[dmeijboom]

Summary

• Use Debian's fixed ca-certificates 20250419~deb12u2 package for both architectures, pinned by SHA-256 and immutable snapshot URL.
• Generate all PHP CA bundles from the same package as the installed raw certificates. Remove the separate stale 20250419 archive to avoid reintroducing roots via mismatched stores.
• Add CI regression checks against the actual generated CA layer and raw package: affected fingerprints absent, unaffected emSign G1/ISRG X1 retained, and direct/cross-signed attack chains rejected offline.

This is a targeted response to the eMudhra intermediate-key compromise, not a blanket removal of eMudhra or Indian CAs. Debian's fix removes emSign ECC Root CA - G3 and AAA Certificate Services; the latter closes the Sectigo cross-sign path.

Validation

• Bazel CA layer builds and regression checks passed for PHP 7.2, 7.4, 8.3, 8.4 and 8.5 on amd64 and arm64 (10 combinations).
• Generated bundle: 150 → 148 roots; exactly the two intended DER fingerprints removed, no other root added or changed.
• All 14 published offline incident chains are accepted by the old bundle and rejected by the new bundle as untrusted issuer. Fixed verification time avoids expiry-based false positives; OpenSSL fallback CA stores disabled.
• Targeted common lock update changes only the two architecture entries for ca-certificates. Existing OpenSSL/debconf dependency constraints remain satisfied. Other package pins unchanged.
• git diff --check and Python syntax check passed.
• GitHub CI passed for commit 87622cab88bee5d2f61a99155b504c183d177663, including the new trust regression and existing full Build and push workflow.
• Local full-image attempt hit a sandbox Python entropy initialization error in an unchanged rules_pkg action; no local runtime test is claimed. All 10 focused local CA-layer checks passed. Local checks used Bazel 9.3.1, the existing Brainhive registry, and the environment's existing Java CA trust store. No TLS verification was disabled.

Sources and rollout

• Mozilla advisory
• Google advisory
• Debian DLA-4845-1
• Incident fixtures and root fingerprints

After review and merge, rebuild and roll out all PHP versions/architectures and downstream images. Existing deployments are not fixed by this PR alone; endpoint compatibility should be checked during rollout. No merge or deployment is included.

Tracks DEV-1740.