Hacker News

points by woodruffw 1 day ago | 0 comments

Homebrew ships its own CA bundle so its own curl, etc. are not affected. But the system versions of those tools will continue to be affected until Apple patches their own bundle.

Edit: Git is still affected, we're fixing that now.

(Source: I am one of Homebrew’s maintainers.)

[–] astrostl 1 day ago

I'm using the latest Homebrew git (2.56.0 confirmed with `which git` and `git --version`), and it remained vulnerable until I manually patched the SYSTEM per https://support.apple.com/en-us/149555

[–] woodruffw 1 day ago

Yes, I realized we have a gap there. I spoke too soon about Git being patched just because our own CA bundle was. My apologies.

There's a fix incoming here[1].

[1]: https://github.com/Homebrew/homebrew-core/pull/321878

[–] geephroh 1 day ago

Thanks for the fix -- appreciate the quick action!

[–] throwaway2037 1 day ago

    > Homebrew ships its own CA bundle

No trolling by this question: Can you explain your decision? I can see some pros and cons of this decision. Was it simply removing dependency upon Apple if there was a disagreement on which CA certs to trust? (You can act without permission from Apple to add/remove CA certs?) Also: How does Homebrew decide which CA certs to include/exclude? Do you get a CA cert pack from Oracle/Mozilla/Google/Microsoft/Amazon/Apple?

Outside of an enterprise environment, I never thought about having multiple "golden sources" of CA certs on a single host. (I have no experience working outside of classic enterprise environments, so please do not read my surprise as immediate dismissal of this idea!) For those unaware, in enterprise environments, it is very common to use a common CA cert pack from Oracle/Mozilla/Google/Microsoft/Amazon/Apple, but add 2-5 CA certs from your own company that act as trust roots.

I did some Googling on this matter. It looks like the "Big Four" of CA cert packs are: Mozilla, Microsoft, Apple, and Google. (I guess there is one or two in China also, be leave that alone for the moment.) What happens if they are in disagreement? This is a complex problem! If anyone is involved in this process, I would like to learn more.

[–] woodruffw 1 day ago

> Can you explain your decision?

Not easily, because it's closer to a convergence of smaller engineering decisions into an emergent choice to ship a CA bundle.

But the short version: lots of tools ship their own CA bundle. This is not ideal for distributors like Homebrew, because people expect one CA root program for the entire distribution. As a result, Homebrew tries (and sometimes fails) to apply a consistent root program across its tools. Apple's own roots are not inherently best suited for all Homebrew users, so we end up shipping a composite of their roots and the Mozila root program.

> What happens if they are in disagreement?

They are in disagreement, all the time! Root program operators are totally free to manage their trust roots as they please. The only forcing function is a desire to honor users' connections; differences in root programs end up getting papered over somewhat by cross-signing between different CAs.

[–] lukasgelbmann 1 day ago

Homebrew’s git (unlike homebrew’s curl) seems to default to using the system’s CA bundle, not homebrew’s. Is that a bug?

[–] woodruffw 1 day ago

Edit: Sorry, I forgot that I had patched my local bundle. This might indeed be an oversight, I'm looking at it now.

Edit 2: This is being fixed now[1]. Everything below is stale.

I couldn't reproduce this:

  % which git
    /opt/homebrew/bin/git
  % git ls-remote https://git-emudhra.we-have-a-problem.com/check.git
    fatal: unable to access 'https://git-emudhra.we-have-a-problem.com/check.git/': SSL certificate problem: unable to get local issuer certificate

Make sure your `git` binary is Homebrew's, not the system/XCode CLT one. If you see `/usr/bin/git`, you're not using the Homebrewed Git.

[1]: https://github.com/Homebrew/homebrew-core/pull/321878

[–] smmeis 14 hours ago

    $ brew list git --versions
    git 2.56.0_2
    $ which git
    /opt/homebrew/bin/git
    $ which curl
    /opt/homebrew/opt/curl/bin/curl
    $ git ls-remote https://git-emudhra.we-have-a-problem.com/check.git
    2975b9930644b321e18ecae09e29c15b955e6103 HEAD
    2975b9930644b321e18ecae09e29c15b955e6103 refs/heads/main

It seems that the curl formula still needs patching?

[–] bombcar 1 day ago

    $ git ls-remote https://git-emudhra.we-have-a-problem.com/check.git && which git
    2975b9930644b321e18ecae09e29c15b955e6103 HEAD
    2975b9930644b321e18ecae09e29c15b955e6103 refs/heads/main
    /opt/homebrew/bin/git

We watch; we wait (I guess)

[–] lukasgelbmann 1 day ago

> “This is being fixed now”

Wow, that was fast!

[–] forkerenok 1 day ago

> (Source: I am one of Homebrew’s maintainers.)

I would've preferred a doc or a code repo link as a source. Otherwise, this just reads like a brag. A decent one, to be fair :)

[–] woodruffw 1 day ago

I’m currently on mobile but you can look at the source (and Git history) for the ca-certificates formula for the patch.

(Sorry if you thought it was a brag, it’s just supposed to be context so that everybody is on the same page about the reason for a comment.)