* [ptxdist] [PATCH v2 0/3] nss/nspr: Update to fix the eMudhra Intermediate CA Compromise
@ 2026-10-27 13:48 Sven Püschel
2026-10-27 13:48 ` [ptxdist] [PATCH v2 1/3] nspr: version bump 4.37 -> 4.40 Sven Püschel
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Sven Püschel @ 2026-10-27 13:48 UTC (permalink / raw)
To: ptxdist; +Cc: Sven Püschel
With the recently announced eMudhra Intermediate CA Compromise [1]
update nss to drop the root CAs to prevent applications which don't
check certificate transparency logs or revocations from establishing
insecure TLS connections.
Technically only the ca-certificates update should be relevant for this
issue, but update the nss package anyways (which also needs at least
nspr version 4.39).
This series obsoletes the previously sent nss update
(mid:20261020121054.2790945-1-s.pueschel@pengutronix.de).
[1] https://emudhra.we-have-a-problem.com/
Signed-off-by: Sven Püschel <s.pueschel@pengutronix.de>
---
Changes in v2:
- also adjust pkgconfig file generation in host-nss rule
- Link to v1: https://lore.kernel.org/r/20261021-fixemudhra-v1-0-36306b489b2e@pengutronix.de
---
Sven Püschel (3):
nspr: version bump 4.37 -> 4.40
nss: version bump 3.130 -> 3.131.1
ca-certificates: version bump 3_130 -> 3_131_1
patches/nss-3.130/0002-add-nss.pc.in.patch | 27 ----------------------
patches/nss-3.130/series | 8 -------
.../0001-nss-fix-nsinstall-build.patch | 0
...HACK-don-t-build-commands-that-need-zlib.patch} | 0
.../0003-HACK-fix-parallel-building-issue.patch} | 0
.../0004-fix-dependency-generation.patch} | 0
patches/nss-3.131.1/series | 7 ++++++
rules/ca-certificates.make | 4 ++--
rules/host-nss.make | 10 ++++++--
rules/nspr.make | 4 ++--
rules/nss.make | 14 +++++++----
11 files changed, 29 insertions(+), 45 deletions(-)
---
base-commit: 25578c25031573977db826d12d05156574cc2898
change-id: 20261021-fixemudhra-f6733d13f0c7
Best regards,
--
Sven Püschel <s.pueschel@pengutronix.de>
^ permalink raw reply [flat|nested] 5+ messages in thread* [ptxdist] [PATCH v2 1/3] nspr: version bump 4.37 -> 4.40 2026-10-27 13:48 [ptxdist] [PATCH v2 0/3] nss/nspr: Update to fix the eMudhra Intermediate CA Compromise Sven Püschel @ 2026-10-27 13:48 ` Sven Püschel 2026-10-27 13:48 ` [ptxdist] [PATCH v2 2/3] nss: version bump 3.130 -> 3.131.1 Sven Püschel 2026-10-27 13:48 ` [ptxdist] [PATCH v2 3/3] ca-certificates: version bump 3_130 -> 3_131_1 Sven Püschel 2 siblings, 0 replies; 5+ messages in thread From: Sven Püschel @ 2026-10-27 13:48 UTC (permalink / raw) To: ptxdist; +Cc: Sven Püschel Signed-off-by: Sven Püschel <s.pueschel@pengutronix.de> --- rules/nspr.make | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rules/nspr.make b/rules/nspr.make index f65db0a9a8336bf9b7810c81ccdb6a586fd6022e..e2dfd88c2be968c762f1bd8c9a6503a25f3b1729 100644 --- a/rules/nspr.make +++ b/rules/nspr.make @@ -14,8 +14,8 @@ PACKAGES-$(PTXCONF_NSPR) += nspr # # Paths and names # -NSPR_VERSION := 4.37 -NSPR_SHA256 := 5f9344ed0e31855bd38f88b33c9d9ab94f70ce547ef3213e488d1520f61840fa +NSPR_VERSION := 4.40 +NSPR_SHA256 := c0c1884c627f3db7a783f7c7314c695226b2043696791d15519e7e0578c19bdc NSPR := nspr-$(NSPR_VERSION) NSPR_SUFFIX := tar.gz NSPR_URL := https://ftp.mozilla.org/pub/nspr/releases/v$(NSPR_VERSION)/src/$(NSPR).$(NSPR_SUFFIX) -- 2.47.3 ^ permalink raw reply [flat|nested] 5+ messages in thread
* [ptxdist] [PATCH v2 2/3] nss: version bump 3.130 -> 3.131.1 2026-10-27 13:48 [ptxdist] [PATCH v2 0/3] nss/nspr: Update to fix the eMudhra Intermediate CA Compromise Sven Püschel 2026-10-27 13:48 ` [ptxdist] [PATCH v2 1/3] nspr: version bump 4.37 -> 4.40 Sven Püschel @ 2026-10-27 13:48 ` Sven Püschel 2026-10-27 13:48 ` [ptxdist] [PATCH v2 3/3] ca-certificates: version bump 3_130 -> 3_131_1 Sven Püschel 2 siblings, 0 replies; 5+ messages in thread From: Sven Püschel @ 2026-10-27 13:48 UTC (permalink / raw) To: ptxdist; +Cc: Sven Püschel Bunch of bugfixes in 3.131 https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_131.html With 3.131.1 they only dropped the certs related to the eMudhra Intermediate CA Compromise [1]: https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/vSxZxnOMMvs Also dropped the patch adding a pc file and instead using the already included PC file and adjusting it's variables with a sed command line. This is based on the ArchLinux build script [2], but a similar sed can also be found in `nss/build.sh`. [1] https://emudhra.we-have-a-problem.com/ [2] https://gitlab.archlinux.org/archlinux/packaging/packages/nss/-/blob/f01ebfe4f1024af88a59c25586729956591abac0/PKGBUILD#L68 Signed-off-by: Sven Püschel <s.pueschel@pengutronix.de> --- v2: - also adjust pc file to a sed replace in the host package --- patches/nss-3.130/0002-add-nss.pc.in.patch | 27 ---------------------- patches/nss-3.130/series | 8 ------- .../0001-nss-fix-nsinstall-build.patch | 0 ...HACK-don-t-build-commands-that-need-zlib.patch} | 0 .../0003-HACK-fix-parallel-building-issue.patch} | 0 .../0004-fix-dependency-generation.patch} | 0 patches/nss-3.131.1/series | 7 ++++++ rules/host-nss.make | 10 ++++++-- rules/nss.make | 14 +++++++---- 9 files changed, 25 insertions(+), 41 deletions(-) diff --git a/patches/nss-3.130/0002-add-nss.pc.in.patch b/patches/nss-3.130/0002-add-nss.pc.in.patch deleted file mode 100644 index addc805b5d39543f587febae968680276a62470b..0000000000000000000000000000000000000000 --- a/patches/nss-3.130/0002-add-nss.pc.in.patch +++ /dev/null @@ -1,27 +0,0 @@ -From: Lucas Stach <l.stach@pengutronix.de> -Date: Tue, 12 Apr 2016 11:36:26 +0200 -Subject: [PATCH] add nss.pc.in - -Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de> ---- - nss/nss.pc.in | 11 +++++++++++ - 1 file changed, 11 insertions(+) - create mode 100644 nss/nss.pc.in - -diff --git a/nss/nss.pc.in b/nss/nss.pc.in -new file mode 100644 -index 000000000000..b80838f8ca0d ---- /dev/null -+++ b/nss/nss.pc.in -@@ -0,0 +1,11 @@ -+prefix=/usr -+exec_prefix=${prefix} -+libdir=${prefix}/lib -+includedir=${prefix}/include/nss -+ -+Name: NSS -+Description: Mozilla Network Security Services -+Version: @VERSION@ -+Requires: nspr -+Libs: -lnss3 -lnssutil3 -lsmime3 -lssl3 -+Cflags: -I${includedir} diff --git a/patches/nss-3.130/series b/patches/nss-3.130/series deleted file mode 100644 index 534d0d6d69f823d512f432093a912eb00ff7a666..0000000000000000000000000000000000000000 --- a/patches/nss-3.130/series +++ /dev/null @@ -1,8 +0,0 @@ -# generated by git-ptx-patches -#tag:base --start-number 1 -0001-nss-fix-nsinstall-build.patch -0002-add-nss.pc.in.patch -0003-HACK-don-t-build-commands-that-need-zlib.patch -0004-HACK-fix-parallel-building-issue.patch -0005-fix-dependency-generation.patch -# 51749efb4fc421b49999aad3745d75b9 - git-ptx-patches magic diff --git a/patches/nss-3.130/0001-nss-fix-nsinstall-build.patch b/patches/nss-3.131.1/0001-nss-fix-nsinstall-build.patch similarity index 100% rename from patches/nss-3.130/0001-nss-fix-nsinstall-build.patch rename to patches/nss-3.131.1/0001-nss-fix-nsinstall-build.patch diff --git a/patches/nss-3.130/0003-HACK-don-t-build-commands-that-need-zlib.patch b/patches/nss-3.131.1/0002-HACK-don-t-build-commands-that-need-zlib.patch similarity index 100% rename from patches/nss-3.130/0003-HACK-don-t-build-commands-that-need-zlib.patch rename to patches/nss-3.131.1/0002-HACK-don-t-build-commands-that-need-zlib.patch diff --git a/patches/nss-3.130/0004-HACK-fix-parallel-building-issue.patch b/patches/nss-3.131.1/0003-HACK-fix-parallel-building-issue.patch similarity index 100% rename from patches/nss-3.130/0004-HACK-fix-parallel-building-issue.patch rename to patches/nss-3.131.1/0003-HACK-fix-parallel-building-issue.patch diff --git a/patches/nss-3.130/0005-fix-dependency-generation.patch b/patches/nss-3.131.1/0004-fix-dependency-generation.patch similarity index 100% rename from patches/nss-3.130/0005-fix-dependency-generation.patch rename to patches/nss-3.131.1/0004-fix-dependency-generation.patch diff --git a/patches/nss-3.131.1/series b/patches/nss-3.131.1/series new file mode 100644 index 0000000000000000000000000000000000000000..ed1f6706e1f31ed11d93ed6918ecae72fce35707 --- /dev/null +++ b/patches/nss-3.131.1/series @@ -0,0 +1,7 @@ +# generated by git-ptx-patches +#tag:base --start-number 1 +0001-nss-fix-nsinstall-build.patch +0002-HACK-don-t-build-commands-that-need-zlib.patch +0003-HACK-fix-parallel-building-issue.patch +0004-fix-dependency-generation.patch +# ea27330855ed3ed4aac49b9ec8451c08 - git-ptx-patches magic diff --git a/rules/host-nss.make b/rules/host-nss.make index 3f66b40a13b5f915d9c5f322efa85edc9271515a..5ead1be8695aa9e8db8b98d773cf06c0595e88ba 100644 --- a/rules/host-nss.make +++ b/rules/host-nss.make @@ -62,8 +62,14 @@ $(STATEDIR)/host-nss.install: $(HOST_NSS_PKGDIR)/usr/lib/$(lib).so$(ptx/nl)) install -d $(HOST_NSS_PKGDIR)/usr/lib/pkgconfig/ - VERSION=$(NSS_VERSION) ptxd_replace_magic \ - $(HOST_NSS_DIR)/nss/nss.pc.in > $(HOST_NSS_PKGDIR)/usr/lib/pkgconfig/nss.pc + sed "$(HOST_NSS_DIR)/nss/pkg/pkg-config/nss.pc.in" \ + -e "s,%prefix%,/usr,g" \ + -e "s,%exec_prefix%,$${prefix},g" \ + -e "s,%libdir%,/usr/lib,g" \ + -e "s,%includedir%,/usr/include/nss,g" \ + -e "s,%NSPR_VERSION%,$(NSPR_VERSION),g" \ + -e "s,%NSS_VERSION%,$(NSS_VERSION),g" \ + > "$(HOST_NSS_PKGDIR)/usr/lib/pkgconfig/nss.pc" install -d $(PTXDIST_SYSROOT_HOST)/usr/include/nss install -m 644 -t $(PTXDIST_SYSROOT_HOST)/usr/include/nss $(HOST_NSS_DIR)/dist/public/nss/* diff --git a/rules/nss.make b/rules/nss.make index 61c4b102c04219e218fb950943679204ec01f501..147d311f24abaeaa90833efb13239451393a965a 100644 --- a/rules/nss.make +++ b/rules/nss.make @@ -14,8 +14,8 @@ PACKAGES-$(PTXCONF_NSS) += nss # # Paths and names # -NSS_VERSION := 3.130 -NSS_SHA256 := afab9f82c78bfa3e7e8b4a61ac31922675c58203f67ff385a2714df7fe9bd5c5 +NSS_VERSION := 3.131.1 +NSS_SHA256 := b1dbc1d9e7f3f8455dfb6d58ec8f7229d8a8450c629a9e69ef2ef6081f359056 NSS := nss-$(NSS_VERSION) NSS_SUFFIX := tar.gz NSS_URL := https://ftp.mozilla.org/pub/security/nss/releases/NSS_$(subst .,_,$(NSS_VERSION))_RTM/src/$(NSS).$(NSS_SUFFIX) @@ -96,8 +96,14 @@ $(STATEDIR)/nss.install: $(NSS_PKGDIR)/usr/lib/$(lib).so$(ptx/nl)) install -d $(NSS_PKGDIR)/usr/lib/pkgconfig/ - VERSION=$(NSS_VERSION) ptxd_replace_magic \ - $(NSS_DIR)/nss/nss.pc.in > $(NSS_PKGDIR)/usr/lib/pkgconfig/nss.pc + sed "$(NSS_DIR)/nss/pkg/pkg-config/nss.pc.in" \ + -e "s,%prefix%,/usr,g" \ + -e "s,%exec_prefix%,$${prefix},g" \ + -e "s,%libdir%,/usr/lib,g" \ + -e "s,%includedir%,/usr/include/nss,g" \ + -e "s,%NSPR_VERSION%,$(NSPR_VERSION),g" \ + -e "s,%NSS_VERSION%,$(NSS_VERSION),g" \ + > "$(NSS_PKGDIR)/usr/lib/pkgconfig/nss.pc" @install -v -d $(NSS_PKGDIR)/usr/include/nss @install -v -m 644 -t $(NSS_PKGDIR)/usr/include/nss $(NSS_DIR)/dist/public/nss/* -- 2.47.3 ^ permalink raw reply [flat|nested] 5+ messages in thread
* [ptxdist] [PATCH v2 3/3] ca-certificates: version bump 3_130 -> 3_131_1 2026-10-27 13:48 [ptxdist] [PATCH v2 0/3] nss/nspr: Update to fix the eMudhra Intermediate CA Compromise Sven Püschel 2026-10-27 13:48 ` [ptxdist] [PATCH v2 1/3] nspr: version bump 4.37 -> 4.40 Sven Püschel 2026-10-27 13:48 ` [ptxdist] [PATCH v2 2/3] nss: version bump 3.130 -> 3.131.1 Sven Püschel @ 2026-10-27 13:48 ` Sven Püschel 2026-10-27 18:02 ` Bruno Thomsen 2 siblings, 1 reply; 5+ messages in thread From: Sven Püschel @ 2026-10-27 13:48 UTC (permalink / raw) To: ptxdist; +Cc: Sven Püschel This fixes the compromised eMudhra intermediate certificates [1] by dropping the relevant root certificates: https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/vSxZxnOMMvs [1] https://emudhra.we-have-a-problem.com/ Signed-off-by: Sven Püschel <s.pueschel@pengutronix.de> --- rules/ca-certificates.make | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rules/ca-certificates.make b/rules/ca-certificates.make index edebddb2cc1cb5fb5f8b937bf123a47c4dfbcf01..2929cb55f130f417bba588a1a2eb2ca37212b94d 100644 --- a/rules/ca-certificates.make +++ b/rules/ca-certificates.make @@ -14,8 +14,8 @@ PACKAGES-$(PTXCONF_CA_CERTIFICATES) += ca-certificates # # Paths and names # -CA_CERTIFICATES_VERSION := NSS_3_130_RTM -CA_CERTIFICATES_SHA256 := beb7e6dfe6499926e52c075c27bcfbe4c957f8609c575b3860273ae2806f63eb +CA_CERTIFICATES_VERSION := NSS_3_131_1_RTM +CA_CERTIFICATES_SHA256 := 3ec2b4d240dc12c747eaf450061db84af757c483bbda302f9e29ceb5d70be510 CA_CERTIFICATES := ca-certificates-$(CA_CERTIFICATES_VERSION) CA_CERTIFICATES_SUFFIX := txt CA_CERTIFICATES_URL := https://hg.mozilla.org/projects/nss/raw-file/$(CA_CERTIFICATES_VERSION)/lib/ckfw/builtins/certdata.$(CA_CERTIFICATES_SUFFIX) -- 2.47.3 ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [ptxdist] [PATCH v2 3/3] ca-certificates: version bump 3_130 -> 3_131_1 2026-10-27 13:48 ` [ptxdist] [PATCH v2 3/3] ca-certificates: version bump 3_130 -> 3_131_1 Sven Püschel @ 2026-10-27 18:02 ` Bruno Thomsen 0 siblings, 0 replies; 5+ messages in thread From: Bruno Thomsen @ 2026-10-27 18:02 UTC (permalink / raw) To: ptxdist Hi Den tirs. 27. okt. 2026 kl. 14.48 skrev Sven Püschel <s.pueschel@pengutronix.de>: > > This fixes the compromised eMudhra intermediate certificates [1] by dropping > the relevant root certificates: > https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/vSxZxnOMMvs Version bump to later version[1] is already on mailing list: ca-certificates: version bump 3.130 -> 3.132 /Bruno [1] https://lore.ptxdist.org/ptxdist/20261026151347.9747-1-bruno.thomsen@gmail.com/T/#u > > [1] https://emudhra.we-have-a-problem.com/ > > Signed-off-by: Sven Püschel <s.pueschel@pengutronix.de> > --- > rules/ca-certificates.make | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/rules/ca-certificates.make b/rules/ca-certificates.make > index edebddb2cc1cb5fb5f8b937bf123a47c4dfbcf01..2929cb55f130f417bba588a1a2eb2ca37212b94d 100644 > --- a/rules/ca-certificates.make > +++ b/rules/ca-certificates.make > @@ -14,8 +14,8 @@ PACKAGES-$(PTXCONF_CA_CERTIFICATES) += ca-certificates > # > # Paths and names > # > -CA_CERTIFICATES_VERSION := NSS_3_130_RTM > -CA_CERTIFICATES_SHA256 := beb7e6dfe6499926e52c075c27bcfbe4c957f8609c575b3860273ae2806f63eb > +CA_CERTIFICATES_VERSION := NSS_3_131_1_RTM > +CA_CERTIFICATES_SHA256 := 3ec2b4d240dc12c747eaf450061db84af757c483bbda302f9e29ceb5d70be510 > CA_CERTIFICATES := ca-certificates-$(CA_CERTIFICATES_VERSION) > CA_CERTIFICATES_SUFFIX := txt > CA_CERTIFICATES_URL := https://hg.mozilla.org/projects/nss/raw-file/$(CA_CERTIFICATES_VERSION)/lib/ckfw/builtins/certdata.$(CA_CERTIFICATES_SUFFIX) > > -- > 2.47.3 > > ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-10-27 18:03 UTC | newest] Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2026-10-27 13:48 [ptxdist] [PATCH v2 0/3] nss/nspr: Update to fix the eMudhra Intermediate CA Compromise Sven Püschel 2026-10-27 13:48 ` [ptxdist] [PATCH v2 1/3] nspr: version bump 4.37 -> 4.40 Sven Püschel 2026-10-27 13:48 ` [ptxdist] [PATCH v2 2/3] nss: version bump 3.130 -> 3.131.1 Sven Püschel 2026-10-27 13:48 ` [ptxdist] [PATCH v2 3/3] ca-certificates: version bump 3_130 -> 3_131_1 Sven Püschel 2026-10-27 18:02 ` Bruno Thomsen
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox