Local macOS Zig 0.17.0 trust patch #

Zig 0.17.0 reads the system keychain certificate bytes directly, without native revocation checks. This optional local patch applies the same four affected root and eight compromised intermediate SPKI exclusions as zttp v0.2.0-alpha.5 after macOS keychain scans. It does not change keychains or disable TLS verification.

The helper is copied from that release's src/trust.zig, with its test-only import removed. Its SHA-256 is ded9677e7abe503f10562d87e4a47eb7d5246aea829027739d0d30a1c6aab447. The original macOS loader fixture is from the Zig 0.17.0 distribution, licensed under MIT. The incident key provenance and original certificate tests live in src/trust-fixtures/.

Apply or restore #

Run from the zttp repository. Pass the exact library directory shown by zig env; the default is a dry run. Use --zig /path/to/zig if it is not the compiler on PATH.

uv run --no-project python -m unittest discover -s scripts -p test_macos_trust.py
uv run --no-project python scripts/macos_trust.py --lib-dir /absolute/zig/lib
uv run --no-project python scripts/macos_trust.py --lib-dir /absolute/zig/lib --apply

The script accepts only version 0.17.0 and the reviewed source checksum. It refuses unknown source, helper, or backup contents and symlinks. Before the atomic source replacement it saves the original beside the source as macos.zig.before-emudhra-2026-10-21. Repeating apply is a no-op.

Restore is also dry-run unless explicitly applied. It retains the original backup and removes only the matching helper:

uv run --no-project python scripts/macos_trust.py --lib-dir /absolute/zig/lib --restore
uv run --no-project python scripts/macos_trust.py --lib-dir /absolute/zig/lib --restore --apply

Verify the active compiler #

The Maker program used by zig fetch and build dependency resolution imports this source; existing Maker cache manifests track it. Normal source invalidation should rebuild the helper automatically. Verify the actual command results; do not assume editing source changed a cached executable, and do not delete the entire compiler cache.

zig fetch https://dv-g3b-emudhra.we-have-a-problem.com/probe.tar.gz
zig fetch https://dv-g3b-aaa-emudhra.we-have-a-problem.com/probe.tar.gz

Both must fail with certificate/TLS validation errors. An archive or Content-Type error means TLS succeeded and is a failure of this check. Fetch a genuine archive using a fresh query-string URL and compare its published package hash to ensure ordinary HTTPS still works. Exercise both bad hosts and an ordinary HTTPS control through the direct standard-library client:

zig run scripts/std_http_trust_probe.zig -lc

Then rerun zig build test plus zig build trust-probe in zttp and websocket.zig.

This local patch affects freshly compiled macOS clients using system-bundle rescans and the newly built Maker. It does not repair existing application binaries or unfiltered caller-supplied CA bundles. Toolchain reinstall or upgrade can replace the patch. Keep the released library fixes and patched Linux system CA packages; record this local modification until an upstream release replaces it. The compatibility tradeoff is distrust of all chains anchored only at the four affected roots, even otherwise valid chains.