NetBSD Problem Report #60908
From www@netbsd.org Tue Oct 20 14:29:09 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
client-signature RSA-PSS (2048 bits) client-digest SHA256)
(Client CN "mail.netbsd.org", Issuer "YR1" (not verified))
by mollari.NetBSD.org (Postfix) with ESMTPS id 341CB1A923B
for <gnats-bugs@gnats.NetBSD.org>; Tue, 20 Oct 2026 14:29:09 +0000 (UTC)
Message-Id: <20261020142907.ECB7B1A923C@mollari.NetBSD.org>
Date: Tue, 20 Oct 2026 14:29:07 +0000 (UTC)
From: campbell+netbsd@mumble.net
Reply-To: campbell+netbsd@mumble.net
To: gnats-bugs@NetBSD.org
Subject: mozilla-certdata: update for compromised CA
X-Send-Pr-Version: www-1.0
X-From4GNATS: "campbell+netbsd@mumble.net via gnats" <gnats-admin@NetBSD.org>
>Number: 60908
>Category: security
>Synopsis: mozilla-certdata: update for compromised CA
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: riastradh
>State: pending-pullups
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Tue Oct 20 14:30:01 +0000 2026
>Closed-Date:
>Last-Modified: Sat Oct 24 12:45:03 +0000 2026
>Originator: Taylor R Campbell
>Release: current, 11, 10
>Organization:
Honest Achmed's Used BSDs and Foundations, Inc.
>Environment:
>Description:
One of the CAs in mozilla-certdata was compromised:
https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/0XofdebrAAAJ
>How-To-Repeat:
probably a bad idea to repeat this
>Fix:
update mozilla-certdata
>Release-Note:
>Audit-Trail:
From: "Nia Alarie" <nia@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/60908 CVS commit: pkgsrc/security
Date: Tue, 20 Oct 2026 14:45:11 +0000
Module Name: pkgsrc
Committed By: nia
Date: Tue Oct 20 14:45:11 UTC 2026
Modified Files:
pkgsrc/security/mozilla-rootcerts: Makefile distinfo
pkgsrc/security/mozilla-rootcerts-openssl: Makefile
Added Files:
pkgsrc/security/mozilla-rootcerts/patches: patch-certdata.txt
Log Message:
mozilla-rootcerts: Remove compromised CAs.
https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/0XofdebrAAAJ
PR security/60908
To generate a diff of this commit:
cvs rdiff -u -r1.66 -r1.67 pkgsrc/security/mozilla-rootcerts/Makefile
cvs rdiff -u -r1.43 -r1.44 pkgsrc/security/mozilla-rootcerts/distinfo
cvs rdiff -u -r1.40 -r1.41 pkgsrc/security/mozilla-rootcerts-openssl/Makefile
cvs rdiff -u -r0 -r1.5 \
pkgsrc/security/mozilla-rootcerts/patches/patch-certdata.txt
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/60908 CVS commit: src/external/mpl/mozilla-certdata/dist
Date: Tue, 20 Oct 2026 14:51:06 +0000
Module Name: src
Committed By: riastradh
Date: Tue Oct 20 14:51:06 UTC 2026
Update of /cvsroot/src/external/mpl/mozilla-certdata/dist
In directory ivanova.netbsd.org:/tmp/cvs-serv13789
Log Message:
mozilla-certdata: Update Mozilla certdata.txt.
nss hg date: 2026-10-20
nss hg revision: 26d38a0c3fb81e7fb2acedbaf4c42dd21dce0517
PR security/60908: mozilla-certdata: update for compromised CA
Status:
Vendor Tag: MOZILLA-CERTDATA
Release Tags: mozilla-certdata-20261020
U src/external/mpl/mozilla-certdata/dist/certdata.txt
No conflicts created by this import
From: Taylor R Campbell <riastradh@NetBSD.org>
To: gnats-bugs@NetBSD.org, netbsd-bugs@NetBSD.org
Cc:
Subject: Re: security/60908: mozilla-certdata: update for compromised CA
Date: Tue, 20 Oct 2026 14:58:37 +0000
Workaround:
certctl untrust /usr/share/certs/mozilla/all/emSign_ECC_Root_CA_-_C3.pem
certctl untrust /usr/share/certs/mozilla/all/emSign_ECC_Root_CA_-_G3
certctl untrust /usr/share/certs/mozilla/all/emSign_Root_CA_-_C1.pem
(Not sure all of these were compromised but they were all removed from
certdata.txt.)
Responsible-Changed-From-To: security-officer->riastradh
Responsible-Changed-By: riastradh@NetBSD.org
Responsible-Changed-When: Tue, 20 Oct 2026 15:40:03 +0000
Responsible-Changed-Why:
I am preparing the update, which involves a lot of annoying set list updates
From: Leonardo Taccari <leot@NetBSD.org>
To: gnats-bugs@NetBSD.org
Cc:
Subject: Re: security/60908: mozilla-certdata: update for compromised CA
Date: Tue, 20 Oct 2026 18:27:19 +0200
Also pkgsrc/security/py-certifi is affected and that was fixed in
py-certifi-2026.10.19 that is in pkgsrc-current.
I have requested [pullup-pkgsrc #7298] for pkgsrc-2026Q3 to pullup it
too.
State-Changed-From-To: open->needs-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Tue, 20 Oct 2026 17:39:59 +0000
State-Changed-Why:
fixed in HEAD, needs pullup-11, pullup-10, pullup-pkgsrc
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/60908 CVS commit: src/distrib/sets/lists/base
Date: Tue, 20 Oct 2026 17:38:54 +0000
Module Name: src
Committed By: riastradh
Date: Tue Oct 20 17:38:54 UTC 2026
Modified Files:
src/distrib/sets/lists/base: mi
Log Message:
mozilla-certdata: Update set lists.
PR security/60908: mozilla-certdata: update for compromised CA
To generate a diff of this commit:
cvs rdiff -u -r1.1392 -r1.1393 src/distrib/sets/lists/base/mi
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/60908 CVS commit: src
Date: Tue, 20 Oct 2026 17:39:20 +0000
Module Name: src
Committed By: riastradh
Date: Tue Oct 20 17:39:20 UTC 2026
Modified Files:
src/doc: 3RDPARTY
src/external/mpl/mozilla-certdata/share: Makefile
Log Message:
mozilla-certdata: Update references in Makefile and doc/3RDPARTY.
PR security/60908: mozilla-certdata: update for compromised CA
To generate a diff of this commit:
cvs rdiff -u -r1.2266 -r1.2267 src/doc/3RDPARTY
cvs rdiff -u -r1.5 -r1.6 src/external/mpl/mozilla-certdata/share/Makefile
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Maya Rashish" <maya@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/60908 CVS commit: [pkgsrc-2026Q3] pkgsrc/security
Date: Tue, 20 Oct 2026 17:50:45 +0000
Module Name: pkgsrc
Committed By: maya
Date: Tue Oct 20 17:50:45 UTC 2026
Modified Files:
pkgsrc/security/mozilla-rootcerts [pkgsrc-2026Q3]: Makefile distinfo
pkgsrc/security/mozilla-rootcerts-openssl [pkgsrc-2026Q3]: Makefile
PLIST
Added Files:
pkgsrc/security/mozilla-rootcerts/patches [pkgsrc-2026Q3]:
patch-certdata.txt
Log Message:
Pullup ticket #7297 - requested by nia
security/mozilla-rootcerts: Security fix
security/mozilla-rootcerts-openssl: Security fix
Revisions pulled up:
- security/mozilla-rootcerts-openssl/Makefile 1.41
- security/mozilla-rootcerts/Makefile 1.67
- security/mozilla-rootcerts/distinfo 1.44
- security/mozilla-rootcerts/patches/patch-certdata.txt 1.5
---
Module Name: pkgsrc
Committed By: nia
Date: Tue Oct 20 14:45:11 UTC 2026
Modified Files:
pkgsrc/security/mozilla-rootcerts: Makefile distinfo
pkgsrc/security/mozilla-rootcerts-openssl: Makefile
Added Files:
pkgsrc/security/mozilla-rootcerts/patches: patch-certdata.txt
Log Message:
mozilla-rootcerts: Remove compromised CAs.
