Repository navigation
Remove governance-managed CA bundles for outbound TLS - #8027
Draft
Eddy Ashton (eddyashton) with Copilot wants to merge 11 commits into
Draft
Eddy Ashton (eddyashton) with Copilot wants to merge 11 commits into
Eddy Ashton (eddyashton) with Copilot wants to merge 11 commits into
Conversation
Co-authored-by: eddyashton <6000239+eddyashton@users.noreply.github.com>
Co-authored-by: eddyashton <6000239+eddyashton@users.noreply.github.com>
Co-authored-by: eddyashton <6000239+eddyashton@users.noreply.github.com>
Co-authored-by: eddyashton <6000239+eddyashton@users.noreply.github.com>
Co-authored-by: eddyashton <6000239+eddyashton@users.noreply.github.com>
Co-authored-by: eddyashton <6000239+eddyashton@users.noreply.github.com>
Copilot created this pull request from a session on behalf of
Eddy Ashton (eddyashton)
July 6, 2026 12:23
There was a problem hiding this comment.
Copilot Revert changes to these versioned, shipped OpenAPI docs - we cannot change the schema for these. If we're dropping the functionality, but need to retain schema compatibility, then we could always return empty objects. Likely the correct fix is a new API version that omits the field, but don't tackle that now.
Contributor
Author
There was a problem hiding this comment.
Addressed in e9b199d by restoring the shipped JWK OpenAPI schema/example files and keeping /gov/service/jwk schema-compatible with an empty caCertBundles object.
Co-authored-by: eddyashton <6000239+eddyashton@users.noreply.github.com>
Member
|
Amaury Chamayou (@achamayou) makes a good point - its very rude to land this in a 7.x patch release, this is only targeting 8.0. |
Resolve conflicts with the JWT auto-refresh retry logic, the typed /gov/service/jwk API structs and the ccf::http_client rename. Move the changelog entry to the unreleased 7.0.17 section and cite the PR number. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
The retry unit test relied on a missing CA bundle to fail each attempt synchronously. With governance-managed bundles removed, make send_curl_get a protected virtual and override it in the test instead. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
libcurl verifies peers against its compiled-in CA bundle and ignores the OpenSSL trust store environment variables, so the documented SSL_CERT_FILE override (and the e2e tests relying on it) had no effect. Apply SSL_CERT_FILE and SSL_CERT_DIR to CURLOPT_CAINFO and CURLOPT_CAPATH for JWT refresh and endorsement fetches, and disable libcurl's CA store cache so trust store updates apply without a restart. The JWT e2e trust store now starts from the system roots, since SSL_CERT_FILE replaces the bundle, and nodes receive the usual minimal environment. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Releases up to and including 7.0.16 only auto-refresh JWT keys over TLS verified against a governance-managed CA bundle, and their constitutions reject set_jwt_issuer without ca_cert_bundle_name. JwtIssuer.register() now sets that bundle and names it when registering against such nodes, via a legacy-only Consortium.set_ca_cert_bundle helper. Newer nodes verify against SSL_CERT_FILE instead, so move the trust store helper from jwt_test.py into infra as NodeTrustStore and pass it to every node started by lts_compatibility.py, including containerised nodes, which bind-mount it. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CCF no longer needs enclave-managed Certificate Authorities for outbound TLS. Outbound TLS verification should use the host/container system trust store.
JWT/JWK auto-refresh
CURLOPT_CAINFO_BLOBoverride.ca_cert_bundle_name; legacy metadata remains readable but ignored.Governance surface
set_ca_cert_bundle/remove_ca_cert_bundleactions from sample constitutions./gov/service/jwk.Outbound HTTPS hardening
SSL_CERT_FILE.Docs and tests
SSL_CERT_FILEfor local self-signed issuer trust.