mailarchive of the ptxdist mailing list
 help / color / mirror / Atom feed
From: "Sven Püschel" <s.pueschel@pengutronix.de>
To: ptxdist@pengutronix.de
Cc: "Sven Püschel" <s.pueschel@pengutronix.de>
Subject: [ptxdist] [PATCH 0/3] nss/nspr: Update to fix the eMudhra Intermediate CA Compromise
Date: Wed, 21 Oct 2026 11:51:37 +0200	[thread overview]
Message-ID: <20261021-fixemudhra-v1-0-36306b489b2e@pengutronix.de> (raw)

With the recently announced eMudhra Intermediate CA Compromise [1]
update nss to drop the root CAs to prevent applications which don't
check certificate transparency logs or revocations from establishing
insecure TLS connections.

Technically only the ca-certificates update should be relevant for this
issue, but update the nss package anyways (which also needs at least
nspr version 4.39).

This series obsoletes the previously sent nss update
(mid:20261020121054.2790945-1-s.pueschel@pengutronix.de).

[1] https://emudhra.we-have-a-problem.com/

Signed-off-by: Sven Püschel <s.pueschel@pengutronix.de>
---
Sven Püschel (3):
      nspr: version bump 4.37 -> 4.40
      nss: version bump 3.130 -> 3.131.1
      ca-certificates: version bump 3_130 -> 3_131_1

 patches/nss-3.130/0002-add-nss.pc.in.patch         | 27 ----------------------
 patches/nss-3.130/series                           |  8 -------
 .../0001-nss-fix-nsinstall-build.patch             |  0
 ...HACK-don-t-build-commands-that-need-zlib.patch} |  0
 .../0003-HACK-fix-parallel-building-issue.patch}   |  0
 .../0004-fix-dependency-generation.patch}          |  0
 patches/nss-3.131.1/series                         |  7 ++++++
 rules/ca-certificates.make                         |  4 ++--
 rules/nspr.make                                    |  4 ++--
 rules/nss.make                                     | 14 +++++++----
 10 files changed, 21 insertions(+), 43 deletions(-)
---
base-commit: 25578c25031573977db826d12d05156574cc2898
change-id: 20261021-fixemudhra-f6733d13f0c7

Best regards,
-- 
Sven Püschel <s.pueschel@pengutronix.de>




             reply	other threads:[~2026-10-21  9:52 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-10-21  9:51 Sven Püschel [this message]
2026-10-21  9:51 ` [ptxdist] [PATCH 1/3] nspr: version bump 4.37 -> 4.40 Sven Püschel
2026-10-21  9:51 ` [ptxdist] [PATCH 2/3] nss: version bump 3.130 -> 3.131.1 Sven Püschel
2026-10-26  7:57   ` Michael Olbrich
2026-10-21  9:51 ` [ptxdist] [PATCH 3/3] ca-certificates: version bump 3_130 -> 3_131_1 Sven Püschel

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261021-fixemudhra-v1-0-36306b489b2e@pengutronix.de \
    --to=s.pueschel@pengutronix.de \
    --cc=ptxdist@pengutronix.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox