ai_ml_operations/scha
2
0 Fork 0
Code Issues 16 Pull Requests Actions Packages Projects Releases Wiki Activity

Drop compromised eMudhra roots from outbound TLS trust #36

Merged
westfarn merged 1 commits from security/emudhra-ca-2026-10 into master 2026-10-23 09:02:26 -07:00
Conversation 0 Commits 1 Files Changed 2
+5 -4
westfarn commented 2026-10-23 08:51:54 -07:00
Owner
Copy link
Copy source

Outbound TLS in this image still trusted the compromised eMudhra roots (emSign ECC Root CA - G3 and Comodo AAA Services).

  • Image install now upgrades ca-certificates and regenerates the trust bundle.
  • certifi is locked at 2026.10.23, which drops those roots for requests and httpx.

Merge this, then redeploy prod.

Outbound TLS in this image still trusted the compromised eMudhra roots (`emSign ECC Root CA - G3` and `Comodo AAA Services`). - Image install now upgrades `ca-certificates` and regenerates the trust bundle. - `certifi` is locked at 2026.10.23, which drops those roots for `requests` and `httpx`. Merge this, then redeploy prod.
westfarn added 1 commit 2026-10-23 08:51:54 -07:00
Drop compromised eMudhra roots from outbound TLS trust.
CI / test (pull_request) Successful in 4s
Details
Unit Tests / test (pull_request) Successful in 3s
Details
32e711ddb9 
Upgrade the image CA store and certifi to 2026.10.23 so forged certificates chaining to emSign ECC Root CA - G3 are rejected.
westfarn merged commit 898b1918ba into master 2026-10-23 09:02:26 -07:00
westfarn deleted branch security/emudhra-ca-2026-10 2026-10-23 09:02:26 -07:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
twestfall westfarn (Ryan Westfall)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: ai_ml_operations/scha#36