Repository navigation
SECURITY: microvm-rootfs: distrust emSign ECC Root CA - G3 via ca-certificates-bundle 20261020-r0 (CVE-2026-111943) - #947
Merged
Conversation
…-r0 (CVE-2026-111943) alpine-minirootfs-3.24.1 ships ca-certificates-bundle 20260611-r0, which still trusts emSign ECC Root CA - G3 (eMudhra intermediate key compromise, Mozilla bug 2083449). Overlay Alpine's 20261020-r0 (G3 removed) with the same base-layer override pattern as openssl; the apk-db reconcile records the new version. build.sh now fails the build if the staged bundle still contains G3. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
|
Warning Review limit reached
This review includes 2 billable files and costs up to $0.50.
Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing. Or wait 9 minutes for your next included review. View limit details
Comment |
jtnkminimal
approved these changes
Oct 20, 2026
This was referenced Oct 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The guest image still trusts emSign ECC Root CA - G3 (SHA-256
86A1ECBA089C4A8D3BBE2734C612BA341D813E043CF9E8A862CD5C57A36BBE6B). Mozilla distrusted that root after eMudhra's intermediate key was compromised (CVE-2026-111943, Mozilla bug 2083449).The root does not come from any
.apkpin. It comes from the base layer:alpine-minirootfs-3.24.1shipsca-certificates-bundle 20260611-r0(lib/apk/db/installed, 119 roots, G3 included). Alpine shipped20261020-r0on every branch (MR !110124 to !110128), and that release drops G3 (118 roots). There is no newer minirootfs release that carries it, so bumpingalpine_releasecannot pick up the fix.Change
ca-certificates-bundle-20261020-r0to the SECURITY OVERRIDES OF THE BASE LAYER block, next to openssl, with the same DROP-WHEN comment. The package contains a single file,etc/ssl/certs/ca-certificates.crt, plus theetc/ssl/cert.pemandetc/ssl1.1/*symlinks, and it has no install script. The overlay therefore replaces the base layer's bundle outright. The existing apk-db reconcile then rewritesV:to20261020-r0, because the minirootfs db recordsca-certificates-bundle./etc/ssl/certs/ca-certificates.crtis missing or empty, or if it still contains G3. The needle is a line of G3's base64 PEM body (its public key). I checked it against real files: it matches once in the 3.24.1 minirootfs bundle and zero times in the 20261020-r0 bundle on both arches. I also corrected the build.sh comment that said the CA bundle needs an install script.Verified
mainAPKINDEX for both arches,P:ca-certificates-bundle V:20261020-r0. The package has noD:deps, so the closure does not change..apkfiles were downloaded from dl-cdn into fresh directories. Each one was checked against its arch's APKINDEX entry three ways:S:: x86_64 107116, aarch64 107099C:, the SHA1 of the control segment.PKGINFOdatahashagainst the sha256 of the data segmentgs://minimal-staging-archives/alpine/v3.24/main/<arch>/, so I uploaded both with--no-clobber. I then re-downloaded them, and both are byte-identical to the verified dl-cdn copies:d0a573c2…176abb008f6d…254dmip dump --packages --exactfor amd64 and arm64 resolves each arch to its own sha256.20261020-r0is the current version, so it reports the pin as current. The components overlay precedence takes the pinned.apkover the minirootfs record.minimal build/minimal-checkCI.Not covered here
The system
ca-certificatespackage is being regenerated from curl's 2026-10-20cacert.pemin a separate PR. This PR touches only the microVM guest image, which uses Alpine's bundle and none of this repo's packages.Needs a human reviewer per repo policy.
🤖 Generated with Claude Code