Your macOS Git Still Trusts Compromised Certificates
Apple's bundled git on macOS still trusts compromised eMudhra certificates, and your automated builds may be silently accepting revoked identities. By the end of this article, you will be able to detect whether your macOS git trusts the compromised certificates, remove them from the system keychain, and verify that your CI environment does not reintroduce them. macOS ships its own copy of git under /usr/bin/git, and it reads certificates from the system keychain rather than from OpenSSL default…