Rafael Gonzaga to the TSC (Michael Dawson) #45691 net: * (SEMVER-MINOR) add autoSelectFamily and autoSelectFamilyAttemptTimeout options (Paolo Insogna) #44731 src: * (SEMVER-MINOR) add uvwasi version (Jithil P Ponnan) #45639 test_runner: * (SEMVER-MINOR) add t.after() hook (Colin Ihrig) #45792 * (SEMVER-MINOR) don't use a symbol for runHook() (Colin Ihrig) #45792 tls: * remove trustcor root ca certificates (Ben Noordhuis) #45776 PR-URL: #45831

Notable changes: build: * disable v8 snapshot compression by default (Joyee Cheung) #45716 deps: * upgrade npm to 9.2.0 (npm team) #45780 doc: * add doc-only deprecation for headers/trailers setters (Rich Trott) #45697 * add Rafael Gonzaga to the TSC (Michael Dawson) #45691 net: * (SEMVER-MINOR) add autoSelectFamily and autoSelectFamilyAttemptTimeout options (Paolo Insogna) #44731 src: * (SEMVER-MINOR) add uvwasi version (Jithil P Ponnan) #45639 test_runner: * (SEMVER-MINOR) add t.after() hook (Colin Ihrig) #45792 * (SEMVER-MINOR) don't use a symbol for runHook() (Colin Ihrig) #45792 tls: * remove trustcor root ca certificates (Ben Noordhuis) #45776 PR-URL: #45831

Follow what Ubuntu did and simply remove the CA certificates altogether. Fixes: #45762 Refs: https://ubuntu.com/security/notices/USN-5761-2 PR-URL: #45776 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Richard Lau <rlau@redhat.com>

Notable changes: Add support for externally shared js builtins: By default Node.js is built so that all dependencies are bundled into the Node.js binary itself. Some Node.js distributions prefer to manage dependencies externally. There are existing build options that allow dependencies with native code to be externalized. This commit adds additional options so that dependencies with JavaScript code (including WASM) can also be externalized. This addition does not affect binaries shipped by the Node.js project but will allow other distributions to externalize additional dependencies when needed. Contributed by Michael Dawson in #44376 fs.watch recursive support on Linux: `fs.watch` supports recursive watch using the `recursive: true` option. ```js const watcher = fs.watch(testDirectory, { recursive: true }); watcher.on('change', function(event, filename) { }); ``` Contributed by Yagiz Nizipli in #45098 Support function mocking on Node.js test runner: The `node:test` module supports mocking during testing via a top-level `mock` object. ```js test('spies on an object method', (t) => { const number = { value: 5, add(a) { return this.value + a; }, }; t.mock.method(number, 'add'); assert.strictEqual(number.add(3), 8); assert.strictEqual(number.add.mock.calls.length, 1); }); ``` Contributed by Colin Ihrig in #45326 Other notable changes: buffer: * (SEMVER-MINOR) introduce File (Khafra) #45139 build: * disable v8 snapshot compression by default (Joyee Cheung) #45716 crypto: * update root certificates (Luigi Pinca) #45490 deps: * update ICU to 72.1 (Michaël Zasso) #45068 doc: * add doc-only deprecation for headers/trailers setters (Rich Trott) #45697 * add Rafael to the tsc (Michael Dawson) #45691 * deprecate use of invalid ports in `url.parse` (Antoine du Hamel) #45576 * add lukekarrys to collaborators (Luke Karrys) #45180 * add anonrig to collaborators (Yagiz Nizipli) #45002 * deprecate url.parse() (Rich Trott) #44919 lib: * drop fetch experimental warning (Matteo Collina) #45287 net: * (SEMVER-MINOR) add autoSelectFamily and autoSelectFamilyAttemptTimeout options (Paolo Insogna) #44731 * src: * (SEMVER-MINOR) add uvwasi version (Jithil P Ponnan) #45639 * (SEMVER-MINOR) add initial shadow realm support (Chengzhong Wu) #42869 test_runner: * (SEMVER-MINOR) add t.after() hook (Colin Ihrig) #45792 * (SEMVER-MINOR) don't use a symbol for runHook() (Colin Ihrig) #45792 tls: * (SEMVER-MINOR) add "ca" property to certificate object (Ben Noordhuis) #44935 * remove trustcor root ca certificates (Ben Noordhuis) #45776 tools: * update certdata.txt (Luigi Pinca) #45490 util: * add fast path for utf8 encoding (Yagiz Nizipli) #45412 * improve textdecoder decode performance (Yagiz Nizipli) #45294 * (SEMVER-MINOR) add MIME utilities (#21128) (Bradley Farias) #21128 PR-URL: TBD

