search

ziglang / zig

General-purpose programming language and toolchain for maintaining robust, optimal, and reusable software.
https://ziglang.org
MIT License
33.34k stars 2.43k forks source link

ship root SSL certificates along with ziglang.org-vendored tarballs #14168

Open andrewrk opened 1 year ago

andrewrk commented 1 year ago

Normally, it is best for applications to rely on their system for providing root SSL certificates. However, Zig is a bit of a special case because it aims to be "Dependency Zero" - a self-contained binary that one can use to build & install other things.

In order to do this consistently across the many different platforms that Zig aims to target, dependencies must be eliminated. There are environments where we want the zig package manager to work, for example, that will not necessarily have any root certificates installed.

Other notable applications that ship their own certificates:

These certificates would be file(s) inside of a sub-directory in lib. Any std lib code that needs a std.Certificate.Bundle would use @embedFile to obtain this set, and then at runtime augment it with the ones found locally on the OS, if any.

Open questions:

Ristovski commented 1 year ago

where to get the set of root certificates for distribution?

Curl seems to host a CA bundle (~221K) extracted from Mozilla: https://curl.se/docs/caextract.html

Direct link: https://curl.se/ca/cacert.pem

##
## Bundle of CA Root Certificates
##
## Certificate data from Mozilla as of: Tue Oct 11 03:12:05 2022 GMT
##
## This is a bundle of X.509 certificates of public Certificate Authorities
## (CA). These were automatically extracted from Mozilla's root certificates
## file (certdata.txt).  This file can be found in the mozilla source tree:
## https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt
##
## It contains the certificates in PEM format and therefore
## can be directly used with curl / libcurl / php_curl, or with
## an Apache+mod_ssl webserver for SSL client authentication.
## Just configure this file as the SSLCACertificateFile.
##
## Conversion done with mk-ca-bundle.pl version 1.29.
## SHA256: 3ff8bd209b5f2e739b9f2b96eacb694a774114685b02978257824f37ff528f71
##

The upstream sources for this are over at Mozillas VCS: https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt

