Admission request trust #

ci-public-ca.py filters the runner's public CA bundle offline before the credential-bearing Prefect request. It excludes SHA-256 SubjectPublicKeyInfo digests for four affected roots and eight compromised intermediate keys from the eMudhra advisory, while preserving unrelated certificate PEM blocks and OpenSSL trust attributes. Invalid input, an empty result, or an existing output file fails before the request.

The workflow sets SSL_CERT_FILE, SSL_CERT_DIR, and CURL_CA_BUNDLE to a dedicated temporary directory and its filtered bundle. curl ignores user configuration and requires HTTPS. No additional admission run is created by the helper; the workflow retains its single serialized Prefect trigger.

Run python3 scripts/test-ci-public-ca.py for genuine affected CA fixtures, unrelated trust preservation, malformed input, and overwrite rejection. The helper, tests, and certificate fixtures match ZDS's tools/ copies.