[chrapkowski-sg]

The private keys of eight eMudhra intermediate CA certificates have been compromised (CVE-2026-111943, https://emudhra.we-have-a-problem.com/). They chain to emSign ECC Root CA - G3, and to AAA Certificate Services through Sectigo cross-signs. The current image (Go 1.26.3, nixpkgs cacert 3.123) still accepts chains through them, with Go module downloads and with git.

Changes

• Build scip-go and the image with Go 1.27.3 (pkgs.go_1_27). Its crypto/x509 rejects chains through these intermediates (announcement). This covers go mod download, go get, and toolchain downloads.
• Drop emSign ECC Root CA - G3 from the image CA bundle, so git (libcurl/OpenSSL) rejects these chains too. NSS 3.131.1 makes the same change. The override turns itself off once nixpkgs ships cacert 3.131.1 or later; leaving it on would fail the build, because the blocklisted root would no longer exist. AAA Certificate Services is already in the bundle without TLS trust, in both 3.126 and 3.131.1.
• Track nixos-26.05-small instead of nixos-26.05. It is the only 26.05 channel with Go 1.27.3 so far. No 26.05 channel has Go 1.26.10 or cacert 3.131.1 yet.

Testing

I built nix build .#docker (amd64) and tested it against the two test hosts: dv-g3b-emudhra.we-have-a-problem.com chains through emSign ECC Root CA - G3, and dv-g3b-aaa-emudhra.we-have-a-problem.com through the AAA cross-sign.

Client	Before, emSign host	After, emSign host	After, AAA host
Go http.Get	accepted	rejected	rejected
go mod download with the host as GOPROXY	accepted	rejected	rejected
go get with GOPROXY=direct	accepted	rejected	rejected
git ls-remote	accepted	rejected	rejected

Each fix works on its own:

• Go 1.27.3 with the old CA bundle still rejects the emSign host (x509: no valid chains built).
• git with the old bundle accepts it, so the bundle change is what protects git.

go test ./... passes in the Nix check phase, and nixfmt and goimports checks pass. I indexed a small module whose dependencies came through proxy.golang.org and a direct git fetch. The output has the same symbols as the old image's. The arm64 image evaluates, but I have not built it.

Release

The published image changes only after a release: bump internal/index/version.txt (for example to 0.2.9) after this merges.

[christoph-sg]

LGTM, could you open an issue for us to back out the custom changes once we can bump to a nixpkgs that has the relevant fixes included by default?

[chrapkowski-sg]

LGTM, could you open an issue for us to back out the custom changes once we can bump to a nixpkgs that has the relevant fixes included by default?

Just in case posting here: CU-3540