From patchwork Wed Oct 28 04:23:43 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 102211 Received: from mail-pj1-f53.google.com (mail-pj1-f53.google.com [209.85.216.53]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.36220.1793161554275811640 for ; Tue, 27 Oct 2026 21:25:54 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=r6I+4jIT; spf=pass (domain: gmail.com, ip: 209.85.216.53, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f53.google.com with SMTP id 98e67ed59e1d1-3ada4c06b7bso276096a91.2 for ; Tue, 27 Oct 2026 21:25:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793161554; x=1793766354; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=UqSGTezzHaB4K9hmZYs2S2Oiyhp2sG3wRr4/8e2l45M=; b=r6I+4jITgEyNDsVM7ISL5X9goQpsXIuXwV4l1oBV/CJ/hcf362p0A5EwqfiIxtjICj 47o99VEV4sH/dmvQAy8wpxT6h2TmWWcqHhAD9JIl/7lOmVeTn3ROEHCFMIRAd3Z8vSgp 6TAJ9jZCbsxKozUj3VVWzAA7zv7VT98YuAVcXWFYBMLzzRsno+FCh0AgR5z1HPwnbZ8R Y7gvkxdAsuSzODZM/I/nZmc+AUABUdIKk97x1MkTGljqLC17vJGxz4e3I1GeninlE8LJ XONj09WA+gP/De7wlxMx4VJK//nqaVZHLtmYSzukw3FejfP4KiGOQvC9dnoesGs9cGBG JB7A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793161554; x=1793766354; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=UqSGTezzHaB4K9hmZYs2S2Oiyhp2sG3wRr4/8e2l45M=; b=QP394b/Sbks56i8Vt8FA+EURM/JdGGX0WXwBS5ohEUELWTmzWJm5zcySQDM6g/pmI3 UeiUQHzGvPb8KRIQokJt/M5+d+ncwtbWOIzpUTKWriied8ueoUHDnPEFgLqKsH64t0fV joGwqgLOt9BpvKtzs0EfkO1RrOQ5X4ik9hPjfrB2AlytMhBuV5ZiLi/6CWUnPDp5IyMo 5eheip+Ei1cCs2iNzgc0sqqBXaKUL6DzQiZYRA26DYn7JtUQXLtQcklWHrz4QOTkBUIF WD+2OwnpK7LvgOoZEzgh7zridxQ4Baq+XnKZIhSHPcWOZaPPApP/tW2K78/xa42sViwv 49ug== X-Gm-Message-State: AFq9FYInvu0padVT1vqqAC1wxjispb3XxVpqYV32Yua4Vf209p/Z4nvE uFP/OaVloaeuNFW5WnskATsAidI9KV8d7qgr44x6bszuNE8Uc6OFEEHGpi/PIg== X-Gm-Gg: AYBFou3vVHJpLNDy4CZLHEic9pVtD1QDBNhqkWE3ZKK1q9h8k7u/lDg32u2cR4gDcMj 2gPXnsQKDQxGTHMuEg3cq4Pm/BVxKl36khcZjfaSAX9GfMkPyc+VE3r4hAdQvapP9i5+L+iB+cu 8sjAjjEtfxa8RaLt9ReUUg0JR3fgNhe688xSulApHKvJxiyjfccLB3KGBdXIFgPnu1SQIwbU01R 8/0OiAS+sdwzfU2stuPlNLHM4S4gCbf7xfuco5G5Z/YhjmUFA/rpe3g4Apb4e7j136QupoxVmpr CxKmaVL7ElNHdUETrQfCZ2t7OIqJ12TsGl8hxPT/KNE2trNhb52Iq13ie2DIAvXKs1o1u+VBNot iR3JyYO00OSe153E5Xhk2uP9NHzUO9jqWiEeo+8CuPWiQN0qwJONjntc6q8LKnjb6Z38q/CbMbe i4QMIPT6u01gfTVET/Y9yP8d2GEo70Rvbuzv46AYVLoqbAsYYsaLgfQ/pKC+oaszWnDgDhrw2cs zY7YjAiHpir4pF4Tke85lltLGEYSQngxnyWgc37SOfGR2jKmTZPl/r4eFDKmN7qQPMKpBP0Xltu tB3lz240Mdx41kCuwpRXOlXXvkXekit5+6CEaH8xDVUzD5Y6b3QkF8eQxxRVkg== X-Received: by 2002:a17:90b:28c7:b0:3ab:17b6:9a93 with SMTP id 98e67ed59e1d1-3ae58140220mr883218a91.52.1793161553239; Tue, 27 Oct 2026 21:25:53 -0700 (PDT) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ae5a48c2d3sm1010794a91.5.2026.10.27.21.25.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 27 Oct 2026 21:25:52 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Peter Marko Subject: [blacksail][PATCH 45/60] nss: remove compromised eMudhra certificates Date: Wed, 28 Oct 2026 17:23:43 +1300 Message-ID: <8a760baf572661b5a26ac674a25d5a3544cf791e.1793161233.