@driggsby/deploy 0.9.3 → 0.10.0

package/README.md

@@ -62,6 +62,16 @@ deploy limits locally.
 uploads only content Driggsby doesn't already have, and finalizes the
 version.
 
+Call `distrustCompromisedRoots()` once at startup, before any request. Some
+Node.js releases still trust the roots behind the eMudhra certificate
+compromise of October 2026. On official Node.js builds, 22.19.0 and later
+22.x or 24.5.0 and later, it removes them from your process's default CA
+list. Older releases can't change that list. Builds or settings that verify
+against the system's OpenSSL store (such as Homebrew's builds, or
+`--use-openssl-ca`) rely on that store's own update. In those cases, update
+Node.js or your system's CA certificates to a current release. The
+`driggsby` and `driggsby-deploy` commands already call it.
+
 Zero runtime dependencies; Node.js 18 or newer; macOS, Linux, and Windows.
 
 ## License

package/dist/cli.js

@@ -2,7 +2,9 @@
 // entrypoint.ts so tests exercise runDeployEntrypoint without triggering a
 // real deploy on import.
 import process from "node:process";
+import { distrustCompromisedRoots } from "./distrusted-roots.js";
 import { runDeployEntrypoint } from "./entrypoint.js";
+distrustCompromisedRoots();
 process.exitCode = await runDeployEntrypoint({
     argv: process.argv.slice(2),
     cwd: process.cwd(),

package/dist/distrusted-roots.d.ts

@@ -0,0 +1,16 @@
+export declare function isDistrustedRoot(pem: string): boolean;
+export interface CaListApi {
+    getCACertificates?: (type: "default" | "bundled" | "extra") => string[];
+    setDefaultCACertificates?: (certs: string[]) => void;
+}
+export interface BuildConfig {
+    variables: {
+        node_shared_openssl?: unknown;
+    };
+    target_defaults: {
+        defines?: unknown;
+    };
+}
+export declare function mayUseOpenSslStore(config?: BuildConfig): boolean;
+export declare function removeDistrustedRoots(api: CaListApi, opensslStore: () => boolean): void;
+export declare function distrustCompromisedRoots(): void;

