[Buildroot] [PATCH 1/1] package/ca-certificates: security bump to 20260816+nmu1

[Buildroot] [PATCH 1/1] package/ca-certificates: security bump to 20260816+nmu1

[Florian Larysch]

This invalidates the compromised eMudhra intermediates by blacklisting
the roots that signed them[1][2].

Changelog: https://salsa.debian.org/debian/ca-certificates/-/blob/5bee010adca85eb867534f6445735ad5cc0dc6f3/debian/changelog

[1] https://emudhra.we-have-a-problem.com/
[2] https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE

Signed-off-by: Florian Larysch <fl@n621.de>
---
This is an alternative to the v2 of "ca-certificates: remove roots
chaining to eMudhra intermediates" which manually adds the patch that is
part of the nmu.

Note that this does also include some other changes since we're bumping
across multiple versions of this package (which might be a good thing
though).
---
 package/ca-certificates/ca-certificates.mk | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package/ca-certificates/ca-certificates.mk b/package/ca-certificates/ca-certificates.mk
index 0f88df3eec..cccac113e4 100644
--- a/package/ca-certificates/ca-certificates.mk
+++ b/package/ca-certificates/ca-certificates.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-CA_CERTIFICATES_VERSION = 20260223
+CA_CERTIFICATES_VERSION = 20260816+nmu1
 CA_CERTIFICATES_SOURCE = ca-certificates_$(CA_CERTIFICATES_VERSION).tar.xz
 CA_CERTIFICATES_SITE = https://snapshot.debian.org/archive/debian/20260223T202245Z/pool/main/c/ca-certificates
 CA_CERTIFICATES_DEPENDENCIES = host-openssl host-python3
-- 
2.56.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/ca-certificates: security bump to 20260816+nmu1

[Thomas Petazzoni via buildroot]

Hello Florian,

On Thu, Oct 22, 2026 at 12:29:58AM +0200, Florian Larysch wrote:
> This invalidates the compromised eMudhra intermediates by blacklisting
> the roots that signed them[1][2].
> 
> Changelog: https://salsa.debian.org/debian/ca-certificates/-/blob/5bee010adca85eb867534f6445735ad5cc0dc6f3/debian/changelog
> 
> [1] https://emudhra.we-have-a-problem.com/
> [2] https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE
> 
> Signed-off-by: Florian Larysch <fl@n621.de>

I ended up applying this version of the fix, even though your patch
was actually not very good, to the point where it was working at all:

- The URL in the .mk file was wrong, so downloading couldn't work
- The hash file had not been updated with the tarball change
- And there was a license file change, requiring the license file hash
  to be updated as well

I fixed all of those issues, and applied to master. Thanks!

Best regards,

Thomas Petazzoni
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/ca-certificates: security bump to 20260816+nmu1

[Florian Larysch]

Hey Thomas,

On Thu, Oct 22, 2026 at 01:08:58PM +0200, Thomas Petazzoni wrote:
> I ended up applying this version of the fix, even though your patch
> was actually not very good, to the point where it was working at all:

Ugh sorry. Between everything blowing up on the internet these past few
days and stuff blowing up in my private life simultaneously I have been
thinking less straight than I would have liked so unlike my original
patch I didn't build test this one.

Sorry again,
Florian
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/ca-certificates: security bump to 20260816+nmu1

[Raphaël Mélotte via buildroot]

In reply of:
> This invalidates the compromised eMudhra intermediates by blacklisting
> the roots that signed them[1][2].
> 
> Changelog: https://salsa.debian.org/debian/ca-certificates/-/blob/5bee010adca85eb867534f6445735ad5cc0dc6f3/debian/changelog
> 
> [1] https://emudhra.we-have-a-problem.com/
> [2] https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE
> 
> Signed-off-by: Florian Larysch <fl@n621.de>

Applied to 2025.02.x, 2026.08.x. Thanks

> ---
> This is an alternative to the v2 of "ca-certificates: remove roots
> chaining to eMudhra intermediates" which manually adds the patch that is
> part of the nmu.
> 
> Note that this does also include some other changes since we're bumping
> across multiple versions of this package (which might be a good thing
> though).
> ---
>  package/ca-certificates/ca-certificates.mk | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/package/ca-certificates/ca-certificates.mk b/package/ca-certificates/ca-certificates.mk
> index 0f88df3eec..cccac113e4 100644
> --- a/package/ca-certificates/ca-certificates.mk
> +++ b/package/ca-certificates/ca-certificates.mk
> @@ -4,7 +4,7 @@
>  #
>  ################################################################################
>  
> -CA_CERTIFICATES_VERSION = 20260223
> +CA_CERTIFICATES_VERSION = 20260816+nmu1
>  CA_CERTIFICATES_SOURCE = ca-certificates_$(CA_CERTIFICATES_VERSION).tar.xz
>  CA_CERTIFICATES_SITE = https://snapshot.debian.org/archive/debian/20260223T202245Z/pool/main/c/ca-certificates
>  CA_CERTIFICATES_DEPENDENCIES = host-openssl host-python3
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot