[kwsantiago]

Removes trust in emSign ECC Root CA - G3 and in the emSign intermediates whose private keys have leaked, across every TLS path in the backend.

The backend trusts certificates through four sources, and each needed its own change.

Compiled-in roots. webpki-roots 1.0.7 (the Nostr relay path) moves to 1.0.10, the first release without G3. The Electrum client used webpki-roots 0.25.4, a line that will never get the fix, so the patched electrum-client fork now depends on 1.0.10 and its pinned rev moves to that commit, tagged blake2b-extended-headers-v2. webpki-root-certs moves to 1.0.10 as well; it is not linked on Linux, but it is in the lockfile.

The verifier. rustls-webpki moves to 0.103.16, which rejects any certificate path containing one of the eight leaked emSign intermediate keys, whatever trust anchors are configured. That covers the rustls paths that mix in system roots.

The system store. reqwest uses native-tls here (resend-rs enables it), so ntfy, Telegram, email, webhooks, exchange rates and the other HTTP clients verify against the image's ca-certificates, and the Nostr relays add the same store to their roots. The 1.7.0 image ships 20250419~deb12u1, which still trusts G3 and AAA Certificate Services. ca-certificates is now pinned to 20250419~deb12u2, which drops both. The pin also invalidates the cached apt-get layer, which would otherwise be reused because the base image digest and the instruction text are unchanged.

Electrum. canary leaves validate_domain at its default of true, so every ssl:// server is checked against the compiled-in store. Moving from 0.25.4 to 1.0.10 also syncs that store to Mozilla's current set: 147 anchors become 120, removing roots Mozilla has distrusted or retired, including the Entrust and AffirmTrust roots, DigiCert Global Root CA, GlobalSign Root CA and AAA Certificate Services. ISRG Root X1 and X2 remain. An ssl:// Electrum server whose chain ends only at a removed root will now fail verification.

backend/osv-scanner.toml overrides webpki-roots 0.26.11 only. That version is the compatibility shim tokio-tungstenite requires; its whole implementation is pub use parent::TLS_SERVER_ROOTS, re-exporting the 1.0.10 locked beside it. RUSTSEC-2026-0381 matches every release below 1.0.10, so the advisory flags the shim by version alone. The override is scoped to that exact version, so a real webpki-roots 1.x below 1.0.10 still fails the scan.

Verified on the built image: ca-certificates is 20250419~deb12u2, and none of the 148 certificates in /etc/ssl/certs/ca-certificates.crt matches the G3 or AAA public key. Trivy reports no findings. Live ssl:// handshakes with validate_domain = true against the pinned rev behave as before: a server with a publicly trusted chain completes the handshake and a call, and two servers presenting self-signed certificates are rejected identically to the previous rev.