https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/0XofdebrAAAJ
PR security/60908
To generate a diff of this commit:
cvs rdiff -u -r1.65 -r1.65.2.1 pkgsrc/security/mozilla-rootcerts/Makefile
cvs rdiff -u -r1.42 -r1.42.2.1 pkgsrc/security/mozilla-rootcerts/distinfo
cvs rdiff -u -r1.39 -r1.39.2.1 \
pkgsrc/security/mozilla-rootcerts-openssl/Makefile
cvs rdiff -u -r1.32 -r1.32.2.1 \
pkgsrc/security/mozilla-rootcerts-openssl/PLIST
cvs rdiff -u -r0 -r1.5.2.2 \
pkgsrc/security/mozilla-rootcerts/patches/patch-certdata.txt
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
State-Changed-From-To: needs-pullups->pending-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Tue, 20 Oct 2026 18:22:22 +0000
State-Changed-Why:
pullup-11 #537
pullup-10 #1383
pullup-pkgsrc #7297, #7298
From: "David A. Holland" <dholland@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/60908 CVS commit: pkgsrc/security/mozilla-rootcerts-openssl
Date: Tue, 20 Oct 2026 18:41:52 +0000
Module Name: pkgsrc
Committed By: dholland
Date: Tue Oct 20 18:41:52 UTC 2026
Modified Files:
pkgsrc/security/mozilla-rootcerts-openssl: PLIST
Log Message:
mozilla-rootcerts-openssl: Update PLIST for "Remove compromised CAs"
PR security/60908
To generate a diff of this commit:
cvs rdiff -u -r1.32 -r1.33 pkgsrc/security/mozilla-rootcerts-openssl/PLIST
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/60908 CVS commit: [netbsd-11] src
Date: Tue, 20 Oct 2026 19:19:04 +0000
Module Name: src
Committed By: martin
Date: Tue Oct 20 19:19:03 UTC 2026
Modified Files:
src/distrib/sets/lists/base [netbsd-11]: mi
src/doc [netbsd-11]: 3RDPARTY
src/external/mpl/mozilla-certdata/share [netbsd-11]: Makefile
email.trust server.trust
Added Files:
src/external/mpl/mozilla-certdata/share/certs [netbsd-11]:
D-TRUST_BR_Root_CA_2_2023.pem D-TRUST_EV_Root_CA_2_2023.pem
OISTE_Client_Root_ECC_G1.pem OISTE_Client_Root_RSA_G1.pem
OISTE_Server_Root_ECC_G1.pem OISTE_Server_Root_RSA_G1.pem
SECOM_SMIME_RSA_Root_CA_2024.pem SECOM_TLS_ECC_Root_CA_2024.pem
SECOM_TLS_RSA_Root_CA_2024.pem SecureSign_Root_CA16.pem
SwissSign_RSA_SMIME_Root_CA_2022_-_1.pem
SwissSign_RSA_TLS_Root_CA_2022_-_1.pem
Telia_EC_Email_Root_CA_v3.pem Telia_EC_TLS_Root_CA_v3.pem
Telia_RSA_Email_Root_CA_v3.pem Telia_RSA_TLS_Root_CA_v3.pem
TrustAsia_SMIME_ECC_Root_CA.pem TrustAsia_SMIME_RSA_Root_CA.pem
TrustAsia_TLS_ECC_Root_CA.pem TrustAsia_TLS_RSA_Root_CA.pem
e-Szigno_TLS_Root_CA_2023.pem
Removed Files:
src/external/mpl/mozilla-certdata/share/certs [netbsd-11]:
AffirmTrust_Commercial.pem AffirmTrust_Networking.pem
AffirmTrust_Premium.pem AffirmTrust_Premium_ECC.pem
Baltimore_CyberTrust_Root.pem
CommScope_Public_Trust_ECC_Root-01.pem
CommScope_Public_Trust_ECC_Root-02.pem
CommScope_Public_Trust_RSA_Root-01.pem
CommScope_Public_Trust_RSA_Root-02.pem
Entrust_Root_Certification_Authority.pem
Explicitly_Distrust_DigiNotar_Root_CA.pem
FIRMAPROFESIONAL_CA_ROOT-A_WEB.pem GLOBALTRUST_2020.pem
SecureSign_RootCA11.pem SecureSign_Root_CA12.pem SecureTrust_CA.pem
Secure_Global_CA.pem Security_Communication_RootCA3.pem
SwissSign_Silver_CA_-_G2.pem TeliaSonera_Root_CA_v1.pem
Trustwave_Global_Certification_Authority.pem
Trustwave_Global_ECC_P256_Certification_Authority.pem
Trustwave_Global_ECC_P384_Certification_Authority.pem
XRamp_Global_CA_Root.pem certSIGN_ROOT_CA.pem
ePKI_Root_Certification_Authority.pem emSign_ECC_Root_CA_-_C3.pem
emSign_ECC_Root_CA_-_G3.pem emSign_Root_CA_-_C1.pem
Log Message:
Pull up following revision(s) (requested by riastradh in ticket #537):
external/mpl/mozilla-certdata/share/certs/AffirmTrust_Commercial.pem: file removal
external/mpl/mozilla-certdata/share/certs/TrustAsia_TLS_ECC_Root_CA.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/OISTE_Server_Root_ECC_G1.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/Trustwave_Global_ECC_P256_Certification_Authority.pem: file removal
external/mpl/mozilla-certdata/share/certs/FIRMAPROFESIONAL_CA_ROOT-A_WEB.pem: file removal
external/mpl/mozilla-certdata/share/certs/TeliaSonera_Root_CA_v1.pem: file removal
external/mpl/mozilla-certdata/share/certs/SwissSign_RSA_SMIME_Root_CA_2022_-_1.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/Entrust_Root_Certification_Authority.pem: file removal
external/mpl/mozilla-certdata/share/certs/CommScope_Public_Trust_RSA_Root-01.pem: file removal
external/mpl/mozilla-certdata/share/certs/ePKI_Root_Certification_Authority.pem: file removal
external/mpl/mozilla-certdata/share/certs/Telia_RSA_TLS_Root_CA_v3.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/TrustAsia_SMIME_RSA_Root_CA.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/GLOBALTRUST_2020.pem: file removal
external/mpl/mozilla-certdata/share/certs/AffirmTrust_Premium_ECC.pem: file removal
external/mpl/mozilla-certdata/share/certs/SecureTrust_CA.pem: file removal
external/mpl/mozilla-certdata/share/certs/OISTE_Server_Root_RSA_G1.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/Trustwave_Global_Certification_Authority.pem: file removal
external/mpl/mozilla-certdata/share/certs/TrustAsia_TLS_RSA_Root_CA.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/e-Szigno_TLS_Root_CA_2023.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/Telia_EC_TLS_Root_CA_v3.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/Security_Communication_RootCA3.pem: file removal
external/mpl/mozilla-certdata/share/certs/SECOM_TLS_ECC_Root_CA_2024.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/OISTE_Client_Root_ECC_G1.pem: revision 1.1
external/mpl/mozilla-certdata/share/email.trust: revision 1.4
external/mpl/mozilla-certdata/share/certs/Telia_RSA_Email_Root_CA_v3.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/SwissSign_Silver_CA_-_G2.pem: file removal
external/mpl/mozilla-certdata/share/certs/SecureSign_Root_CA12.pem: file removal
external/mpl/mozilla-certdata/share/certs/SecureSign_RootCA11.pem: file removal
external/mpl/mozilla-certdata/share/certs/Secure_Global_CA.pem: file removal
external/mpl/mozilla-certdata/share/certs/OISTE_Client_Root_RSA_G1.pem: revision 1.1
external/mpl/mozilla-certdata/share/server.trust: revision 1.4
external/mpl/mozilla-certdata/share/certs/XRamp_Global_CA_Root.pem: file removal
external/mpl/mozilla-certdata/share/certs/CommScope_Public_Trust_ECC_Root-02.pem: file removal
external/mpl/mozilla-certdata/share/certs/Baltimore_CyberTrust_Root.pem: file removal
