[Leechael]

The mkosi guest OS was built from the Debian 20260721T000000Z snapshot. Its trixie ca-certificates 20250419 still trusts emSign ECC Root CA - G3 and Comodo AAA Services root, so every client in the guest that reads the system trust store (docker, containerd, nerdctl, curl, ...) accepts a certificate issued by one of the compromised eMudhra/emSign intermediate CAs. The Go components were also built with Go 1.26.2, which predates the Go fix.

Changes

file	before	after
os/mkosi/mkosi.conf Snapshot=	20260721T000000Z	20261021T000000Z
os/mkosi/mkosi.tools.conf Snapshot=	20260721T000000Z	20261021T000000Z
os/mkosi/versions.env DEBIAN_SNAPSHOT	20260721T000000Z	20261021T000000Z
os/mkosi/versions.env GO_TOOLCHAIN_VERSION / _SHA256	1.26.2 / 990e6b4b...	1.26.10 / ccfe7ae8...
os/mkosi/tests/acceptance.sh	asserts 20260721T000000Z and 1.26.2	asserts 20261021T000000Z and 1.26.10; comment updated

• With Snapshot= set, mkosi 26 (the pinned revision) also adds archive/debian-security/<snapshot> for <release>-security. 20261021T000000Z resolves to debian-security 20261020T213255Z, and that snapshot's trixie-security Packages.xz lists ca-certificates 20250419+deb13u1. snapshot.debian.org first saw that version at 20261020T205625Z. I also checked that the debian, debian-debug and debian-security InRelease files exist at this timestamp.
• Go 1.26.10 carries the CVE-2026-111943 fix: crypto/x509 rejects chains that contain the compromised intermediate keys. I took the sha256 from the go.dev download index (the same index returns the old 1.26.2 hash that was in versions.env). I also downloaded go1.26.10.linux-amd64.tar.gz and checked its hash locally.
• The rest of the trixie package set moves forward three months with the snapshot. DEBIAN_BASE_IMAGE (trixie-20260713) still predates the snapshot, as its comment requires.

Tests run

• os/mkosi/tests/acceptance.sh: passes ("mkosi static acceptance passed").

Not run here

• A full mkosi image build, and a boot of the new image. The mkosi-build workflow runs on this PR because it touches os/**.
• I did not check that every package in the new snapshot installs cleanly. The mkosi build is the check for that.
• No curl self-test inside a booted guest. 推断: the guest gets the same 20250419+deb13u1 trust store that rejects the test site.

Rollout impact

The rootfs changes, so the OS image hash and the TDX measurements change. Update the OS image allowlists before rolling out: the on-chain OS image hashes and the auth configs (osImages in auth-simple, osImageHash in auth-eth-bun).

Remaining / needs a decision

• The prebuilt upstream nerdctl 2.3.5 (built with go1.26.5) and stargz-snapshotter 0.18.2 (built with go1.25.6) stay as they are. I checked this with go version on the release binaries that match the versions.env sha256. Their newest releases, nerdctl 2.4.1 (2026-10-02) and stargz-snapshotter 0.19.0 (2026-10-08), both predate the Go fix (2026-10-20), so neither is a fixed build. Options: wait for releases built with Go >= 1.26.10, or build both from source with the pinned Go toolchain.
• The mkosi Go is now ahead of the Go that oe-core pins for the Yocto backend. The acceptance comment used to say the two match. The Yocto backend's Go is not changed here.
• The dstack Rust binaries in the guest pick up rustls-webpki 0.103.16 only together with branch security/emsign-rust-workspace. Land both before cutting a guest image, so it needs one allowlist update instead of two.