chore(tls): drop the CA distrust step from the Bun services now that Bun ships the blocklist (#9413)

Author: waleedlatif1

apps/realtime/src/bootstrap.ts

@@ -3,18 +3,9 @@
  * loading the Socket.IO server, whose modules (`@/env`, DB preflight) read env
  * at import time. See `@sim/runtime-secrets`.
  */
-import { createLogger } from '@sim/logger'
 import { loadRuntimeSecrets } from '@sim/runtime-secrets'
-import { distrustCompromisedRoots } from '@sim/security/tls-trust'
 
-const tlsTrust = distrustCompromisedRoots()
 await loadRuntimeSecrets()
-const logger = createLogger('Bootstrap')
-if (tlsTrust.unsupported || tlsTrust.error) {
-  logger.error('Could not distrust compromised CA roots', tlsTrust)
-} else if (tlsTrust.removed.length > 0) {
-  logger.info('Distrusted compromised CA roots', { removed: tlsTrust.removed })
-}
 /**
  * Pin this process to the `realtime` DB role — covering both the realtime
  * `socketDb` pool and the shared `@sim/db` client used by handlers, preflight,

apps/sim/bootstrap.ts

@@ -3,18 +3,9 @@
  * loading the Next.js standalone server, so application modules that read env at
  * import time see the full configuration. See `@sim/runtime-secrets`.
  */
-import { createLogger } from '@sim/logger'
 import { loadRuntimeSecrets } from '@sim/runtime-secrets'
-import { distrustCompromisedRoots } from '@sim/security/tls-trust'
 
-const tlsTrust = distrustCompromisedRoots()
 await loadRuntimeSecrets()
-const logger = createLogger('Bootstrap')
-if (tlsTrust.unsupported || tlsTrust.error) {
-  logger.error('Could not distrust compromised CA roots', tlsTrust)
-} else if (tlsTrust.removed.length > 0) {
-  logger.info('Distrusted compromised CA roots', { removed: tlsTrust.removed })
-}
 // `server.js` is the Next standalone build artifact, a sibling of this file in
 // the image; it does not exist at type-check time, so the specifier is held in a
 // variable to keep it out of static module resolution.

packages/security/src/tls-trust.ts

@@ -6,9 +6,11 @@ import tls from 'node:tls'
  * eMudhra intermediates whose private keys were reported compromised in October
  * 2026 (https://emudhra.we-have-a-problem.com/roots.json). Mozilla's root store
  * already excludes all four, so dropping them leaves the process trusting what
- * Firefox trusts. Upstream runtimes are fixing this with their own blocklists
- * (Node.js #66871, Bun #46159); once a deployed runtime ships one, these roots
- * are absent from its store and {@link distrustCompromisedRoots} changes nothing.
+ * Firefox trusts. Upstream runtimes ship their own blocklists (Node.js #66871,
+ * Bun #46159); once a deployed runtime has one, these roots are absent from its
+ * store and {@link distrustCompromisedRoots} changes nothing. The Bun services
+ * run a Bun that has it, so only the Trigger.dev task runtime, whose Node build
+ * the platform chooses, still calls this.
  */
 const COMPROMISED_ROOT_SPKI_SHA256 = new Set([
   '8d417db2dd8bf5e3084d1e3f196d583849d81bdd4c00c70b9d39369e96b8c782', // emSign ECC Root CA - G3