Notable changes: Add support for externally shared js builtins: By default Node.js is built so that all dependencies are bundled into the Node.js binary itself. Some Node.js distributions prefer to manage dependencies externally. There are existing build options that allow dependencies with native code to be externalized. This commit adds additional options so that dependencies with JavaScript code (including WASM) can also be externalized. This addition does not affect binaries shipped by the Node.js project but will allow other distributions to externalize additional dependencies when needed. Contributed by Michael Dawson in #44376 fs.watch recursive support on Linux: `fs.watch` supports recursive watch using the `recursive: true` option. ```js const watcher = fs.watch(testDirectory, { recursive: true }); watcher.on('change', function(event, filename) { }); ``` Contributed by Yagiz Nizipli in #45098 Support function mocking on Node.js test runner: The `node:test` module supports mocking during testing via a top-level `mock` object. ```js test('spies on an object method', (t) => { const number = { value: 5, add(a) { return this.value + a; }, }; t.mock.method(number, 'add'); assert.strictEqual(number.add(3), 8); assert.strictEqual(number.add.mock.calls.length, 1); }); ``` Contributed by Colin Ihrig in #45326 Other notable changes: buffer: * (SEMVER-MINOR) introduce File (Khafra) #45139 build: * disable v8 snapshot compression by default (Joyee Cheung) #45716 crypto: * update root certificates (Luigi Pinca) #45490 deps: * update ICU to 72.1 (Michaël Zasso) #45068 doc: * add doc-only deprecation for headers/trailers setters (Rich Trott) #45697 * add Rafael to the tsc (Michael Dawson) #45691 * deprecate use of invalid ports in `url.parse` (Antoine du Hamel) #45576 * add lukekarrys to collaborators (Luke Karrys) #45180 * add anonrig to collaborators (Yagiz Nizipli) #45002 * deprecate url.parse() (Rich Trott) #44919 lib: * drop fetch experimental warning (Matteo Collina) #45287 net: * (SEMVER-MINOR) add autoSelectFamily and autoSelectFamilyAttemptTimeout options (Paolo Insogna) #44731 * src: * (SEMVER-MINOR) add uvwasi version (Jithil P Ponnan) #45639 * (SEMVER-MINOR) add initial shadow realm support (Chengzhong Wu) #42869 test_runner: * (SEMVER-MINOR) add t.after() hook (Colin Ihrig) #45792 * (SEMVER-MINOR) don't use a symbol for runHook() (Colin Ihrig) #45792 tls: * (SEMVER-MINOR) add "ca" property to certificate object (Ben Noordhuis) #44935 * remove trustcor root ca certificates (Ben Noordhuis) #45776 tools: * update certdata.txt (Luigi Pinca) #45490 util: * add fast path for utf8 encoding (Yagiz Nizipli) #45412 * improve textdecoder decode performance (Yagiz Nizipli) #45294 * (SEMVER-MINOR) add MIME utilities (#21128) (Bradley Farias) #21128 PR-URL: #46025

Follow what Ubuntu did and simply remove the CA certificates altogether. Fixes: #45762 Refs: https://ubuntu.com/security/notices/USN-5761-2 PR-URL: #45776 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Richard Lau <rlau@redhat.com>

