From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Wed, 21 Oct 2026 11:52:10 +0200 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1xJSzR-001Q5t-2Q for lore@lore.pengutronix.de; Wed, 21 Oct 2026 11:52:10 +0200 Received: from [127.0.0.1] (helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xJSzP-0004Ts-H7; Wed, 21 Oct 2026 11:52:07 +0200 Received: from dude04.red.stw.pengutronix.de ([2a0a:edc0:0:1101:1d::ac]) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xJSz9-0004GU-Ow; Wed, 21 Oct 2026 11:51:51 +0200 From: =?utf-8?q?Sven_P=C3=BCschel?= Date: Wed, 21 Oct 2026 11:51:40 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Message-Id: <20261021-fixemudhra-v1-3-36306b489b2e@pengutronix.de> References: <20261021-fixemudhra-v1-0-36306b489b2e@pengutronix.de> In-Reply-To: <20261021-fixemudhra-v1-0-36306b489b2e@pengutronix.de> To: ptxdist@pengutronix.de X-Mailer: b4 0.14.2 Subject: [ptxdist] [PATCH 3/3] ca-certificates: version bump 3_130 -> 3_131_1 X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Cc: =?utf-8?q?Sven_P=C3=BCschel?= Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false This fixes the compromised eMudhra intermediate certificates [1] by dropping the relevant root certificates: https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/vSxZxnOMMvs [1] https://emudhra.we-have-a-problem.com/ Signed-off-by: Sven Püschel --- rules/ca-certificates.make | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rules/ca-certificates.make b/rules/ca-certificates.make index edebddb2cc1cb5fb5f8b937bf123a47c4dfbcf01..2929cb55f130f417bba588a1a2eb2ca37212b94d 100644 --- a/rules/ca-certificates.make +++ b/rules/ca-certificates.make @@ -14,8 +14,8 @@ PACKAGES-$(PTXCONF_CA_CERTIFICATES) += ca-certificates # # Paths and names # -CA_CERTIFICATES_VERSION := NSS_3_130_RTM -CA_CERTIFICATES_SHA256 := beb7e6dfe6499926e52c075c27bcfbe4c957f8609c575b3860273ae2806f63eb +CA_CERTIFICATES_VERSION := NSS_3_131_1_RTM +CA_CERTIFICATES_SHA256 := 3ec2b4d240dc12c747eaf450061db84af757c483bbda302f9e29ceb5d70be510 CA_CERTIFICATES := ca-certificates-$(CA_CERTIFICATES_VERSION) CA_CERTIFICATES_SUFFIX := txt CA_CERTIFICATES_URL := https://hg.mozilla.org/projects/nss/raw-file/$(CA_CERTIFICATES_VERSION)/lib/ckfw/builtins/certdata.$(CA_CERTIFICATES_SUFFIX) -- 2.47.3