Repository navigation
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why: DEV-1740. eMudhra intermediate CA private keys were compromised; OS/browser root updates do not repair roots compiled into these Rust clients.
How: update only webpki-roots and webpki-root-certs to 1.0.10 and rustls-webpki to 0.103.16. The root packages remove emSign ECC Root CA - G3. The verifier blocks the compromised public keys across alternate/cross-signed paths; the 0.26.11 roots wrapper now resolves to the patched 1.x store. Unrelated dependencies and trust configuration stay unchanged. HTTP paths delegated to native Apple/Windows certificate verification still depend on OS trust updates; this PR fixes the bundled-root and webpki validation paths, not the operating system.
Validation: parsed the lockfile, resolved every package reference, checked incoming/outgoing registry semver constraints and verified downloaded crate SHA-256 against crates.io. Confirmed the updated root sources exclude G3 and the verifier includes the eight-key blocklist. Cargo metadata --locked --format-version 1 also passed without modifying the committed lockfile, using the repository-defined Bazel-fetched Rust toolchain. Local cargo check --locked passed, plus five focused client/registry tests (cargo test --locked client::tests and cargo test --locked image::registry::tests). Cross-platform build coverage remains for CI. This is a draft, not a claim that a rebuilt release is already shipped.
Sources: https://rustsec.org/advisories/RUSTSEC-2026-0381.html, https://rustsec.org/advisories/RUSTSEC-2026-0382.html, https://rustsec.org/advisories/RUSTSEC-2026-0383.html
Ticket: https://linear.app/brainhivenl/issue/DEV-1740