Notable changes: Add support for externally shared js builtins: By default Node.js is built so that all dependencies are bundled into the Node.js binary itself. Some Node.js distributions prefer to manage dependencies externally. There are existing build options that allow dependencies with native code to be externalized. This commit adds additional options so that dependencies with JavaScript code (including WASM) can also be externalized. This addition does not affect binaries shipped by the Node.js project but will allow other distributions to externalize additional dependencies when needed. Contributed by Michael Dawson in #44376 fs.watch recursive support on Linux: `fs.watch` supports recursive watch using the `recursive: true` option. ```js const watcher = fs.watch(testDirectory, { recursive: true }); watcher.on('change', function(event, filename) { }); ``` Contributed by Yagiz Nizipli in #45098 Support function mocking on Node.js test runner: The `node:test` module supports mocking during testing via a top-level `mock` object. ```js test('spies on an object method', (t) => { const number = { value: 5, add(a) { return this.value + a; }, }; t.mock.method(number, 'add'); assert.strictEqual(number.add(3), 8); assert.strictEqual(number.add.mock.calls.length, 1); }); ``` Contributed by Colin Ihrig in #45326 Other notable changes: buffer: * (SEMVER-MINOR) introduce File (Khafra) #45139 build: * disable v8 snapshot compression by default (Joyee Cheung) #45716 crypto: * update root certificates (Luigi Pinca) #45490 deps: * update ICU to 72.1 (Michaël Zasso) #45068 doc: * add doc-only deprecation for headers/trailers setters (Rich Trott) #45697 * add Rafael to the tsc (Michael Dawson) #45691 * deprecate use of invalid ports in `url.parse` (Antoine du Hamel) #45576 * add lukekarrys to collaborators (Luke Karrys) #45180 * add anonrig to collaborators (Yagiz Nizipli) #45002 * deprecate url.parse() (Rich Trott) #44919 lib: * drop fetch experimental warning (Matteo Collina) #45287 net: * (SEMVER-MINOR) add autoSelectFamily and autoSelectFamilyAttemptTimeout options (Paolo Insogna) #44731 * src: * (SEMVER-MINOR) add uvwasi version (Jithil P Ponnan) #45639 * (SEMVER-MINOR) add initial shadow realm support (Chengzhong Wu) #42869 test_runner: * (SEMVER-MINOR) add t.after() hook (Colin Ihrig) #45792 * (SEMVER-MINOR) don't use a symbol for runHook() (Colin Ihrig) #45792 tls: * (SEMVER-MINOR) add "ca" property to certificate object (Ben Noordhuis) #44935 * remove trustcor root ca certificates (Ben Noordhuis) #45776 tools: * update certdata.txt (Luigi Pinca) #45490 util: * add fast path for utf8 encoding (Yagiz Nizipli) #45412 * improve textdecoder decode performance (Yagiz Nizipli) #45294 * (SEMVER-MINOR) add MIME utilities (#21128) (Bradley Farias) #21128 PR-URL: #46025

