From da40c792b7d25b2d87cd5ea0b37a1c235f1bf743 Mon Sep 17 00:00:00 2001 From: Sylvain Rabot Date: Wed, 21 Oct 2026 10:33:11 +0200 Subject: [PATCH] fix: distrust compromised eMudhra intermediates The private keys of eight eMudhra intermediate CAs are recoverable from their public certificates, so a client trusting the chain can be MITM'd (https://emudhra.we-have-a-problem.com/). Upgrade Go to 1.26.10, a patched release, and require Alpine `ca-certificates>=20261020-r0` in the runtime image. The version constraint fails the build rather than shipping old roots, and busts any cached layer from before the fix. Constraint: Stay on the Go 1.26 line rather than moving to 1.27.3 Rejected: Remove roots manually from /etc/ca-certificates.conf | patched Alpine package exists Confidence: high Scope-risk: narrow Not-tested: Full cachew image build (needs dist/ binaries) Signed-off-by: Sylvain Rabot --- bin/{.go-1.26.1.pkg => .go-1.26.10.pkg} | 0 bin/go | 2 +- bin/gofmt | 2 +- docker/Dockerfile | 2 +- 4 files changed, 3 insertions(+), 3 deletions(-) rename bin/{.go-1.26.1.pkg => .go-1.26.10.pkg} (100%) diff --git a/bin/.go-1.26.1.pkg b/bin/.go-1.26.10.pkg similarity index 100% rename from bin/.go-1.26.1.pkg rename to bin/.go-1.26.10.pkg diff --git a/bin/go b/bin/go index 99e87832..29428877 120000 --- a/bin/go +++ b/bin/go @@ -1 +1 @@ -.go-1.26.1.pkg \ No newline at end of file +.go-1.26.10.pkg \ No newline at end of file diff --git a/bin/gofmt b/bin/gofmt index 99e87832..29428877 120000 --- a/bin/gofmt +++ b/bin/gofmt @@ -1 +1 @@ -.go-1.26.1.pkg \ No newline at end of file +.go-1.26.10.pkg \ No newline at end of file diff --git a/docker/Dockerfile b/docker/Dockerfile index 7cdc931a..734804f5 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -6,7 +6,7 @@ ARG TARGETARCH SHELL ["/bin/sh", "-o", "pipefail", "-c"] # Install runtime dependencies for git operations and TLS -RUN apk add --no-cache ca-certificates curl git git-daemon git-lfs tzdata zstd && \ +RUN apk add --no-cache 'ca-certificates>=20261020-r0' curl git git-daemon git-lfs tzdata zstd && \ addgroup -g 1000 cachew && \ adduser -D -u 1000 -G cachew cachew