You're viewing the mastodonapp.uk public feed.

Federated feed Local feed

지지 ᚠד (Jiji Freya Daniel) 🐢✨🧡CyReVolt@mastodon.social
Oct 22, 2026, 8:58 AM
RE: https://social.treehouse.systems/@grawity/117480732617892779
Essentially needs lots of rebuilds/updates, nothing special.
On that note:
So do all those Docker/container images.
And all your systems.
I saw the (implied) question come up if a single global, content-addressable (cert) store for the entire universe would help; but: bottlenecks, agreement, ...
I am thus comparing this to the neverending discussion around shared libraries.
One property of embedding and bundling is resilience through self-sovereignty. But it's also a chicken-and-egg problem.
💬 2🔄 0⭐ 1

Replies

grawitygrawity@treehouse.systems
Oct 22, 2026, 9:10 AM
@CyReVolt I think you're putting words in my mouth which I haven't said. A "single global, content-addressable (cert) store for the entire universe" was not suggested to that extent.
The majority of those programs have already agreed on using a single store anyway. It's Mozilla's CA store all over the place. Except through many independently maintained copies – a python module, a rust crate pinned to old version, etc. – all of which become additional bottlenecks.
💬 0🔄 0⭐ 0
지지 ᚠד (Jiji Freya Daniel) 🐢✨🧡CyReVolt@mastodon.social
Oct 22, 2026, 9:51 AM
@grawity Ah sorry, I didn't mean to make it sound like you said that - I meant to pick this up from people I've generally seen suggest that noone should bundle CA certs. Thank you for clarifying, and sorry again. 🥺
💬 1🔄 0⭐ 0
지지 ᚠד (Jiji Freya Daniel) 🐢✨🧡CyReVolt@mastodon.social
Oct 22, 2026, 9:59 AM
@grawity I have rephrased it so it wouldn't sound like you meant that.
💬 0🔄 0⭐ 0
kpcyrd 🏳️‍🌈🏴kpcyrd@chaos.social
Oct 22, 2026, 10:36 AM
@CyReVolt For container images it could make sense for docker/podman/kubernetes to come up with something that mounts the CA bundle of the host into the container.
It would help with eMudhra, but it would also help with people having their own internal CAs. There's currently workarounds like https://github.com/chainguard-dev/incert
💬 1🔄 0⭐ 0
지지 ᚠד (Jiji Freya Daniel) 🐢✨🧡CyReVolt@mastodon.social
Oct 22, 2026, 11:23 AM
@kpcyrd I think that making such things an explicit container image layer would also work for some people.
Kubernetes can provide trust DBs and similar via ConfigMaps and mounts, yea - that is commonly done with many things already, such as app configuration files. I would consider trust DBs to be part of app config, thinking about it.
💬 0🔄 0⭐ 0