RaresKeYandLéo
c6d76b9a9b
Repair SearXNG system and certifi stores, validate native amd64/arm64 runtime images through Compose, and publish the exact verified artifacts through a trusted CI job. Adopt released Python, certifi, grpcio, uv and Docker CLI trust fixes, with strict controls for all fourteen public incident chains. Part of #6784 and #6790. Co-authored-by: Léo <leograndcontact@gmail.com>
CA trust regression fixtures
The public certificates embedded in tests/test_ca_trust.py exercise the October 2026 eMudhra trust-store check. They contain no private keys. emsign-g3.pem and aaa.pem are the incident's affected trust anchors; emsign-g1.pem is an unaffected emSign anchor that must remain usable. localhost-leaf.pem is a synthetic self-signed Ed25519 server certificate with CA:FALSE, generated solely to reproduce hashed non-CA certificates found in Ubuntu's OpenSSL directory; its private key was discarded. The test creates temporary PEM files from these public constants. The certificate fingerprints are the factual identity of each fixture.
Sources: the incident root list and the public Mozilla root certificates distributed in Debian's ca-certificates package.
incident.json contains the four published roots, sixteen compromised intermediate certificates and cross-signs, and the fourteen published server chains, retrieved on 2026-10-21 with chains refreshed on 2026-10-23. The refresh adds the two DV G3B hosts without Certificate Transparency entries and preserves the original twelve chains. Certificates are deduplicated by SHA-256 of DER; each chain lists its leaf first. The additional cross-signed emSign Root TLS CA - G3 issuer comes from those chains and has fingerprint 3094025792039a68af6e553686410bdab7c0d4a36b9084cba64202e35d6ebbdd. Like the intermediates, it must not be accepted as a custom trust anchor. All data is public certificate material, with no private keys.
Downloaded source SHA-256 values:
roots.json:119f32cd81a6b5a4e3c4c2df5fe07daa90dc43cafa123a62f0394f1895d92380impacted-intermediates.json:f67b3abe9b4879f4e91874ed041beccd71257f1db41c588c724ccf12aa90c59echains.zip:7b949956955fc501a30f4d98d2f513d34c0bbbe92e29a968194c96e097ce2345
The offline OpenSSL regression verifies server purpose, hostname and strict certificate rules with partial-chain trust, at 2026-10-23T12:00:00Z (1792756800). Fixing the verification date keeps later certificate expiry from masking a broken mitigation. All fourteen chains must verify against the affected positive-control roots and fail against the unaffected G1-only store. Adding the compromised DV G3B intermediate restores four paths, including the two new hosts, which the checker must reject. The regression makes no network requests and skips chain verification if the OpenSSL executable is unavailable; certificate-inventory tests still run using Python's standard library.
The SearXNG derived-image validation uses the same incident.json inventory and fixed verification timestamp, checking each stored DER fingerprint before use. See the image documentation for its validation targets and source provenance.
emsign-g1.txt is the unaffected public emSign Root CA - G1 certificate in PEM format, used by the SearXNG regressions to verify preservation of unrelated trust. Its fingerprint is SHA-256 40f6af0346a99aa1cd1d555a4e9cce62c7f9634603ee406615833dc8c8d00367.