google_root_ssl_certificates

This directory defines the google_root_ssl_certificates package, which provides a scoped TLS trust store containing Google Trust Services (GTS) root CAs.

Overview

• Source: The certificate bundle (cert.pem) contains root certificates from Google Trust Services (GTS), the public Certificate Authority operated by Google.
• Synchronization: Automatically updated on a regular schedule via an automated synchronization pipeline. Manual edits to cert.pem should not be made directly.
• Usage:
  • Statically Routed Services: Used by platform services that communicate with Google backend endpoints (such as feedback, cobalt, and timekeeper).
  • Configurable Subsystems: Selected for the Software Delivery (SWD) stack (omaha-client, system-updater) when products configure software_delivery.trust_store = "restricted" in product assembly.
• Verification:
  • Build-time Scrutiny verification can be configured to assert that target components are strictly routed to this store.

For more details on Fuchsia's trust store architecture and product configuration policy, see TLS trust stores.