Comment by TheDong
3 days ago
I mean, they're the TLS certs are baked into the stdlib 'tls' package, not the compiler itself.
It's just an unfortunate unforced error that the go TLS package is bundled along with the compiler, in the same way Safari being bundled with iOS updates is an unforced error meaning a safari security bug requires a full OS update.
There are no certs baked into Go’s stdlib. This is about pkg x509 blacklisting certain certs that get loaded from elsewhere.
Oh, wow, that makes it even sillier. If I want to delete certs from my system certificate store, I can do that, the stdlib should not be making that choice if it's not even packaging the things.
These are intermediate certificates, and the system certificate store on Linux provides no way to tell verifiers such as Go's crypto/x509 that an intermediate is revoked. So Go really has no other option here.
1 reply →