external/mpl/mozilla-certdata/share/certs/Telia_EC_Email_Root_CA_v3.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/SwissSign_RSA_TLS_Root_CA_2022_-_1.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/SECOM_TLS_RSA_Root_CA_2024.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/Trustwave_Global_ECC_P384_Certification_Authority.pem: file removal
external/mpl/mozilla-certdata/share/certs/CommScope_Public_Trust_RSA_Root-02.pem: file removal
doc/3RDPARTY: revision 1.2267
external/mpl/mozilla-certdata/share/certs/emSign_ECC_Root_CA_-_G3.pem: file removal
external/mpl/mozilla-certdata/share/certs/emSign_ECC_Root_CA_-_C3.pem: file removal
external/mpl/mozilla-certdata/share/certs/SecureSign_Root_CA16.pem: revision 1.1
distrib/sets/lists/base/mi: revision 1.1393
external/mpl/mozilla-certdata/share/certs/AffirmTrust_Premium.pem: file removal
external/mpl/mozilla-certdata/share/certs/Explicitly_Distrust_DigiNotar_Root_CA.pem: file removal
external/mpl/mozilla-certdata/share/Makefile: revision 1.6
external/mpl/mozilla-certdata/share/certs/AffirmTrust_Networking.pem: file removal
external/mpl/mozilla-certdata/share/certs/emSign_Root_CA_-_C1.pem: file removal
external/mpl/mozilla-certdata/share/certs/SECOM_SMIME_RSA_Root_CA_2024.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/TrustAsia_SMIME_ECC_Root_CA.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/D-TRUST_EV_Root_CA_2_2023.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/D-TRUST_BR_Root_CA_2_2023.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/CommScope_Public_Trust_ECC_Root-01.pem: file removal
external/mpl/mozilla-certdata/share/certs/certSIGN_ROOT_CA.pem: file removal
mozilla-certdata: regen
mozilla-certdata: Update set lists.
PR security/60908: mozilla-certdata: update for compromised CA
mozilla-certdata: Update references in Makefile and doc/3RDPARTY.
PR security/60908: mozilla-certdata: update for compromised CA
To generate a diff of this commit:
cvs rdiff -u -r1.1367.2.2 -r1.1367.2.3 src/distrib/sets/lists/base/mi
cvs rdiff -u -r1.2126.2.17 -r1.2126.2.18 src/doc/3RDPARTY
cvs rdiff -u -r1.5 -r1.5.2.1 src/external/mpl/mozilla-certdata/share/Makefile
cvs rdiff -u -r1.3 -r1.3.2.1 \
src/external/mpl/mozilla-certdata/share/email.trust \
src/external/mpl/mozilla-certdata/share/server.trust
cvs rdiff -u -r1.1 -r0 \
src/external/mpl/mozilla-certdata/share/certs/AffirmTrust_Commercial.pem \
src/external/mpl/mozilla-certdata/share/certs/AffirmTrust_Networking.pem \
src/external/mpl/mozilla-certdata/share/certs/AffirmTrust_Premium.pem \
src/external/mpl/mozilla-certdata/share/certs/AffirmTrust_Premium_ECC.pem \
src/external/mpl/mozilla-certdata/share/certs/Baltimore_CyberTrust_Root.pem \
src/external/mpl/mozilla-certdata/share/certs/CommScope_Public_Trust_ECC_Root-01.pem \
src/external/mpl/mozilla-certdata/share/certs/CommScope_Public_Trust_ECC_Root-02.pem \
src/external/mpl/mozilla-certdata/share/certs/CommScope_Public_Trust_RSA_Root-01.pem \
src/external/mpl/mozilla-certdata/share/certs/CommScope_Public_Trust_RSA_Root-02.pem \
src/external/mpl/mozilla-certdata/share/certs/Entrust_Root_Certification_Authority.pem \
src/external/mpl/mozilla-certdata/share/certs/Explicitly_Distrust_DigiNotar_Root_CA.pem \
src/external/mpl/mozilla-certdata/share/certs/FIRMAPROFESIONAL_CA_ROOT-A_WEB.pem \
src/external/mpl/mozilla-certdata/share/certs/GLOBALTRUST_2020.pem \
src/external/mpl/mozilla-certdata/share/certs/SecureSign_RootCA11.pem \
src/external/mpl/mozilla-certdata/share/certs/SecureSign_Root_CA12.pem \
src/external/mpl/mozilla-certdata/share/certs/SecureTrust_CA.pem \
src/external/mpl/mozilla-certdata/share/certs/Secure_Global_CA.pem \
src/external/mpl/mozilla-certdata/share/certs/Security_Communication_RootCA3.pem \
src/external/mpl/mozilla-certdata/share/certs/SwissSign_Silver_CA_-_G2.pem \
src/external/mpl/mozilla-certdata/share/certs/TeliaSonera_Root_CA_v1.pem \
src/external/mpl/mozilla-certdata/share/certs/Trustwave_Global_Certification_Authority.pem \
src/external/mpl/mozilla-certdata/share/certs/Trustwave_Global_ECC_P256_Certification_Authority.pem \
src/external/mpl/mozilla-certdata/share/certs/Trustwave_Global_ECC_P384_Certification_Authority.pem \
src/external/mpl/mozilla-certdata/share/certs/XRamp_Global_CA_Root.pem \
src/external/mpl/mozilla-certdata/share/certs/certSIGN_ROOT_CA.pem \
src/external/mpl/mozilla-certdata/share/certs/ePKI_Root_Certification_Authority.pem \
src/external/mpl/mozilla-certdata/share/certs/emSign_ECC_Root_CA_-_C3.pem \
src/external/mpl/mozilla-certdata/share/certs/emSign_ECC_Root_CA_-_G3.pem \
src/external/mpl/mozilla-certdata/share/certs/emSign_Root_CA_-_C1.pem
cvs rdiff -u -r0 -r1.1.2.2 \
src/external/mpl/mozilla-certdata/share/certs/D-TRUST_BR_Root_CA_2_2023.pem \
src/external/mpl/mozilla-certdata/share/certs/D-TRUST_EV_Root_CA_2_2023.pem \
src/external/mpl/mozilla-certdata/share/certs/OISTE_Client_Root_ECC_G1.pem \
src/external/mpl/mozilla-certdata/share/certs/OISTE_Client_Root_RSA_G1.pem \
src/external/mpl/mozilla-certdata/share/certs/OISTE_Server_Root_ECC_G1.pem \
src/external/mpl/mozilla-certdata/share/certs/OISTE_Server_Root_RSA_G1.pem \
src/external/mpl/mozilla-certdata/share/certs/SECOM_SMIME_RSA_Root_CA_2024.pem \
src/external/mpl/mozilla-certdata/share/certs/SECOM_TLS_ECC_Root_CA_2024.pem \
src/external/mpl/mozilla-certdata/share/certs/SECOM_TLS_RSA_Root_CA_2024.pem \
src/external/mpl/mozilla-certdata/share/certs/SecureSign_Root_CA16.pem \
src/external/mpl/mozilla-certdata/share/certs/SwissSign_RSA_SMIME_Root_CA_2022_-_1.pem \
src/external/mpl/mozilla-certdata/share/certs/SwissSign_RSA_TLS_Root_CA_2022_-_1.pem \
src/external/mpl/mozilla-certdata/share/certs/Telia_EC_Email_Root_CA_v3.pem \
src/external/mpl/mozilla-certdata/share/certs/Telia_EC_TLS_Root_CA_v3.pem \
src/external/mpl/mozilla-certdata/share/certs/Telia_RSA_Email_Root_CA_v3.pem \
src/external/mpl/mozilla-certdata/share/certs/Telia_RSA_TLS_Root_CA_v3.pem \
src/external/mpl/mozilla-certdata/share/certs/TrustAsia_SMIME_ECC_Root_CA.pem \
src/external/mpl/mozilla-certdata/share/certs/TrustAsia_SMIME_RSA_Root_CA.pem \
src/external/mpl/mozilla-certdata/share/certs/TrustAsia_TLS_ECC_Root_CA.pem \
src/external/mpl/mozilla-certdata/share/certs/TrustAsia_TLS_RSA_Root_CA.pem \
src/external/mpl/mozilla-certdata/share/certs/e-Szigno_TLS_Root_CA_2023.pem
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/60908 CVS commit: [netbsd-10] src
Date: Tue, 20 Oct 2026 19:23:14 +0000
Module Name: src
Committed By: martin
Date: Tue Oct 20 19:23:13 UTC 2026
Modified Files:
src/distrib/sets/lists/base [netbsd-10]: mi
src/doc [netbsd-10]: 3RDPARTY