Notable changes: Add support for externally shared js builtins: By default Node.js is built so that all dependencies are bundled into the Node.js binary itself. Some Node.js distributions prefer to manage dependencies externally. There are existing build options that allow dependencies with native code to be externalized. This commit adds additional options so that dependencies with JavaScript code (including WASM) can also be externalized. This addition does not affect binaries shipped by the Node.js project but will allow other distributions to externalize additional dependencies when needed. Contributed by Michael Dawson in #44376 Introduce `File`: The File class is part of the [FileAPI](https://w3c.github.io/FileAPI/). It can be used anywhere a Blob can, for example in `URL.createObjectURL` and `FormData`. It contains two properties that Blobs do not have: `lastModified`, the last time the file was modified in ms, and `name`, the name of the file. Contributed by Khafra in #45139 Support function mocking on Node.js test runner: The `node:test` module supports mocking during testing via a top-level `mock` object. ```js test('spies on an object method', (t) => { const number = { value: 5, add(a) { return this.value + a; }, }; t.mock.method(number, 'add'); assert.strictEqual(number.add(3), 8); assert.strictEqual(number.add.mock.calls.length, 1); }); ``` Contributed by Colin Ihrig in #45326 Other notable changes: build: * disable v8 snapshot compression by default (Joyee Cheung) #45716 crypto: * update root certificates (Luigi Pinca) #45490 deps: * update ICU to 72.1 (Michaël Zasso) #45068 doc: * add doc-only deprecation for headers/trailers setters (Rich Trott) #45697 * add Rafael to the tsc (Michael Dawson) #45691 * deprecate use of invalid ports in `url.parse` (Antoine du Hamel) #45576 * add lukekarrys to collaborators (Luke Karrys) #45180 * add anonrig to collaborators (Yagiz Nizipli) #45002 * deprecate url.parse() (Rich Trott) #44919 lib: * drop fetch experimental warning (Matteo Collina) #45287 net: * (SEMVER-MINOR) add autoSelectFamily and autoSelectFamilyAttemptTimeout options (Paolo Insogna) #44731 * src: * (SEMVER-MINOR) add uvwasi version (Jithil P Ponnan) #45639 * (SEMVER-MINOR) add initial shadow realm support (Chengzhong Wu) #42869 test_runner: * (SEMVER-MINOR) add t.after() hook (Colin Ihrig) #45792 * (SEMVER-MINOR) don't use a symbol for runHook() (Colin Ihrig) #45792 tls: * (SEMVER-MINOR) add "ca" property to certificate object (Ben Noordhuis) #44935 * remove trustcor root ca certificates (Ben Noordhuis) #45776 tools: * update certdata.txt (Luigi Pinca) #45490 util: * add fast path for utf8 encoding (Yagiz Nizipli) #45412 * improve textdecoder decode performance (Yagiz Nizipli) #45294 * (SEMVER-MINOR) add MIME utilities (#21128) (Bradley Farias) #21128 PR-URL: #46025

Follow what Ubuntu did and simply remove the CA certificates altogether. Fixes: #45762 Refs: https://ubuntu.com/security/notices/USN-5761-2 PR-URL: #45776 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Richard Lau <rlau@redhat.com>

Notable changes: Add support for externally shared js builtins: By default Node.js is built so that all dependencies are bundled into the Node.js binary itself. Some Node.js distributions prefer to manage dependencies externally. There are existing build options that allow dependencies with native code to be externalized. This commit adds additional options so that dependencies with JavaScript code (including WASM) can also be externalized. This addition does not affect binaries shipped by the Node.js project but will allow other distributions to externalize additional dependencies when needed. Contributed by Michael Dawson in #44376 Introduce `File`: The File class is part of the [FileAPI](https://w3c.github.io/FileAPI/). It can be used anywhere a Blob can, for example in `URL.createObjectURL` and `FormData`. It contains two properties that Blobs do not have: `lastModified`, the last time the file was modified in ms, and `name`, the name of the file. Contributed by Khafra in #45139 Support function mocking on Node.js test runner: The `node:test` module supports mocking during testing via a top-level `mock` object. ```js test('spies on an object method', (t) => { const number = { value: 5, add(a) { return this.value + a; }, }; t.mock.method(number, 'add'); assert.strictEqual(number.add(3), 8); assert.strictEqual(number.add.mock.calls.length, 1); }); ``` Contributed by Colin Ihrig in #45326 Other notable changes: build: * disable v8 snapshot compression by default (Joyee Cheung) #45716 crypto: * update root certificates (Luigi Pinca) #45490 deps: * update ICU to 72.1 (Michaël Zasso) #45068 doc: * add doc-only deprecation for headers/trailers setters (Rich Trott) #45697 * add Rafael to the tsc (Michael Dawson) #45691 * deprecate use of invalid ports in `url.parse` (Antoine du Hamel) #45576 * add lukekarrys to collaborators (Luke Karrys) #45180 * add anonrig to collaborators (Yagiz Nizipli) #45002 * deprecate url.parse() (Rich Trott) #44919 lib: * drop fetch experimental warning (Matteo Collina) #45287 net: * (SEMVER-MINOR) add autoSelectFamily and autoSelectFamilyAttemptTimeout options (Paolo Insogna) #44731 * src: * (SEMVER-MINOR) add uvwasi version (Jithil P Ponnan) #45639 * (SEMVER-MINOR) add initial shadow realm support (Chengzhong Wu) #42869 test_runner: * (SEMVER-MINOR) add t.after() hook (Colin Ihrig) #45792 * (SEMVER-MINOR) don't use a symbol for runHook() (Colin Ihrig) #45792 tls: * (SEMVER-MINOR) add "ca" property to certificate object (Ben Noordhuis) #44935 * remove trustcor root ca certificates (Ben Noordhuis) #45776 tools: * update certdata.txt (Luigi Pinca) #45490 util: * add fast path for utf8 encoding (Yagiz Nizipli) #45412 * improve textdecoder decode performance (Yagiz Nizipli) #45294 * (SEMVER-MINOR) add MIME utilities (#21128) (Bradley Farias) #21128 PR-URL: #46025

