From bfaa1c7d9f8fa9e27dc71d97e7713faf20bc1e3f Mon Sep 17 00:00:00 2001 From: aaron Date: Sun, 25 Oct 2026 10:49:12 +0100 Subject: [PATCH 1/2] chore(flake): update nixpkgs to pick up cacert 3.131.1 Bumps nixos-unstable from 6510408 (2026-10-10) to 3ec6363 (2026-10-23), which includes nixpkgs f903b88 (cacert 3.126 -> 3.131.1). NSS 3.131.1 drops emSign ECC Root CA - G3 after the eMudhra intermediate key compromise. nixpkgs removed the scripted initrd in this range, so boot.initrd.systemd.enable is now a failing assertion. systemd initrd was already enabled, so dropping the line does not change boot. Co-Authored-By: Claude Opus 5.5 --- flake.lock | 6 +++--- modules/nixos/bootloader.nix | 3 --- 2 files changed, 3 insertions(+), 6 deletions(-) diff --git a/flake.lock b/flake.lock index e69d082..77f7982 100644 --- a/flake.lock +++ b/flake.lock @@ -258,11 +258,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1791594108, - "narHash": "sha256-XK4KceonkwD8LuMAt/vNrz982mXJM5jeHAxMwsUXXAQ=", + "lastModified": 1792773339, + "narHash": "sha256-rZLrzrC6i+jnTAlvPZHogKDulY7WWDEv9hJeHieO7Zw=", "owner": "nixos", "repo": "nixpkgs", - "rev": "6510408d147d8c5e6d76043e899e9251756f6a75", + "rev": "3ec636362e1816bc2f0888fa0fa2c69f1bc9e504", "type": "github" }, "original": { diff --git a/modules/nixos/bootloader.nix b/modules/nixos/bootloader.nix index f0fb590..708cd4b 100644 --- a/modules/nixos/bootloader.nix +++ b/modules/nixos/bootloader.nix @@ -9,9 +9,6 @@ efi.canTouchEfiVariables = true; }; - # enable systemd initrd - boot.initrd.systemd.enable = true; - # plymouth boot.plymouth = { enable = true; From 66e738c792fb8af204666329c7e1215f02a54274 Mon Sep 17 00:00:00 2001 From: aaron Date: Sun, 25 Oct 2026 10:49:12 +0100 Subject: [PATCH 2/2] fix(certificates): drop temporary emSign ECC Root CA - G3 distrust cacert 3.131.1 no longer ships this root at all, so the blacklist entry added in #111 is redundant. Closes #110 Co-Authored-By: Claude Opus 5.5 --- modules/nixos/certificates.nix | 5 ----- 1 file changed, 5 deletions(-) diff --git a/modules/nixos/certificates.nix b/modules/nixos/certificates.nix index 79767dc..cc90cb5 100644 --- a/modules/nixos/certificates.nix +++ b/modules/nixos/certificates.nix @@ -17,9 +17,4 @@ in security.pki.certificates = [ caddyRootCA # self-signed pki ca for my home-lab ]; - - # Temporary: eMudhra intermediates under this root have recoverable private - # keys (https://bugzilla.mozilla.org/show_bug.cgi?id=2083449). Remove once - # nixos-unstable ships cacert >= 3.131.1 (nixpkgs f903b88). - security.pki.caCertificateBlacklist = [ "emSign ECC Root CA - G3" ]; }