From 10ca0e42bec0a5e8a42bd5c33a9f30c694dabb4f Mon Sep 17 00:00:00 2001
From: Adam Chrapkowski <adam.chrapkowski@sourcegraph.com>
Date: Thu, 22 Oct 2026 08:09:01 +0000
Subject: [PATCH] Distrust compromised eMudhra intermediates in the Docker
 image

The private keys of eight eMudhra intermediate CA certificates have been
compromised (CVE-2026-111943). They chain to emSign ECC Root CA - G3,
and to AAA Certificate Services through Sectigo cross-signs.

Build scip-go and the image with Go 1.27.3, whose crypto/x509 rejects
chains through these intermediates. Go module downloads are covered by
this.

Drop emSign ECC Root CA - G3 from the image CA bundle so git and other
OpenSSL clients reject these chains too. The override is skipped once
nixpkgs ships cacert 3.131.1, which removes that root itself. The
bundle already excludes AAA Certificate Services from TLS trust.

Track nixos-26.05-small, the only 26.05 channel with Go 1.27.3 so far.
---
 flake.lock |  8 ++++----
 flake.nix  | 25 ++++++++++++++++++++-----
 2 files changed, 24 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index 6e0fb09..81a811a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -20,16 +20,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1780203844,
-        "narHash": "sha256-K5sT4jTpGs15ADhviMKNBH38REpPf5Q6mM1+N6cArVE=",
+        "lastModified": 1792593785,
+        "narHash": "sha256-dEQs/r/DSIvSjw5pQro/BAqsUnFNNZ3I/qmFYzatGvc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b51242d7d43689db2f3be91bd05d5b24fbb469c4",
+        "rev": "8c259fc0dd1f3ccc1aaf4f9156ab16b7328b5a4f",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-26.05",
+        "ref": "nixos-26.05-small",
         "repo": "nixpkgs",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 6a02ab4..0b0303c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -4,7 +4,7 @@
       url = "github:numtide/flake-utils";
     };
     nixpkgs = {
-      url = "github:NixOS/nixpkgs/nixos-26.05";
+      url = "github:NixOS/nixpkgs/nixos-26.05-small";
     };
   };
 
@@ -19,10 +19,25 @@
       let
         pkgs = import nixpkgs { inherit system; };
         version = pkgs.lib.fileContents ./internal/index/version.txt;
+        # Go 1.27.3 rejects chains through the compromised eMudhra
+        # intermediates (CVE-2026-111943). The default pkgs.go is an
+        # older 1.26 release without the fix.
+        go = pkgs.go_1_27;
+        # NSS 3.131.1 removes the emSign ECC Root CA - G3 root that
+        # the compromised eMudhra intermediates chain to. Until nixpkgs
+        # ships it, drop the root ourselves so git and other OpenSSL
+        # clients reject those chains too. (The bundle already excludes
+        # AAA Certificate Services, the root of the Sectigo cross-signs,
+        # from TLS trust.)
+        cacert =
+          if pkgs.lib.versionOlder pkgs.cacert.version "3.131.1" then
+            pkgs.cacert.override { blacklist = [ "emSign ECC Root CA - G3" ]; }
+          else
+            pkgs.cacert;
       in
       {
         packages = {
-          scip-go = pkgs.buildGoModule {
+          scip-go = (pkgs.buildGoModule.override { inherit go; }) {
             pname = "scip-go";
             inherit version;
             src = ./.;
@@ -44,9 +59,9 @@
             tag = version;
             contents = [
               self.packages.${system}.scip-go
-              pkgs.go
+              go
               pkgs.git
-              pkgs.dockerTools.caCertificates
+              (pkgs.dockerTools.override { inherit cacert; }).caCertificates
               pkgs.dockerTools.usrBinEnv
               pkgs.dockerTools.fakeNss
               pkgs.busybox
@@ -103,7 +118,7 @@
         devShells = {
           default = pkgs.mkShellNoCC {
             buildInputs = [
-              pkgs.go
+              go
               pkgs.gotools
               pkgs.nixfmt
             ];