Repository navigation
block roots from ca-certs - #2215
Merged
bobcallaway merged 1 commit intoOct 20, 2026
Merged
Conversation
Signed-off-by: Bob Callaway <bcallaway@google.com>
loosebazooka
approved these changes
Oct 20, 2026
This was referenced Oct 21, 2026
m1sk9
added a commit
to m1sk9/chime
that referenced
this pull request
Oct 21, 2026
The debian12 distroless images are no longer updated upstream and still ship ca-certificates 20250419~deb12u1, which trusts "AAA Certificate Services", the Sectigo root that cross-signed the eMudhra intermediates whose private keys were compromised on 2026-10-17. chime verifies TLS against the system store, so staying on debian12 would keep trusting certificates forged with the leaked keys. The debian13 images drop that root (GoogleContainerTools/distroless#2215). The builder moves to trixie to stay on a maintained Debian release. rustls-webpki 0.103.16 rejects chains containing the compromised intermediates, which covers a stale root store too. Co-authored-by: Claude <noreply@anthropic.com>
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Due to a security incident with a third-party CA, we are proactively removing two roots from the cacerts bundle out of an abundance of caution.