8000 eMudhra certificates in Docker image · Issue #16656 · NixOS/nix · GitHub
[go: up one dir, main page]
Skip to content

eMudhra certificates in Docker image #16656

New issue
New issue
Open
Open
eMudhra certificates in Docker image#16656
< 8000 div class="menuActionsContainer__S_GMw3">
Assignees
xokdvium
Labels
processIssues related to the development process of NixsecuritySecurity-related issues

Description

@VlaDexa
VlaDexa
opened on Oct 21, 2026

Please, update Docker images to include fixes connected to eMudhra CA compromise

Source from NixOS/nixpkgs#576485 (comment)

Activity

  1. xokdvium
    self-assigned this
    on Oct 21, 2026

  2. xokdvium commented on Oct 21, 2026

    @xokdvium
    xokdvium
    on Oct 21, 2026
    Contributor

    This will need an update and cutting a point release. I had intended to backport the multiple nixpkgs bumps we've had to do to 2.35-maintenance branch once 26.05 advances sufficiently (haven't checked that it had). We will need to pick quite a few things to get there though. This should also pick up the recent libcurl fixes IIRC.

    Although the docker image of course can (and should) be built with a custom nixpkgs to get the latest security fixes precisely because of such possibilities. The release binaries will regardless be a bit slower-moving due to the nature of the input pinning and the releases being versioned alongside nix and not nixpkgs.

  3. xokdvium
    added
    securitySecurity-related issues
    processIssues related to the development process of Nix
    on Oct 21, 2026

  4. xokdvium commented on Oct 21, 2026

    @xokdvium
    xokdvium
    on Oct 21, 2026
    Contributor

    In the meantime what you can do is:

    nix-channel --add https://channels.nixos.org/nixos-unstable-small nixos-unstable-small
nix-channel --update
nix-env --upgrade -f "<nixos-unstable-small>" -A cacert

    https://nixpk.gs/pr-tracker.html?pr=576347 hasn't hit unstable. However, when that does hit unstable it would just be:

    nix-channel --update
nix-env --upgrade -f "<nixpkgs>" -A cacert

  5. xokdvium commented on Oct 22, 2026

    @xokdvium
    xokdvium
    on Oct 22, 2026
    Contributor

    At least for 2.35 updating the pins is easy enough:

    #16661
    https://github.com/NixOS/nix/pkgs/container/nix/1431096097?tag=2.35.4
    https://github.com/NixOS/nix/actions/runs/39854051163/job/120087505662

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

processIssues related to the development process of NixsecuritySecurity-related issues

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions
    0