Post by @emilianosandri@mastodon.bsd.cafe
Apple's command-line utilities are still exposed to the recent eMudhra weak certificate problem, and will be until a pending software update.
MacOS command-line utilities do use the OS-built-in certificate store, but they (curl, git, python, pip, ruby, bunch of others including openssl, alarmingly) are not built to know about Apple's revocation lists.
So, something to have on the, ahem, radar. More somewhat unsatisfying information here: https://support.apple.com/en-us/149555
@mhoye When an issue impacts macOS command line utils the OS structure makes very frustrating to work it out.
Two years ago I wanted to replace the built-in ssh program to have a version compatible with my Yubikey but when I saw the work involved I ultimately gave up and opted for issuing a mac only private key and copy it to my servers.
@emilianosandri Yeah. The command line has been a second class citizen of the Mac since the inception of OSX.
@mhoye Before OSX there wasn't a command line at all and earlier OSX respected Unix conventions to the point they got UNIX certified multiple times... only in later years they started to stray away for example moving home directories from /home to /Users