Repository navigation
DOCOPS-203 Remove the CA filtering step, keep the apt update - #391
Merged
Merged
Conversation
GitHub does not allow NODE_OPTIONS to be set through GITHUB_ENV, so the line failed with an error annotation and never took effect, while the step still reported success. Node is covered by the 24.22.1 version pin; the step now only points OpenSSL tools at the filtered CA bundle.
✅ Deploy Preview for neo4j-docs-ui ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Ubuntu ca-certificates 20260816ubuntu0.24.04.1 already blacklists emSign ECC Root CA - G3, the root the compromised intermediates sit under, and Node 24.22.1 carries the matching removal. The filtering step only dropped other roots that were not named in the incident. Keep the three apt lines from the security guidance.
recrwplay
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces the filtering step added in #390. Keeps the three apt lines from the security guidance and the Node 24.22.1 pin.
Why
ca-certificates20260816ubuntu0.24.04.1 (published 20 October) already blacklistsemSign ECC Root CA - G3, the root the compromised intermediates sit under. The apt step picks that up, so it is the fix for the system trust store.NODE_OPTIONSthrough$GITHUB_ENV, which GitHub does not allow. Every run logged an error annotation and the step still passed.Changes
Distrust remaining eMudhra/emSign rootsstep from the two publishing jobs (ci.ymlandrelease.yml).Patch eMudhra CA compromise(the three apt lines, unchanged).Verification
CI on this PR: all checks pass and no
##[error]lines in the build log.