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 28 Oct 2026 04:25:57 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131597 From: Peter Marko See https://emudhra.we-have-a-problem.com/ Signed-off-by: Peter Marko --- ...ve-eMudhra-emSign-Root-CA-C1-and-emS.patch | 272 ++++++++++++++++++ ...ve-eMudhra-emSign-Root-CA-G3-from-NS.patch | 143 +++++++++ meta-oe/recipes-support/nss/nss_3.126.bb | 2 + 3 files changed, 417 insertions(+) create mode 100644 meta-oe/recipes-support/nss/nss/0008-Bug-2083709-Remove-eMudhra-emSign-Root-CA-C1-and-emS.patch create mode 100644 meta-oe/recipes-support/nss/nss/0009-Bug-2084101-Remove-eMudhra-emSign-Root-CA-G3-from-NS.patch diff --git a/meta-oe/recipes-support/nss/nss/0008-Bug-2083709-Remove-eMudhra-emSign-Root-CA-C1-and-emS.patch b/meta-oe/recipes-support/nss/nss/0008-Bug-2083709-Remove-eMudhra-emSign-Root-CA-C1-and-emS.patch new file mode 100644 index 0000000000..f153eccb86 --- /dev/null +++ b/meta-oe/recipes-support/nss/nss/0008-Bug-2083709-Remove-eMudhra-emSign-Root-CA-C1-and-emS.patch @@ -0,0 +1,272 @@ +From 15734105a44679969114534ac5ceaf08e9630dd3 Mon Sep 17 00:00:00 2001 +From: Anna +Date: Tue, 20 Oct 2026 09:03:59 +0000 +Subject: [PATCH] Bug 2083709 - Remove eMudhra emSign Root CA - C1 and emSign + ECC Root CA - C3 from NSS + +Differential Revision: https://phabricator.services.mozilla.com/D335517 + +Upstream-Status: Backport [https://github.com/mozilla/nss/commit/15734105a44679969114534ac5ceaf08e9630dd3] +Signed-off-by: Peter Marko +--- + nss/lib/ckfw/builtins/certdata.txt | 247 ----------------------------- + 1 file changed, 247 deletions(-) + +diff --git a/nss/lib/ckfw/builtins/certdata.txt b/nss/lib/ckfw/builtins/certdata.txt +index 0a451693c..05172ca23 100644 +--- a/nss/lib/ckfw/builtins/certdata.txt ++++ b/nss/lib/ckfw/builtins/certdata.txt +@@ -12221,253 +12221,6 @@ CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR + CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST + CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE + +-# +-# Certificate "emSign Root CA - C1" +-# +-# Issuer: CN=emSign Root CA - C1,O=eMudhra Inc,OU=emSign PKI,C=US +-# Serial Number:00:ae:cf:00:ba:c4:cf:32:f8:43:b2 +-# Subject: CN=emSign Root CA - C1,O=eMudhra Inc,OU=emSign PKI,C=US +-# Not Valid Before: Sun Feb 18 18:30:00 2018 +-# Not Valid After : Wed Feb 18 18:30:00 2043 +-# Fingerprint (SHA-256): 12:56:09:AA:30:1D:A0:A2:49:B9:7A:82:39:CB:6A:34:21:6F:44:DC:AC:9F:39:54:B1:42:92:F2:E8:C8:60:8F +-# Fingerprint (SHA1): E7:2E:F1:DF:FC:B2:09:28:CF:5D:D4:D5:67:37:B1:51:CB:86:4F:01 +-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE +-CKA_TOKEN CK_BBOOL CK_TRUE +-CKA_PRIVATE CK_BBOOL CK_FALSE +-CKA_MODIFIABLE CK_BBOOL CK_FALSE +-CKA_LABEL UTF8 "emSign Root CA - C1" +-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509 +-CKA_SUBJECT MULTILINE_OCTAL +-\060\126\061\013\060\011\006\003\125\004\006\023\002\125\123\061 +-\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147\156 +-\040\120\113\111\061\024\060\022\006\003\125\004\012\023\013\145 +-\115\165\144\150\162\141\040\111\156\143\061\034\060\032\006\003 +-\125\004\003\023\023\145\155\123\151\147\156\040\122\157\157\164 +-\040\103\101\040\055\040\103\061 +-END +-CKA_ID UTF8 "0" +-CKA_ISSUER MULTILINE_OCTAL +-\060\126\061\013\060\011\006\003\125\004\006\023\002\125\123\061 +-\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147\156 +-\040\120\113\111\061\024\060\022\006\003\125\004\012\023\013\145 +-\115\165\144\150\162\141\040\111\156\143\061\034\060\032\006\003 +-\125\004\003\023\023\145\155\123\151\147\156\040\122\157\157\164 +-\040\103\101\040\055\040\103\061 +-END +-CKA_SERIAL_NUMBER MULTILINE_OCTAL +-\002\013\000\256\317\000\272\304\317\062\370\103\262 +-END +-CKA_VALUE MULTILINE_OCTAL +-\060\202\003\163\060\202\002\133\240\003\002\001\002\002\013\000 +-\256\317\000\272\304\317\062\370\103\262\060\015\006\011\052\206 +-\110\206\367\015\001\001\013\005\000\060\126\061\013\060\011\006 +-\003\125\004\006\023\002\125\123\061\023\060\021\006\003\125\004 +-\013\023\012\145\155\123\151\147\156\040\120\113\111\061\024\060 +-\022\006\003\125\004\012\023\013\145\115\165\144\150\162\141\040 +-\111\156\143\061\034\060\032\006\003\125\004\003\023\023\145\155 +-\123\151\147\156\040\122\157\157\164\040\103\101\040\055\040\103 +-\061\060\036\027\015\061\070\060\062\061\070\061\070\063\060\060 +-\060\132\027\015\064\063\060\062\061\070\061\070\063\060\060\060 +-\132\060\126\061\013\060\011\006\003\125\004\006\023\002\125\123 +-\061\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147 +-\156\040\120\113\111\061\024\060\022\006\003\125\004\012\023\013 +-\145\115\165\144\150\162\141\040\111\156\143\061\034\060\032\006 +-\003\125\004\003\023\023\145\155\123\151\147\156\040\122\157\157 +-\164\040\103\101\040\055\040\103\061\060\202\001\042\060\015\006 +-\011\052\206\110\206\367\015\001\001\001\005\000\003\202\001\017 +-\000\060\202\001\012\002\202\001\001\000\317\353\251\271\361\231 +-\005\314\330\050\041\112\363\163\064\121\204\126\020\365\240\117 +-\054\022\343\372\023\232\047\320\317\371\171\032\164\137\035\171 +-\071\374\133\370\160\216\340\222\122\367\344\045\371\124\203\331 +-\035\323\310\132\205\077\136\307\266\007\356\076\300\316\232\257 +-\254\126\102\052\071\045\160\326\277\265\173\066\255\254\366\163 +-\334\315\327\035\212\203\245\373\053\220\025\067\153\034\046\107 +-\334\073\051\126\223\152\263\301\152\072\235\075\365\301\227\070 +-\130\005\213\034\021\343\344\264\270\135\205\035\203\376\170\137 +-\013\105\150\030\110\245\106\163\064\073\376\017\310\166\273\307 +-\030\363\005\321\206\363\205\355\347\271\331\062\255\125\210\316 +-\246\266\221\260\117\254\176\025\043\226\366\077\360\040\064\026 +-\336\012\306\304\004\105\171\177\247\375\276\322\251\245\257\234 +-\305\043\052\367\074\041\154\275\257\217\116\305\072\262\363\064 +-\022\374\337\200\032\111\244\324\251\225\367\236\211\136\242\211 +-\254\224\313\250\150\233\257\212\145\047\315\211\356\335\214\265 +-\153\051\160\103\240\151\013\344\271\017\002\003\001\000\001\243 +-\102\060\100\060\035\006\003\125\035\016\004\026\004\024\376\241 +-\340\160\036\052\003\071\122\132\102\276\134\221\205\172\030\252 +-\115\265\060\016\006\003\125\035\017\001\001\377\004\004\003\002 +-\001\006\060\017\006\003\125\035\023\001\001\377\004\005\060\003 +-\001\001\377\060\015\006\011\052\206\110\206\367\015\001\001\013 +-\005\000\003\202\001\001\000\302\112\126\372\025\041\173\050\242 +-\351\345\035\373\370\055\304\071\226\101\114\073\047\054\304\154 +-\030\025\200\306\254\257\107\131\057\046\013\343\066\260\357\073 +-\376\103\227\111\062\231\022\025\133\337\021\051\377\253\123\370 +-\273\301\170\017\254\234\123\257\127\275\150\214\075\151\063\360 +-\243\240\043\143\073\144\147\042\104\255\325\161\313\126\052\170 +-\222\243\117\022\061\066\066\342\336\376\000\304\243\140\017\047 +-\255\240\260\212\265\066\172\122\241\275\047\364\040\047\142\350 +-\115\224\044\023\344\012\004\351\074\253\056\310\103\011\112\306 +-\141\004\345\111\064\176\323\304\310\365\017\300\252\351\272\124 +-\136\363\143\053\117\117\120\324\376\271\173\231\214\075\300\056 +-\274\002\053\323\304\100\344\212\007\061\036\233\316\046\231\023 +-\373\021\352\232\042\014\021\031\307\136\033\201\120\060\310\226 +-\022\156\347\313\101\177\221\073\242\107\267\124\200\033\334\000 +-\314\232\220\352\303\303\120\006\142\014\060\300\025\110\247\250 +-\131\174\341\256\042\242\342\012\172\017\372\142\253\122\114\341 +-\361\337\312\276\203\015\102 +-END +-CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE +-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE +-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE +- +-# Trust for "emSign Root CA - C1" +-# Issuer: CN=emSign Root CA - C1,O=eMudhra Inc,OU=emSign PKI,C=US +-# Serial Number:00:ae:cf:00:ba:c4:cf:32:f8:43:b2 +-# Subject: CN=emSign Root CA - C1,O=eMudhra Inc,OU=emSign PKI,C=US +-# Not Valid Before: Sun Feb 18 18:30:00 2018 +-# Not Valid After : Wed Feb 18 18:30:00 2043 +-# Fingerprint (SHA-256): 12:56:09:AA:30:1D:A0:A2:49:B9:7A:82:39:CB:6A:34:21:6F:44:DC:AC:9F:39:54:B1:42:92:F2:E8:C8:60:8F +-# Fingerprint (SHA1): E7:2E:F1:DF:FC:B2:09:28:CF:5D:D4:D5:67:37:B1:51:CB:86:4F:01 +-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST +-CKA_TOKEN CK_BBOOL CK_TRUE +-CKA_PRIVATE CK_BBOOL CK_FALSE +-CKA_MODIFIABLE CK_BBOOL CK_FALSE +-CKA_LABEL UTF8 "emSign Root CA - C1" +-CKA_CERT_SHA1_HASH MULTILINE_OCTAL +-\347\056\361\337\374\262\011\050\317\135\324\325\147\067\261\121 +-\313\206\117\001 +-END +-CKA_CERT_MD5_HASH MULTILINE_OCTAL +-\330\343\135\001\041\372\170\132\260\337\272\322\356\052\137\150 +-END +-CKA_ISSUER MULTILINE_OCTAL +-\060\126\061\013\060\011\006\003\125\004\006\023\002\125\123\061 +-\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147\156 +-\040\120\113\111\061\024\060\022\006\003\125\004\012\023\013\145 +-\115\165\144\150\162\141\040\111\156\143\061\034\060\032\006\003 +-\125\004\003\023\023\145\155\123\151\147\156\040\122\157\157\164 +-\040\103\101\040\055\040\103\061 +-END +-CKA_SERIAL_NUMBER MULTILINE_OCTAL +-\002\013\000\256\317\000\272\304\317\062\370\103\262 +-END +-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR +-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR +-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST +-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE +- +-# +-# Certificate "emSign ECC Root CA - C3" +-# +-# Issuer: CN=emSign ECC Root CA - C3,O=eMudhra Inc,OU=emSign PKI,C=US +-# Serial Number:7b:71:b6:82:56:b8:12:7c:9c:a8 +-# Subject: CN=emSign ECC Root CA - C3,O=eMudhra Inc,OU=emSign PKI,C=US +-# Not Valid Before: Sun Feb 18 18:30:00 2018 +-# Not Valid After : Wed Feb 18 18:30:00 2043 +-# Fingerprint (SHA-256): BC:4D:80:9B:15:18:9D:78:DB:3E:1D:8C:F4:F9:72:6A:79:5D:A1:64:3C:A5:F1:35:8E:1D:DB:0E:DC:0D:7E:B3 +-# Fingerprint (SHA1): B6:AF:43:C2:9B:81:53:7D:F6:EF:6B:C3:1F:1F:60:15:0C:EE:48:66 +-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE +-CKA_TOKEN CK_BBOOL CK_TRUE +-CKA_PRIVATE CK_BBOOL CK_FALSE +-CKA_MODIFIABLE CK_BBOOL CK_FALSE +-CKA_LABEL UTF8 "emSign ECC Root CA - C3" +-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509 +-CKA_SUBJECT MULTILINE_OCTAL +-\060\132\061\013\060\011\006\003\125\004\006\023\002\125\123\061 +-\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147\156 +-\040\120\113\111\061\024\060\022\006\003\125\004\012\023\013\145 +-\115\165\144\150\162\141\040\111\156\143\061\040\060\036\006\003 +-\125\004\003\023\027\145\155\123\151\147\156\040\105\103\103\040 +-\122\157\157\164\040\103\101\040\055\040\103\063 +-END +-CKA_ID UTF8 "0" +-CKA_ISSUER MULTILINE_OCTAL +-\060\132\061\013\060\011\006\003\125\004\006\023\002\125\123\061 +-\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147\156 +-\040\120\113\111\061\024\060\022\006\003\125\004\012\023\013\145 +-\115\165\144\150\162\141\040\111\156\143\061\040\060\036\006\003 +-\125\004\003\023\027\145\155\123\151\147\156\040\105\103\103\040 +-\122\157\157\164\040\103\101\040\055\040\103\063 +-END +-CKA_SERIAL_NUMBER MULTILINE_OCTAL +-\002\012\173\161\266\202\126\270\022\174\234\250 +-END +-CKA_VALUE MULTILINE_OCTAL +-\060\202\002\053\060\202\001\261\240\003\002\001\002\002\012\173 +-\161\266\202\126\270\022\174\234\250\060\012\006\010\052\206\110 +-\316\075\004\003\003\060\132\061\013\060\011\006\003\125\004\006 +-\023\002\125\123\061\023\060\021\006\003\125\004\013\023\012\145 +-\155\123\151\147\156\040\120\113\111\061\024\060\022\006\003\125 +-\004\012\023\013\145\115\165\144\150\162\141\040\111\156\143\061 +-\040\060\036\006\003\125\004\003\023\027\145\155\123\151\147\156 +-\040\105\103\103\040\122\157\157\164\040\103\101\040\055\040\103 +-\063\060\036\027\015\061\070\060\062\061\070\061\070\063\060\060 +-\060\132\027\015\064\063\060\062\061\070\061\070\063\060\060\060 +-\132\060\132\061\013\060\011\006\003\125\004\006\023\002\125\123 +-\061\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147 +-\156\040\120\113\111\061\024\060\022\006\003\125\004\012\023\013 +-\145\115\165\144\150\162\141\040\111\156\143\061\040\060\036\006 +-\003\125\004\003\023\027\145\155\123\151\147\156\040\105\103\103 +-\040\122\157\157\164\040\103\101\040\055\040\103\063\060\166\060 +-\020\006\007\052\206\110\316\075\002\001\006\005\053\201\004\000 +-\042\003\142\000\004\375\245\141\256\173\046\020\035\351\267\042 +-\060\256\006\364\201\263\261\102\161\225\071\274\323\122\343\257 +-\257\371\362\227\065\222\066\106\016\207\225\215\271\071\132\351 +-\273\337\320\376\310\007\101\074\273\125\157\203\243\152\373\142 +-\260\201\211\002\160\175\110\305\112\343\351\042\124\042\115\223 +-\273\102\014\257\167\234\043\246\175\327\141\021\316\145\307\370 +-\177\376\365\362\251\243\102\060\100\060\035\006\003\125\035\016 +-\004\026\004\024\373\132\110\320\200\040\100\362\250\351\000\007 +-\151\031\167\247\346\303\364\317\060\016\006\003\125\035\017\001 +-\001\377\004\004\003\002\001\006\060\017\006\003\125\035\023\001 +-\001\377\004\005\060\003\001\001\377\060\012\006\010\052\206\110 +-\316\075\004\003\003\003\150\000\060\145\002\061\000\264\330\057 +-\002\211\375\266\114\142\272\103\116\023\204\162\265\256\335\034 +-\336\326\265\334\126\217\130\100\132\055\336\040\114\042\203\312 +-\223\250\176\356\022\100\307\326\207\117\370\337\205\002\060\034 +-\024\144\344\174\226\203\021\234\260\321\132\141\113\246\017\111 +-\323\000\374\241\374\344\245\377\177\255\327\060\320\307\167\177 +-\276\201\007\125\060\120\040\024\365\127\070\012\250\061\121 +-END +-CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE +-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE +-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE +- +-# Trust for "emSign ECC Root CA - C3" +-# Issuer: CN=emSign ECC Root CA - C3,O=eMudhra Inc,OU=emSign PKI,C=US +-# Serial Number:7b:71:b6:82:56:b8:12:7c:9c:a8 +-# Subject: CN=emSign ECC Root CA - C3,O=eMudhra Inc,OU=emSign PKI,C=US +-# Not Valid Before: Sun Feb 18 18:30:00 2018 +-# Not Valid After : Wed Feb 18 18:30:00 2043 +-# Fingerprint (SHA-256): BC:4D:80:9B:15:18:9D:78:DB:3E:1D:8C:F4:F9:72:6A:79:5D:A1:64:3C:A5:F1:35:8E:1D:DB:0E:DC:0D:7E:B3 +-# Fingerprint (SHA1): B6:AF:43:C2:9B:81:53:7D:F6:EF:6B:C3:1F:1F:60:15:0C:EE:48:66 +-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST +-CKA_TOKEN CK_BBOOL CK_TRUE +-CKA_PRIVATE CK_BBOOL CK_FALSE +-CKA_MODIFIABLE CK_BBOOL CK_FALSE +-CKA_LABEL UTF8 "emSign ECC Root CA - C3" +-CKA_CERT_SHA1_HASH MULTILINE_OCTAL +-\266\257\103\302\233\201\123\175\366\357\153\303\037\037\140\025 +-\014\356\110\146 +-END +-CKA_CERT_MD5_HASH MULTILINE_OCTAL +-\076\123\263\243\201\356\327\020\370\323\260\035\027\222\365\325 +-END +-CKA_ISSUER MULTILINE_OCTAL +-\060\132\061\013\060\011\006\003\125\004\006\023\002\125\123\061 +-\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147\156 +-\040\120\113\111\061\024\060\022\006\003\125\004\012\023\013\145 +-\115\165\144\150\162\141\040\111\156\143\061\040\060\036\006\003 +-\125\004\003\023\027\145\155\123\151\147\156\040\105\103\103\040 +-\122\157\157\164\040\103\101\040\055\040\103\063 +-END +-CKA_SERIAL_NUMBER MULTILINE_OCTAL +-\002\012\173\161\266\202\126\270\022\174\234\250 +-END +-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR +-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR +-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST +-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE +- + # + # Certificate "Hongkong Post Root CA 3" + # diff --git a/meta-oe/recipes-support/nss/nss/0009-Bug-2084101-Remove-eMudhra-emSign-Root-CA-G3-from-NS.patch b/meta-oe/recipes-support/nss/nss/0009-Bug-2084101-Remove-eMudhra-emSign-Root-CA-G3-from-NS.patch new file mode 100644 index 0000000000..3d999e16dd --- /dev/null +++ b/meta-oe/recipes-support/nss/nss/0009-Bug-2084101-Remove-eMudhra-emSign-Root-CA-G3-from-NS.patch @@ -0,0 +1,143 @@ +From 0a2b0c75fa036930d98331b721c0780693a3e17a Mon Sep 17 00:00:00 2001 +From: Anna +Date: Tue, 20 Oct 2026 10:05:35 +0000 +Subject: [PATCH] Bug 2084101 - Remove eMudhra emSign Root CA - G3 from NSS + +Differential Revision: https://phabricator.services.mozilla.com/D335548 + +Upstream-Status: Backport [https://github.com/mozilla/nss/commit/0a2b0c75fa036930d98331b721c0780693a3e17a] +Signed-off-by: Peter Marko +--- + nss/lib/ckfw/builtins/certdata.txt | 119 ----------------------------- + 1 file changed, 119 deletions(-) + +diff --git a/nss/lib/ckfw/builtins/certdata.txt b/nss/lib/ckfw/builtins/certdata.txt +index 05172ca23..9ee50e8d5 100644 +--- a/nss/lib/ckfw/builtins/certdata.txt ++++ b/nss/lib/ckfw/builtins/certdata.txt +@@ -12102,125 +12102,6 @@ CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR + CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST + CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE + +-# +-# Certificate "emSign ECC Root CA - G3" +-# +-# Issuer: CN=emSign ECC Root CA - G3,O=eMudhra Technologies Limited,OU=emSign PKI,C=IN +-# Serial Number:3c:f6:07:a9:68:70:0e:da:8b:84 +-# Subject: CN=emSign ECC Root CA - G3,O=eMudhra Technologies Limited,OU=emSign PKI,C=IN +-# Not Valid Before: Sun Feb 18 18:30:00 2018 +-# Not Valid After : Wed Feb 18 18:30:00 2043 +-# Fingerprint (SHA-256): 86:A1:EC:BA:08:9C:4A:8D:3B:BE:27:34:C6:12:BA:34:1D:81:3E:04:3C:F9:E8:A8:62:CD:5C:57:A3:6B:BE:6B +-# Fingerprint (SHA1): 