Skip to content

tools: use vendored trust store in shell.nix - #67318

Merged
nodejs-github-bot merged 2 commits into
nodejs:mainfrom
aduh95:vendored-trust-store
Nov 9, 2026
Merged

nodejs-github-bot merged 2 commits into
nodejs:mainfrom
aduh95:vendored-trust-store

Conversation

@aduh95

@aduh95 aduh95 commented Nov 7, 2026 •

Copy link
Copy Markdown
Contributor

Especially important for LTS line, where we do not update the nixpkgs pin so the trust store could be quite old. Related: https://emudhra.we-have-a-problem.com/apple.html

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
@aduh95 aduh95 added dont-land-on-v22.x PRs that should not land on the v22.x-staging branch and should not be released in v22.x. dont-land-on-v24.x PRs that should not land on the v24.x-staging branch and should not be released in v24.x. labels Nov 7, 2026
@github-actions

github-actions Bot commented Nov 7, 2026

Copy link
Copy Markdown
Contributor
Platform Number of requisites Proportion of new derivations
x86_64-linux 526 -> 530 => +4 4 / 530 = 0.7%
aarch64-linux 527 -> 531 => +4 4 / 531 = 0.7%
x86_64-darwin 442 -> 446 => +4 4 / 446 = 0.8%
aarch64-darwin 455 -> 459 => +4 4 / 459 = 0.8%
Total 1950 -> 1966 => +16 16 / 1966 = 0.8%
Changelog
@@ -1177,0 +1178,16 @@
+/nix/store/2cqaisk4d708ylzmjzf4nhj1d7pxwcdw-nss-cacert-3.131.1 (aarch64-darwin)
+/nix/store/wga7b0fc2hwpk179fzhiyx9fdpn4wy7g-nss-cacert-3.131.1 (aarch64-linux)
+/nix/store/af7i638sj8x256vn09hy33dcsgy7yrjl-nss-cacert-3.131.1 (x86_64-darwin)
+/nix/store/3hqw3567s77lxz9w120cagc1zlcv14ia-nss-cacert-3.131.1 (x86_64-linux)
+/nix/store/4c4xyrlj0pjijh14cgcph3cvxiiqwx9j-nss-cacert-3.131.1-hashed (aarch64-darwin)
+/nix/store/cnws21k2jhj0n9rcd0hpb9vfixsclf23-nss-cacert-3.131.1-hashed (aarch64-linux)
+/nix/store/6q5pgyj1a1lad0c02d3ivdhaway46s5x-nss-cacert-3.131.1-hashed (x86_64-darwin)
+/nix/store/4qw5wx7jirbhwbli4szysqa0vgkhyacx-nss-cacert-3.131.1-hashed (x86_64-linux)
+/nix/store/95gmgbyn0vry3891hrcxmjk8ysl8dmjq-nss-cacert-3.131.1-p11kit (aarch64-darwin)
+/nix/store/nyxwg18l7kkr4j7cabd7wgjf4lnx6sf7-nss-cacert-3.131.1-p11kit (aarch64-linux)
+/nix/store/1pd3sy0h6710vhx2a8x9sxjpnhmc1lnd-nss-cacert-3.131.1-p11kit (x86_64-darwin)
+/nix/store/9phbpwddyy20hm3f2i52w6ki6irwbwp2-nss-cacert-3.131.1-p11kit (x86_64-linux)
+/nix/store/pmc2i8w1q6fa62bazc1haw6zb3f2lr94-nss-cacert-3.131.1-unbundled (aarch64-darwin)
+/nix/store/35rmzyfva5jc27i7m30sbsw66rckgj02-nss-cacert-3.131.1-unbundled (aarch64-linux)
+/nix/store/mvw0crwsv6sarllpm7i418ny1vixhdm4-nss-cacert-3.131.1-unbundled (x86_64-darwin)
+/nix/store/khjfvscv0q79vjva7abw62dzqcz5gdyq-nss-cacert-3.131.1-unbundled (x86_64-linux)

@aduh95

aduh95 commented Nov 9, 2026

Copy link
Copy Markdown
Contributor Author

/cc @nodejs/security

@panva panva left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@aduh95 aduh95 added author ready PRs with CI started, the required approvals, and no outstanding review comments. commit-queue PRs queued for automated landing through the Commit Queue. labels Nov 9, 2026
@nodejs-github-bot
nodejs-github-bot merged commit 04cd8c1 into nodejs:main Nov 9, 2026
35 checks passed
@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

Landed in 04cd8c1

@nodejs-github-bot nodejs-github-bot removed the commit-queue PRs queued for automated landing through the Commit Queue. label Nov 9, 2026
@aduh95
aduh95 deleted the vendored-trust-store branch November 9, 2026 16:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

author ready PRs with CI started, the required approvals, and no outstanding review comments. dont-land-on-v22.x PRs that should not land on the v22.x-staging branch and should not be released in v22.x. dont-land-on-v24.x PRs that should not land on the v24.x-staging branch and should not be released in v24.x.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants