fix(tls): distrust the roots behind the compromised eMudhra intermediates

apps/desktop/package.json

@@ -54,7 +54,7 @@
     "@types/node": "24.19.2",
     "@types/react": "^19",
     "@types/react-dom": "^19",
-    "electron": "43.5.0",
+    "electron": "43.8.1",
     "electron-builder": "26.15.3",
     "esbuild": "0.28.2",
     "jsdom": "^26.0.0",

apps/realtime/src/bootstrap.ts

@@ -3,9 +3,18 @@
  * loading the Socket.IO server, whose modules (`@/env`, DB preflight) read env
  * at import time. See `@sim/runtime-secrets`.
  */
+import { createLogger } from '@sim/logger'
 import { loadRuntimeSecrets } from '@sim/runtime-secrets'
+import { distrustCompromisedRoots } from '@sim/security/tls-trust'
 
+const tlsTrust = distrustCompromisedRoots()
 await loadRuntimeSecrets()
+const logger = createLogger('Bootstrap')
+if (tlsTrust.unsupported || tlsTrust.error) {
+  logger.error('Could not distrust compromised CA roots', tlsTrust)
+} else if (tlsTrust.removed.length > 0) {
+  logger.info('Distrusted compromised CA roots', { removed: tlsTrust.removed })
+}
 /**
  * Pin this process to the `realtime` DB role — covering both the realtime
  * `socketDb` pool and the shared `@sim/db` client used by handlers, preflight,

apps/sim/bootstrap.ts

@@ -3,9 +3,18 @@
  * loading the Next.js standalone server, so application modules that read env at
  * import time see the full configuration. See `@sim/runtime-secrets`.
  */
+import { createLogger } from '@sim/logger'
 import { loadRuntimeSecrets } from '@sim/runtime-secrets'
+import { distrustCompromisedRoots } from '@sim/security/tls-trust'
 
+const tlsTrust = distrustCompromisedRoots()
 await loadRuntimeSecrets()
+const logger = createLogger('Bootstrap')
+if (tlsTrust.unsupported || tlsTrust.error) {
+  logger.error('Could not distrust compromised CA roots', tlsTrust)
+} else if (tlsTrust.removed.length > 0) {
+  logger.info('Distrusted compromised CA roots', { removed: tlsTrust.removed })
+}
 // `server.js` is the Next standalone build artifact, a sibling of this file in
 // the image; it does not exist at type-check time, so the specifier is held in a
 // variable to keep it out of static module resolution.

apps/sim/trigger.config.ts

@@ -2,6 +2,8 @@ import { OTLPLogExporter } from '@opentelemetry/exporter-logs-otlp-http'
 import { OTLPMetricExporter } from '@opentelemetry/exporter-metrics-otlp-http'
 import { OTLPTraceExporter } from '@opentelemetry/exporter-trace-otlp-http'
 import { resourceFromAttributes } from '@opentelemetry/resources'
+import { createLogger } from '@sim/logger'
+import { distrustCompromisedRoots } from '@sim/security/tls-trust'
 import {
   additionalFiles,
   additionalPackages,
@@ -106,7 +108,9 @@ export default defineConfig({
    */
   ignorePatterns: ['**/*.{test,spec,integration}.{ts,tsx,mts,cts,js,jsx,mjs,cjs}'],
   /**
-   * Runs before any task run, in the run process. Marks the process so that
+   * Runs before any task run, in the run process. First drops the compromised
+   * eMudhra roots from the default CA set, before the run opens any TLS
+   * connection (see `@sim/security/tls-trust`). Then marks the process so that
    * dispatch decisions further down the call graph stop inferring from
    * environment variables whether Trigger.dev is available: a process that
    * Trigger.dev is executing has Trigger.dev available by definition.
@@ -124,6 +128,10 @@ export default defineConfig({
    * @see https://trigger.dev/docs/config/config-file#lifecycle-functions
    */
   init: async () => {
+    const tlsTrust = distrustCompromisedRoots()
+    if (tlsTrust.unsupported || tlsTrust.error) {
+      createLogger('TriggerInit').error('Could not distrust compromised CA roots', tlsTrust)
+    }
     markInsideTriggerRun()
     const { warmRedisConnection } = await import('./lib/core/config/redis')
     await warmRedisConnection()

docker/app.Dockerfile

@@ -13,12 +13,21 @@ FROM oven/bun:1.4.2-slim AS base
 # subprocess adapter; python3 is the node-gyp interpreter and is kept because
 # build-base inherits from this stage. The compiler toolchain lives in build-base
 # so the runner does not ship it.
+#
+# The OS trust store then drops the two roots that chain to the compromised
+# eMudhra intermediates (https://emudhra.we-have-a-problem.com), both already
+# out of Mozilla's store; Bun's fetch, curl, and python3 read it. The final
+# grep matches a signature line of each root (AAA, then emSign ECC G3), so the
+# build fails if the edit ever stops removing them.
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
     apt-get update && apt-get install -y --no-install-recommends \
     python3 curl ca-certificates bash ffmpeg \
     && curl -fsSL https://deb.nodesource.com/setup_24.x | bash - \
-    && apt-get install -y nodejs
+    && apt-get install -y nodejs \
+    && sed -i -E 's#^mozilla/(emSign_ECC_Root_CA_-_G3|Comodo_AAA_Services_root)\.crt$#!&#' /etc/ca-certificates.conf \
+    && update-ca-certificates \
+    && ! grep -qF -e 'l2D4kF501KKaU73yqWjgom7C12yxow+ev+to51byrvLjKzg6CYG1a4XXvi3tPxq3' -e 'CUfvO6wIBHxcmbHtRwfSAjEAnbpV/KlK6O3t5nYBQnvI+GDZjVGLVTv7jHvrZQnD' /etc/ssl/certs/ca-certificates.crt
 
 # ========================================
 # Build Base: adds the native toolchain the isolated-vm rebuild needs

docker/cron.Dockerfile

@@ -16,8 +16,15 @@ ARG TARGETARCH
 ARG SUPERCRONIC_SHA256_amd64=feefa310da569c81b99e1027b86b27b51e6ee9ab647747b49099645120cfc671
 ARG SUPERCRONIC_SHA256_arm64=f1f8585c66de020fef494dd636058f99949d108f569fef00016a1c8b9eb145b3
 
+# The trust store drops the roots that chain to the compromised eMudhra
+# intermediates (https://emudhra.we-have-a-problem.com), already out of
+# Mozilla's store. The grep matches a signature line of each root (AAA, then
+# emSign ECC G3), so the build fails if the edit ever stops removing them.
 RUN set -eux; \
     apk add --no-cache ca-certificates curl tzdata; \
+    sed -i -E 's#^mozilla/(emSign_ECC_Root_CA_-_G3|Comodo_AAA_Services_root)\.crt$#!&#' /etc/ca-certificates.conf; \
+    update-ca-certificates; \
+    if grep -qF -e 'l2D4kF501KKaU73yqWjgom7C12yxow+ev+to51byrvLjKzg6CYG1a4XXvi3tPxq3' -e 'CUfvO6wIBHxcmbHtRwfSAjEAnbpV/KlK6O3t5nYBQnvI+GDZjVGLVTv7jHvrZQnD' /etc/ssl/certs/ca-certificates.crt; then exit 1; fi; \
     case "${TARGETARCH}" in \
       amd64) sha="${SUPERCRONIC_SHA256_amd64}" ;; \
       arm64) sha="${SUPERCRONIC_SHA256_arm64}" ;; \

packages/security/package.json

@@ -50,6 +50,10 @@
       "types": "./src/standard-webhooks.ts",
       "default": "./src/standard-webhooks.ts"
     },
+    "./tls-trust": {
+      "types": "./src/tls-trust.ts",
+      "default": "./src/tls-trust.ts"
+    },
     "./tokens": {
       "types": "./src/tokens.ts",
       "default": "./src/tokens.ts"

