From 23666980ebd93ea91a6456b8fe948267dc9ce166 Mon Sep 17 00:00:00 2001 From: Peter Schilling Date: Thu, 22 Oct 2026 11:46:57 -0700 Subject: [PATCH] fix: reject compromised eMudhra certificate chains The CLI combines OS roots with embedded Mozilla roots, so updating the system trust store alone leaves compromised certificate chains trusted. Update rustls-webpki to 0.103.16 to block the affected keys and webpki-roots to 1.0.10 to remove the affected bundled root. Fetch the latest standalone updater for releases: cargo-dist 0.31.0 otherwise selects axoupdater 0.10.0, while the certificate fixes shipped in 0.10.3. Verified all 14 advisory hosts were accepted before and rejected after the update, both with default trust and affected roots supplied through SSL_CERT_FILE. Legitimate Linear TLS still works. The full repository check, dist generation/plan checks, and license generation pass. --- CHANGELOG.md | 4 ++++ Cargo.lock | 8 ++++---- dist-workspace.toml | 2 ++ 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e6e7a73f..4b44c9ad 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,6 +12,10 @@ - `comment list` for issues, projects, documents and initiatives marks resolved threads `[resolved]`, and its `--json` output includes `resolvedAt`, `resolvingCommentId` and `resolvingUser` like `issue view --json`, plus `parent.resolvedAt`, the thread state of a reply +### Fixed + +- Reject TLS certificate chains using the [compromised eMudhra intermediate CAs](https://emudhra.we-have-a-problem.com/), including chains trusted through the OS store or `SSL_CERT_FILE`, and remove the affected root from the bundled Mozilla roots. New releases also fetch the patched standalone `linear-update` updater + ## [3.0.0] - 2026-10-06 ### Upgrading from 2.x diff --git a/Cargo.lock b/Cargo.lock index b0904632..09c7d41b 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1730,9 +1730,9 @@ dependencies = [ [[package]] name = "rustls-webpki" -version = "0.103.15" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "ring", "rustls-pki-types", @@ -2429,9 +2429,9 @@ dependencies = [ [[package]] name = "webpki-roots" -version = "1.0.9" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a" +checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9" dependencies = [ "rustls-pki-types", ] diff --git a/dist-workspace.toml b/dist-workspace.toml index f78b5669..0cbaa18c 100644 --- a/dist-workspace.toml +++ b/dist-workspace.toml @@ -23,6 +23,8 @@ npm-package = "linear-cli" install-path = "CARGO_HOME" # Whether to install an updater program install-updater = true +# Use axoupdater 0.10.3+ for its eMudhra fix; dist 0.31.0 pins 0.10.0. +always-use-latest-updater = true # Steps run before each build-local-artifacts job (relative to .github/workflows). # They write THIRD_PARTY_LICENSES.md, which `include` adds to every archive. github-build-setup = "../build-setup.yml"