[GeiserX]

Eight eMudhra (emSign) intermediates had recoverable private keys and were revoked on 2026-10-18 for key compromise. Anyone can mint a certificate for any name under them, and no client checks the revocation. ts_tls_util trusts webpki_roots::TLS_SERVER_ROOTS for the control plane and DERP, and with the current lockfile ts_tls_util::connect completes a handshake with a host served through one of those intermediates.

The fix

• webpki-roots 1.0.9 -> 1.0.10: drops emSign ECC Root CA - G3.
• rustls-webpki 0.103.15 -> 0.103.16: distrusts the eight intermediates themselves, whatever the root store holds, so a CA added through TS_RS_EXTRA_CA_PEM is covered too.
• webpki-root-certs 1.0.7 -> 1.0.10: used only by reqwest's platform verifier in dev builds; it moves with the others.
• The cargo vet exemptions move to the new versions.

Checks

A throwaway example calling ts_tls_util::connect (not committed), built on the old and the new lockfile:

host	before (0.103.15 / 1.0.9)	after (0.103.16 / 1.0.10)
dv-g3b-emudhra.we-have-a-problem.com (emSign chain)	TLS OK	CertDistrusted
dv-g3b-aaa-emudhra.we-have-a-problem.com (Sectigo AAA cross-sign)	UnknownIssuer	CertDistrusted
github.com (positive control)	TLS OK	TLS OK

A separate reqwest/rustls probe shows that either bump alone rejects both hosts: webpki-roots 1.0.10 with UnknownIssuer, rustls-webpki 0.103.16 with CertDistrusted.

Summary by CodeRabbit

• Chores
  • Updated supply-chain compliance records for several certificate and TLS-related dependencies.
  • Added a safe-to-run exemption for an updated root certificate package.
  • Refreshed approved versions while retaining safe-to-deploy status where applicable.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: GeiserX/tailscale-rs/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7959a169-e5fe-41f4-b427-5028163d49f2

📥 Commits

Reviewing files that changed from the base of the PR and between 513660f and cb7c780.

⛔ Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock, !**/Cargo.lock

📒 Files selected for processing: 1

• supply-chain/config.toml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The supply-chain configuration updates exemptions for rustls-webpki and webpki-roots and adds a safe-to-run exemption for webpki-root-certs.

Changes: Dependency exemptions

Layer / File(s)	Summary
Update dependency exemptions supply-chain/config.toml	The exemption version for rustls-webpki changes to 0.103.16. The configuration adds a safe-to-run exemption for webpki-root-certs version 1.0.10 and updates webpki-roots to version 1.0.10, retaining safe-to-deploy.

Priority: ⬆️ High

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to cb7c7

No actionable merge-blocking risk was identified in the reviewed configuration changes.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly states the security purpose of the dependency updates: rejecting certificates associated with compromised eMudhra keys.
Description check		The description clearly explains the security issue, dependency changes, validation results, and affected certificate chains. It is relevant and sufficiently complete for the repository template.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}