coinos-server.git/docker/bun-distrust.ts, branch master

docker: ghcr.io/coinos/bun, oven/bun with the distrusted emSign G3 root swapped out

2026-10-21T13:03:25Z

bun-distrust.ts now carries the root's DER itself instead of finding it through tls.getCACertificates, so it works on any bun image. Co-Authored-By: Claude Opus 5.5

base: bun-distrust leaves the binary alone when there's nothing to replace

2026-10-21T12:58:33Z

Co-Authored-By: Claude Opus 5.5

base: take emSign ECC Root CA - G3 out of bun's built-in root store

2026-10-21T12:58:15Z

Bun compiles Mozilla's roots into its binary and NODE_USE_SYSTEM_CA only adds to them, so the fixed Debian ca-certificates doesn't reach fetch/tls. docker/bun-distrust.ts overwrites the root's DER in place with a same-length self-signed placeholder (key discarded) at image build time. Drop it once a bun release removes the root itself. Co-Authored-By: Claude Opus 5.5