> It appears to me they do, and that is why everybody is saying to patch your python, go, and node infrastructure separately from /etc/ssl.
No it is not. As I said, the revoked key IDs is a supplementary list. It is not a root store. They do not add new root keys or transmit any public key material via this path. It may not contain data that is applicable to the root store being used, but it is perfectly permissible to relay a revocation 'out of band' as long as it represents a truly revoked certificate (CRLs and OCSP are out of band in the same sense)
Only in Java is the practice you're describing (full root store bundled with the runtime) widespread. (Edit: Node.js too, apparently)
No it is not. As I said, the revoked key IDs is a supplementary list. It is not a root store. They do not add new root keys or transmit any public key material via this path. It may not contain data that is applicable to the root store being used, but it is perfectly permissible to relay a revocation 'out of band' as long as it represents a truly revoked certificate (CRLs and OCSP are out of band in the same sense)
Only in Java is the practice you're describing (full root store bundled with the runtime) widespread. (Edit: Node.js too, apparently)