Drop the compromised emSign CA from every trust path

backend/Cargo.toml

@@ -122,11 +122,11 @@ path = "system_tests/blake2b_hardfork_headers.rs"
 # "data not consumed entirely when explicitly deserializing".
 #
 # Both crates are pinned to an immutable rev rather than a branch, since they carry consensus code.
-# Each rev is also tagged in its repo (blake2b-hardfork-0.32-v1, blake2b-extended-headers-v1) so a
+# Each rev is also tagged in its repo (blake2b-hardfork-0.32-v1, blake2b-extended-headers-v2) so a
 # force-push cannot orphan it and break every clean build, including the Docker image.
 # bdk_wallet and bdk_electrum need no fork; they inherit the fix through `bitcoin`.
 [patch.crates-io]
 bitcoin = { git = "https://github.com/privkeyio/rust-bitcoin", rev = "e9aa336977e334f29fbe440a0dc0d21fa739fbf6" }
-electrum-client = { git = "https://github.com/privkeyio/rust-electrum-client", rev = "b5c4e202c84e39791e50e92ca576b2ad38bed02e" }
+electrum-client = { git = "https://github.com/privkeyio/rust-electrum-client", rev = "bae28010c620dbe9726499cece1f31066cf217bc" }
 # phonenumber needs postcard's std serialization, not embedded heapless atomics.
 postcard = { path = "vendor/postcard" }

backend/Dockerfile

@@ -34,10 +34,15 @@ WORKDIR /app
 # (3 critical); the fix lives only in bookworm-security, not in any base tag.
 # When Debian publishes a later revision the mirror drops this one and the build
 # fails loudly, which is the point: bump the pin and re-run the container scan.
+# ca-certificates is pinned for the same reason: 20250419~deb12u2 is the first
+# bookworm revision that drops emSign ECC Root CA - G3 and AAA Certificate
+# Services, whose emSign intermediates have leaked private keys. Earlier
+# revisions trust them, and reqwest (native-tls) and the Nostr relays read this
+# store. Pinning also busts any cached layer built before that revision.
 RUN apt-get update && apt-get install -y --only-upgrade \
     perl-base=5.36.0-7+deb12u4 \
     && apt-get install -y \
-    ca-certificates \
+    ca-certificates=20250419~deb12u2 \
     libssl3 \
     libpcre2-8-0 \
     && rm -rf /var/lib/apt/lists/*

backend/osv-scanner.toml

@@ -0,0 +1,13 @@
+# osv-scanner reads this file only for backend/Cargo.lock; see frontend/osv-scanner.toml.
+
+# RUSTSEC-2026-0381 covers every webpki-roots release below 1.0.10, so it also
+# matches 0.26.11, the compatibility shim tokio-tungstenite requires. The shim's
+# whole implementation is `pub use parent::TLS_SERVER_ROOTS`, re-exporting the
+# webpki-roots 1.x locked beside it, which is 1.0.10 and carries no affected root.
+# Scoped to this one version so a real webpki-roots 1.x below 1.0.10 still fails.
+[[PackageOverrides]]
+name = "webpki-roots"
+version = "0.26.11"
+ecosystem = "crates.io"
+vulnerability.ignore = true
+reason = "Root-less shim re-exporting webpki-roots 1.0.10, which drops emSign ECC Root CA - G3."