From f4ff7cb1eaa23ecffaeb11e8b31417a6db0c4b78 Mon Sep 17 00:00:00 2001 From: Lain Soykaf Date: Wed, 21 Oct 2026 08:21:43 +0400 Subject: [PATCH] fix(http): make Finch trust the CAStore bundle Mint trusts the OTP CA store, which comes from the OS. Load the CAStore bundle into it when Finch starts, so Finch trusts the same roots as the other adapters. --- changelog.d/hackney-castore.security | 2 +- lib/pleroma/application.ex | 10 ++++++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/changelog.d/hackney-castore.security b/changelog.d/hackney-castore.security index d30a53f80..44cb90ce6 100644 --- a/changelog.d/hackney-castore.security +++ b/changelog.d/hackney-castore.security @@ -1 +1 @@ -Hackney now trusts only the CAStore certificate bundle instead of its outdated certifi bundle, which still trusted the compromised eMudhra intermediate CAs +Hackney and Finch now trust only the CAStore certificate bundle, which rejects the compromised eMudhra intermediate CAs diff --git a/lib/pleroma/application.ex b/lib/pleroma/application.ex index 353e91f72..adc054f3b 100644 --- a/lib/pleroma/application.ex +++ b/lib/pleroma/application.ex @@ -66,6 +66,7 @@ defmodule Pleroma.Application do if match?({Tesla.Adapter.Finch, _}, adapter) do Logger.info("Starting Finch") + use_castore_for_otp_cacerts() Finch.start_link(name: MyFinch) end @@ -304,6 +305,15 @@ defmodule Pleroma.Application do end end + # Mint trusts the OTP CA store, which comes from the OS. Make it the CAStore + # bundle that the other adapters trust. OTP 24 has no such store and Mint + # uses CAStore there anyway. + defp use_castore_for_otp_cacerts do + if Code.ensure_loaded?(:public_key) and function_exported?(:public_key, :cacerts_load, 1) do + :ok = :public_key.cacerts_load(CAStore.file_path()) + end + end + defp http_children_hackney do pools = [:federation, :media]