Tool in question is here: https://curl.se/docs/mk-ca-bundle.html

Click to expand CA list

``` $ awk '/===/ {print line} {line = $0}' /tmp/cacert.pem GlobalSign Root CA Entrust.net Premium 2048 Secure Server CA Baltimore CyberTrust Root Entrust Root Certification Authority Comodo AAA Services root QuoVadis Root CA 2 QuoVadis Root CA 3 Security Communication Root CA XRamp Global CA Root Go Daddy Class 2 CA Starfield Class 2 CA DigiCert Assured ID Root CA DigiCert Global Root CA DigiCert High Assurance EV Root CA SwissSign Gold CA - G2 SwissSign Silver CA - G2 SecureTrust CA Secure Global CA COMODO Certification Authority Network Solutions Certificate Authority COMODO ECC Certification Authority Certigna ePKI Root Certification Authority certSIGN ROOT CA NetLock Arany (Class Gold) Főtanúsítvány Hongkong Post Root CA 1 SecureSign RootCA11 Microsec e-Szigno Root CA 2009 GlobalSign Root CA - R3 Autoridad de Certificacion Firmaprofesional CIF A62634068 Izenpe.com Go Daddy Root Certificate Authority - G2 Starfield Root Certificate Authority - G2 Starfield Services Root Certificate Authority - G2 AffirmTrust Commercial AffirmTrust Networking AffirmTrust Premium AffirmTrust Premium ECC Certum Trusted Network CA TWCA Root Certification Authority Security Communication RootCA2 Actalis Authentication Root CA Buypass Class 2 Root CA Buypass Class 3 Root CA T-TeleSec GlobalRoot Class 3 D-TRUST Root Class 3 CA 2 2009 D-TRUST Root Class 3 CA 2 EV 2009 CA Disig Root R2 ACCVRAIZ1 TWCA Global Root CA TeliaSonera Root CA v1 E-Tugra Certification Authority T-TeleSec GlobalRoot Class 2 Atos TrustedRoot 2011 QuoVadis Root CA 1 G3 QuoVadis Root CA 2 G3 QuoVadis Root CA 3 G3 DigiCert Assured ID Root G2 DigiCert Assured ID Root G3 DigiCert Global Root G2 DigiCert Global Root G3 DigiCert Trusted Root G4 COMODO RSA Certification Authority USERTrust RSA Certification Authority USERTrust ECC Certification Authority GlobalSign ECC Root CA - R5 Staat der Nederlanden EV Root CA IdenTrust Commercial Root CA 1 IdenTrust Public Sector Root CA 1 Entrust Root Certification Authority - G2 Entrust Root Certification Authority - EC1 CFCA EV ROOT OISTE WISeKey Global Root GB CA SZAFIR ROOT CA2 Certum Trusted Network CA 2 Hellenic Academic and Research Institutions RootCA 2015 Hellenic Academic and Research Institutions ECC RootCA 2015 ISRG Root X1 AC RAIZ FNMT-RCM Amazon Root CA 1 Amazon Root CA 2 Amazon Root CA 3 Amazon Root CA 4 TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1 GDCA TrustAUTH R5 ROOT TrustCor RootCert CA-1 TrustCor RootCert CA-2 TrustCor ECA-1 SSL.com Root Certification Authority RSA SSL.com Root Certification Authority ECC SSL.com EV Root Certification Authority RSA R2 SSL.com EV Root Certification Authority ECC GlobalSign Root CA - R6 OISTE WISeKey Global Root GC CA UCA Global G2 Root UCA Extended Validation Root Certigna Root CA emSign Root CA - G1 emSign ECC Root CA - G3 emSign Root CA - C1 emSign ECC Root CA - C3 Hongkong Post Root CA 3 Entrust Root Certification Authority - G4 Microsoft ECC Root Certificate Authority 2017 Microsoft RSA Root Certificate Authority 2017 e-Szigno Root CA 2017 certSIGN Root CA G2 Trustwave Global Certification Authority Trustwave Global ECC P256 Certification Authority Trustwave Global ECC P384 Certification Authority NAVER Global Root Certification Authority AC RAIZ FNMT-RCM SERVIDORES SEGUROS GlobalSign Root R46 GlobalSign Root E46 GLOBALTRUST 2020 ANF Secure Server Root CA Certum EC-384 CA Certum Trusted Root CA TunTrust Root CA HARICA TLS RSA Root CA 2021 HARICA TLS ECC Root CA 2021 Autoridad de Certificacion Firmaprofesional CIF A62634068 vTrus ECC Root CA vTrus Root CA ISRG Root X2 HiPKI Root CA - G1 GlobalSign ECC Root CA - R4 GTS Root R1 GTS Root R2 GTS Root R3 GTS Root R4 Telia Root CA v2 D-TRUST BR Root CA 1 2020 D-TRUST EV Root CA 1 2020 DigiCert TLS ECC P384 Root G5 DigiCert TLS RSA4096 Root G5 Certainly Root R1 Certainly Root E1 E-Tugra Global Root CA RSA v3 E-Tugra Global Root CA ECC v3 Security Communication RootCA3 Security Communication ECC RootCA1 ```

iacore commented 1 year ago

Does it even matter? If the hash is correct, we don't care about the identity of the domain in valid.

TLS certificates also need to be checked for update regularly, due to potential CA security breach.

mateusz834 commented 1 year ago

Normally, it is best for applications to rely on their system for providing root SSL certificates. However, Zig is a bit of a special case because it aims to be "Dependency Zero" - a self-contained binary that one can use to build & install other things.

Wouldn't it be better to try to use the system root CAs, but when they are unavail fallback to the embeded roots?

notcancername commented 4 months ago

Wouldn't it be better to try to use the system root CAs, but when they are unavail fallback to the embeded roots?

In my opinion, this should be a compile-time option, to avoid bloating the binary in cases where it would be harmful.