# Admission request trust

`ci-public-ca.py` filters the runner's public CA bundle offline before the
credential-bearing Prefect request. It excludes SHA-256 SubjectPublicKeyInfo
digests for four affected roots and eight compromised intermediate keys from
the [eMudhra advisory](https://emudhra.we-have-a-problem.com/), while preserving
unrelated certificate PEM blocks and OpenSSL trust attributes. Invalid input,
an empty result, or an existing output file fails before the request.

The workflow sets `SSL_CERT_FILE`, `SSL_CERT_DIR`, and `CURL_CA_BUNDLE` to a
dedicated temporary directory and its filtered bundle. curl ignores user
configuration and requires HTTPS. No additional admission run is created by
the helper; the workflow retains its single serialized Prefect trigger.

Run `python3 scripts/test-ci-public-ca.py` for genuine affected CA fixtures,
unrelated trust preservation, malformed input, and overwrite rejection.
The helper, tests, and certificate fixtures match ZDS's `tools/` copies.