package/dist/distrusted-roots.js

@@ -0,0 +1,83 @@
+// Roots over the eMudhra intermediate CAs that turned out, in October 2026,
+// to have trivially weak private keys. The intermediates chain to emSign ECC
+// Root CA - G3, and through Sectigo cross-signs to AAA Certificate Services,
+// so anyone can issue a certificate for any host under either root. Current
+// Node.js releases trust neither; older ones trust one or both. Both bins
+// remove them from the process's default CA list before making any request,
+// where Node.js lets them.
+import { createHash } from "node:crypto";
+import process from "node:process";
+import tls from "node:tls";
+// SHA-256 fingerprints of the two roots' DER encodings.
+const DISTRUSTED_ROOT_FINGERPRINTS = new Set([
+    // emSign ECC Root CA - G3
+    "86a1ecba089c4a8d3bbe2734c612ba341d813e043cf9e8a862cd5c57a36bbe6b",
+    // AAA Certificate Services
+    "d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef4",
+]);
+const PEM_BODY = /-----BEGIN CERTIFICATE-----([\s\S]*?)-----END CERTIFICATE-----/;
+// The SHA-256 of a PEM certificate's DER. Node.js re-serializes the list
+// once it has been set, so certificates compare by content, not by text.
+function fingerprint(pem) {
+    const body = PEM_BODY.exec(pem)?.[1];
+    if (body === undefined) {
+        return undefined;
+    }
+    const der = Buffer.from(body.replace(/\s+/g, ""), "base64");
+    return createHash("sha256").update(der).digest("hex");
+}
+export function isDistrustedRoot(pem) {
+    const print = fingerprint(pem);
+    return print !== undefined && DISTRUSTED_ROOT_FINGERPRINTS.has(print);
+}
+// Builds made to verify against OpenSSL's own store (the build flag that
+// defines NODE_OPENSSL_CERT_STORE, as Homebrew's and many Linux
+// distributions' builds do) still report Node.js's bundled list, so
+// replacing that list would swap their real store, company CAs included,
+// for the bundled roots; their fix comes from that store's own update.
+// Builds linked against a shared OpenSSL are skipped too, to stay on the
+// safe side, as is any runtime whose build configuration doesn't say.
+// Exported for tests.
+export function mayUseOpenSslStore(config = process.config) {
+    const defines = config.target_defaults.defines;
+    return (config.variables.node_shared_openssl !== false ||
+        !Array.isArray(defines) ||
+        defines.includes("NODE_OPENSSL_CERT_STORE"));
+}
+// Removes the distrusted roots from the default CA list, where that list is
+// the one Node.js verifies against: it holds every bundled root, and is at
+// least as long as the bundled roots plus the extra CAs, as it is unless
+// --use-openssl-ca is set. It never sets an empty list, and it does nothing
+// where Node.js can't change the list or the list doesn't hold the roots.
+// Exported for tests; callers use distrustCompromisedRoots.
+export function removeDistrustedRoots(api, opensslStore) {
+    if (api.getCACertificates === undefined || api.setDefaultCACertificates === undefined) {
+        return;
+    }
+    try {
+        if (opensslStore()) {
+            return;
+        }
+        const roots = api.getCACertificates("default");
+        const bundled = api.getCACertificates("bundled");
+        const listed = new Set(roots.map(fingerprint));
+        const holdsBundled = bundled.every((pem) => listed.has(fingerprint(pem)));
+        if (!holdsBundled || roots.length < bundled.length + api.getCACertificates("extra").length) {
+            return;
+        }
+        const kept = roots.filter((pem) => !isDistrustedRoot(pem));
+        if (kept.length !== roots.length && kept.length > 0) {
+            api.setDefaultCACertificates(kept);
+        }
+    }
+    catch {
+        // Hardening only: if Node.js can't read or replace its list, the CLI
+        // carries on with the list Node.js already uses.
+    }
+}
+// Silently removes the distrusted roots from this process's default CA list,
+// where Node.js lets it. Call it once at startup, before the first HTTPS
+// request: the list applies to TLS connections made after it is set.
+export function distrustCompromisedRoots() {
+    removeDistrustedRoots(tls, () => mayUseOpenSslStore());
+}

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export { DeployApiError, DeployError } from "./errors.ts";
+export { distrustCompromisedRoots } from "./distrusted-roots.ts";
 export { PUBLIC_BASE_URL, consoleUrlOnOrigin, isLoopbackBaseUrl, resolveBaseUrl } from "./base-url.ts";
 export { MAX_FILE_BYTES, MAX_FILE_COUNT, MAX_PATH_LENGTH, MAX_TOTAL_BYTES, slugProblem, } from "./limits.ts";
 export { type ProjectConfig, readProjectConfig, writeAssignedSlug } from "./project-config.ts";

package/dist/index.js

@@ -2,6 +2,9 @@
 // The driggsby CLI's deploy/rollback/versions commands build on these
 // exports; Node-only sandboxes can use them directly.
 export { DeployApiError, DeployError } from "./errors.js";
+// Drops the roots over the compromised eMudhra intermediates from the
+// process's default CA list. Both bins call it before any request.
+export { distrustCompromisedRoots } from "./distrusted-roots.js";
 // The base-URL policy: which origin the token travels to, and what
 // DRIGGSBY_BASE_URL may override it with. One implementation for both this
 // package's bin and the driggsby CLI.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@driggsby/deploy",
-  "version": "0.9.3",
+  "version": "0.10.0",
   "description": "Deploy static Driggsby apps: the deploy protocol client used by the driggsby CLI.",
   "license": "Apache-2.0",
   "repository": {