From cb7c7809ffd899d7a42081e2d9a78023036cb9d5 Mon Sep 17 00:00:00 2001
From: GeiserX <9169332+GeiserX@users.noreply.github.com>
Date: Wed, 21 Oct 2026 00:53:10 +0200
Subject: [PATCH] fix(deps): stop trusting certificates minted with the leaked
 eMudhra keys

Eight eMudhra (emSign) intermediates had recoverable private keys and were
revoked on 2026-10-18 for key compromise. ts_tls_util trusts
webpki_roots::TLS_SERVER_ROOTS for the control plane and DERP, and with
webpki-roots 1.0.9 and rustls-webpki 0.103.15 ts_tls_util::connect completed
a handshake with dv-g3b-emudhra.we-have-a-problem.com, a host served through
one of them.

webpki-roots 1.0.10 drops emSign ECC Root CA - G3, and rustls-webpki
0.103.16 distrusts the eight intermediates themselves, which also covers a
CA added through TS_RS_EXTRA_CA_PEM. Both test hosts (the emSign chain and
the Sectigo AAA cross-sign) now fail with CertDistrusted; github.com still
connects. webpki-root-certs 1.0.7 -> 1.0.10 rides along for reqwest's
platform verifier in dev builds. The cargo vet exemptions move to the new
versions.

Signed-off-by: GeiserX <9169332+GeiserX@users.noreply.github.com>
---
 Cargo.lock               | 12 ++++++------
 supply-chain/config.toml |  6 +++---
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 312a29e..a900580 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -5170,9 +5170,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.15"
+version = "0.103.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
+checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
 dependencies = [
  "aws-lc-rs",
  "ring",
@@ -6776,18 +6776,18 @@ dependencies = [
 
 [[package]]
 name = "webpki-root-certs"
-version = "1.0.7"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f31141ce3fc3e300ae89b78c0dd67f9708061d1d2eda54b8209346fd6be9a92c"
+checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb"
 dependencies = [
  "rustls-pki-types",
 ]
 
 [[package]]
 name = "webpki-roots"
-version = "1.0.9"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a"
+checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9"
 dependencies = [
  "rustls-pki-types",
 ]
diff --git a/supply-chain/config.toml b/supply-chain/config.toml
index 4192318..ae4792d 100644
--- a/supply-chain/config.toml
+++ b/supply-chain/config.toml
@@ -1666,7 +1666,7 @@ version = "0.1.1"
 criteria = "safe-to-run"
 
 [[exemptions.rustls-webpki]]
-version = "0.103.15"
+version = "0.103.16"
 criteria = "safe-to-deploy"
 
 [[exemptions.rustversion]]
@@ -2206,11 +2206,11 @@ version = "1.1.0"
 criteria = "safe-to-deploy"
 
 [[exemptions.webpki-root-certs]]
-version = "1.0.7"
+version = "1.0.10"
 criteria = "safe-to-run"
 
 [[exemptions.webpki-roots]]
-version = "1.0.9"
+version = "1.0.10"
 criteria = "safe-to-deploy"
 
 [[exemptions.wezterm-bidi]]