From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Wed, 21 Oct 2026 11:52:05 +0200 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1xJSzN-001Q59-0i for lore@lore.pengutronix.de; Wed, 21 Oct 2026 11:52:05 +0200 Received: from [127.0.0.1] (helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xJSzM-0004IV-KI; Wed, 21 Oct 2026 11:52:04 +0200 Received: from dude04.red.stw.pengutronix.de ([2a0a:edc0:0:1101:1d::ac]) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xJSz9-0004GU-Ln; Wed, 21 Oct 2026 11:51:51 +0200 From: =?utf-8?q?Sven_P=C3=BCschel?= Date: Wed, 21 Oct 2026 11:51:37 +0200 Message-Id: <20261021-fixemudhra-v1-0-36306b489b2e@pengutronix.de> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit X-B4-Tracking: v=1; b=H4sIACmL2GoC/6tWKk4tykwtVrJSqFYqSi3LLM7MzwNyDHUUlJIzE vPSU3UzU4B8JSMDIzNDAyND3bTMitTc0pSMokTdNDNzY+MUQ+M0g2RzJaCGgqJUkCzIsOjY2lo AzPa2hFwAAAA= X-Change-ID: 20261021-fixemudhra-f6733d13f0c7 To: ptxdist@pengutronix.de X-Mailer: b4 0.14.2 Subject: [ptxdist] [PATCH 0/3] nss/nspr: Update to fix the eMudhra Intermediate CA Compromise X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Cc: =?utf-8?q?Sven_P=C3=BCschel?= Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false With the recently announced eMudhra Intermediate CA Compromise [1] update nss to drop the root CAs to prevent applications which don't check certificate transparency logs or revocations from establishing insecure TLS connections. Technically only the ca-certificates update should be relevant for this issue, but update the nss package anyways (which also needs at least nspr version 4.39). This series obsoletes the previously sent nss update (mid:20261020121054.2790945-1-s.pueschel@pengutronix.de). [1] https://emudhra.we-have-a-problem.com/ Signed-off-by: Sven Püschel --- Sven Püschel (3): nspr: version bump 4.37 -> 4.40 nss: version bump 3.130 -> 3.131.1 ca-certificates: version bump 3_130 -> 3_131_1 patches/nss-3.130/0002-add-nss.pc.in.patch | 27 ---------------------- patches/nss-3.130/series | 8 ------- .../0001-nss-fix-nsinstall-build.patch | 0 ...HACK-don-t-build-commands-that-need-zlib.patch} | 0 .../0003-HACK-fix-parallel-building-issue.patch} | 0 .../0004-fix-dependency-generation.patch} | 0 patches/nss-3.131.1/series | 7 ++++++ rules/ca-certificates.make | 4 ++-- rules/nspr.make | 4 ++-- rules/nss.make | 14 +++++++---- 10 files changed, 21 insertions(+), 43 deletions(-) --- base-commit: 25578c25031573977db826d12d05156574cc2898 change-id: 20261021-fixemudhra-f6733d13f0c7 Best regards, -- Sven Püschel