packages/security/src/tls-trust.ts

@@ -0,0 +1,101 @@
+import { createHash, X509Certificate } from 'node:crypto'
+import tls from 'node:tls'
+
+/**
+ * SubjectPublicKeyInfo SHA-256 of every root that chains to one of the eight
+ * eMudhra intermediates whose private keys were reported compromised in October
+ * 2026 (https://emudhra.we-have-a-problem.com/roots.json). Mozilla's root store
+ * already excludes all four, so dropping them leaves the process trusting what
+ * Firefox trusts. Upstream runtimes are fixing this with their own blocklists
+ * (Node.js #66871, Bun #46159); once a deployed runtime ships one, these roots
+ * are absent from its store and {@link distrustCompromisedRoots} changes nothing.
+ */
+const COMPROMISED_ROOT_SPKI_SHA256 = new Set([
+  '8d417db2dd8bf5e3084d1e3f196d583849d81bdd4c00c70b9d39369e96b8c782', // emSign ECC Root CA - G3
+  'c619e4780ed8e0abeda24ad732567de4383a7ea941338f6d1a7d1b49ac792fe9', // emSign Root TLS CA - G3
+  '0a6c2b2ca5b364207954171987ac9d2178561569d8205457e77ca90c32ede282', // emSign Root CS CA - G3
+  'bd153ed7b0434f6886b17bce8bbe84ed340c7132d702a8f4fa318f756ecbd6f3', // AAA Certificate Services
+])
+
+export interface DistrustCompromisedRootsResult {
+  /** Subject CNs of the roots removed from the default CA set. */
+  removed: string[]
+  /** Set when the runtime cannot replace its default CA set; trust is unchanged. */
+  unsupported?: boolean
+  /** Set when reading or replacing the CA set failed; trust is unchanged. */
+  error?: unknown
+}
+
+let applied: DistrustCompromisedRootsResult | undefined
+
+function spkiSha256(certificate: X509Certificate): string {
+  return createHash('sha256')
+    .update(certificate.publicKey.export({ type: 'spki', format: 'der' }))
+    .digest('hex')
+}
+
+/**
+ * Bun's `node:tls` verifies against the OS store as well as its bundled one,
+ * but reports only the bundled roots as `default`, so replacing the default
+ * with that list alone would silently drop the OS roots. Node's `default`
+ * already is exactly what it verifies against.
+ */
+function currentTrustedCertificates(): string[] {
+  if (!process.versions.bun) return tls.getCACertificates('default')
+  return [
+    ...tls.getCACertificates('default'),
+    ...tls.getCACertificates('system'),
+    ...tls.getCACertificates('extra'),
+  ]
+}
+
+/**
+ * Removes the compromised eMudhra roots from the process-wide default CA set,
+ * so every TLS client created afterwards rejects chains through them. Call it
+ * once at process start, before any outbound connection.
+ *
+ * Covers Node's `fetch` and every `node:tls` client (`https`, Postgres, Redis,
+ * AWS SDK) under both Node and Bun. Bun's native `fetch` keeps its own compiled
+ * store and ignores this, so it needs a Bun release with the updated roots.
+ *
+ * The CA set is replaced only when a compromised root is present in it, and
+ * never on any other change: a certificate that cannot be parsed is kept, and
+ * any failure leaves trust exactly as it was. Never throws.
+ */
+export function distrustCompromisedRoots(): DistrustCompromisedRootsResult {
+  if (applied) return applied
+  if (typeof tls.setDefaultCACertificates !== 'function') {
+    applied = { removed: [], unsupported: true }
+    return applied
+  }
+
+  try {
+    const kept = new Map<string, string>()
+    const removed = new Map<string, string>()
+    for (const pem of currentTrustedCertificates()) {
+      let certificate: X509Certificate
+      try {
+        certificate = new X509Certificate(pem)
+      } catch {
+        kept.set(pem, pem)
+        continue
+      }
+      const fingerprint = certificate.fingerprint256
+      if (kept.has(fingerprint) || removed.has(fingerprint)) continue
+      if (COMPROMISED_ROOT_SPKI_SHA256.has(spkiSha256(certificate))) {
+        removed.set(
+          fingerprint,
+          certificate.subject.match(/^CN=(.*)$/m)?.[1] ?? certificate.subject
+        )
+      } else {
+        kept.set(fingerprint, pem)
+      }
+    }
+
+    if (removed.size > 0) tls.setDefaultCACertificates([...kept.values()])
+    applied = { removed: [...removed.values()] }
+  } catch (error) {
+    applied = { removed: [], error }
+  }
+  return applied
+}