nix-cacert-scan

> Oh, you have a detailed package inventory or, dare I say it, SBOMs? That's really nice. Do show me where that lists the various vendored or hard-coded CA trust bundles. Yeah, I didn't think so.3 Interesting the Author linked to nixos issue here, if you follow that link you end up at nix-cacert-scan, a tool that scans your system nix closure for packages that contain TLS certs, and from there you can find out why any package includes it and add overlays to patch any such packages, even add automation to your pipeline to detect compromised certs throughout your whole system. I think this is one of the strengths of nixos, it is a pity it isn't more focused on security, missing things like signed commits on nixpkgs, built-in kernel hardening, musl builds. nixpkgs is also so huge and interweaved, it would be nice if a secure core was separated out (before someone commercial does it.)

This incident somehow exposes another previously overlooked issue. I just notice that so many softwares vendor their own version of CA store for no particular reason [1][2]. It is relatively easy to patch system CA bundles. It would be quite challenging to patch every binary that embedded their own CA. As such, many systems will remain vulnerable for quite some times. [1] nixpkgs#576475 [2] zimbatm/nix-cacert-scan