src/external/mpl/mozilla-certdata/share [netbsd-10]: Makefile
email.trust server.trust
Added Files:
src/external/mpl/mozilla-certdata/share/certs [netbsd-10]:
D-TRUST_BR_Root_CA_2_2023.pem D-TRUST_EV_Root_CA_2_2023.pem
OISTE_Client_Root_ECC_G1.pem OISTE_Client_Root_RSA_G1.pem
OISTE_Server_Root_ECC_G1.pem OISTE_Server_Root_RSA_G1.pem
SECOM_SMIME_RSA_Root_CA_2024.pem SECOM_TLS_ECC_Root_CA_2024.pem
SECOM_TLS_RSA_Root_CA_2024.pem SecureSign_Root_CA16.pem
SwissSign_RSA_SMIME_Root_CA_2022_-_1.pem
SwissSign_RSA_TLS_Root_CA_2022_-_1.pem
Telia_EC_Email_Root_CA_v3.pem Telia_EC_TLS_Root_CA_v3.pem
Telia_RSA_Email_Root_CA_v3.pem Telia_RSA_TLS_Root_CA_v3.pem
TrustAsia_SMIME_ECC_Root_CA.pem TrustAsia_SMIME_RSA_Root_CA.pem
TrustAsia_TLS_ECC_Root_CA.pem TrustAsia_TLS_RSA_Root_CA.pem
e-Szigno_TLS_Root_CA_2023.pem
Removed Files:
src/external/mpl/mozilla-certdata/share/certs [netbsd-10]:
AffirmTrust_Commercial.pem AffirmTrust_Networking.pem
AffirmTrust_Premium.pem AffirmTrust_Premium_ECC.pem
Baltimore_CyberTrust_Root.pem
CommScope_Public_Trust_ECC_Root-01.pem
CommScope_Public_Trust_ECC_Root-02.pem
CommScope_Public_Trust_RSA_Root-01.pem
CommScope_Public_Trust_RSA_Root-02.pem
Entrust_Root_Certification_Authority.pem
Explicitly_Distrust_DigiNotar_Root_CA.pem
FIRMAPROFESIONAL_CA_ROOT-A_WEB.pem GLOBALTRUST_2020.pem
SecureSign_RootCA11.pem SecureSign_Root_CA12.pem SecureTrust_CA.pem
Secure_Global_CA.pem Security_Communication_RootCA3.pem
SwissSign_Silver_CA_-_G2.pem TeliaSonera_Root_CA_v1.pem
Trustwave_Global_Certification_Authority.pem
Trustwave_Global_ECC_P256_Certification_Authority.pem
Trustwave_Global_ECC_P384_Certification_Authority.pem
XRamp_Global_CA_Root.pem certSIGN_ROOT_CA.pem
ePKI_Root_Certification_Authority.pem emSign_ECC_Root_CA_-_C3.pem
emSign_ECC_Root_CA_-_G3.pem emSign_Root_CA_-_C1.pem
Log Message:
Pull up following revision(s) (requested by riastradh in ticket #1383):
external/mpl/mozilla-certdata/share/certs/AffirmTrust_Commercial.pem: file removal
external/mpl/mozilla-certdata/share/certs/TrustAsia_TLS_ECC_Root_CA.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/OISTE_Server_Root_ECC_G1.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/Trustwave_Global_ECC_P256_Certification_Authority.pem: file removal
external/mpl/mozilla-certdata/share/certs/FIRMAPROFESIONAL_CA_ROOT-A_WEB.pem: file removal
external/mpl/mozilla-certdata/share/certs/TeliaSonera_Root_CA_v1.pem: file removal
external/mpl/mozilla-certdata/share/certs/SwissSign_RSA_SMIME_Root_CA_2022_-_1.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/Entrust_Root_Certification_Authority.pem: file removal
external/mpl/mozilla-certdata/share/certs/CommScope_Public_Trust_RSA_Root-01.pem: file removal
external/mpl/mozilla-certdata/share/certs/ePKI_Root_Certification_Authority.pem: file removal
external/mpl/mozilla-certdata/share/certs/Telia_RSA_TLS_Root_CA_v3.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/TrustAsia_SMIME_RSA_Root_CA.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/GLOBALTRUST_2020.pem: file removal
external/mpl/mozilla-certdata/share/certs/AffirmTrust_Premium_ECC.pem: file removal
external/mpl/mozilla-certdata/share/certs/SecureTrust_CA.pem: file removal
external/mpl/mozilla-certdata/share/certs/OISTE_Server_Root_RSA_G1.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/Trustwave_Global_Certification_Authority.pem: file removal
external/mpl/mozilla-certdata/share/certs/TrustAsia_TLS_RSA_Root_CA.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/e-Szigno_TLS_Root_CA_2023.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/Telia_EC_TLS_Root_CA_v3.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/Security_Communication_RootCA3.pem: file removal
external/mpl/mozilla-certdata/share/certs/SECOM_TLS_ECC_Root_CA_2024.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/OISTE_Client_Root_ECC_G1.pem: revision 1.1
external/mpl/mozilla-certdata/share/email.trust: revision 1.4
external/mpl/mozilla-certdata/share/certs/Telia_RSA_Email_Root_CA_v3.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/SwissSign_Silver_CA_-_G2.pem: file removal
external/mpl/mozilla-certdata/share/certs/SecureSign_Root_CA12.pem: file removal
external/mpl/mozilla-certdata/share/certs/SecureSign_RootCA11.pem: file removal
external/mpl/mozilla-certdata/share/certs/Secure_Global_CA.pem: file removal
external/mpl/mozilla-certdata/share/certs/OISTE_Client_Root_RSA_G1.pem: revision 1.1
external/mpl/mozilla-certdata/share/server.trust: revision 1.4
external/mpl/mozilla-certdata/share/certs/XRamp_Global_CA_Root.pem: file removal
external/mpl/mozilla-certdata/share/certs/CommScope_Public_Trust_ECC_Root-02.pem: file removal
external/mpl/mozilla-certdata/share/certs/Baltimore_CyberTrust_Root.pem: file removal
external/mpl/mozilla-certdata/share/certs/Telia_EC_Email_Root_CA_v3.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/SwissSign_RSA_TLS_Root_CA_2022_-_1.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/SECOM_TLS_RSA_Root_CA_2024.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/Trustwave_Global_ECC_P384_Certification_Authority.pem: file removal
external/mpl/mozilla-certdata/share/certs/CommScope_Public_Trust_RSA_Root-02.pem: file removal
doc/3RDPARTY: revision 1.2267
external/mpl/mozilla-certdata/share/certs/emSign_ECC_Root_CA_-_G3.pem: file removal
external/mpl/mozilla-certdata/share/certs/emSign_ECC_Root_CA_-_C3.pem: file removal
external/mpl/mozilla-certdata/share/certs/SecureSign_Root_CA16.pem: revision 1.1
distrib/sets/lists/base/mi: revision 1.1393
external/mpl/mozilla-certdata/share/certs/AffirmTrust_Premium.pem: file removal
external/mpl/mozilla-certdata/share/certs/Explicitly_Distrust_DigiNotar_Root_CA.pem: file removal
external/mpl/mozilla-certdata/share/Makefile: revision 1.6
external/mpl/mozilla-certdata/share/certs/AffirmTrust_Networking.pem: file removal
external/mpl/mozilla-certdata/share/certs/emSign_Root_CA_-_C1.pem: file removal
external/mpl/mozilla-certdata/share/certs/SECOM_SMIME_RSA_Root_CA_2024.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/TrustAsia_SMIME_ECC_Root_CA.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/D-TRUST_EV_Root_CA_2_2023.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/D-TRUST_BR_Root_CA_2_2023.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/CommScope_Public_Trust_ECC_Root-01.pem: file removal
external/mpl/mozilla-certdata/share/certs/certSIGN_ROOT_CA.pem: file removal
mozilla-certdata: regen
mozilla-certdata: Update set lists.
