hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fix(http): make Finch trust the CAStore bundle

Browse source 
Mint trusts the OTP CA store, which comes from the OS. Load the CAStore
bundle into it when Finch starts, so Finch trusts the same roots as the
other adapters.
This commit is contained in:
Lain Soykaf 2026-10-21 08:21:43 +04:00
commit f4ff7cb1ea
No known key found for this signature in database
2 changed files with 11 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
changelog.d/hackney-castore.security
View file

@ -1 +1 @@
Hackney now trusts only the CAStore certificate bundle instead of its outdated certifi bundle, which still trusted the compromised eMudhra intermediate CAs
Hackney and Finch now trust only the CAStore certificate bundle, which rejects the compromised eMudhra intermediate CAs

10
lib/pleroma/application.ex
View file

@ -66,6 +66,7 @@ defmodule Pleroma.Application do
if match?({Tesla.Adapter.Finch, _}, adapter) do
Logger.info("Starting Finch")
use_castore_for_otp_cacerts()
Finch.start_link(name: MyFinch)
end
@ -304,6 +305,15 @@ defmodule Pleroma.Application do
end
end
# Mint trusts the OTP CA store, which comes from the OS. Make it the CAStore
# bundle that the other adapters trust. OTP 24 has no such store and Mint
# uses CAStore there anyway.
defp use_castore_for_otp_cacerts do
if Code.ensure_loaded?(:public_key) and function_exported?(:public_key, :cacerts_load, 1) do
:ok = :public_key.cacerts_load(CAStore.file_path())
end
end
defp http_children_hackney do
pools = [:federation, :media]