starred/nix-config
1
0 Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-11-13 12:13:46 +01:00
Code Issues Packages Projects Releases 10 Wiki Activity

fix(pki): distrust roots with compromised eMudhra intermediates (#479)

Browse Source 
Assisted-by: DeepSeek Harness 0.2.1-rc.2 (gpt-6.1-sol)
Assisted-by: DeepSeek Harness 0.2.1-rc.2 (deepseek-flash)
This commit is contained in:
ryan4yin | 二花 authored and GitHub committed 2026-10-20 23:49:52 +08:00
1 parent 274590df63
commit 0dcf547d1f
2 files changed
+11
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

WORKAROUNDS.md
+1
View File
@@ -52,6 +52,7 @@ A setting that works around a bug or a hardware quirk.
| WA-032 | `amdgpu.runpm=0` kernel parameter — `hosts/idols-aquamarine/hardware-amd-gpu.nix` | this board's DSDT advertises ATPX power control (`\_SB.PC00.GFX0.ATPX`) but never defines the `PEG0.PEGP._OFF`/`_ON` symbols its body calls, so the first idle resume of the headless R9700 leaves it in `runtime_status = error` (`resume of IP block <smu> failed -62`) until reboot, and amdgpu discards the ACPI error. Root cause, kernel-source trail and the measured field comparison: `hosts/idols-aquamarine/ROCM.md`. | Drop once a BIOS update defines those ACPI methods (upstream releases 1023/1066 exist for this board; a flash changes PCR7, so re-enroll TPM2), or a kernel release stops trusting ATPX when its power methods are missing | 2026-10-14 | on a BIOS update or kernel bump | active |
| WA-036 | catppuccin eval-time ports kept in the home closure (`home.extraDependencies`) — `home/base/core/theme.nix` | catppuccin/nix reads some ports at eval time (`lib.importTOML "${sources.starship}/<flavor>.toml"`) and inlines the result, so the built port, catppuccin's build/install hooks and the fetched port source stay unreachable: every gc deletes them, and the deploy after it rebuilds them (build logs: 2026-10-16). `home.extraDependencies` records the port in the generation, which is a gc root. Also read at eval time upstream: `bottom`, `element` (option `element-desktop`), `firefox`, `rio`, `palette` (options `skim`, `tty`), `spotify-player`. | Drop once catppuccin/nix stops reading port files at eval time, or those ports come from a binary cache | 2026-10-16 | on a catppuccin bump | active |
| WA-039 | niri's NVIDIA free-buffer pool bounded (`GLVidHeapReuseRatio` 0) — `hosts/idols-ai/hardware-nvidia.nix` | the driver does not return freed vidmem buffers to its free pool, so niri's VRAM grows to ~1.1 GiB instead of the ~100 MiB its NVIDIA notes expect (measured 1137 MiB after 24 h uptime; [NVIDIA/egl-wayland#126](https://github.com/NVIDIA/egl-wayland/issues/126)) | Drop once a driver stops growing niri's VRAM without the profile, or niri ships its own default | 2026-10-19 | on an nvidia driver bump | active |
| WA-040 | NixOS root CA blacklist — `modules/base/security.nix` | eMudhra intermediate keys were compromised; [NixOS/nixpkgs#576390](https://github.com/NixOS/nixpkgs/pull/576390) and [#576401](https://github.com/NixOS/nixpkgs/pull/576401) merged before reaching release channels | Drop once every consumed NixOS nixpkgs revision includes the upstream root blacklist | 2026-10-20 | on nixpkgs bump | active |
If WA-008 freezes recur, the fallback is to restore the parameters commented out in
`hosts/idols-ai/hardware-configuration.nix` —
modules/base/security.nix
+10
View File
@@ -3,4 +3,14 @@
security.pki.certificateFiles = [
../../certs/ecc-ca.crt
];
# Distrust the roots that signed the compromised eMudhra intermediates
# (Mozilla advisory, 2026-10-20). Upstream nixpkgs blacklists them as of
# NixOS/nixpkgs#576390; drop this once every consumed nixpkgs revision has it (WA-040).
security.pki.caCertificateBlacklist = [
"Comodo AAA Services root"
"emSign ECC Root CA - G3"
"emSign Root CA - C1"
"emSign ECC Root CA - C3"
];
}