Follow what Ubuntu did and simply remove the CA certificates altogether. Fixes: #45762 Refs: https://ubuntu.com/security/notices/USN-5761-2 PR-URL: #45776 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Richard Lau <rlau@redhat.com>

Notable changes: Add support for externally shared js builtins: By default Node.js is built so that all dependencies are bundled into the Node.js binary itself. Some Node.js distributions prefer to manage dependencies externally. There are existing build options that allow dependencies with native code to be externalized. This commit adds additional options so that dependencies with JavaScript code (including WASM) can also be externalized. This addition does not affect binaries shipped by the Node.js project but will allow other distributions to externalize additional dependencies when needed. Contributed by Michael Dawson in #44376 Introduce `File`: The File class is part of the [FileAPI](https://w3c.github.io/FileAPI/). It can be used anywhere a Blob can, for example in `URL.createObjectURL` and `FormData`. It contains two properties that Blobs do not have: `lastModified`, the last time the file was modified in ms, and `name`, the name of the file. Contributed by Khafra in #45139 Support function mocking on Node.js test runner: The `node:test` module supports mocking during testing via a top-level `mock` object. ```js test('spies on an object method', (t) => { const number = { value: 5, add(a) { return this.value + a; }, }; t.mock.method(number, 'add'); assert.strictEqual(number.add(3), 8); assert.strictEqual(number.add.mock.calls.length, 1); }); ``` Contributed by Colin Ihrig in #45326 Other notable changes: build: * disable v8 snapshot compression by default (Joyee Cheung) #45716 crypto: * update root certificates (Luigi Pinca) #45490 deps: * update ICU to 72.1 (Michaël Zasso) #45068 doc: * add doc-only deprecation for headers/trailers setters (Rich Trott) #45697 * add Rafael to the tsc (Michael Dawson) #45691 * deprecate use of invalid ports in `url.parse` (Antoine du Hamel) #45576 * add lukekarrys to collaborators (Luke Karrys) #45180 * add anonrig to collaborators (Yagiz Nizipli) #45002 * deprecate url.parse() (Rich Trott) #44919 lib: * drop fetch experimental warning (Matteo Collina) #45287 net: * (SEMVER-MINOR) add autoSelectFamily and autoSelectFamilyAttemptTimeout options (Paolo Insogna) #44731 * src: * (SEMVER-MINOR) add uvwasi version (Jithil P Ponnan) #45639 * (SEMVER-MINOR) add initial shadow realm support (Chengzhong Wu) #42869 test_runner: * (SEMVER-MINOR) add t.after() hook (Colin Ihrig) #45792 * (SEMVER-MINOR) don't use a symbol for runHook() (Colin Ihrig) #45792 tls: * (SEMVER-MINOR) add "ca" property to certificate object (Ben Noordhuis) #44935 * remove trustcor root ca certificates (Ben Noordhuis) #45776 tools: * update certdata.txt (Luigi Pinca) #45490 util: * add fast path for utf8 encoding (Yagiz Nizipli) #45412 * improve textdecoder decode performance (Yagiz Nizipli) #45294 * (SEMVER-MINOR) add MIME utilities (#21128) (Bradley Farias) #21128 PR-URL: #46025

tls: remove trustcor root ca certificates

87d95f3

Follow what Ubuntu did and simply remove the CA certificates altogether. Fixes: nodejs#45762 Refs: https://ubuntu.com/security/notices/USN-5761-2

nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. labels Dec 7, 2022

cjihrig approved these changes Dec 7, 2022

View reviewed changes

lpinca approved these changes Dec 7, 2022

View reviewed changes

aduh95 added author ready PRs that have at least one approval, no pending requests for changes, and a CI started. request-ci Add this label to start a Jenkins CI on a PR. labels Dec 7, 2022

github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Dec 7, 2022

richardlau approved these changes Dec 7, 2022

View reviewed changes

richardlau added the notable-change PRs with changes that should be highlighted in changelogs. label Dec 7, 2022

github-actions bot mentioned this pull request Dec 9, 2022

CI Reliability 2022-12-09 nodejs/reliability#452

Open

5 tasks

bnoordhuis added request-ci Add this label to start a Jenkins CI on a PR. and removed needs-ci PRs that need a full CI run. labels Dec 9, 2022

github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Dec 9, 2022

github-actions bot mentioned this pull request Dec 10, 2022

CI Reliability 2022-12-10 nodejs/reliability#453

Open

9 tasks

richardlau added the commit-queue Add this label to land a pull request using GitHub Actions. label Dec 10, 2022

nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Dec 10, 2022

nodejs-github-bot merged commit 3ff724d into nodejs:main Dec 10, 2022

This was referenced Dec 11, 2022

CI Reliability 2022-12-11 nodejs/reliability#454

Open

CI Reliability 2022-12-12 nodejs/reliability#455

Open

targos mentioned this pull request Dec 12, 2022

v19.3.0 release proposal #45831

Merged

github-actions bot mentioned this pull request Dec 13, 2022

CI Reliability 2022-12-13 nodejs/reliability#456

Open

13 tasks

github-actions bot mentioned this pull request Dec 14, 2022

CI Reliability 2022-12-14 nodejs/reliability#457

Open

12 tasks

danielleadams mentioned this pull request Dec 30, 2022

v18.13.0 release proposal #46025

Merged

bnoordhuis deleted the fix45762 branch January 2, 2023 11:59

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

tls: remove trustcor root ca certificates #45776

tls: remove trustcor root ca certificates #45776

Uh oh!

bnoordhuis commented Dec 7, 2022

nodejs-github-bot commented Dec 7, 2022

nodejs-github-bot commented Dec 9, 2022

bnoordhuis commented Dec 10, 2022

targos commented Dec 10, 2022

nodejs-github-bot commented Dec 10, 2022

nodejs-github-bot commented Dec 10, 2022

Labels

7 participants

Uh oh!

tls: remove trustcor root ca certificates #45776

tls: remove trustcor root ca certificates #45776

Uh oh!

Conversation

bnoordhuis commented Dec 7, 2022

nodejs-github-bot commented Dec 7, 2022

nodejs-github-bot commented Dec 9, 2022

bnoordhuis commented Dec 10, 2022

targos commented Dec 10, 2022

nodejs-github-bot commented Dec 10, 2022

nodejs-github-bot commented Dec 10, 2022

Labels

7 participants