Flox Files

[!WARNING] After upgrading to Flox 1.19.1, we recommend rebooting your system to ensure full remediation.

Changes

• Flox no longer sets SSL_CERT_FILE in activated environments, no longer copies your SSL_CERT_FILE into NIX_SSL_CERT_FILE, and no longer overrides a NIX_SSL_CERT_FILE, PATH_LOCALE or LOCALE_ARCHIVE you have set. When neither certificate variable is set, Flox sets NIX_SSL_CERT_FILE for Nix-built software only.
• If your environment or a tool in it relied on the SSL_CERT_FILE Flox used to export, set it yourself in the manifest's [vars] section.

## Fixes

• On Linux, Flox's bundled CA certificates now distrust four compromised roots (three emSign roots and the Comodo AAA Services root). macOS is unaffected because the system keychain governs trust there.
• Environments built with Flox 1.19.0 or earlier no longer export an outdated SSL_CERT_FILE when activated. No rebuild is needed.
• Container images built with flox containerize now carry the same CA bundle at /etc/ssl/certs as Flox itself, including Flox's distrust of compromised certificate authorities.
• On Linux, activations, services, local builds, flox develop, flox run and extensions no longer inherit the SSL_CERT_FILE and SSL_CERT_DIR that Flox's TLS library wrote into the Flox process.

## Download Links

• DEB (x86_64-linux)
• DEB (aarch64-linux)
• RPM (x86_64-linux)
• RPM (aarch64-linux)
• OSX (x86_64-darwin)
• OSX (aarch64-darwin)

[!NOTE] You can find the SHA256 checksums for Flox 1.19.1 and SHA512 checksums for Flox 1.19.1 online.