30:43:FA:4F:F2:57:DC:A0:C3:80:EE:2E:58:EA:78:B2:3F:E6:BB:C1 +-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE +-CKA_TOKEN CK_BBOOL CK_TRUE +-CKA_PRIVATE CK_BBOOL CK_FALSE +-CKA_MODIFIABLE CK_BBOOL CK_FALSE +-CKA_LABEL UTF8 "emSign ECC Root CA - G3" +-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509 +-CKA_SUBJECT MULTILINE_OCTAL +-\060\153\061\013\060\011\006\003\125\004\006\023\002\111\116\061 +-\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147\156 +-\040\120\113\111\061\045\060\043\006\003\125\004\012\023\034\145 +-\115\165\144\150\162\141\040\124\145\143\150\156\157\154\157\147 +-\151\145\163\040\114\151\155\151\164\145\144\061\040\060\036\006 +-\003\125\004\003\023\027\145\155\123\151\147\156\040\105\103\103 +-\040\122\157\157\164\040\103\101\040\055\040\107\063 +-END +-CKA_ID UTF8 "0" +-CKA_ISSUER MULTILINE_OCTAL +-\060\153\061\013\060\011\006\003\125\004\006\023\002\111\116\061 +-\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147\156 +-\040\120\113\111\061\045\060\043\006\003\125\004\012\023\034\145 +-\115\165\144\150\162\141\040\124\145\143\150\156\157\154\157\147 +-\151\145\163\040\114\151\155\151\164\145\144\061\040\060\036\006 +-\003\125\004\003\023\027\145\155\123\151\147\156\040\105\103\103 +-\040\122\157\157\164\040\103\101\040\055\040\107\063 +-END +-CKA_SERIAL_NUMBER MULTILINE_OCTAL +-\002\012\074\366\007\251\150\160\016\332\213\204 +-END +-CKA_VALUE MULTILINE_OCTAL +-\060\202\002\116\060\202\001\323\240\003\002\001\002\002\012\074 +-\366\007\251\150\160\016\332\213\204\060\012\006\010\052\206\110 +-\316\075\004\003\003\060\153\061\013\060\011\006\003\125\004\006 +-\023\002\111\116\061\023\060\021\006\003\125\004\013\023\012\145 +-\155\123\151\147\156\040\120\113\111\061\045\060\043\006\003\125 +-\004\012\023\034\145\115\165\144\150\162\141\040\124\145\143\150 +-\156\157\154\157\147\151\145\163\040\114\151\155\151\164\145\144 +-\061\040\060\036\006\003\125\004\003\023\027\145\155\123\151\147 +-\156\040\105\103\103\040\122\157\157\164\040\103\101\040\055\040 +-\107\063\060\036\027\015\061\070\060\062\061\070\061\070\063\060 +-\060\060\132\027\015\064\063\060\062\061\070\061\070\063\060\060 +-\060\132\060\153\061\013\060\011\006\003\125\004\006\023\002\111 +-\116\061\023\060\021\006\003\125\004\013\023\012\145\155\123\151 +-\147\156\040\120\113\111\061\045\060\043\006\003\125\004\012\023 +-\034\145\115\165\144\150\162\141\040\124\145\143\150\156\157\154 +-\157\147\151\145\163\040\114\151\155\151\164\145\144\061\040\060 +-\036\006\003\125\004\003\023\027\145\155\123\151\147\156\040\105 +-\103\103\040\122\157\157\164\040\103\101\040\055\040\107\063\060 +-\166\060\020\006\007\052\206\110\316\075\002\001\006\005\053\201 +-\004\000\042\003\142\000\004\043\245\014\270\055\022\365\050\363 +-\261\262\335\342\002\022\200\236\071\137\111\115\237\311\045\064 +-\131\164\354\273\006\034\347\300\162\257\350\256\057\341\101\124 +-\207\024\250\112\262\350\174\202\346\133\152\265\334\263\165\316 +-\213\006\320\206\043\277\106\325\216\017\077\004\364\327\034\222 +-\176\366\245\143\302\365\137\216\056\117\241\030\031\002\053\062 +-\012\202\144\175\026\223\321\243\102\060\100\060\035\006\003\125 +-\035\016\004\026\004\024\174\135\002\204\023\324\314\212\233\201 +-\316\027\034\056\051\036\234\110\143\102\060\016\006\003\125\035 +-\017\001\001\377\004\004\003\002\001\006\060\017\006\003\125\035 +-\023\001\001\377\004\005\060\003\001\001\377\060\012\006\010\052 +-\206\110\316\075\004\003\003\003\151\000\060\146\002\061\000\276 +-\363\141\317\002\020\035\144\225\007\270\030\156\210\205\005\057 +-\203\010\027\220\312\037\212\114\350\015\033\172\261\255\325\201 +-\011\107\357\073\254\010\004\174\134\231\261\355\107\007\322\002 +-\061\000\235\272\125\374\251\112\350\355\355\346\166\001\102\173 +-\310\370\140\331\215\121\213\125\073\373\214\173\353\145\011\303 +-\370\226\315\107\250\202\362\026\125\167\044\176\022\020\225\004 +-\054\243 +-END +-CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE +-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE +-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE +- +-# Trust for "emSign ECC Root CA - G3" +-# Issuer: CN=emSign ECC Root CA - G3,O=eMudhra Technologies Limited,OU=emSign PKI,C=IN +-# Serial Number:3c:f6:07:a9:68:70:0e:da:8b:84 +-# Subject: CN=emSign ECC Root CA - G3,O=eMudhra Technologies Limited,OU=emSign PKI,C=IN +-# Not Valid Before: Sun Feb 18 18:30:00 2018 +-# Not Valid After : Wed Feb 18 18:30:00 2043 +-# Fingerprint (SHA-256): 86:A1:EC:BA:08:9C:4A:8D:3B:BE:27:34:C6:12:BA:34:1D:81:3E:04:3C:F9:E8:A8:62:CD:5C:57:A3:6B:BE:6B +-# Fingerprint (SHA1): 30:43:FA:4F:F2:57:DC:A0:C3:80:EE:2E:58:EA:78:B2:3F:E6:BB:C1 +-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST +-CKA_TOKEN CK_BBOOL CK_TRUE +-CKA_PRIVATE CK_BBOOL CK_FALSE +-CKA_MODIFIABLE CK_BBOOL CK_FALSE +-CKA_LABEL UTF8 "emSign ECC Root CA - G3" +-CKA_CERT_SHA1_HASH MULTILINE_OCTAL +-\060\103\372\117\362\127\334\240\303\200\356\056\130\352\170\262 +-\077\346\273\301 +-END +-CKA_CERT_MD5_HASH MULTILINE_OCTAL +-\316\013\162\321\237\210\216\320\120\003\350\343\270\213\147\100 +-END +-CKA_ISSUER MULTILINE_OCTAL +-\060\153\061\013\060\011\006\003\125\004\006\023\002\111\116\061 +-\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147\156 +-\040\120\113\111\061\045\060\043\006\003\125\004\012\023\034\145 +-\115\165\144\150\162\141\040\124\145\143\150\156\157\154\157\147 +-\151\145\163\040\114\151\155\151\164\145\144\061\040\060\036\006 +-\003\125\004\003\023\027\145\155\123\151\147\156\040\105\103\103 +-\040\122\157\157\164\040\103\101\040\055\040\107\063 +-END +-CKA_SERIAL_NUMBER MULTILINE_OCTAL +-\002\012\074\366\007\251\150\160\016\332\213\204 +-END +-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR +-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR +-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST +-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE +- + # + # Certificate "Hongkong Post Root CA 3" + # diff --git a/meta-oe/recipes-support/nss/nss_3.126.bb b/meta-oe/recipes-support/nss/nss_3.126.bb index f26e70539f..2caf15302b 100644 --- a/meta-oe/recipes-support/nss/nss_3.126.bb +++ b/meta-oe/recipes-support/nss/nss_3.126.bb @@ -32,6 +32,8 @@ SRC_URI = "https://ftp.mozilla.org/pub/security/nss/releases/${VERSION_DIR}/src/ file://0005-nss-does-not-build-on-mips-with-clang-because-wrong-.patch \ file://0006-Fix-nss-multilib-build-on-openSUSE-11.x-32bit.patch \ file://0007-freebl-add-a-configure-option-to-disable-ARM-HW-cryp.patch \ + file://0008-Bug-2083709-Remove-eMudhra-emSign-Root-CA-C1-and-emS.patch \ + file://0009-Bug-2084101-Remove-eMudhra-emSign-Root-CA-G3-from-NS.patch \ " SRC_URI[sha256sum] = "7aa07c758be1453d82d739240b249ffb7aef0041be488067e1c0f348e1f9e337"