Repository navigation
Test that the compromised eMudhra CAs are rejected - #57
Merged
Merged
Conversation
Run curl and uvx (bundled and system roots) against the hosts published at https://emudhra.we-have-a-problem.com/ and require a certificate error. Assisted-by: Claude Sonnet 5.5
Assisted-by: Claude Sonnet 5.5
Negative controls (uv 0.12.24, and ca-certificates 20260601 from a pre-fix snapshot) showed that dv-g3b-aaa-emudhra and uvx --system-certs pass on unpatched images, so they cannot catch a regression. Keep curl and bundled-roots uvx against dv-g3b-emudhra. Assisted-by: Claude Opus 5.5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add a container test that the image rejects the compromised eMudhra intermediate CAs described at https://emudhra.we-have-a-problem.com/.
tests/emudhra.shis run inside the built image by a new CI step. Againstdv-g3b-emudhra.we-have-a-problem.comit requires a certificate error fromcurl(exit 60, so a network failure does not pass) and fromuvxwith its bundled roots. Negative controls on a throwaway branch showed each check fails without its fix (uv 0.12.24; ca-certificates 20260601 from a pre-fix snapshot). The page's second host anduvx --system-certspassed on those unpatched images, so they are left out.The test should fail on images with
uvolder than 0.13.4 orca-certificatesolder than 20260816ubuntu0.*, and pass on the current ones. Before this branch's updates the Dockerfile useduv:0.12withubuntu:resolute-20260912; it now usesuv:0.13withubuntu:resolute-20261006. The Ubuntu base tag predates theca-certificatesfix (published 2026-10-20), so the fix reaches the image through theapt-get install ca-certificateslayer at build time, and a stale cached build would fail this test, which is the point.It passes in CI on amd64 and arm64, and also adds the
actions/checkoutstep the workflow needs to mounttests/. It depends on the third party checker host being reachable from the runners.AI Disclaimer
The code and this description were generated with AI and reviewed/tweaked by the author.
🤖 Generated with Claude Code
https://claude.ai/code/session_01MWyja3hE36C6yQkTsTfU5Y