PR security/60908: mozilla-certdata: update for compromised CA
mozilla-certdata: Update references in Makefile and doc/3RDPARTY.
PR security/60908: mozilla-certdata: update for compromised CA
To generate a diff of this commit:
cvs rdiff -u -r1.1314.2.12 -r1.1314.2.13 src/distrib/sets/lists/base/mi
cvs rdiff -u -r1.1905.2.20 -r1.1905.2.21 src/doc/3RDPARTY
cvs rdiff -u -r1.2.2.4 -r1.2.2.5 \
src/external/mpl/mozilla-certdata/share/Makefile
cvs rdiff -u -r1.1.2.4 -r1.1.2.5 \
src/external/mpl/mozilla-certdata/share/email.trust \
src/external/mpl/mozilla-certdata/share/server.trust
cvs rdiff -u -r1.1.2.2 -r0 \
src/external/mpl/mozilla-certdata/share/certs/AffirmTrust_Commercial.pem \
src/external/mpl/mozilla-certdata/share/certs/AffirmTrust_Networking.pem \
src/external/mpl/mozilla-certdata/share/certs/AffirmTrust_Premium.pem \
src/external/mpl/mozilla-certdata/share/certs/AffirmTrust_Premium_ECC.pem \
src/external/mpl/mozilla-certdata/share/certs/Baltimore_CyberTrust_Root.pem \
src/external/mpl/mozilla-certdata/share/certs/Entrust_Root_Certification_Authority.pem \
src/external/mpl/mozilla-certdata/share/certs/Explicitly_Distrust_DigiNotar_Root_CA.pem \
src/external/mpl/mozilla-certdata/share/certs/FIRMAPROFESIONAL_CA_ROOT-A_WEB.pem \
src/external/mpl/mozilla-certdata/share/certs/GLOBALTRUST_2020.pem \
src/external/mpl/mozilla-certdata/share/certs/SecureSign_RootCA11.pem \
src/external/mpl/mozilla-certdata/share/certs/SecureSign_Root_CA12.pem \
src/external/mpl/mozilla-certdata/share/certs/SecureTrust_CA.pem \
src/external/mpl/mozilla-certdata/share/certs/Secure_Global_CA.pem \
src/external/mpl/mozilla-certdata/share/certs/Security_Communication_RootCA3.pem \
src/external/mpl/mozilla-certdata/share/certs/SwissSign_Silver_CA_-_G2.pem \
src/external/mpl/mozilla-certdata/share/certs/TeliaSonera_Root_CA_v1.pem \
src/external/mpl/mozilla-certdata/share/certs/Trustwave_Global_Certification_Authority.pem \
src/external/mpl/mozilla-certdata/share/certs/Trustwave_Global_ECC_P256_Certification_Authority.pem \
src/external/mpl/mozilla-certdata/share/certs/Trustwave_Global_ECC_P384_Certification_Authority.pem \
src/external/mpl/mozilla-certdata/share/certs/XRamp_Global_CA_Root.pem \
src/external/mpl/mozilla-certdata/share/certs/certSIGN_ROOT_CA.pem \
src/external/mpl/mozilla-certdata/share/certs/ePKI_Root_Certification_Authority.pem \
src/external/mpl/mozilla-certdata/share/certs/emSign_ECC_Root_CA_-_C3.pem \
src/external/mpl/mozilla-certdata/share/certs/emSign_ECC_Root_CA_-_G3.pem \
src/external/mpl/mozilla-certdata/share/certs/emSign_Root_CA_-_C1.pem
cvs rdiff -u -r1.1.4.2 -r0 \
src/external/mpl/mozilla-certdata/share/certs/CommScope_Public_Trust_ECC_Root-01.pem \
src/external/mpl/mozilla-certdata/share/certs/CommScope_Public_Trust_ECC_Root-02.pem \
src/external/mpl/mozilla-certdata/share/certs/CommScope_Public_Trust_RSA_Root-01.pem \
src/external/mpl/mozilla-certdata/share/certs/CommScope_Public_Trust_RSA_Root-02.pem
cvs rdiff -u -r0 -r1.1.4.2 \
src/external/mpl/mozilla-certdata/share/certs/D-TRUST_BR_Root_CA_2_2023.pem \
src/external/mpl/mozilla-certdata/share/certs/D-TRUST_EV_Root_CA_2_2023.pem \
src/external/mpl/mozilla-certdata/share/certs/OISTE_Client_Root_ECC_G1.pem \
src/external/mpl/mozilla-certdata/share/certs/OISTE_Client_Root_RSA_G1.pem \
src/external/mpl/mozilla-certdata/share/certs/OISTE_Server_Root_ECC_G1.pem \
src/external/mpl/mozilla-certdata/share/certs/OISTE_Server_Root_RSA_G1.pem \
src/external/mpl/mozilla-certdata/share/certs/SECOM_SMIME_RSA_Root_CA_2024.pem \
src/external/mpl/mozilla-certdata/share/certs/SECOM_TLS_ECC_Root_CA_2024.pem \
src/external/mpl/mozilla-certdata/share/certs/SECOM_TLS_RSA_Root_CA_2024.pem \
src/external/mpl/mozilla-certdata/share/certs/SecureSign_Root_CA16.pem \
src/external/mpl/mozilla-certdata/share/certs/SwissSign_RSA_SMIME_Root_CA_2022_-_1.pem \
src/external/mpl/mozilla-certdata/share/certs/SwissSign_RSA_TLS_Root_CA_2022_-_1.pem \
src/external/mpl/mozilla-certdata/share/certs/Telia_EC_Email_Root_CA_v3.pem \
src/external/mpl/mozilla-certdata/share/certs/Telia_EC_TLS_Root_CA_v3.pem \
src/external/mpl/mozilla-certdata/share/certs/Telia_RSA_Email_Root_CA_v3.pem \
src/external/mpl/mozilla-certdata/share/certs/Telia_RSA_TLS_Root_CA_v3.pem \
src/external/mpl/mozilla-certdata/share/certs/TrustAsia_SMIME_ECC_Root_CA.pem \
src/external/mpl/mozilla-certdata/share/certs/TrustAsia_SMIME_RSA_Root_CA.pem \
src/external/mpl/mozilla-certdata/share/certs/TrustAsia_TLS_ECC_Root_CA.pem \
src/external/mpl/mozilla-certdata/share/certs/TrustAsia_TLS_RSA_Root_CA.pem \
src/external/mpl/mozilla-certdata/share/certs/e-Szigno_TLS_Root_CA_2023.pem
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/60908 CVS commit: [netbsd-10] src/distrib/sets/lists/base
Date: Tue, 20 Oct 2026 19:31:41 +0000
Module Name: src
Committed By: martin
Date: Tue Oct 20 19:31:40 UTC 2026
Modified Files:
src/distrib/sets/lists/base [netbsd-10]: mi
Log Message:
Pull up following revision(s) (requested by riastradh in ticket #1383):
external/mpl/mozilla-certdata/share/certs/AffirmTrust_Commercial.pem: file removal
external/mpl/mozilla-certdata/share/certs/TrustAsia_TLS_ECC_Root_CA.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/OISTE_Server_Root_ECC_G1.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/Trustwave_Global_ECC_P256_Certification_Authority.pem: file removal
external/mpl/mozilla-certdata/share/certs/FIRMAPROFESIONAL_CA_ROOT-A_WEB.pem: file removal
external/mpl/mozilla-certdata/share/certs/TeliaSonera_Root_CA_v1.pem: file removal
external/mpl/mozilla-certdata/share/certs/SwissSign_RSA_SMIME_Root_CA_2022_-_1.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/Entrust_Root_Certification_Authority.pem: file removal
external/mpl/mozilla-certdata/share/certs/CommScope_Public_Trust_RSA_Root-01.pem: file removal
external/mpl/mozilla-certdata/share/certs/ePKI_Root_Certification_Authority.pem: file removal
external/mpl/mozilla-certdata/share/certs/Telia_RSA_TLS_Root_CA_v3.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/TrustAsia_SMIME_RSA_Root_CA.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/GLOBALTRUST_2020.pem: file removal
external/mpl/mozilla-certdata/share/certs/AffirmTrust_Premium_ECC.pem: file removal
external/mpl/mozilla-certdata/share/certs/SecureTrust_CA.pem: file removal
external/mpl/mozilla-certdata/share/certs/OISTE_Server_Root_RSA_G1.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/Trustwave_Global_Certification_Authority.pem: file removal
external/mpl/mozilla-certdata/share/certs/TrustAsia_TLS_RSA_Root_CA.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/e-Szigno_TLS_Root_CA_2023.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/Telia_EC_TLS_Root_CA_v3.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/Security_Communication_RootCA3.pem: file removal
external/mpl/mozilla-certdata/share/certs/SECOM_TLS_ECC_Root_CA_2024.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/OISTE_Client_Root_ECC_G1.pem: revision 1.1
external/mpl/mozilla-certdata/share/email.trust: revision 1.4
external/mpl/mozilla-certdata/share/certs/Telia_RSA_Email_Root_CA_v3.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/SwissSign_Silver_CA_-_G2.pem: file removal
external/mpl/mozilla-certdata/share/certs/SecureSign_Root_CA12.pem: file removal
external/mpl/mozilla-certdata/share/certs/SecureSign_RootCA11.pem: file removal
external/mpl/mozilla-certdata/share/certs/Secure_Global_CA.pem: file removal
external/mpl/mozilla-certdata/share/certs/OISTE_Client_Root_RSA_G1.pem: revision 1.1
external/mpl/mozilla-certdata/share/server.trust: revision 1.4
external/mpl/mozilla-certdata/share/certs/XRamp_Global_CA_Root.pem: file removal
external/mpl/mozilla-certdata/share/certs/CommScope_Public_Trust_ECC_Root-02.pem: file removal
external/mpl/mozilla-certdata/share/certs/Baltimore_CyberTrust_Root.pem: file removal
external/mpl/mozilla-certdata/share/certs/Telia_EC_Email_Root_CA_v3.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/SwissSign_RSA_TLS_Root_CA_2022_-_1.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/SECOM_TLS_RSA_Root_CA_2024.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/Trustwave_Global_ECC_P384_Certification_Authority.pem: file removal
external/mpl/mozilla-certdata/share/certs/CommScope_Public_Trust_RSA_Root-02.pem: file removal
doc/3RDPARTY: revision 1.2267 (patch)
external/mpl/mozilla-certdata/share/certs/emSign_ECC_Root_CA_-_G3.pem: file removal
external/mpl/mozilla-certdata/share/certs/emSign_ECC_Root_CA_-_C3.pem: file removal
external/mpl/mozilla-certdata/share/certs/SecureSign_Root_CA16.pem: revision 1.1
distrib/sets/lists/base/mi: revision 1.1393 (patch)
external/mpl/mozilla-certdata/share/certs/AffirmTrust_Premium.pem: file removal
external/mpl/mozilla-certdata/share/certs/Explicitly_Distrust_DigiNotar_Root_CA.pem: file removal
external/mpl/mozilla-certdata/share/Makefile: revision 1.6
external/mpl/mozilla-certdata/share/certs/AffirmTrust_Networking.pem: file removal
external/mpl/mozilla-certdata/share/certs/emSign_Root_CA_-_C1.pem: file removal
external/mpl/mozilla-certdata/share/certs/SECOM_SMIME_RSA_Root_CA_2024.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/TrustAsia_SMIME_ECC_Root_CA.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/D-TRUST_EV_Root_CA_2_2023.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/D-TRUST_BR_Root_CA_2_2023.pem: revision 1.1
external/mpl/mozilla-certdata/share/certs/CommScope_Public_Trust_ECC_Root-01.pem: file removal
external/mpl/mozilla-certdata/share/certs/certSIGN_ROOT_CA.pem: file removal
mozilla-certdata: regen
mozilla-certdata: Update set lists.
PR security/60908: mozilla-certdata: update for compromised CA
mozilla-certdata: Update references in Makefile and doc/3RDPARTY.
PR security/60908: mozilla-certdata: update for compromised CA
To generate a diff of this commit:
cvs rdiff -u -r1.1314.2.13 -r1.1314.2.14 src/distrib/sets/lists/base/mi
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Nia Alarie" <nia@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/60908 CVS commit: pkgsrc/security/ca-certificates
Date: Tue, 20 Oct 2026 22:55:53 +0000
Module Name: pkgsrc
Committed By: nia
Date: Tue Oct 20 22:55:53 UTC 2026
Modified Files:
pkgsrc/security/ca-certificates: Makefile distinfo
Added Files:
pkgsrc/security/ca-certificates/patches: patch-mozilla_certdata.txt
Log Message:
ca-certificates: Remove compromised certificates.
https://emudhra.we-have-a-problem.com/
PR security/60908
To generate a diff of this commit:
cvs rdiff -u -r1.18 -r1.19 pkgsrc/security/ca-certificates/Makefile
cvs rdiff -u -r1.15 -r1.16 pkgsrc/security/ca-certificates/distinfo
cvs rdiff -u -r0 -r1.1 \
pkgsrc/security/ca-certificates/patches/patch-mozilla_certdata.txt
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Nia Alarie" <nia@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/60908 CVS commit: pkgsrc/security/mozilla-rootcerts
Date: Tue, 20 Oct 2026 22:59:05 +0000
Module Name: pkgsrc
Committed By: nia
Date: Tue Oct 20 22:59:05 UTC 2026
Modified Files:
pkgsrc/security/mozilla-rootcerts: Makefile distinfo
pkgsrc/security/mozilla-rootcerts/patches: patch-certdata.txt
Log Message:
mozilla-rootcerts: Second part of "remove compromised CAs"
PR security/60908
To generate a diff of this commit:
cvs rdiff -u -r1.67 -r1.68 pkgsrc/security/mozilla-rootcerts/Makefile
cvs rdiff -u -r1.44 -r1.45 pkgsrc/security/mozilla-rootcerts/distinfo
cvs rdiff -u -r1.5 -r1.6 \
pkgsrc/security/mozilla-rootcerts/patches/patch-certdata.txt
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/60908 CVS commit: src/distrib/sets/lists/base
Date: Wed, 21 Oct 2026 00:28:51 +0000
Module Name: src
Committed By: riastradh
Date: Wed Oct 21 00:28:51 UTC 2026
Modified Files:
src/distrib/sets/lists/base: mi
Log Message:
mozilla-certdata: Mark two nixed certs as obsolete.
