Arch Linux

--verbose

A lot has changed since CAcert has been added(+removed+readded) to Arch. From what I gather, CAcert is only in Arch because it seemed like a good idea once and nobody changed it since.

* RedHat/Fedora never added it, Debian/Ubuntu have disabled it years ago (2014/2015), it's optional in SUSE, the BSDs don't have it, actually hardly anyone but Gentoo and Arch still do. It never got included in any of the major root stores (Apple/Google/Java/Microsoft/Mozilla).

* Let's Encrypt provides free fully trusted server certs. Free mail certs from trusted roots can be had as well (why anyone would bother with smime nowadays is another matter).

* Meanwhile Google, Mozilla and others have actually done a lot to fix the "broken" CA system so that you might actually be able to - somewhat - trust the public CAs in the root programs soon. This does not apply to CAcert though, both in terms of policies/audits but also in terms of real-world technical differences, i.e. Certificate Transparency enforcement. Security improvements that made it into the Baseline requirements for CAs or Mozilla/Google policy are not implemented by CAcert. Though I doubt they do, CAcert still _could_ pretty much sign and MITM whatever and nobody would notice or care - like in the good old days or on systems with a private CA installed.

* Is there even any real-world use case for having CAcert trusted in Arch when nobody else trusts it or ever will? On the other hand, the presence of a legacy root cert with no oversight from anyone or anything could very well be considered a security risk.

I completely agree.

+ 1 for removal.

+1 removal

I'd just suggest there's a period of "depreciation" when people would be clearly informed of the removal of the package (and their options).

+1 for removal. Maybe even a few years later than should have been done. Having it available to install on as as-wanted basis is fine, but requiring it on a base system install is not. I'm also for the conflicts tag so that it gets removed by default. Sysadmins should have to deliberately want and add the package if they have some special case that requires access to those certs. In order to avoid conflicts perhaps the *-cacert package could be renamed to something else so a conflicts rule could get rid of the current packages, but a separate new package could be installed by those who want it without tripping over the conflict rule.

If you want to re-add the cacert certs without removing the ca-certificates metapackage you just need to rebuild it with a pkgrel bump; the conflicts/replaces are versioned.