Repository navigation
Known Issues: frontend row still holds the eMudhra root in the SWC binary - #367
Merged
Merged
Conversation
…C binary The row marked fixed after the Node base and the OS bundle were read. The image also ships @next/swc-linux-arm64-musl under the sitemap generator's tool path, whose embedded root list includes "emSign ECC Root CA - G3": a full certificate DER match and a public-key match, in 16.4.3 (the version in the image) and in 16.4.6, the newest. The running server maps only node_datachannel.node, and the startup sitemap tool maps no native module, so the binary is not loaded at runtime. The row goes back to open with that detail, and a note records that the v0.14.1 release notes overstated it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
fixed. That row had been read only through Node's built-in roots and the OS bundle.developmentand the pod running it (2026-11-11):@next/swc-linux-arm64-musl16.4.3 at/app/deploy/tools/sitemap-generator/node_modules/.pnpm/…/next-swc.linux-arm64-musl.node(90 MB) contains the full DER of "emSign ECC Root CA - G3" once and its SubjectPublicKeyInfo once. The other native modules in the image (node_datachannel.node,sharp-linuxmusl-arm64-0.35.5.node) contain neither, and the 16.4.6 binary (the newest) embeds the root as well. That is the only SWC binary in the image.next-serverprocess maps onlynode_datachannel.node. The startupnext-sitemaptool, run in the image with a hook that lists mapped native modules at exit, produced its sitemap and mapped none.open(the register's vocabulary has no risk-accepted state), with the roots, the trust store sources, the runtime relevance and the 16.4.6 finding recorded, and a one-line correction note sits in the source-build item. The file has no count line; the register is now 9fixedand 5open.Test plan
check-public-repo-hygiene.py,check-markdown-links.py,check-third-party-licenses.py,check-besu-qbft-baseline.py,check-node-version-consistency.py,check-image-hash-inputs.sh