Missed a spot, must not have had a clean destdir somehow.
PR security/60908: mozilla-certdata: update for compromised CA
To generate a diff of this commit:
cvs rdiff -u -r1.1393 -r1.1394 src/distrib/sets/lists/base/mi
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Maya Rashish" <maya@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/60908 CVS commit: [pkgsrc-2026Q3] pkgsrc/security/ca-certificates
Date: Wed, 21 Oct 2026 01:45:22 +0000
Module Name: pkgsrc
Committed By: maya
Date: Wed Oct 21 01:45:22 UTC 2026
Modified Files:
pkgsrc/security/ca-certificates [pkgsrc-2026Q3]: Makefile distinfo
Added Files:
pkgsrc/security/ca-certificates/patches [pkgsrc-2026Q3]:
patch-mozilla_certdata.txt
Log Message:
Pullup ticket #7300 - requested by nia
security/ca-certificates: Security fix
Revisions pulled up:
- security/ca-certificates/Makefile 1.19
- security/ca-certificates/distinfo 1.16
- security/ca-certificates/patches/patch-mozilla_certdata.txt 1.1
---
Module Name: pkgsrc
Committed By: nia
Date: Tue Oct 20 22:55:53 UTC 2026
Modified Files:
pkgsrc/security/ca-certificates: Makefile distinfo
Added Files:
pkgsrc/security/ca-certificates/patches: patch-mozilla_certdata.txt
Log Message:
ca-certificates: Remove compromised certificates.
https://emudhra.we-have-a-problem.com/
PR security/60908
To generate a diff of this commit:
cvs rdiff -u -r1.18 -r1.18.2.1 pkgsrc/security/ca-certificates/Makefile
cvs rdiff -u -r1.15 -r1.15.2.1 pkgsrc/security/ca-certificates/distinfo
cvs rdiff -u -r0 -r1.1.2.2 \
pkgsrc/security/ca-certificates/patches/patch-mozilla_certdata.txt
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Maya Rashish" <maya@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/60908 CVS commit: [pkgsrc-2026Q3] pkgsrc/security/ca-certificates
Date: Wed, 21 Oct 2026 01:45:44 +0000
Module Name: pkgsrc
Committed By: maya
Date: Wed Oct 21 01:45:44 UTC 2026
Modified Files:
pkgsrc/security/ca-certificates [pkgsrc-2026Q3]: PLIST
Log Message:
Pullup ticket #7300 - requested by nia
security/ca-certificates: Security fix
Revisions pulled up:
- security/ca-certificates/Makefile 1.19
- security/ca-certificates/distinfo 1.16
- security/ca-certificates/patches/patch-mozilla_certdata.txt 1.1
---
Module Name: pkgsrc
Committed By: nia
Date: Tue Oct 20 22:55:53 UTC 2026
Modified Files:
pkgsrc/security/ca-certificates: Makefile distinfo
Added Files:
pkgsrc/security/ca-certificates/patches: patch-mozilla_certdata.txt
Log Message:
ca-certificates: Remove compromised certificates.
https://emudhra.we-have-a-problem.com/
PR security/60908
To generate a diff of this commit:
cvs rdiff -u -r1.10 -r1.10.2.1 pkgsrc/security/ca-certificates/PLIST
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Maya Rashish" <maya@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/60908 CVS commit: [pkgsrc-2026Q3] pkgsrc/security
Date: Wed, 21 Oct 2026 01:50:12 +0000
Module Name: pkgsrc
Committed By: maya
Date: Wed Oct 21 01:50:12 UTC 2026
Modified Files:
pkgsrc/security/mozilla-rootcerts [pkgsrc-2026Q3]: Makefile distinfo
pkgsrc/security/mozilla-rootcerts-openssl [pkgsrc-2026Q3]: Makefile
PLIST
pkgsrc/security/mozilla-rootcerts/patches [pkgsrc-2026Q3]:
patch-certdata.txt
Log Message:
Pullup tickets #7301, #7302 - requested by nia
security/mozilla-rootcerts-openssl: Security fix
security/mozilla-rootcerts: Security fix
Revisions pulled up:
- security/mozilla-rootcerts-openssl/Makefile 1.42
- security/mozilla-rootcerts-openssl/PLIST 1.34
- security/mozilla-rootcerts/Makefile 1.68
- security/mozilla-rootcerts/distinfo 1.45
- security/mozilla-rootcerts/patches/patch-certdata.txt 1.6
---
Module Name: pkgsrc
Committed By: nia
Date: Tue Oct 20 22:59:05 UTC 2026
Modified Files:
pkgsrc/security/mozilla-rootcerts: Makefile distinfo
pkgsrc/security/mozilla-rootcerts/patches: patch-certdata.txt
Log Message:
mozilla-rootcerts: Second part of "remove compromised CAs"
PR security/60908
---
Module Name: pkgsrc
Committed By: nia
Date: Tue Oct 20 22:59:33 UTC 2026
Modified Files:
pkgsrc/security/mozilla-rootcerts-openssl: Makefile PLIST
Log Message:
mozilla-rootcerts-openssl: Update for mozilla-rootcerts changes
To generate a diff of this commit:
cvs rdiff -u -r1.65.2.1 -r1.65.2.2 pkgsrc/security/mozilla-rootcerts/Makefile
cvs rdiff -u -r1.42.2.1 -r1.42.2.2 pkgsrc/security/mozilla-rootcerts/distinfo
cvs rdiff -u -r1.39.2.1 -r1.39.2.2 \
pkgsrc/security/mozilla-rootcerts-openssl/Makefile
cvs rdiff -u -r1.32.2.1 -r1.32.2.2 \
pkgsrc/security/mozilla-rootcerts-openssl/PLIST
cvs rdiff -u -r1.5.2.2 -r1.5.2.3 \
pkgsrc/security/mozilla-rootcerts/patches/patch-certdata.txt
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: Taylor R Campbell <riastradh@NetBSD.org>
To: gnats-bugs@NetBSD.org, netbsd-bugs@NetBSD.org
Cc:
Subject: Re: security/60908: mozilla-certdata: update for compromised CA
Date: Wed, 21 Oct 2026 04:03:01 +0000
> Date: Tue, 20 Oct 2026 14:58:37 +0000
> From: Taylor R Campbell <riastradh@NetBSD.org>
>
> Workaround:
>
> certctl untrust /usr/share/certs/mozilla/all/emSign_ECC_Root_CA_-_C3.pem
> certctl untrust /usr/share/certs/mozilla/all/emSign_ECC_Root_CA_-_G3
> certctl untrust /usr/share/certs/mozilla/all/emSign_Root_CA_-_C1.pem
>
> (Not sure all of these were compromised but they were all removed from
> certdata.txt.)
Corrected workaround:
certctl untrust /usr/share/certs/mozilla/all/Comodo_AAA_Services_root.pem
certctl untrust /usr/share/certs/mozilla/all/emSign_ECC_Root_CA_-_G3.pem
Various tests for whether it worked are posted at:
https://emudhra.we-have-a-problem.com/
For example, you can try:
ftp -V -o /dev/null https://dv-g3b-emudhra.we-have-a-problem.com/
ftp -V -o /dev/null https://dv-g3b-aaa-emudhra.we-have-a-problem.com/
If either one quietly succeds, you are in trouble.
From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/60908 CVS commit: [netbsd-11] src/distrib/sets/lists/base
Date: Wed, 21 Oct 2026 04:56:41 +0000
Module Name: src
Committed By: martin
Date: Wed Oct 21 04:56:40 UTC 2026
Modified Files:
src/distrib/sets/lists/base [netbsd-11]: mi
Log Message:
Pull up following revision(s) (requested by riastradh in ticket #537):
distrib/sets/lists/base/mi: revision 1.1394
mozilla-certdata: Mark two nixed certs as obsolete.
Missed a spot, must not have had a clean destdir somehow.
PR security/60908: mozilla-certdata: update for compromised CA
To generate a diff of this commit:
cvs rdiff -u -r1.1367.2.3 -r1.1367.2.4 src/distrib/sets/lists/base/mi
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Nia Alarie" <nia@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/60908 CVS commit: pkgsrc/www
Date: Wed, 21 Oct 2026 22:02:37 +0000
Module Name: pkgsrc
Committed By: nia
Date: Wed Oct 21 22:02:37 UTC 2026
Modified Files:
pkgsrc/www/palemoon: Makefile distinfo
pkgsrc/www/palemoon-gtk3: Makefile
Added Files:
pkgsrc/www/palemoon/patches:
patch-platform_security_nss_lib_ckfw_builtins_certdata.txt
Log Message:
palemoon: Update CA store to fix PR security/60908
To generate a diff of this commit:
cvs rdiff -u -r1.56 -r1.57 pkgsrc/www/palemoon/Makefile
cvs rdiff -u -r1.49 -r1.50 pkgsrc/www/palemoon/distinfo
cvs rdiff -u -r1.10 -r1.11 pkgsrc/www/palemoon-gtk3/Makefile
cvs rdiff -u -r0 -r1.1 \
pkgsrc/www/palemoon/patches/patch-platform_security_nss_lib_ckfw_builtins_certdata.txt
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Nia Alarie" <nia@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/60908 CVS commit: pkgsrc/www/basilisk
Date: Wed, 21 Oct 2026 23:15:43 +0000
Module Name: pkgsrc
Committed By: nia
Date: Wed Oct 21 23:15:43 UTC 2026
Modified Files:
pkgsrc/www/basilisk: Makefile distinfo
Added Files:
pkgsrc/www/basilisk/patches:
patch-platform_security_nss_lib_ckfw_builtins_certdata.txt
Log Message:
basilisk: Remove compromised CAs from the built-in cert store.
PR security/60908
To generate a diff of this commit:
cvs rdiff -u -r1.13 -r1.14 pkgsrc/www/basilisk/Makefile
cvs rdiff -u -r1.6 -r1.7 pkgsrc/www/basilisk/distinfo
cvs rdiff -u -r0 -r1.1 \
pkgsrc/www/basilisk/patches/patch-platform_security_nss_lib_ckfw_builtins_certdata.txt
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Benny Siegert" <bsiegert@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/60908 CVS commit: [pkgsrc-2026Q3] pkgsrc/www/basilisk
Date: Sat, 24 Oct 2026 12:40:03 +0000
Module Name: pkgsrc
Committed By: bsiegert
Date: Sat Oct 24 12:40:03 UTC 2026
Modified Files:
pkgsrc/www/basilisk [pkgsrc-2026Q3]: Makefile distinfo
Added Files:
pkgsrc/www/basilisk/patches [pkgsrc-2026Q3]:
patch-platform_security_nss_lib_ckfw_builtins_certdata.txt
Log Message:
Pullup ticket #7316 - requested by nia
www/basilisk: security fix (compromised certificates)
Revisions pulled up:
- www/basilisk/Makefile 1.14
- www/basilisk/distinfo 1.7
- www/basilisk/patches/patch-platform_security_nss_lib_ckfw_builtins_certdata.txt 1.1
---
Module Name: pkgsrc
Committed By: nia
Date: Wed Oct 21 23:15:43 UTC 2026
Modified Files:
pkgsrc/www/basilisk: Makefile distinfo
Added Files:
pkgsrc/www/basilisk/patches:
patch-platform_security_nss_lib_ckfw_builtins_certdata.txt
Log Message:
basilisk: Remove compromised CAs from the built-in cert store.
PR security/60908
To generate a diff of this commit:
cvs rdiff -u -r1.11 -r1.11.2.1 pkgsrc/www/basilisk/Makefile
cvs rdiff -u -r1.6 -r1.6.2.1 pkgsrc/www/basilisk/distinfo
cvs rdiff -u -r0 -r1.1.2.2 \
pkgsrc/www/basilisk/patches/patch-platform_security_nss_lib_ckfw_builtins_certdata.txt
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Benny Siegert" <bsiegert@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/60908 CVS commit: [pkgsrc-2026Q3] pkgsrc/www
Date: Sat, 24 Oct 2026 12:40:10 +0000
Module Name: pkgsrc
Committed By: bsiegert
Date: Sat Oct 24 12:40:10 UTC 2026
Modified Files:
pkgsrc/www/palemoon [pkgsrc-2026Q3]: Makefile distinfo
pkgsrc/www/palemoon-gtk3 [pkgsrc-2026Q3]: Makefile
Added Files:
pkgsrc/www/palemoon/patches [pkgsrc-2026Q3]:
patch-platform_security_nss_lib_ckfw_builtins_certdata.txt
Log Message:
Pullup ticket #7318 - requested by nia
www/palemoon: security fix (compromised certificates)
Revisions pulled up:
- www/palemoon-gtk3/Makefile 1.11
- www/palemoon/Makefile 1.57
- www/palemoon/distinfo 1.50
- www/palemoon/patches/patch-platform_security_nss_lib_ckfw_builtins_certdata.txt 1.1
---
Module Name: pkgsrc
Committed By: nia
Date: Wed Oct 21 22:02:37 UTC 2026
Modified Files:
pkgsrc/www/palemoon: Makefile distinfo
pkgsrc/www/palemoon-gtk3: Makefile
Added Files:
pkgsrc/www/palemoon/patches:
patch-platform_security_nss_lib_ckfw_builtins_certdata.txt
Log Message:
palemoon: Update CA store to fix PR security/60908
To generate a diff of this commit:
cvs rdiff -u -r1.52.2.1 -r1.52.2.2 pkgsrc/www/palemoon/Makefile
cvs rdiff -u -r1.47.2.2 -r1.47.2.3 pkgsrc/www/palemoon/distinfo
cvs rdiff -u -r1.6.2.1 -r1.6.2.2 pkgsrc/www/palemoon-gtk3/Makefile
cvs rdiff -u -r0 -r1.1.2.2 \
pkgsrc/www/palemoon/patches/patch-platform_security_nss_lib_ckfw_builtins_certdata.txt
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
>Unformatted:
(Contact us)
$NetBSD: query-full-pr,v 1.51 2026/08/10 02:28:17 riastradh Exp $
$NetBSD: gnats_config.sh,v 1.10 2026/05/13 22:00:09 riastradh Exp $
Copyright © 1994-2026
The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.
Home