Repository navigation
Five security pins move together: the CA bundle, Firefox 153.6.0, Node.js 24.22.2, Python 3.12.16 and patch 2.8.1 - #655
Merged
Merged
Conversation
…e.js 24.22.2, Python 3.12.16 and patch 2.8.1 Each was held in tools/pin-reviews.tsv for a fix that reaches Kryptik, and the bundle and Firefox each rebuild every image, so they move in one build: - the CA bundle 2026-10-20 leaves out the three emSign roots of the eMudhra compromise, which the net zone's TLS and every OpenSSL program still trusted; - Firefox ESR 153.6.0, after 153.5.1's built-in OneCRL entries for the same intermediates; its four GCC patches apply unchanged, and their directory follows the version; - Node.js 24.22.2, which only the browser's build runs, signed now by Antoine du Hamel, whom nodejs/node's README lists as a releaser: his key replaces Richard Lau's, who signed 24.22.0; - Python 3.12.16, whose ssl module carries the eMudhra distrust and which update-fetch.py runs in the net zone; - patch 2.8.1, which the image ships. Every hash is the publisher's own: curl.se's .sha256, the SHA256SUMS that Mozilla's key signs, and the SHASUMS256.txt Node's releaser signs, each checked here, and the Python and patch tarballs hashed after their signatures checked against the keys already pinned for them.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Five pins held in
tools/pin-reviews.tsvfor security fixes that reach Kryptik move in one build. The bundle and Firefox each rebuild every image, so one rebuild covers all five. This is the v1.0.0 blocker: Distro's tag job runscheck-pin-reviews --no-held.image_ships=no).ssl.tools/net/update-fetch.pyruns it in the net zone./usr/bin/patchships.Where each hash comes from:
cacert-2026-10-20.pem.sha256.SHA256SUMSatreleases/153.6.0esr/. Its.ascchecks GOODSIG here, signed by subkey 827E6586… of the pinned primary 14F26682D0916CDD81E37B6D61B7B526D98F0353. The 153.6.0esrKEYfile is byte for byte the 153.5.1esr one, so the key-provenance row's note (that subkey, and the revoked 09BEED63…) still holds; only its URL moves.SHASUMS256.txt. Its detached.sigchecks GOODSIG here..ascchecks GOODSIG from Thomas Wouters 7169605F62C751356D054A26A821E680E5FA6305, already pinned in verify-signatures.sh..sigchecks GOODSIG from Andreas Gruenbacher 259B3792B3D6D319212CC4DCD5BF9FEB0313653A, already in key-provenance.tsv (korg; acl,attr,patch).CI's Source manifest verifies all of this again from the pinned keys.
Node.js's signer changed. 24.22.1 and 24.22.2 are signed by Antoine du Hamel, 5BE8A3F6C8A5C01D106C0AD820B1A390B168D356, not Richard Lau (C82FA3AE…, who signed 24.22.0).
keys/5BE8A3F6….asc.verify-signatures.sh's pinned list and inkey-provenance.tsv, so only the key that signs the pinned release is trusted.Firefox's patches:
build/patches/firefox-153.5.0moves tofirefox-153.6.0, sinceapply_repo_patchesnames the version.patch -p1 -F0) against their six files atFIREFOX_153_6_0esr_RELEASEand apply unchanged, so theirSHA256SUMSstands.Still to do before this lands:
V_PATCHrebuilds from stage 02, and the bundle and Firefox rebuild every image: a cold build, about 6 h.Tectonix: 5807 → 5807, no violations.