Skip to content

Update ssl certs using pem files from google3. - #8574

Merged
briantting merged 1 commit into
youtube:25.lts.1+from
briantting:25.lts.1+
Jan 15, 2026
Merged

briantting merged 1 commit into
youtube:25.lts.1+from
briantting:25.lts.1+

Conversation

@briantting

@briantting briantting commented Jan 8, 2026 •

Copy link
Copy Markdown
Member

googledata/security/ctlog/ca_certificates/chrome/chrome_roots.pem and
security/cacerts/for_connecting_to_google/roots.pem were used with Cobalt's update_certs.py script.

Update cross-signed-*.pem

cross-signed-leaf.pem
cross-signed-root-md5.pem
cross-signed-root-sha256.pem

Cherry-picked from I6d6b77beb2b222acb470010099b79eae6556e12c

Bug: 278599663

@github-actions

github-actions Bot commented Jan 8, 2026

Copy link
Copy Markdown
Contributor

🤖 Gemini Suggested Commit Message


net: Update SSL certificates

Synchronize the set of trusted root certificates with the latest
from google3. This update ensures Cobalt maintains up-to-date
security for network connections by including current trusted roots
and removing expired or deprecated ones.

Bug: 278599663

💡 Pro Tips for a Better Commit Message:

  1. Influence the Result: Want to change the output? You can write custom prompts or instructions directly in the Pull Request description. The model uses that text to generate the message.
  2. Re-run the Generator: Post a comment with: /generate-commit-message

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the SSL root certificates by removing several old certificates and adding three new ones. The build configuration in cobalt/network/certs.gni is updated accordingly, and the list of certificates remains correctly sorted. The changes appear to be a routine certificate update from an upstream source, as indicated in the pull request description.

Per the repository's style guide, changes that are backports or cherry-picks from an upstream source do not require a detailed code review. My review confirms that the patch is applied correctly and is consistent across all file changes. Therefore, I approve this pull request.

@briantting
briantting enabled auto-merge (squash) January 8, 2026 23:14
@kaidokert

Copy link
Copy Markdown
Contributor

ping on this - can we get this landed ?

googledata/security/ctlog/ca_certificates/chrome/chrome_roots.pem and
security/cacerts/for_connecting_to_google/roots.pem were used with
Cobalt's update_certs.py script.

Bug: 278599663
@briantting
briantting disabled auto-merge January 15, 2026 01:25
@briantting
briantting merged commit 99a19f5 into youtube:25.lts.1+ Jan 15, 2026
21 checks passed
@briantting
briantting deleted the 25.lts.1+ branch May 27, 2026 10:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants