From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Tue, 27 Oct 2026 14:48:37 +0100 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1xLhXY-003wGS-34 for lore@lore.pengutronix.de; Tue, 27 Oct 2026 14:48:37 +0100 Received: from [127.0.0.1] (helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xLhXY-0005y6-Gh; Tue, 27 Oct 2026 14:48:36 +0100 Received: from dude04.red.stw.pengutronix.de ([2a0a:edc0:0:1101:1d::ac]) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xLhXI-0005x7-M8; Tue, 27 Oct 2026 14:48:20 +0100 From: =?utf-8?q?Sven_P=C3=BCschel?= Date: Tue, 27 Oct 2026 14:48:03 +0100 Message-Id: <20261027-fixemudhra-v2-0-11be14cb5ae4@pengutronix.de> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit X-B4-Tracking: v=1; b=H4sIAJOr4GoC/22Myw6DIBBFf8XMujQ8Gmy78j8aFyqDzKJoQImN4 d8LXXd57s05J0QMhBGezQkBE0VafAF5aWByg5+RkSkMkkstuBTM0oHv3bgwMKtbpYxQlk8tFGE NWN8ae/WFHcVtCZ9fO4m6/s0kwThTWnE93u6PUWK3op/3LSyejqtB6HPOX8lhlIypAAAA X-Change-ID: 20261021-fixemudhra-f6733d13f0c7 To: ptxdist@pengutronix.de X-Mailer: b4 0.14.2 Subject: [ptxdist] [PATCH v2 0/3] nss/nspr: Update to fix the eMudhra Intermediate CA Compromise X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Cc: =?utf-8?q?Sven_P=C3=BCschel?= Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false With the recently announced eMudhra Intermediate CA Compromise [1] update nss to drop the root CAs to prevent applications which don't check certificate transparency logs or revocations from establishing insecure TLS connections. Technically only the ca-certificates update should be relevant for this issue, but update the nss package anyways (which also needs at least nspr version 4.39). This series obsoletes the previously sent nss update (mid:20261020121054.2790945-1-s.pueschel@pengutronix.de). [1] https://emudhra.we-have-a-problem.com/ Signed-off-by: Sven Püschel --- Changes in v2: - also adjust pkgconfig file generation in host-nss rule - Link to v1: https://lore.kernel.org/r/20261021-fixemudhra-v1-0-36306b489b2e@pengutronix.de --- Sven Püschel (3): nspr: version bump 4.37 -> 4.40 nss: version bump 3.130 -> 3.131.1 ca-certificates: version bump 3_130 -> 3_131_1 patches/nss-3.130/0002-add-nss.pc.in.patch | 27 ---------------------- patches/nss-3.130/series | 8 ------- .../0001-nss-fix-nsinstall-build.patch | 0 ...HACK-don-t-build-commands-that-need-zlib.patch} | 0 .../0003-HACK-fix-parallel-building-issue.patch} | 0 .../0004-fix-dependency-generation.patch} | 0 patches/nss-3.131.1/series | 7 ++++++ rules/ca-certificates.make | 4 ++-- rules/host-nss.make | 10 ++++++-- rules/nspr.make | 4 ++-- rules/nss.make | 14 +++++++---- 11 files changed, 29 insertions(+), 45 deletions(-) --- base-commit: 25578c25031573977db826d12d05156574cc2898 change-id: 20261021-fixemudhra-f6733d13f0c7 Best regards, -- Sven Püschel